Pith. sign in

REVIEW 6 major objections 5 minor 45 references

Antelope: Potent and Concealed Jailbreak Attack Strategy

T0 review · 6 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Antelope claims a faster, more covert jailbreak for text-to-image models, reporting top attack success on most defenses.

desk verdict A competent incremental jailbreak combo whose 'consistent superiority' claim is not yet proven: no error bars, no code or token-pair release, and a real risk of validation-set contamination. read the letter →

arxiv 2412.08156 v1 pith:2BLRGBC4 submitted 2024-12-11 cs.CR cs.AIcs.CV

Xin Zhao , Xiaojun Chen , Haoyu Gao This is my paper · ORCID
classification cs.CRcs.AIcs.CV
keywords jailbreakattacktext-to-imagemodelsdiffusionNSFWcontentadversarialpromptssemanticalignmentconceptconfusionsafetyfilters
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes Antelope, a jailbreak attack strategy against text-to-image models that aims to generate NSFW images from prompts that look harmless to safety filters. The method exploits concept confusion: it chooses token pairs that are far apart in semantic text space yet visually similar in image space, then performs embedding arithmetic—subtracting one embedding and adding another—to steer generation toward the target concept. Evaluations on Stable Diffusion v1.4, v2.1, ESD, SafeGen, and four SLD configurations for both nudity and violence targets show Antelope achieving the highest attack success rate in most settings, with lower or comparable FID and search times around 54–56 seconds per prompt. The paper also reports that adversarial prompts found on an open model transfer to black-box online services such as Midjourney and Leonardo.AI, suggesting current safety filters can be bypassed by innocuous-looking prompts that preserve the intended image content.

What carries the argument

The central mechanism is text-embedding arithmetic in CLIP's semantic space: subtract the embedding En of a 'negative' token (semantically divergent from the target but visually similar) from the cleaned prompt embedding Ec, then add the embedding Ep of a 'positive' token, producing the adjusted embedding Et = Ec − En + Ep. The search then minimizes L = γ(1 − cos(Ec||s, Et)) + (1 − γ)(1 − cos(Ec||s, Ei)) over a candidate suffix s of N tokens, where Ei is the embedding of a reference image generated from the original prompt. This operation reintroduces the sensitive concept in embedding space while keeping the visible prompt innocuous, and it is what lets the attack align with both the original text meaning and the target imagery.

What would settle it

Measure, for a fixed set of concept pairs, the distribution of image embeddings from 500+ prompts per pair: if concepts that are far apart in CLIP text space produce images no more similar than random pairs, the Eq. (4) objective is not measuring what the attack needs. A second check is to run the same pipeline with random instead of ChatGPT-chosen token pairs and compare ASR.

Watch

Extended reading notes

Core claim

The paper's central claim is that an adversarial prompt can be assembled by first cleaning the original prompt into a harmless form, then appending a short suffix of four or five tokens so that the combined text embedding is simultaneously close to an adjusted target embedding and to a reference image embedding. The adjusted embedding comes from the identity Et = Ec − En + Ep, where Ep and En are embeddings of positive and negative tokens that are semantically divergent but visually similar. The search minimizes a weighted loss of cosine distances in text and image space, and when the loss drops below a threshold the prompt is tested against the NSFW filter. On the I2P-derived NSFW-333 and NSFW-59 prompt sets, Antelope reports ASR up to 81.98% for nudity on SDv1.4 and 74.58% for violence under SafeGen, outperforming SneakyPrompt, QF-Attack, MMP-Attack, and MMA-Diffusion in most defense configurations while maintaining lower or comparable FID.

Load-bearing premise

The attack rests on the assumption that prompts far apart in the model's semantic space can nonetheless generate similar images, so subtracting one embedding and adding another reliably brings back the target concept; the paper's evidence for this is a TSNE plot of 50 prompts per concept rather than a measured distribution.

Editorial extensions

If this is right

  • Text filters that screen for explicit words can be bypassed by a cleaned prompt plus a 4–5 token suffix, because the sensitive concept is carried by the embedding adjustment rather than by the visible tokens.
  • A single open model such as SDv1.4 can be used to find prompts that transfer to closed services like Midjourney and Leonardo.AI, so an attacker does not need access to the target model's weights.
  • The reported search time of roughly 54–56 seconds per prompt makes the attack practical to run at scale, unlike gradient-based baselines that take minutes to hours.
  • Existing defenses reduce but do not eliminate the attack: ESD is the strongest against nudity and SLD-max against violence, yet Antelope still achieves nonzero ASR under every tested defense.
  • The optimal settings (γ = 0.2, N = 4 or 5, τ = 0.7) give a concrete recipe that other researchers can reproduce or defend against.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the concept-confusion hypothesis generalizes beyond the tested pairs, any multimodal text encoder whose embedding space has linear semantic structure could be vulnerable to the same subtract-and-add recipe, not just Stable Diffusion.
  • Because the paper validates semantic-distance-to-image-similarity only with a TSNE plot of 50 prompts per concept, a quantitative study across many concept pairs would show whether Antelope's success depends on the particular ChatGPT-chosen tokens or on the embedding arithmetic itself.
  • The same combined similarity loss Antelope minimizes could be repurposed as a detection signal: a defender could flag prompts whose embeddings sit unusually close to both a sensitive reference image and a positive token—something the paper does not explore.
  • The observed platform asymmetry (Midjourney stricter on nudity, Leonardo.AI stricter on violence) suggests an attacker could specialize suffix tokens per target service to improve transfer, a step the paper reports but does not develop.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 5 minor

Summary. The paper proposes Antelope, a jailbreak attack against text-to-image (T2I) diffusion models. The attack preprocesses an original NSFW prompt into a benign-looking prompt, appends a small set of suffix tokens, and optimizes those tokens to minimize a weighted cosine-similarity loss in both text and image embedding spaces. The search is terminated early using an NSFW filter, and the resulting prompts are evaluated for attack success rate (ASR) and FID against four baselines across eight defense configurations, with additional qualitative tests on two online services. The central claim is that Antelope consistently achieves the highest ASR and best FID in most cases while being faster than prior gradient- or RL-based attacks.

Significance. If the empirical claims hold, Antelope would be a practical and efficient red-team tool for evaluating safety mechanisms in T2I systems. The paper covers a broad set of defenses (SDv1.4, SDv2.1, ESD, SafeGen, and four SLD variants), compares against four published baselines, reports search-time costs, and includes ablations for the main hyperparameters. The method itself is simple and clearly stated. The main weaknesses are experimental: the headline comparisons are single-run point estimates with no variance information, the hyperparameters appear to be selected on the evaluation distribution without a stated holdout, the FID reference set is generated by the same kind of model rather than a natural image distribution, and the online black-box claim is supported only by qualitative examples. These issues affect the strength of the central claim, but they are fixable with additional experiments or a more carefully qualified presentation.

major comments (6)
  1. [§4.1, Tables 1–2] No error bars, confidence intervals, or significance tests are reported for any ASR or FID value. Several decisive-looking differences are very small: in Table 1 the SLD-max nudity FID for Antelope is 62.17 versus 62.15 for SneakyPrompt, and in Table 2 the SDv1.4 violence ASR is a tie at 54.24. Without repeated runs or significance testing, the claim that Antelope 'consistently achieves the highest ASR and FID performance in most cases' is not established. The claim is also not literally true for every column: in the ESD/nudity block, Antelope's ASR (12.91) is below MMA-Diffusion (15.02). The authors should report means and standard deviations over multiple seeds, state the number of repetitions, and soften or qualify the consistency claim.
  2. [§4.3] The hyperparameters γ=0.2, N=4/5, and τ=0.7 are chosen using 10 'representative prompts' per target attribute, and the paper does not state whether these prompts are disjoint from the NSFW-333 and NSFW-59 sets used to produce Tables 1 and 2. If the development prompts overlap with the evaluation prompts, the hyperparameters are effectively tuned on the test set, which would inflate the reported ASR and undermine the comparison with baselines. The authors must state the relationship between the development and evaluation prompt sets and, ideally, re-run the main tables with hyperparameters selected on a disjoint development set.
  3. [§3.3 and §4.1] The early-stopping procedure in the 'Jailbreak Safety Checker' stops the search when generated images pass an NSFW filter, while the ASR metric in §4.1 is computed with an NSFW detector (NudeNet/Q16). If the filter used during search is the same detector used for scoring, then the reported ASR is a selection artifact: the search is stopped precisely when that detector is fooled, so the final evaluation is not an independent measure of attack success. The authors should clarify whether the search-time filter and the evaluation detector are identical, and, if so, provide an additional evaluation with a different NSFW classifier to test generalization.
  4. [§4.1, Metrics – FID] The FID reference set is described as 1,000 images generated from raw NSFW prompts in a 'No Attack' setting. This is not the standard use of FID, which compares generated samples to a real image distribution; here the reference distribution consists of images produced by the same generative model, so it may favor methods that replicate the model's own output statistics rather than realistic NSFW imagery. The paper also does not state whether this reference set is held fixed across all attacks and defenses or whether the same random seeds are used. Since several FID differences are within 1–2 points, the 'best FID' claims need to specify the exact reference construction and be accompanied by variance estimates.
  5. [§4.2, Figure 6] The claim that Antelope can 'penetrate online black-box services' is supported only by qualitative examples on Midjourney and Leonardo.AI. There is no quantitative success rate, no number of prompts tested, and no comparison with baseline attacks in the black-box setting. Moreover, the conclusion acknowledges that attack success rates on unfamiliar online models remain relatively low. The authors should either provide a systematic black-box evaluation with a defined prompt set and success criteria or explicitly restrict the contribution to a transfer demonstration rather than a claim of effective online penetration.
  6. [§3.3, Eq. (1), Figure 5] The core assumption that concepts distant in text-embedding space can still generate visually similar images, and that the operation Et = Ec − En + Ep reliably reintroduces the target concept, is supported only by a TSNE visualization of 50 prompts per concept. TSNE is a nonlinear projection and the figure does not quantify whether text-space distance predicts image-space similarity for the ChatGPT-selected token pairs. Since Eq. (4) directly optimizes text-embedding alignment as a proxy for image-level alignment, this assumption is load-bearing. A quantitative validation—for example, measuring image similarity for randomly sampled token pairs, or showing that the positive/negative pairs selected by ChatGPT produce consistent image-level changes—would substantially strengthen the paper.
minor comments (5)
  1. [Throughout] There are several typos and inconsistencies: 'Leoanrdo.AI' appears in §§2 and 4.2, 'SDv14' and 'SDv1.4' are used interchangeably, and 'N = 4or 5' in §3.3 is missing a space. These should be corrected in a revision.
  2. [§3.3, Similar Token Selection] The ChatGPT prompt or template used to generate the positive/negative token pairs is not provided, and the token pairs themselves are not listed. Without this information, the method is not fully reproducible. The authors should release the exact prompts used and at least a sample of the selected token pairs.
  3. [§4.1, Setup] The optimization procedure is unclear: §3.3 describes a search over the vocabulary, while §4.1 mentions a learning rate and 2000 iterations. The authors should clarify whether the suffix tokens are optimized by gradient descent on the embedding or selected by discrete search, and how the learning rate is applied.
  4. [Table 3] The notation in Table 3 is not fully explained: the asterisk (*) for SneakyPrompt is described only as 'ambiguous timing,' and the violence row for 'SneakyPro. beam' appears to be missing a value. Please clarify or complete the table.
  5. [Figure 4] The description of 'simulating the distribution of both negative and positive prompts from machine view and human view' is vague. It should be made explicit what data or model was used to produce the sentiment distributions and how they relate to token-pair selection.

Circularity Check

0 steps flagged · score 1.0 of 10

No construction-level circularity: Antelope is an empirically evaluated attack whose reported ASR/FID are not derived from its own fitted inputs; remaining issues are statistical-validity concerns.

full rationale

The paper's chain of derivation is an optimization procedure (Eq. 1-4) plus empirical evaluation. Eq. 4 minimizes a weighted cosine loss toward an adjusted text embedding Et and a reference image embedding Ei, but no reported result (ASR or FID) is defined as that loss; ASR is the fraction of prompts for which the finite-budget search found an image that bypasses a detector, and FID is measured against a separately generated 1,000-image reference set. Thus no 'prediction' is equivalent to an input by construction. The hyperparameter choice (γ=0.2, N=5, τ=0.7) in Sec. 4.3 is selected on 10 representative prompts per attribute; if those prompts overlap NSFW-333/NSFW-59 the reported numbers would be optimistically biased, but the paper never states overlap, so this is a statistical-validity concern rather than a demonstrated circular step. The search loop uses an NSFW filter and the ASR metric uses an NSFW detector; the paper does not define ASR as the training loss, so this reuse is a possible evaluation-contamination issue, not a construction-level tautology. The only self-citation by the authors ([44]) appears in a list of safety-concern references and is not load-bearing. The paper's own conclusion admits low ASR on unfamiliar online models, which is an honest limitation, not circularity. Consequently, no circular step can be quoted or exhibited.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central attack depends on embedding-space assumptions and on several hand-tuned constants and ChatGPT choices that are not fully specified. The empirical comparison is plausible, but the contribution as stated is not self-contained.

free parameters (4)
  • gamma (loss weight) = 0.2
    Tuned on 10 prompts per attribute (Table 4); ASR at gamma=0.2 is 60% for nudity and 80% for violence, but other values are close.
  • N (number of suffix tokens) = 5 (or 4-5)
    Tuned on 10 prompts per attribute (Table 5); N=4 or 5 gives the best ASR.
  • tau (early stopping threshold) = 0.7
    Set from the minimum loss values at the chosen gamma and N in Fig. 7; it directly controls when the search stops and which prompts are evaluated.
  • ChatGPT-selected positive/negative token pairs = unspecified
    The token pairs used in Eq. 1 are chosen via ChatGPT and never listed; they are a hand-picked input to the core embedding operation.
assumptions (5)
  • domain assumption CLIP text embedding arithmetic can add or remove semantic attributes (Et = Ec - En + Ep).
    Borrowed from JPA [17] without independent verification; Eq. 1 assumes this operation reintroduces the target concept.
  • domain assumption Cosine similarity in CLIP space between text and reference image embeddings is a valid proxy for visual similarity of generated images.
    The loss functions in Eqs. 2-4 minimize this cosine distance, but no calibration is provided to show it tracks generation similarity.
  • ad hoc to paper ChatGPT-selected token pairs are suitable positive and negative pairs for nudity and violence.
    The entire method depends on these selections, but they are not specified or validated independently.
  • domain assumption NSFW detectors NudeNet and Q16 correctly label generated images.
    ASR and search termination rely on these detectors as ground truth for unsafe content.
  • domain assumption Adversarial prompts optimized on SDv1.4 transfer to black-box online models.
    Online tests are qualitative, and the conclusion admits low success rates on unfamiliar models.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Antelope: Potent and Concealed Jailbreak Attack Strategy." pith.science (2026). https://pith.science/paper/2BLRGBC4

@misc{pith2026241208156,
  author       = {Pith},
  title        = {Pith review of: Antelope: Potent and Concealed Jailbreak Attack Strategy},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2BLRGBC4}},
  note         = {Machine review of arXiv:2412.08156}
}
read the original abstract

Due to the remarkable generative potential of diffusion-based models, numerous researches have investigated jailbreak attacks targeting these frameworks. A particularly concerning threat within image models is the generation of Not-Safe-for-Work (NSFW) content. Despite the implementation of security filters, numerous efforts continue to explore ways to circumvent these safeguards. Current attack methodologies primarily encompass adversarial prompt engineering or concept obfuscation, yet they frequently suffer from slow search efficiency, conspicuous attack characteristics and poor alignment with targets. To overcome these challenges, we propose Antelope, a more robust and covert jailbreak attack strategy designed to expose security vulnerabilities inherent in generative models. Specifically, Antelope leverages the confusion of sensitive concepts with similar ones, facilitates searches in the semantically adjacent space of these related concepts and aligns them with the target imagery, thereby generating sensitive images that are consistent with the target and capable of evading detection. Besides, we successfully exploit the transferability of model-based attacks to penetrate online black-box services. Experimental evaluations demonstrate that Antelope outperforms existing baselines across multiple defensive mechanisms, underscoring its efficacy and versatility.

Figures

Figures reproduced from arXiv: 2412.08156 by the authors.

Figure 1
Figure 1. Existing defense mechanisms in Text-to-Image (T2I) models. External defenses include pre-text filters and post-image filters, [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. GPT-4o [23] directly rejects image generation requests containing adversarial prompts with inappropriate semantics or unclear concepts. tire sampling distribution of prompts, rather than directly modifying individual prompt tokens or embeddings. In￾spired by gradient-based optimization in NLP (Natural Lan￾guage Processing), MMA-Diffusion [39] and UPAM [25] apply token-level gradients for refined optimization, yet th… view at source ↗
Figure 3
Figure 3. Overview of the Antelope pipeline. We start by preprocessing original prompts into harmless prompts and generating token pairs aligned with the target attack type. Subsequently, we search for adversarial prompts that align with both the text and reference image. The search process continues iteratively until such an adversarial prompt is found, which can generate images that pass the NSFW filter [PITH_FULL_IMAGE:fi… view at source ↗
Figures from the paper (3 more)
Figure 5
Figure 5. Figure 5: Visualization of related concepts in both text and image [PITH_FULL_IMAGE:figures/full_fig_p004_5.png]
Figure 6
Figure 6. Figure 6: Visualization results of Antelope across different T2I services. Black text denotes the original prompts, while red text indicates the suffixes added during the search process. Exposed content has been masked for privacy and compliance [PITH_FULL_IMAGE:figures/full_fi…
Figure 7
Figure 7. Figure 7: Loss function values across different γ and N for both nudity (N-) and violence (V-) target attributes. judgment module for τ and fix N = 5. We then select 10 representative prompts for each target attribute, nudity and violence, increasing γ incrementally from 0.0 to …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 35 canonical work pages

  1. [1]

    Improving image gener- ation with better captions, 2023

    James Betker, Gabriel Goh, Li Jing, TimBrooks, Jianfeng Wang, Linjie Li, LongOuyang, JuntangZhuang, JoyceLee, YufeiGuo, WesamManassra, PrafullaDhariwal, CaseyChu, YunxinJiao, and Aditya Ramesh. Improving image gener- ation with better captions, 2023. 2

    work page 2023

  2. [2]

    Tom B. Brown, Benjamin Mann, Nick Ryder, Melanie Sub- biah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakan- tan, Pranav Shyam, Girish Sastry, Amanda Askell, Sand- hini Agarwal, Ariel Herbert-V oss, Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel M. Ziegler, Jeffrey Wu, Clemens Winter, Christopher Hesse, Mark Chen, Eric Sigler, Mateusz...

    work page 2020

  3. [3]

    Con- ceptprune: Concept editing in diffusion models via skilled neuron pruning, 2024

    Ruchika Chavhan, Da Li, and Timothy Hospedales. Con- ceptprune: Concept editing in diffusion models via skilled neuron pruning, 2024. 2

    work page 2024

  4. [4]

    How to backdoor diffusion models? In 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 4015–4024, 2023

    Sheng-Yen Chou, Pin-Yu Chen, and Tsung-Yi Ho. How to backdoor diffusion models? In 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 4015–4024, 2023. 1

    work page 2023

  5. [5]

    Divide-and-conquer at- tack: Harnessing the power of llm to bypass safety filters of text-to-image models, 2024

    Yimo Deng and Huangxun Chen. Divide-and-conquer at- tack: Harnessing the power of llm to bypass safety filters of text-to-image models, 2024. 2

    work page 2024

  6. [6]

    BERT: Pre-training of deep bidirectional trans- formers for language understanding

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. BERT: Pre-training of deep bidirectional trans- formers for language understanding. In Proceedings of the 2019 Conference of the North American Chapter of the As- sociation for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers) , pages 4171–4186, Minnea...

    work page 2019

  7. [7]

    An image is worth 16x16 words: Transformers for image recognition at scale, 2021

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Syl- vain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale, 2021. 1

    2021

  8. [8]

    Erasing concepts from diffusion models

    Rohit Gandikota, Joanna Materzy ´nska, Jaden Fiotto- Kaufman, and David Bau. Erasing concepts from diffusion models. In Proceedings of the 2023 IEEE International Con- ference on Computer Vision, 2023. 1, 2, 6

    work page 2023

Show all 45 references
  1. [9]

    Rt-attack: Jailbreaking text-to-image models via random token, 2024

    Sensen Gao, Xiaojun Jia, Yihao Huang, Ranjie Duan, Jin- dong Gu, Yang Liu, and Qing Guo. Rt-attack: Jailbreaking text-to-image models via random token, 2024. 2

    2024

  2. [10]

    Zico Kolter, AI Sony, Sony Group Corporation, and Bosch Center

    Yutong He, Alexander Robey, Naoki Murata, Yiding Jiang, Joshua Williams, George J Pappas, Hamed Hassani, Yuki Mitsufuji, Ruslan Salakhutdinov, J. Zico Kolter, AI Sony, Sony Group Corporation, and Bosch Center. Automated black-box prompt engineering for personalized text-to- im...

    2024 arXiv

  3. [11]

    Denoising diffu- sion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffu- sion probabilistic models. CoRR, abs/2006.11239, 2020. 1, 3

    2006 arXiv

  4. [12]

    Perception-guided jailbreak against text-to-image models, 2024

    Yihao Huang, Le Liang, Tianlin Li, Xiaojun Jia, Run Wang, Weikai Miao, Geguang Pu, and Yang Liu. Perception-guided jailbreak against text-to-image models, 2024. 4

    2024

  5. [13]

    Inappropriate image prompts

    I2P. Inappropriate image prompts. https://huggingface.co/datasets/AIML-TUDA/i2p. 5

  6. [14]

    Leonardo.ai, 2023

    Leonardo.Ai. Leonardo.ai, 2023. https://leonardo. ai/. 2, 3, 6

    2023

  7. [15]

    Safegen: Mitigating sex- ually explicit content generation in text-to-image models

    Xinfeng Li, Yuchen Yang, Jiangyi Deng, Chen Yan, Yanjiao Chen, Xiaoyu Ji, and Wenyuan Xu. Safegen: Mitigating sex- ually explicit content generation in text-to-image models. In arXiv preprint arXiv:2404.06666, 2024. 1, 2, 6

    2024 arXiv

  8. [16]

    Groot: Adversarial testing for generative text-to-image models with tree-based semantic transformation, 2024

    Yi Liu, Guowei Yang, Gelei Deng, Feiyue Chen, Yuqi Chen, Ling Shi, Tianwei Zhang, and Yang Liu. Groot: Adversarial testing for generative text-to-image models with tree-based semantic transformation, 2024. 1

    2024

  9. [17]

    Jailbreaking prompt attack: A controllable adversarial attack against diffusion models, 2024

    Jiachen Ma, Anda Cao, Zhiqing Xiao, Jie Zhang, Chao Ye, and Junbo Zhao. Jailbreaking prompt attack: A controllable adversarial attack against diffusion models, 2024. 1, 5

    2024

  10. [18]

    Towards deep learning models resistant to adversarial attacks, 2019

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks, 2019. 2

    2019

  11. [19]

    Generating images from captions with attention, 2016

    Elman Mansimov, Emilio Parisotto, Jimmy Lei Ba, and Rus- lan Salakhutdinov. Generating images from captions with attention, 2016. 3

    2016

  12. [20]

    Midjourney, 2023

    Midjourney. Midjourney, 2023. https : / / www . midjourney.com/. 1, 2, 3, 6

    2023

  13. [21]

    GLIDE: towards photorealis- tic image generation and editing with text-guided diffusion models

    Alexander Quinn Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, Ilya Sutskever, and Mark Chen. GLIDE: towards photorealis- tic image generation and editing with text-guided diffusion models. In International Conference on Machine Learning, I...

    2022

  14. [22]

    NudeNet. Nudenet. https://github.com/notAI-tech/NudeNet. 5

  15. [23]

    Chatgpt, 2023

    OpenAI. Chatgpt, 2023. https://chatgpt.com. 2, 3, 5

    2023

  16. [24]

    Scalable diffusion models with transformers

    William Peebles and Saining Xie. Scalable diffusion models with transformers. arXiv preprint arXiv:2212.09748, 2022. 1 9

    2022 arXiv

  17. [25]

    Upam: Unified prompt attack in text-to-image generation models against both tex- tual filters and visual checkers, 2024

    Duo Peng, Qiuhong Ke, and Jun Liu. Upam: Unified prompt attack in text-to-image generation models against both tex- tual filters and visual checkers, 2024. 3

    2024

  18. [26]

    Unsafe diffusion: On the generation of unsafe images and hateful memes from text- to-image models, 2023

    Yiting Qu, Xinyue Shen, Xinlei He, Michael Backes, Sav- vas Zannettou, and Yang Zhang. Unsafe diffusion: On the generation of unsafe images and hateful memes from text- to-image models, 2023. 1

    2023

  19. [27]

    Learning transferable visual models from natural language supervision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision. In International Con...

    2021

  20. [28]

    Zero-shot text-to-image generation

    Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea V oss, Alec Radford, Mark Chen, and Ilya Sutskever. Zero-shot text-to-image generation. In Proceedings of the 38th International Conference on Machine Learning, ICML 2021, 18-24 July 2021, Virtual Event , pages 88...

    2021

  21. [29]

    Hierarchical text-conditional image gener- ation with clip latents, 2022

    Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text-conditional image gener- ation with clip latents, 2022. 1, 2

    2022

  22. [30]

    Red-teaming the stable diffusion safety filter, 2022

    Javier Rando, Daniel Paleka, David Lindner, Lennart Heim, and Florian Tram`er. Red-teaming the stable diffusion safety filter, 2022. 1, 2

    2022

  23. [31]

    High-resolution image syn- thesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj¨orn Ommer. High-resolution image syn- thesis with latent diffusion models. InIEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2022, New Orleans, LA, USA, June 18-24, 2022 , pages 10674–...

    2022

  24. [32]

    U-net: Convolutional networks for biomedical image segmentation,

    Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomedical image segmentation,

  25. [33]

    Patrick Schramowski, Christopher Tauchmann, and Kristian Kersting. Can machines help us answering question 16 in datasheets, and in turn reflecting on inappropriate content? In Proceedings of the ACM Conference on Fairness, Ac- countability, and Transparency (FAccT), 2022. 5

    2022

  26. [34]

    Safe latent diffusion: Mitigating inappro- priate degeneration in diffusion models, 2023

    Patrick Schramowski, Manuel Brack, Bj ¨orn Deiseroth, and Kristian Kersting. Safe latent diffusion: Mitigating inappro- priate degeneration in diffusion models, 2023. 1, 2, 6

    2023

  27. [35]

    Denois- ing diffusion implicit models

    Jiaming Song, Chenlin Meng, and Stefano Ermon. Denois- ing diffusion implicit models. CoRR, abs/2010.02502, 2020. 1

    2010 arXiv

  28. [36]

    Ring-a-bell! how reliable are concept removal meth- ods for diffusion models?, 2024

    Yu-Lin Tsai, Chia-Yi Hsu, Chulin Xie, Chih-Hsun Lin, Jia- You Chen, Bo Li, Pin-Yu Chen, Chia-Mu Yu, and Chun-Ying Huang. Ring-a-bell! how reliable are concept removal meth- ods for diffusion models?, 2024. 2

    2024

  29. [37]

    Gomez, Lukasz Kaiser, and Illia Polosukhin

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszko- reit, Llion Jones, Aidan N. Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. CoRR, abs/1706.03762, 2017. 1

    2017 arXiv

  30. [38]

    On the multi-modal vulnera- bility of diffusion models

    Dingcheng Yang, Yang Bai, Xiaojun Jia, Yang Liu, Xi- aochun Cao, and Wenjian Yu. On the multi-modal vulnera- bility of diffusion models. InTrustworthy Multi-modal Foun- dation Models and AI Agents (TiFA), 2024. 2, 6

    2024

  31. [39]

    Mma-diffusion: Multimodal at- tack on diffusion models

    Yijun Yang, Ruiyuan Gao, Xiaosen Wang, Tsung-Yi Ho, Nan Xu, and Qiang Xu. Mma-diffusion: Multimodal at- tack on diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 7737–7746, 2024. 1, 2, 3, 6

    2024

  32. [40]

    Guardt2i: Defending text-to-image models from adversarial prompts, 2024

    Yijun Yang, Ruiyuan Gao, Xiao Yang, Jianyuan Zhong, and Qiang Xu. Guardt2i: Defending text-to-image models from adversarial prompts, 2024. 1

    2024

  33. [41]

    Sneakyprompt: Jailbreaking text-to-image generative models

    Yuchen Yang, Bo Hui, Haolin Yuan, Neil Gong, and Yinzhi Cao. Sneakyprompt: Jailbreaking text-to-image generative models. In Proceedings of the IEEE Symposium on Security and Privacy, 2024. 1, 2, 6

    2024

  34. [42]

    Vector-quantized image modeling with improved vqgan

    Jiahui Yu, Xin Li, Jing Yu Koh, Han Zhang, Ruoming Pang, James Qin, Alexander Ku, Yuanzhong Xu, Jason Baldridge, and Yonghui Wu. Vector-quantized image modeling with improved vqgan. ArXiv, abs/2110.04627, 2021. 3

    2021 arXiv

  35. [43]

    To gener- ate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images

    Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yi- hua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu. To gener- ate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images ... for now, 2024. 2

    2024

  36. [44]

    Cipherdm: Secure three-party infer- ence for diffusion model sampling

    Xin Zhao, Xiaojun Chen, Xudong Chen, He Li, Tingyu Fan, and Zhendong Zhao. Cipherdm: Secure three-party infer- ence for diffusion model sampling. In Computer Vision – ECCV 2024, pages 288–305, Cham, 2025. Springer Nature Switzerland. 1

    2024

  37. [45]

    A pilot study of query-free adversarial attack against stable diffusion

    Haomin Zhuang, Yihua Zhang, and Sijia Liu. A pilot study of query-free adversarial attack against stable diffusion. In Proceedings of the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition (CVPR) Workshops , pages 2385–2392, 2023. 2, 6 10

    2023

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.