mlsanityData to 14 Oct 2026

Mind the Trojan Horse: Image Prompt Adapter Enabling Scalable and Deceptive Jailbreaking

arXiv 2504.05838 ↗First posted 8 Apr 2025cs.CV cs.AI cs.CRcited by 2

On the map: LLM safety and security → Vision-language and text-to-image safety

Abstract (arXiv)

Recently, the Image Prompt Adapter (IP-Adapter) has been increasingly integrated into text-to-image diffusion models (T2I-DMs) to improve controllability. However, in this paper, we reveal that T2I-DMs equipped with the IP-Adapter (T2I-IP-DMs) enable a new jailbreak attack named the hijacking attack. We demonstrate that, by uploading imperceptible image-space adversarial examples (AEs), the adversary can hijack massive benign users to jailbreak an Image Generation Service (IGS) driven by T2I-IP-DMs and mislead the public to discredit the service provider. Worse still, the IP-Adapter's dependency on open-source image encoders reduces the knowledge required to craft AEs. Extensive experiments verify the technical feasibility of the hijacking attack. In light of the revealed threat, we investigate several existing defenses and explore combining the IP-Adapter with adversarially trained models to overcome existing defenses' limitations. Our code is available at https://github.com/fhdnskfbeuv/attackIPA.

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Placed in Vision-language and text-to-image safety, one of 12 directions in LLM safety and security. Builds on 64 of its 90 references that are in the map. First posted on arXiv 8 Apr 2025.

Builds on

64 of 90 references.

Closest ancestors · 8

Same direction, newest first

  1. 2024Jailbreak Attacks and Defenses against Multimodal Generative Models: A Survey14 Nov
  2. 2024SAFREE: Training-Free and Adaptive Guard for Safe Text-to-Image And Video Generation16 Oct
  3. 2024ART: Automatic Red-teaming for Text-to-Image Models to Protect Benign Users24 May
  4. 2024SafeGen: Mitigating Sexually Explicit Content Generation in Text-to-Image Models10 Apr
  5. 2023Implicit Concept Removal of Diffusion Models9 Oct
  6. 2023Prompting4Debugging: Red-Teaming Text-to-Image Diffusion Models by Finding Problematic Prompts12 Sep
  7. 2023Forget-Me-Not: Learning to Forget in Text-to-Image Diffusion Models30 Mar
  8. 2022Red-Teaming the Stable Diffusion Safety Filter3 Oct

Other references · 56

  1. 2017Attention Is All You Needcited by 60,361
  2. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  3. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  4. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  5. 2020Denoising Diffusion Implicit Modelscited by 9,781
  6. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  7. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  8. 2023SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesiscited by 4,356
  9. 2022InstructPix2Pix: Learning to Follow Image Editing Instructionscited by 2,611
  10. 2023IP-Adapter: Text Compatible Image Prompt Adapter for Text-to-Image Diffusion Modelscited by 1,464
  11. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  12. 2023T2I-Adapter: Learning Adapters to Dig out More Controllable Ability for Text-to-Image Diffusion Modelscited by 1,351
38 more
  1. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  2. 2024ChatGLM: A Family of Large Language Models from GLM-130B to GLM-4 All Toolscited by 1,121
  3. 2021Perceiver: General Perception with Iterative Attentioncited by 1,104
  4. 2022Exploring CLIP for Assessing the Look and Feel of Imagescited by 991
  5. 2023OpenFlamingo: An Open-Source Framework for Training Large Autoregressive Vision-Language Modelscited by 565
  6. 2023Erasing Concepts from Diffusion Modelscited by 539
  7. 2017Countering Adversarial Images using Input Transformationscited by 520
  8. 2022Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Modelscited by 513
  9. 2022Diffusion Models for Adversarial Purificationcited by 476
  10. 2019On Evaluating Adversarial Robustnesscited by 447
  11. 2023BLIP-Diffusion: Pre-trained Subject Representation for Controllable Text-to-Image Generation and Editingcited by 442
  12. 2023Unified Concept Editing in Diffusion Modelscited by 388
  13. 2023Ablating Concepts in Text-to-Image Diffusion Modelscited by 317
  14. 2023Are aligned neural networks adversarially aligned?cited by 315
  15. 2024MACE: Mass Concept Erasure in Diffusion Modelscited by 307
  16. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 290
  17. 2021VITON-HD: High-Resolution Virtual Try-On via Misalignment-Aware Normalizationcited by 287
  18. 2023Glaze: Protecting Artists from Style Mimicry by Text-to-Image Modelscited by 205
  19. 2022Versatile Diffusion: Text, Images and Variations All in One Diffusion Modelcited by 199
  20. 2023MMA-Diffusion: MultiModal Attack on Diffusion Modelscited by 194
  21. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 172
  22. 2023Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examplescited by 167
  23. 2023Raising the Cost of Malicious AI-Powered Image Editingcited by 163
  24. 2020Perceptual Adversarial Robustness: Defense Against Unseen Threat Modelscited by 137
  25. 2023Anti-DreamBooth: Protecting users from personalized text-to-image synthesiscited by 120
  26. 2024Robust CLIP: Unsupervised Adversarial Fine-Tuning of Vision Embeddings for Robust Large Vision-Language Modelscited by 120
  27. 2024Improving Diffusion Models for Authentic Virtual Try-on in the Wildcited by 109
  28. 2018IntroVAE: Introspective Variational Autoencoders for Photographic Image Synthesiscited by 85
  29. 2023Content-based Unrestricted Adversarial Attackcited by 73
  30. 2023Self-Discovering Interpretable Diffusion Latent Directions for Responsible Text-to-Image Generationcited by 69
  31. 2023Robust Evaluation of Diffusion-Based Adversarial Purificationcited by 65
  32. 2023AdvDiff: Generating Unrestricted Adversarial Examples using Diffusion Modelscited by 46
  33. 2021TRS: Transferability Reduced Ensemble via Encouraging Gradient Diversity and Model Smoothnesscited by 38
  34. 2023Why Does Little Robustness Help? A Further Step Towards Understanding Adversarial Transferabilitycited by 32
  35. 2023Adversarial Illusions in Multi-Modal Embeddingscited by 29
  36. 2022Restricted Black-box Adversarial Attack Against DeepFake Face Swappingcited by 25
  37. 2024ADBM: Adversarial diffusion bridge model for reliable adversarial purificationcited by 24
  38. 2022The Enemy of My Enemy is My Friend: Exploring Inverse Adversaries for Improving Adversarial Trainingcited by 23

50 most cited of 56 All 56 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 1; 2026: 1.

2 papers.

  1. 2025Watch, Listen, Understand, Mislead: Tri-modal Adversarial Attacks on Short Videos for Content Appropriateness Evaluationcited by 2
  2. 2026UnifiedAttack: Evaluating the Safety of Large Multimodal Models in Synergistic Harmful Image-Text Generationcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024HTS-Attack: Heuristic Token Search for Jailbreaking Text-to-Image Models
  2. 2025When Memory Becomes a Vulnerability: Towards Multi-turn Jailbreak Attacks against Text-to-Image Generation Systems
  3. 2026Reading Between the Pixels: An Inscriptive Jailbreak Attack on Text-to-Image Models
  4. 2025Universally Unfiltered and Unseen:Input-Agnostic Multimodal Jailbreaks against Text-to-Image Model Safeguards
  5. 2026Mind the Gap: Zero-Query Jailbreaks via Filter-Generator Discrepancy in Text-to-Image Systems
  6. 2024Gradient-based Jailbreak Images for Multimodal Fusion Models
  7. 2025Reason2Attack: Jailbreaking Text-to-Image Models via LLM Reasoning
  8. 2026JANUS: A Lightweight Framework for Jailbreaking Text-to-Image Models via Distribution Optimization