Pith. sign in

REVIEW 4 major objections 7 minor 45 references

PLA: Prompt Learning Attack against Text-to-Image Generative Models

T0 review · 4 major / 7 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that black-box text-to-image safety mechanisms can be bypassed reliably by learning adversarial prompts through gradient-based multimodal optimization.

desk verdict A genuinely new black-box prompt-learning attack with honest ablations, but the headline margin depends on an auxiliary model the threat model does not mention. read the letter →

arxiv 2508.03696 v1 pith:PVFXP6WH submitted 2025-07-14 cs.CR cs.AIcs.CV

Xinqi Lyu , Yihao Liu , Yanjie Li , Bin Xiao This is my paper · ORCID
classification cs.CRcs.AIcs.CV
keywords adversarialpromptstext-to-imagegenerationblack-boxattackpromptlearningsafetymechanismsNSFWcontentzeroth-orderoptimizationmultimodalsimilarity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that a black-box text-to-image (T2I) service, even when it combines a prompt filter with a post-hoc safety checker, can be made to generate NSFW content by prompts that an attacker learns through gradient-based training rather than word substitution. The proposed framework, PLA, optimizes a learnable embedding that is concatenated with the target prompt and fed into BERT or T5, which then outputs an adversarial prompt. Training is driven by multimodal similarities computed by CLIP, including an image-image term that requires an auxiliary T2I model without safety mechanisms to supply a target image. In the reported comparisons across SDv1.5, SDXLv1.0, and SLD with three safety checkers, average ASR-4 values reach about 86 to 95 percent, roughly 10 to 17 points above the strongest baseline; if the paper is right, attackers with query access and an unguarded auxiliary generator can reliably bypass current black-box defenses.

What carries the argument

The load-bearing objects are the sensitive-knowledge-guided prompt encoder and the multimodal loss that trains it. The sensitive knowledge extraction module maps a target prompt's text embedding through a low-then-high projection and injects the resulting sensitive embedding into the middle of the prompt encoder, so the adversarial prompt inherits the target's meaning without its words. The loss combines a text-image cosine-similarity term (target prompt vs. generated image) with an image-image cosine-similarity term (auxiliary target image vs. generated image), both scored by CLIP. The optimizer is a zeroth-order estimator with a momentum-like history term and a restart rule that replaces safety-induced black images with Gaussian noise; this is the mechanism that lets gradients flow despite black-box access and blocked outputs.

What would settle it

Run PLA against a victim model whose post-hoc safety checker and image similarity are computed in a space different from CLIP, and separately run it with the auxiliary target image removed from the image-image loss. If the success rate remains near the reported 90 percent under both changes, the central mechanism would not be what the paper says; if either change collapses the success rate, the dependence is confirmed.

Watch

Extended reading notes

Core claim

PLA treats the adversarial prompt as the output of a pretrained language model conditioned on a learnable embedding. The embedding is built by extracting sensitive knowledge from the target prompt's text representation, projecting it through a two-layer module, and adding it into a middle layer of the prompt encoder, so the generated prompt keeps the harmful semantics but uses different words. The prompt is evaluated by a multimodal loss that maximizes CLIP similarities between target prompt and generated image and between the auxiliary target image and generated image. Gradients are estimated with zeroth-order finite differences, but because safety mechanisms return black images and make those differences zero, the update keeps a momentum term from previous iterations and, if the first step is all black, restarts with Gaussian noise in place of the black images. The paper claims this makes gradient-driven training feasible in black-box settings and reports success rates that exceed all evaluated baselines.

Load-bearing premise

The attack depends on having an unguarded auxiliary text-to-image model that will generate the target image from the target prompt, since the image-image loss built on that image is the component whose removal hurts performance most; if no such model exists or its images do not resemble the victim's, the training signal weakens.

Editorial extensions

If this is right

  • Black-box T2I services that use prompt filters and post-hoc safety checkers of the kind tested cannot rely on those mechanisms alone to stop NSFW generation by a determined attacker with query access.
  • Gradient-based prompt learning over continuous embeddings can outperform search-based word substitution, so defenses should expect adversarial prompts that are not simple synonyms of banned words.
  • The strong dependence on the image-image loss means the attacker needs an unguarded auxiliary generator; blocking or detecting such auxiliary outputs would raise the attack's cost.
  • Because BERT/T5-generated adversarial prompts can be fluent, prompt sanitizers will need to defend semantics rather than lexical content.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper, this suggests a usable red-team benchmark: report ASR-4 under PLA alongside new T2I safety mechanisms, since it tests robustness to optimization rather than to lexical variants.
  • Beyond the paper, because the attack optimizes the same CLIP similarity space that many safety checkers use, a straightforward robustness test would be to re-run PLA against a checker that scores images in a different embedding space and see whether transfer fails.
  • Beyond the paper, the auxiliary-model dependence implies a potential defensive signal: services could look for prompts that consistently ask for images without safety filters or for statistical similarity to a known auxiliary model's output distribution, though the paper itself does not test this.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The paper proposes PLA, a prompt-learning attack against black-box text-to-image (T2I) models equipped with prompt filters and post-hoc safety checkers. The method learns an adversarial prompt by optimizing a prompt encoder with a zeroth-order gradient estimate of a multimodal loss that combines text-image similarity (target prompt vs. generated image) and image-image similarity (target image vs. generated image). The target image is produced by an auxiliary unguarded T2I model. Extensive experiments across SDv1.5, SDXLv1.0, and SLD with three safety checkers, as well as on Stability.ai and DALL·E 3, report attack success rates substantially above baselines such as MMA-Diffusion, with ablation studies attributing much of the gain to the image-image loss and the proposed gradient optimization strategy.

Significance. If the reported results are reliable, PLA would be a strong black-box attack against deployed T2I safety mechanisms, demonstrating that gradient-driven prompt optimization can outperform word-substitution baselines. The paper includes credible negative-space details such as ablations that remove each loss term and each gradient component, and it evaluates against multiple victim models, checkers, and online services. However, the central claim is heavily dependent on an auxiliary unguarded T2I model whose availability is not part of the stated threat model, and several methodological gaps (metric inflation, missing query budgets, small evaluation subsets, and lack of error bars) currently weaken the evidence.

major comments (4)
  1. [§3.2, §4.2, Table 4] The threat model in §3.2 states that the attacker has access only to the generated images of the black-box model M, but the method in §4.2 uses an auxiliary model M_s to produce a target image Itar for the image-image loss Lb. The ablation in Table 4 shows that removing Lb reduces ASR-4 from 93.34 to 79.34 on SLD violence and from 93.41 to 74.66 on SLD nudity, and the latter value falls below the MMA-Diffusion baseline of 76.48 in Table 1. The claimed superiority over the strongest baseline is therefore contingent on access to an unguarded auxiliary model that is not described in the threat model. Please either add M_s explicitly to the attacker capabilities, justify its availability, or provide an evaluation that does not rely on it.
  2. [§5.1, Tables 1 and 2] The ASR-N metric counts a prompt as successful if any of N generated images is NSFW, which inflates success rates: for example, PLA-BERT on SDXLv1.0 nudity reaches ASR-4 of 95.37 but ASR-1 of only 76.20 under the SC checker. The abstract and conclusions state a 'high success rate' without clearly disclosing this any-of-N property. Moreover, no error bars, confidence intervals, or seed variations are reported, and the violence dataset contains only 30 prompts. Please report ASR-1 alongside ASR-4 in the main text and provide variance estimates or a clear statement of statistical significance for the claimed margins over baselines.
  3. [§5.3, Table 3] The online-service evaluation uses a subset of only 20 prompts per category and does not report the number of queries required by the ZOO-based optimization for each prompt, which is critical because online services impose rate limits and query caps. Without this information, it is unclear whether the reported 36–70% ASR-4 values reflect a practical attack under realistic query budgets. Please also describe the human-evaluation protocol (e.g., inter-rater agreement, instructions to evaluators) so that the results are reproducible.
  4. [§4.4, Table 5] The proposed gradient update in Eq. (9) and the 'restart' strategy of replacing black images with Gaussian noise are heuristic, and Table 5 shows that the standard ZOO version (GZOO) performs far worse (52.89 ASR-4 on violence vs. 91.69 for the proposed GP LA). This indicates that the success of PLA hinges on these heuristics, yet the paper offers no analysis of why the history-gradient update and the Gaussian-noise substitution yield valid gradient estimates, nor a sensitivity study of the hyperparameters β, η, and c. Please add such an analysis or at least a systematic ablation of these parameters.
minor comments (7)
  1. [Eq. (8)] The zeroth-order gradient formula is written ambiguously: the denominator '2c · Δ' appears to be a vector, but in standard ZOO the denominator is the scalar 2c and the result is multiplied by Δ. Please clarify the notation.
  2. [§5.4] The term 'GP LA' in Table 5 is not defined in the text; it presumably means the proposed gradient method plus PLA, but it should be spelled out when first used.
  3. [§5.1] The paper states that complete PixArt auxiliary-model studies are in the appendix, but the main text does not summarize those results. Please add a sentence reporting whether PixArt as M_s gives similar success rates to SDv1.4, since the choice of auxiliary model is load-bearing.
  4. [§1] The phrase 'the high-dimensional features of text embedding are leveraged' in the introduction is vague; the actual mechanism in §4.1 is a two-layer MLP with residual addition. Please align the introduction with the method.
  5. [§2.2] The related work describes MMA-Diffusion as a white-box attack, but in the experiments it is used as a baseline for black-box attacks without explaining how it is adapted. Please clarify the baseline setup.
  6. [§5.2, Tables 1 and 2] The tables report 'AVG' columns, but the text says 'average ASR-4 of PLA-BERT is 91.45%, 90.57%, and 90.82%, which matches only the SDv1.5, SDXLv1.0, and SLD rows. Please ensure the column headers and text are consistent.
  7. [References] Reference [15] cites Ho et al. for the Gaussian-noise idea, but the restart strategy is a much more specific algorithmic choice; a more direct citation to the specific diffusion-sampling property would help.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attack is optimized against external safety mechanisms and evaluated externally; the auxiliary-model dependency is a threat-model assumption, not a self-referential reduction.

full rationale

I walked the paper's derivation chain. The adversarial prompt is generated as padv = PLM([epe; ptar]) (Eq. 4), where epe is learned from sensitive embeddings of the target prompt. The training signal is the multimodal loss LMS = La + Lb (Eq. 7), with La = 1 - cos(Ten(ptar), Ven(Igen)) and Lb = 1 - cos(Ven(Itar), Ven(Igen)) (Eqs. 5-6). The target image Itar is generated by an auxiliary model Ms without safety mechanisms (Section 4.2), so it is independent supervision, not a fitted parameter of the victim model. Gradient estimation uses zeroth-order optimization (Eq. 8) with history and restart (Eq. 9); none of these equations define the reported attack success rate in terms of the optimized loss. The evaluation metric ASR-N is measured by external post-hoc safety checkers (SC, Q16, MHSC) or human evaluators, and the reported numbers are not produced by construction from the CLIP losses. The dependency on an unguarded auxiliary model is a legitimate threat-model and transferability assumption, but it is not circular: the victim's safety mechanisms and the success metric are external to the optimization objective. There are no load-bearing self-citations, no imported uniqueness theorems, and no renaming of a known result as a new prediction. The central claim therefore has independent content and is not circular.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The paper introduces no new physical or external entities. It uses learned embeddings and modules that are internal to the method: a sensitive embedding, a prompt encoder, and a SKE module. These are algorithmic constructs rather than postulated entities with independent falsifiable handles. The central claim depends instead on the hyperparameters and domain assumptions listed above.

free parameters (4)
  • omega = not reported
    Weight controlling the strength of sensitive embedding integration in Eq. (2), chosen by hand in the method description.
  • insertion layer l = not reported
    Layer index at which the sensitive embedding is inserted into the prompt encoder, chosen by hand and not specified in main text.
  • c (ZOO decay parameter) = not reported
    Perturbation scale in the finite-difference gradient estimator in Eq. (8), requires a value but none is given.
  • beta and eta = not reported
    History gradient weight and learning rate in Eq. (9), not specified in main text.
assumptions (5)
  • domain assumption The black-box victim model returns either a generated image or a black image and is queryable by the attacker.
    Section 3.2 threat model states the attacker has access only to generated images of the victim model and that safety mechanisms return black images.
  • domain assumption An auxiliary T2I model without safety mechanisms can generate NSFW target images from target prompts.
    Section 4.2 uses Itar = Ms(ptar) as supervision; if such an unguarded model is unavailable or mismatched, the image-image loss loses its grounding.
  • domain assumption CLIP cosine similarity reflects the semantic and NSFW-relevant content needed for attack success.
    Section 4.3 builds both loss terms from CLIP encoders; the method assumes CLIP alignment is a faithful proxy for harmful content similarity.
  • ad hoc to paper Random Gaussian noise substituted for black images provides useful gradient information.
    Section 4.4 introduces the 'restart' strategy to replace black images with Gaussian noise when gradients vanish; no theoretical justification is provided beyond an ablation.
  • standard math Zeroth-order finite-difference gradient estimation converges for the prompt encoder optimization.
    Section 4.4 cites ZOO literature and assumes smoothness and finite inverse momentum conditions on the loss landscape.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PLA: Prompt Learning Attack against Text-to-Image Generative Models." pith.science (2026). https://pith.science/paper/PVFXP6WH

@misc{pith2026250803696,
  author       = {Pith},
  title        = {Pith review of: PLA: Prompt Learning Attack against Text-to-Image Generative Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PVFXP6WH}},
  note         = {Machine review of arXiv:2508.03696}
}
read the original abstract

Text-to-Image (T2I) models have gained widespread adoption across various applications. Despite the success, the potential misuse of T2I models poses significant risks of generating Not-Safe-For-Work (NSFW) content. To investigate the vulnerability of T2I models, this paper delves into adversarial attacks to bypass the safety mechanisms under black-box settings. Most previous methods rely on word substitution to search adversarial prompts. Due to limited search space, this leads to suboptimal performance compared to gradient-based training. However, black-box settings present unique challenges to training gradient-driven attack methods, since there is no access to the internal architecture and parameters of T2I models. To facilitate the learning of adversarial prompts in black-box settings, we propose a novel prompt learning attack framework (PLA), where insightful gradient-based training tailored to black-box T2I models is designed by utilizing multimodal similarities. Experiments show that our new method can effectively attack the safety mechanisms of black-box T2I models including prompt filters and post-hoc safety checkers with a high success rate compared to state-of-the-art methods. Warning: This paper may contain offensive model-generated content.

Figures

Figures reproduced from arXiv: 2508.03696 by the authors.

Figure 1
Figure 1. Illustration of black-box victim models that incorporate prompt filters and post-hoc safety checkers. Prompt filters block prompts [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Overview of PLA. (a) In sensitive knowledge guided encoding, the SKE module extracts sensitive embeddings from the target [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Visualization results of PLA. Sensitive words within the target prompt are colored in red. Images are generated by SDXLv1.0. tack method exhibits superior attack performance. We pro￾vide more examples of NSFW images generated by T2I on￾line services in the Appendix. 5.4. Ablation Study Multimodal Loss. To demonstrate the effectiveness of the multimodal loss, we conduct ablation studies by removing the specific La (o… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 34 canonical work pages

  1. [1]

    Available: https://openai.com/index/ dall-e-3/

    Dall·e 3. Available: https://openai.com/index/ dall-e-3/. 1, 6, 7

    work page

  2. [2]

    Available: https://openai.com/index/ gpt-4/

    Gpt-4. Available: https://openai.com/index/ gpt-4/. 1

    work page

  3. [3]

    Available: https : / / runwayml

    Gen-2. Available: https : / / runwayml . com / research/gen-2

    work page

  4. [4]

    Available: https://designer

    Microsoft designer. Available: https://designer. microsoft.com/. 1

    work page

  5. [5]

    Available: https://www.midjourney

    Midjourney. Available: https://www.midjourney. com/. 3

    work page

  6. [6]

    Available: https://github.com/PixArt- alpha/PixArt-alpha

    Pixart. Available: https://github.com/PixArt- alpha/PixArt-alpha. 6

    work page

  7. [7]

    Available: https:// huggingface.co/CompVis/stable-diffusion- v1-4

    Stable diffusion v1.4 checkpoint, . Available: https:// huggingface.co/CompVis/stable-diffusion- v1-4. 6

    work page

  8. [8]

    Available: https: //huggingface.co/stable- diffusion- v1- 5/ stable-diffusion-v1-5

    Stable diffusion v1.5 checkpoint, . Available: https: //huggingface.co/stable- diffusion- v1- 5/ stable-diffusion-v1-5 . 1, 6, 7

    work page

Show all 45 references
  1. [9]

    Available: https://stability.ai/

    stability.ai. Available: https://stability.ai/. 1, 6, 7

  2. [10]

    Deepzero: Scaling up zeroth-order optimization for deep model train- ing

    Aochuan Chen, Yimeng Zhang, Jinghan Jia, James Diffend- erfer, Jiancheng Liu, Konstantinos Parasyris, Yihua Zhang, Zheng Zhang, Bhavya Kailkhura, and Sijia Liu. Deepzero: Scaling up zeroth-order optimization for deep model train- ing. arXiv preprint arXiv:2310.02025, 2023. 5

    arXiv

  3. [11]

    Zoo: Zeroth order optimization based black- box attacks to deep neural networks without training substi- tute models

    Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. Zoo: Zeroth order optimization based black- box attacks to deep neural networks without training substi- tute models. In Proceedings of the 10th ACM workshop on artificial intelligence and security, pages 15–26, 2017

    2017

  4. [12]

    Zo-adamm: Zeroth-order adaptive momentum method for black-box optimization.Ad- vances in neural information processing systems , 32, 2019

    Xiangyi Chen, Sijia Liu, Kaidi Xu, Xingguo Li, Xue Lin, Mingyi Hong, and David Cox. Zo-adamm: Zeroth-order adaptive momentum method for black-box optimization.Ad- vances in neural information processing systems , 32, 2019. 5

    2019

  5. [13]

    Gradient-based optimizer (gbo): a review, theory, variants, and applications.Archives of Com- putational Methods in Engineering, 30(4):2431–2449, 2023

    Mohammad Sh Daoud, Mohammad Shehab, Hani M Al-Mimi, Laith Abualigah, Raed Abu Zitar, and Mohd Khaled Yousef Shambour. Gradient-based optimizer (gbo): a review, theory, variants, and applications.Archives of Com- putational Methods in Engineering, 30(4):2431–2449, 2023. 1

    2023

  6. [14]

    Erasing concepts from diffusion models

    Rohit Gandikota, Joanna Materzynska, Jaden Fiotto- Kaufman, and David Bau. Erasing concepts from diffusion models. In Proceedings of the IEEE/CVF International Con- ference on Computer Vision, pages 2426–2436, 2023. 2

    2023

  7. [15]

    Denoising dif- fusion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising dif- fusion probabilistic models. Advances in neural information processing systems, 33:6840–6851, 2020. 6

    2020

  8. [16]

    Bert: Pre-training of deep bidirectional trans- formers for language understanding

    Jacob Devlin Ming-Wei Chang Kenton and Lee Kristina Toutanova. Bert: Pre-training of deep bidirectional trans- formers for language understanding. In Proceedings of naacL-HLT, page 2. Minneapolis, Minnesota, 2019. 5, 6

    2019

  9. [17]

    Adam: A method for stochastic opti- mization

    Diederik P Kingma. Adam: A method for stochastic opti- mization. arXiv preprint arXiv:1412.6980, 2014. 2

    2014 arXiv

  10. [18]

    Ablating con- cepts in text-to-image diffusion models

    Nupur Kumari, Bingliang Zhang, Sheng-Yu Wang, Eli Shechtman, Richard Zhang, and Jun-Yan Zhu. Ablating con- cepts in text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vi- sion, pages 22691–22702, 2023. 2

    2023

  11. [19]

    Holis- tic evaluation of text-to-image models

    Tony Lee, Michihiro Yasunaga, Chenlin Meng, Yifan Mai, Joon Sung Park, Agrim Gupta, Yunzhi Zhang, Deepak Narayanan, Hannah Teufel, Marco Bellagente, et al. Holis- tic evaluation of text-to-image models. Advances in Neural Information Processing Systems, 36, 2024. 2

    2024

  12. [20]

    Adversarial example does good: Preventing paint- ing imitation from diffusion models via adversarial exam- ples

    Chumeng Liang, Xiaoyu Wu, Yang Hua, Jiaru Zhang, Yim- ing Xue, Tao Song, Zhengui Xue, Ruhui Ma, and Haibing Guan. Adversarial example does good: Preventing paint- ing imitation from diffusion models via adversarial exam- ples. In International Conference on Machine Learning , ...

    2023

  13. [21]

    Riatig: Reliable and imperceptible adversarial text- to-image generation with natural prompts

    Han Liu, Yuhao Wu, Shixuan Zhai, Bo Yuan, and Ning Zhang. Riatig: Reliable and imperceptible adversarial text- to-image generation with natural prompts. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 20585–20594, 2023. 1

    2023

  14. [22]

    Intriguing properties of text-guided diffusion models

    Qihao Liu, Adam Kortylewski, Yutong Bai, Song Bai, and Alan Yuille. Intriguing properties of text-guided diffusion models. arXiv preprint arXiv:2306.00974, 2, 2023. 3

    2023 arXiv

  15. [23]

    Latent guard: a safety framework for text-to-image generation

    Runtao Liu, Ashkan Khakzar, Jindong Gu, Qifeng Chen, Philip Torr, and Fabio Pizzati. Latent guard: a safety framework for text-to-image generation. arXiv preprint arXiv:2404.08031, 2024. 2

    2024 arXiv

  16. [24]

    Black box adversarial prompting for foundation models

    Natalie Maus, Patrick Chao, Eric Wong, and Jacob R Gard- ner. Black box adversarial prompting for foundation models. In The Second Workshop on New Frontiers in Adversarial Machine Learning, 2023. 3

    2023

  17. [25]

    Sdxl: Improving latent diffusion mod- els for high-resolution image synthesis

    Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas M ¨uller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion mod- els for high-resolution image synthesis. arXiv preprint arXiv:2307.01952, 2023. 6

    2023 arXiv

  18. [26]

    Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models

    Yiting Qu, Xinyue Shen, Xinlei He, Michael Backes, Sav- vas Zannettou, and Yang Zhang. Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Se- curity, ...

    2023

  19. [27]

    Learning transferable visual models from natural language supervi- sion

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervi- sion. In International conference on machine learning, ...

    2021

  20. [28]

    Exploring the limits of transfer learning with a unified text-to-text transformer

    Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of machine learning research, 21(140):1–67, 2020. 5, 6

    2020

  21. [29]

    Red-teaming the stable diffusion safety filter

    Javier Rando, Daniel Paleka, David Lindner, Lennart Heim, and Florian Tram`er. Red-teaming the stable diffusion safety filter. arXiv preprint arXiv:2210.04610, 2022. 2 9

    2022 arXiv

  22. [30]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022. 1, 3

    2022

  23. [31]

    Photorealistic text-to-image diffusion models with deep language understanding

    Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding. Advances in neural information...

    2022

  24. [32]

    Raising the cost of malicious ai-powered image editing

    Hadi Salman, Alaa Khaddaj, Guillaume Leclerc, Andrew Ilyas, and Aleksander Madry. Raising the cost of malicious ai-powered image editing. In International Conference on Machine Learning, pages 29894–29918. PMLR, 2023. 3

    2023

  25. [33]

    Patrick Schramowski, Christopher Tauchmann, and Kristian Kersting. Can machines help us answering question 16 in datasheets, and in turn reflecting on inappropriate content? In Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency, pages 1350–136...

    2022

  26. [34]

    Safe latent diffusion: Mitigating inappro- priate degeneration in diffusion models

    Patrick Schramowski, Manuel Brack, Bj ¨orn Deiseroth, and Kristian Kersting. Safe latent diffusion: Mitigating inappro- priate degeneration in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 22522–22531, 2023. 1, 2, 6

    2023

  27. [35]

    Introduction to stochastic search and opti- mization: estimation, simulation, and control

    James C Spall. Introduction to stochastic search and opti- mization: estimation, simulation, and control. John Wiley & Sons, 2005. 5

    2005

  28. [36]

    Stochastic gradient descent as approximate bayesian infer- ence

    Mandt Stephan, Matthew D Hoffman, David M Blei, et al. Stochastic gradient descent as approximate bayesian infer- ence. Journal of Machine Learning Research, 18(134):1–35,

  29. [37]

    Ring-a-bell! how reliable are concept removal methods for diffusion models? In International Conference on Learning Representations, 2024

    Yu-Lin Tsai, Chia-yi Hsu, Chulin Xie, Chih-hsun Lin, Jia You Chen, Bo Li, Pin-Yu Chen, Chia-Mu Yu, and Chun- ying Huang. Ring-a-bell! how reliable are concept removal methods for diffusion models? In International Conference on Learning Representations, 2024. 3, 6, 7

    2024

  30. [38]

    Mma-diffusion: Multimodal attack on diffusion models

    Yijun Yang, Ruiyuan Gao, Xiaosen Wang, Tsung-Yi Ho, Nan Xu, and Qiang Xu. Mma-diffusion: Multimodal attack on diffusion models. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pages 7737–7746, 2024. 1, 3, 6, 7

    2024

  31. [39]

    Guardt2i: Defending text-to-image models from adversarial prompts

    Yijun Yang, Ruiyuan Gao, Xiao Yang, Jianyuan Zhong, and Qiang Xu. Guardt2i: Defending text-to-image models from adversarial prompts. arXiv preprint arXiv:2403.01446,

    arXiv

  32. [40]

    Sneakyprompt: Jailbreaking text-to-image generative models

    Yuchen Yang, Bo Hui, Haolin Yuan, Neil Gong, and Yinzhi Cao. Sneakyprompt: Jailbreaking text-to-image generative models. In 2024 IEEE symposium on security and privacy (SP), pages 897–912. IEEE, 2024. 1, 3, 6, 7

    2024

  33. [41]

    Forget-me-not: Learning to forget in text-to-image diffusion models

    Gong Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me-not: Learning to forget in text-to-image diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1755–1764, 2024. 2

    2024

  34. [42]

    On the robustness of latent diffusion models

    Jianping Zhang, Zhuoer Xu, Shiwen Cui, Changhua Meng, Weibin Wu, and Michael R Lyu. On the robustness of latent diffusion models. arXiv preprint arXiv:2306.08257, 2023. 3

    2023 arXiv

  35. [43]

    To gener- ate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images

    Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yi- hua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu. To gener- ate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now. arXiv preprint arXiv:2310.11868, 2023. 1, 2, 3, 6, 7

    arXiv

  36. [44]

    Random learn- ing gradient based optimization for efficient design of photo- voltaic models

    Wei Zhou, Pengjun Wang, Ali Asghar Heidari, Xuehua Zhao, Hamza Turabieh, and Huiling Chen. Random learn- ing gradient based optimization for efficient design of photo- voltaic models. Energy Conversion and Management, 230: 113751, 2021. 1

    2021

  37. [45]

    A pilot study of query-free adversarial attack against stable diffusion

    Haomin Zhuang, Yihua Zhang, and Sijia Liu. A pilot study of query-free adversarial attack against stable diffusion. In Proceedings of the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition, pages 2385–2392, 2023. 3, 6, 7 10

    2023

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.