{"id":"4595250e-e0ca-499f-95dd-e3ee1b21da07","arxiv_id":"2412.08156","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"Antelope finds short, inconspicuous suffix tokens by aligning prompt embeddings with reference image embeddings, achieving higher ASR than prior jailbreak attacks on Stable Diffusion and several defenses.","lead":"This paper introduces Antelope, a jailbreak attack that crafts subtle text prompts to make AI image generators produce NSFW images while bypassing safety filters. It reports higher attack success than four existing methods across several defenses, and some transfer to online services.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"No error bars or significance tests, and hyperparameters are tuned on an unseparated development set; the reported ASR/FID differences may be noise, so the claim of consistent superiority is not yet established.","rationale":"The reader identifies the Eq.1 embedding arithmetic as the weakest assumption. That is a legitimate concern about the method's interpretability, but it is not the most load-bearing threat to the paper's central empirical claim. Even if the linear composition in Eq.1 is theoretically unjustified, the attack could still achieve high ASR by the suffix search alone, e.g., by exploiting shared low-level features between the clean prompt and the reference image embedding. Conversely, if the reported ASR/FID advantages are within noise or are biased by tuning on the test set, the headline claim of consistent superiority collapses regardless of whether the mechanism is valid. Tables 1 and 2 contain multiple near-ties and outright losses (e.g., Table 2 violence: Antelope ties MMP on SDv14, loses to MMP on SDv21 by 6.8 points, ties Sneaky on SLD-max). The absence of any statistical analysis means we cannot distinguish a genuine improvement from random variation. The ablation (Sec. 4.3) tunes γ and N on 10 prompts per attribute without a stated separation from the 333/59 evaluation prompts, creating a potential leakage channel. A simple hold-out check would resolve this. My proposed test would re-run the comparison with confidence intervals and a clean split; that directly settles the central claim. Thus I partially agree with the reader: reproducibility and missing code are issues, but the statistical rigor of the comparison is the load-bearing point.","tokens_in":11649,"tokens_out":13100,"duration_ms":131376,"concrete_test":"Run each attack method (Antelope and four baselines) on a fixed, pre-registered subset of 50 prompts from NSFW-333 and 20 from NSFW-59, with 5 independent random seeds per prompt, and report mean ± 95% CI for ASR and FID under all 8 defenses. Additionally, inspect whether the 10 ablation prompts of Sec. 4.3 are included in NSFW-333/59; if they are, hold out all ablation prompts and re-tune γ and N on a separate development set, then re-run the full comparison. If the CIs of Antelope overlap those of the best baseline in more than 2 of 8 defenses, or if ASR drops by more than 5 points after the train/test separation, the claim of consistent superiority is not supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim of consistent superiority (Sec. 4.2) is an empirical statement, but the paper provides no error bars, confidence intervals, or significance tests for any ASR or FID number. Several differences are tiny: Table 1 nudity FID for SLD-max shows Antelope 62.17 vs SneakyPrompt 62.15; Table 2 violence ASR for SDv14 shows Antelope 54.24 tied with MMP-Attack, and for SLD-max Antelope 32.20 tied with SneakyPrompt. Without variance estimates, these could be random. More seriously, the hyperparameters γ=0.2, N=5, and τ=0.7 are chosen in Sec. 4.3 using 10 'representative prompts' per target attribute, and the paper never states whether these prompts are disjoint from the NSFW-333/NSFW-59 evaluation sets used in Tables 1-2. If they overlap, the hyperparameter selection directly optimizes on the test set, inflating ASR. Finally, the FID reference set is described as 1,000 images generated from raw NSFW prompts in a No Attack setting, but the paper does not state whether this reference set is held fixed across defenses or whether FID is computed with the same random seeds; given that the FID differences are within a few points, the 'best FID' claim is not robust.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Antelope, a jailbreak attack against text-to-image (T2I) diffusion models. The attack preprocesses an original NSFW prompt into a benign-looking prompt, appends a small set of suffix tokens, and optimizes those tokens to minimize a weighted cosine-similarity loss in both text and image embedding spaces. The search is terminated early using an NSFW filter, and the resulting prompts are evaluated for attack success rate (ASR) and FID against four baselines across eight defense configurations, with additional qualitative tests on two online services. The central claim is that Antelope consistently achieves the highest ASR and best FID in most cases while being faster than prior gradient- or RL-based attacks.","tokens_in":11921,"tokens_out":5299,"duration_ms":57279,"significance":"If the empirical claims hold, Antelope would be a practical and efficient red-team tool for evaluating safety mechanisms in T2I systems. The paper covers a broad set of defenses (SDv1.4, SDv2.1, ESD, SafeGen, and four SLD variants), compares against four published baselines, reports search-time costs, and includes ablations for the main hyperparameters. The method itself is simple and clearly stated. The main weaknesses are experimental: the headline comparisons are single-run point estimates with no variance information, the hyperparameters appear to be selected on the evaluation distribution without a stated holdout, the FID reference set is generated by the same kind of model rather than a natural image distribution, and the online black-box claim is supported only by qualitative examples. These issues affect the strength of the central claim, but they are fixable with additional experiments or a more carefully qualified presentation.","major_comments":[{"comment":"No error bars, confidence intervals, or significance tests are reported for any ASR or FID value. Several decisive-looking differences are very small: in Table 1 the SLD-max nudity FID for Antelope is 62.17 versus 62.15 for SneakyPrompt, and in Table 2 the SDv1.4 violence ASR is a tie at 54.24. Without repeated runs or significance testing, the claim that Antelope 'consistently achieves the highest ASR and FID performance in most cases' is not established. The claim is also not literally true for every column: in the ESD/nudity block, Antelope's ASR (12.91) is below MMA-Diffusion (15.02). The authors should report means and standard deviations over multiple seeds, state the number of repetitions, and soften or qualify the consistency claim.","section":"§4.1, Tables 1–2"},{"comment":"The hyperparameters γ=0.2, N=4/5, and τ=0.7 are chosen using 10 'representative prompts' per target attribute, and the paper does not state whether these prompts are disjoint from the NSFW-333 and NSFW-59 sets used to produce Tables 1 and 2. If the development prompts overlap with the evaluation prompts, the hyperparameters are effectively tuned on the test set, which would inflate the reported ASR and undermine the comparison with baselines. The authors must state the relationship between the development and evaluation prompt sets and, ideally, re-run the main tables with hyperparameters selected on a disjoint development set.","section":"§4.3"},{"comment":"The early-stopping procedure in the 'Jailbreak Safety Checker' stops the search when generated images pass an NSFW filter, while the ASR metric in §4.1 is computed with an NSFW detector (NudeNet/Q16). If the filter used during search is the same detector used for scoring, then the reported ASR is a selection artifact: the search is stopped precisely when that detector is fooled, so the final evaluation is not an independent measure of attack success. The authors should clarify whether the search-time filter and the evaluation detector are identical, and, if so, provide an additional evaluation with a different NSFW classifier to test generalization.","section":"§3.3 and §4.1"},{"comment":"The FID reference set is described as 1,000 images generated from raw NSFW prompts in a 'No Attack' setting. This is not the standard use of FID, which compares generated samples to a real image distribution; here the reference distribution consists of images produced by the same generative model, so it may favor methods that replicate the model's own output statistics rather than realistic NSFW imagery. The paper also does not state whether this reference set is held fixed across all attacks and defenses or whether the same random seeds are used. Since several FID differences are within 1–2 points, the 'best FID' claims need to specify the exact reference construction and be accompanied by variance estimates.","section":"§4.1, Metrics – FID"},{"comment":"The claim that Antelope can 'penetrate online black-box services' is supported only by qualitative examples on Midjourney and Leonardo.AI. There is no quantitative success rate, no number of prompts tested, and no comparison with baseline attacks in the black-box setting. Moreover, the conclusion acknowledges that attack success rates on unfamiliar online models remain relatively low. The authors should either provide a systematic black-box evaluation with a defined prompt set and success criteria or explicitly restrict the contribution to a transfer demonstration rather than a claim of effective online penetration.","section":"§4.2, Figure 6"},{"comment":"The core assumption that concepts distant in text-embedding space can still generate visually similar images, and that the operation Et = Ec − En + Ep reliably reintroduces the target concept, is supported only by a TSNE visualization of 50 prompts per concept. TSNE is a nonlinear projection and the figure does not quantify whether text-space distance predicts image-space similarity for the ChatGPT-selected token pairs. Since Eq. (4) directly optimizes text-embedding alignment as a proxy for image-level alignment, this assumption is load-bearing. A quantitative validation—for example, measuring image similarity for randomly sampled token pairs, or showing that the positive/negative pairs selected by ChatGPT produce consistent image-level changes—would substantially strengthen the paper.","section":"§3.3, Eq. (1), Figure 5"}],"minor_comments":[{"comment":"There are several typos and inconsistencies: 'Leoanrdo.AI' appears in §§2 and 4.2, 'SDv14' and 'SDv1.4' are used interchangeably, and 'N = 4or 5' in §3.3 is missing a space. These should be corrected in a revision.","section":"Throughout"},{"comment":"The ChatGPT prompt or template used to generate the positive/negative token pairs is not provided, and the token pairs themselves are not listed. Without this information, the method is not fully reproducible. The authors should release the exact prompts used and at least a sample of the selected token pairs.","section":"§3.3, Similar Token Selection"},{"comment":"The optimization procedure is unclear: §3.3 describes a search over the vocabulary, while §4.1 mentions a learning rate and 2000 iterations. The authors should clarify whether the suffix tokens are optimized by gradient descent on the embedding or selected by discrete search, and how the learning rate is applied.","section":"§4.1, Setup"},{"comment":"The notation in Table 3 is not fully explained: the asterisk (*) for SneakyPrompt is described only as 'ambiguous timing,' and the violence row for 'SneakyPro. beam' appears to be missing a value. Please clarify or complete the table.","section":"Table 3"},{"comment":"The description of 'simulating the distribution of both negative and positive prompts from machine view and human view' is vague. It should be made explicit what data or model was used to produce the sentiment distributions and how they relate to token-pair selection.","section":"Figure 4"}],"recommendation":"major_revision","confidential_remarks":"The core idea is plausible and the evaluation is broad, but the experimental rigor is not yet at the level needed for the strong comparative claims. If the authors can separate hyperparameter tuning from evaluation, report variance, clarify the detector overlap, and replace the qualitative online results with quantitative data, the paper could become publishable. I do not see an unfixable flaw in the method itself."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Antelope is a reasonable engineering contribution: it packages prompt cleaning, ChatGPT-picked token pairs, embedding arithmetic, suffix search, and early stopping into a single attack. The method is clearly explained and sensibly motivated; the comparison against four baselines across eight defense configurations is useful, and the timing table is a nice practical addition. The authors also honestly note in Section 6 that transfer to black-box services remains relatively low, which matches the qualitative online results.\n\nThe novelty is real but incremental. JPA, MMP-Attack, RT-Attack, and DACA already provide the components. What is new is the combination and the way they use positive/negative token pairs selected by ChatGPT to reintroduce a concept after cleaning the prompt. That is a legitimate twist, not a new paradigm.\n\nThe central claim of \"consistently achieves the highest ASR and FID in most cases\" is not supported as strongly as the tables suggest. There are no error bars, confidence intervals, or significance tests anywhere. Some of the margins are tiny—SLD-max nudity FID 62.17 vs 62.15, violence ASR ties at 54.24 and 32.20. With five images per prompt and no variance estimate, those differences could be noise. More important, hyperparameters gamma, N, and tau are chosen on ten \"representative prompts\" per target, and the paper never says whether those overlap with NSFW-333/NSFW-59. If they overlap, the selection is tuning on the test set. The FID reference set of 1,000 images also lacks a statement that it is fixed across defenses and seeds.\n\nThe missing pieces are concrete: no code, no data, and the ChatGPT-selected token pairs are unspecified. That matters here because the core assumption that semantic-space distance tracks image-space similarity (Eq. 1) is supported only by a TSNE plot of 50 prompts per concept. It is plausible, but it is not a measured distribution.\n\nI don't think the paper is circular or incoherent; it is an empirical paper with an unverified headline. The ablation is honest about small scale. The citation pattern looks normal for the area. This deserves serious peer review—the content is useful for the red-teaming community and the method is not derivative enough to desk reject. But the revision needs confidence intervals, a clean train/test split, and either code or full token-pair disclosure before the superiority claim can be taken at face value.","headline":"A competent incremental jailbreak combo whose 'consistent superiority' claim is not yet proven: no error bars, no code or token-pair release, and a real risk of validation-set contamination.","tokens_in":12464,"tokens_out":2256,"would_cite":false,"duration_ms":23329,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Antelope claims a faster, more covert jailbreak for text-to-image models, reporting top attack success on most defenses.","keywords":["jailbreak attack","text-to-image models","diffusion models","NSFW content","adversarial prompts","semantic alignment","concept confusion","safety filters"],"falsifier":"Measure, for a fixed set of concept pairs, the distribution of image embeddings from 500+ prompts per pair: if concepts that are far apart in CLIP text space produce images no more similar than random pairs, the Eq. (4) objective is not measuring what the attack needs. A second check is to run the same pipeline with random instead of ChatGPT-chosen token pairs and compare ASR.","tokens_in":11415,"feed_emoji":"🔓","tokens_out":8995,"duration_ms":84598,"temperature":0.7,"pith_summary":"This paper proposes Antelope, a jailbreak attack strategy against text-to-image models that aims to generate NSFW images from prompts that look harmless to safety filters. The method exploits concept confusion: it chooses token pairs that are far apart in semantic text space yet visually similar in image space, then performs embedding arithmetic—subtracting one embedding and adding another—to steer generation toward the target concept. Evaluations on Stable Diffusion v1.4, v2.1, ESD, SafeGen, and four SLD configurations for both nudity and violence targets show Antelope achieving the highest attack success rate in most settings, with lower or comparable FID and search times around 54–56 seconds per prompt. The paper also reports that adversarial prompts found on an open model transfer to black-box online services such as Midjourney and Leonardo.AI, suggesting current safety filters can be bypassed by innocuous-looking prompts that preserve the intended image content.","feed_headline":"Antelope jailbreak beats four attacks on most image-model defenses","feed_subtitle":"Attack hides the concept in embedding arithmetic, slipping NSFW prompts past Stable Diffusion and online filters.","key_machinery":"The central mechanism is text-embedding arithmetic in CLIP's semantic space: subtract the embedding En of a 'negative' token (semantically divergent from the target but visually similar) from the cleaned prompt embedding Ec, then add the embedding Ep of a 'positive' token, producing the adjusted embedding Et = Ec − En + Ep. The search then minimizes L = γ(1 − cos(Ec||s, Et)) + (1 − γ)(1 − cos(Ec||s, Ei)) over a candidate suffix s of N tokens, where Ei is the embedding of a reference image generated from the original prompt. This operation reintroduces the sensitive concept in embedding space while keeping the visible prompt innocuous, and it is what lets the attack align with both the original text meaning and the target imagery.","core_discovery":"The paper's central claim is that an adversarial prompt can be assembled by first cleaning the original prompt into a harmless form, then appending a short suffix of four or five tokens so that the combined text embedding is simultaneously close to an adjusted target embedding and to a reference image embedding. The adjusted embedding comes from the identity Et = Ec − En + Ep, where Ep and En are embeddings of positive and negative tokens that are semantically divergent but visually similar. The search minimizes a weighted loss of cosine distances in text and image space, and when the loss drops below a threshold the prompt is tested against the NSFW filter. On the I2P-derived NSFW-333 and NSFW-59 prompt sets, Antelope reports ASR up to 81.98% for nudity on SDv1.4 and 74.58% for violence under SafeGen, outperforming SneakyPrompt, QF-Attack, MMP-Attack, and MMA-Diffusion in most defense configurations while maintaining lower or comparable FID.","pith_inferences":["If the concept-confusion hypothesis generalizes beyond the tested pairs, any multimodal text encoder whose embedding space has linear semantic structure could be vulnerable to the same subtract-and-add recipe, not just Stable Diffusion.","Because the paper validates semantic-distance-to-image-similarity only with a TSNE plot of 50 prompts per concept, a quantitative study across many concept pairs would show whether Antelope's success depends on the particular ChatGPT-chosen tokens or on the embedding arithmetic itself.","The same combined similarity loss Antelope minimizes could be repurposed as a detection signal: a defender could flag prompts whose embeddings sit unusually close to both a sensitive reference image and a positive token—something the paper does not explore.","The observed platform asymmetry (Midjourney stricter on nudity, Leonardo.AI stricter on violence) suggests an attacker could specialize suffix tokens per target service to improve transfer, a step the paper reports but does not develop."],"forward_implications":["Text filters that screen for explicit words can be bypassed by a cleaned prompt plus a 4–5 token suffix, because the sensitive concept is carried by the embedding adjustment rather than by the visible tokens.","A single open model such as SDv1.4 can be used to find prompts that transfer to closed services like Midjourney and Leonardo.AI, so an attacker does not need access to the target model's weights.","The reported search time of roughly 54–56 seconds per prompt makes the attack practical to run at scale, unlike gradient-based baselines that take minutes to hours.","Existing defenses reduce but do not eliminate the attack: ESD is the strongest against nudity and SLD-max against violence, yet Antelope still achieves nonzero ASR under every tested defense.","The optimal settings (γ = 0.2, N = 4 or 5, τ = 0.7) give a concrete recipe that other researchers can reproduce or defend against."],"supporting_citations":[{"why":"It supplies the PSTSI principle that a safe substitution phrase can be perceptually similar to the target unsafe word yet semantically divergent, which motivates the token-pair selection.","marker":"[12]"},{"why":"It grounds the claim that semantic attributes encoded in soft embeddings can be added or subtracted in pretrained text space, supporting Eq. (1).","marker":"[17]"},{"why":"It provides the ChatGPT-generated positive/negative token pairs that the attack uses to steer the embedding toward the target attribute.","marker":"[23]"},{"why":"It is the Stable Diffusion architecture and CLIP text/image encoder on which Antelope computes embeddings and runs the main offline evaluations.","marker":"[31]"},{"why":"It is one of the four baseline jailbreak attacks, an RL-based word-substitution method that the paper compares against.","marker":"[41]"},{"why":"It is the query-free character-level baseline that is fast but, according to the paper, poorly aligned with the target image.","marker":"[45]"},{"why":"It is the suffix-optimization baseline that also aligns prompts with reference images and is among the strongest competitors.","marker":"[38]"},{"why":"It is the gradient-based multimodal baseline that the paper contrasts with Antelope's faster search.","marker":"[39]"},{"why":"It supplies the NudeNet detector used to judge whether generated images count as nudity for ASR computation.","marker":"[22]"},{"why":"It supplies the Q16 classifier used to detect violent or harmful content, defining the violence-target ASR.","marker":"[33]"}],"fun_headline_variants":["Covert Antelope attack slips NSFW prompts past Stable Diffusion","Antelope jailbreak hides concept in embedding arithmetic","New Antelope attack beats four other jailbreaks on defenses","Antelope: covert and potent jailbreak that evades filters","Antelope attack embeds harmful prompts to slip past safety filters"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack rests on the assumption that prompts far apart in the model's semantic space can nonetheless generate similar images, so subtracting one embedding and adding another reliably brings back the target concept; the paper's evidence for this is a TSNE plot of 50 prompts per concept rather than a measured distribution.","fun_headline_variants_meta":{"raw":{"variants":["Covert Antelope attack slips NSFW prompts past Stable Diffusion","Antelope jailbreak hides concept in embedding arithmetic","New Antelope attack beats four other jailbreaks on defenses","Antelope: covert and potent jailbreak that evades filters","Antelope attack embeds harmful prompts to slip past safety filters"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000483,"raw_usage":{"total_tokens":2378,"prompt_tokens":932,"completion_tokens":1446,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":548,"completion_tokens_details":{"reasoning_tokens":1364}},"tokens_in":548,"tokens_out":1446,"duration_ms":8766,"temperature":1.0,"reasoning_tokens":1364,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T18:08:12.650170+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Measure, for a fixed set of concept pairs, the distribution of image embeddings from 500+ prompts per pair: if concepts that are far apart in CLIP text space produce images no more similar than random pairs, the Eq. (4) objective is not measuring what the attack needs. A second check is to run the same pipeline with random instead of ChatGPT-chosen token pairs and compare ASR.","supporting_citations":[{"cited_title":"Perception-guided jailbreak against text-to-image models, 2024","cited_arxiv_id":null,"evidence_quote":"It supplies the PSTSI principle that a safe substitution phrase can be perceptually similar to the target unsafe word yet semantically divergent, which motivates the token-pair selection."},{"cited_title":"Jailbreaking prompt attack: A controllable adversarial attack against diffusion models, 2024","cited_arxiv_id":null,"evidence_quote":"It grounds the claim that semantic attributes encoded in soft embeddings can be added or subtracted in pretrained text space, supporting Eq. (1)."},{"cited_title":"Chatgpt, 2023","cited_arxiv_id":null,"evidence_quote":"It provides the ChatGPT-generated positive/negative token pairs that the attack uses to steer the embedding toward the target attribute."},{"cited_title":"High-resolution image syn- thesis with latent diffusion models","cited_arxiv_id":null,"evidence_quote":"It is the Stable Diffusion architecture and CLIP text/image encoder on which Antelope computes embeddings and runs the main offline evaluations."},{"cited_title":"Sneakyprompt: Jailbreaking text-to-image generative models","cited_arxiv_id":null,"evidence_quote":"It is one of the four baseline jailbreak attacks, an RL-based word-substitution method that the paper compares against."},{"cited_title":"A pilot study of query-free adversarial attack against stable diffusion","cited_arxiv_id":null,"evidence_quote":"It is the query-free character-level baseline that is fast but, according to the paper, poorly aligned with the target image."},{"cited_title":"On the multi-modal vulnera- bility of diffusion models","cited_arxiv_id":null,"evidence_quote":"It is the suffix-optimization baseline that also aligns prompts with reference images and is among the strongest competitors."},{"cited_title":"Mma-diffusion: Multimodal at- tack on diffusion models","cited_arxiv_id":null,"evidence_quote":"It is the gradient-based multimodal baseline that the paper contrasts with Antelope's faster search."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"It supplies the NudeNet detector used to judge whether generated images count as nudity for ASR computation."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"It supplies the Q16 classifier used to detect violent or harmful content, defining the violence-target ASR."}],"review_version":1}