{"id":"16459965-e219-451e-bbed-96e29ee8428d","arxiv_id":"2508.03696","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"PLA trains adversarial prompts with a zero-order gradient method and multimodal CLIP losses to bypass safety filters and post-hoc checkers in black-box text-to-image models, outperforming earlier word-substitution attacks.","lead":"An adversarial attack method, PLA, learns prompts that bypass the safety filters and NSFW checkers of black-box text-to-image models by training on CLIP similarity losses and estimated gradients. The paper reports high success rates against Stable Diffusion, SDXL, SLD, and online services, which matters for the robustness of AI safety mechanisms.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"PLA's reported advantage over baselines hinges on an unstated auxiliary-model assumption; removing the image-image loss Lb erases most of the margin, so the central claim is not robust without this resource.","rationale":"The reader's weakest assumption correctly identifies the auxiliary unguarded T2I model as critical, and Table 4 provides direct evidence: the image-image loss Lb is the largest single contributor, and removing it can drop PLA below the strongest baseline on at least one reported condition. I considered other candidate concerns, including the high-dimensional ZOO/SPSA query cost and the ASR-4 metric's inflation, but those are secondary: the paper does report online-service attacks, and ASR-1 is also reported. The auxiliary-model dependency is more fundamental because it is an unstated precondition of the method's main loss term, and the threat model does not mention it. I would not change the reader's CONDITIONAL verdict: the method is plausible and well-ablated, but the reported margin over SOTA is not established without either a stated assumption about Ms or additional experiments that remove or vary Ms. The paper deserves credit for running ablations and reporting both ASR-1 and ASR-4, but the missing query budgets and the limited online subset reinforce the need for the proposed check before accepting the headline numbers at face value.","tokens_in":14239,"tokens_out":10871,"duration_ms":130697,"concrete_test":"Run the full Table 1/Table 2 protocol with Lb removed (La-only PLA) across all three victim models, three safety checkers, and both datasets, then compare directly against MMA-Diffusion. If La-only PLA does not consistently beat MMA-Diffusion, the claimed advantage depends on the auxiliary model. Additionally, rerun PLA with a distributionally mismatched auxiliary model (e.g., an anime-domain or non-diffusion T2I model) and report ASR-4/ASR-1; if the image-image term no longer helps, the paper must qualify the central claim as conditional on an available, distributionally similar unguarded auxiliary model.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that PLA achieves high ASR against black-box T2I safety mechanisms, exceeding SOTA baselines by 10–17 points. The method's image-image loss Lb (Eq. 6) requires a target image Itar generated by an auxiliary unguarded T2I model Ms (Section 4.2), yet the threat model in Section 3.2 describes an attacker with access only to the black-box model's generated images and never states that Ms is available. Table 4 shows this is not a minor ingredient: removing Lb drops ASR-4 from 93.34 to 79.34 on SLD violence and from 93.41 to 74.66 on SLD nudity, while removing La drops to 81.02 and 82.99 respectively. On the SLD nudity row, the La-only variant (74.66) falls below MMA-Diffusion's 76.48 ASR-4 (Table 1), so the claimed superiority over the strongest baseline is contingent on Lb and therefore on Ms. If a realistic attacker lacks a distributionally matched unguarded model, or if Ms's output distribution differs from the victim's (e.g., local SDv1.4 vs. proprietary DALL·E 3), the target-image supervision weakens and the reported gains may not transfer. The online-service results in Table 3 (45–55% ASR-4) are lower than local-model results and still rely on the same auxiliary model, so the assumption is load-bearing for the paper's headline claim, not just for generalization.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes PLA, a prompt-learning attack against black-box text-to-image (T2I) models equipped with prompt filters and post-hoc safety checkers. The method learns an adversarial prompt by optimizing a prompt encoder with a zeroth-order gradient estimate of a multimodal loss that combines text-image similarity (target prompt vs. generated image) and image-image similarity (target image vs. generated image). The target image is produced by an auxiliary unguarded T2I model. Extensive experiments across SDv1.5, SDXLv1.0, and SLD with three safety checkers, as well as on Stability.ai and DALL·E 3, report attack success rates substantially above baselines such as MMA-Diffusion, with ablation studies attributing much of the gain to the image-image loss and the proposed gradient optimization strategy.","tokens_in":14556,"tokens_out":6147,"duration_ms":68246,"significance":"If the reported results are reliable, PLA would be a strong black-box attack against deployed T2I safety mechanisms, demonstrating that gradient-driven prompt optimization can outperform word-substitution baselines. The paper includes credible negative-space details such as ablations that remove each loss term and each gradient component, and it evaluates against multiple victim models, checkers, and online services. However, the central claim is heavily dependent on an auxiliary unguarded T2I model whose availability is not part of the stated threat model, and several methodological gaps (metric inflation, missing query budgets, small evaluation subsets, and lack of error bars) currently weaken the evidence.","major_comments":[{"comment":"The threat model in §3.2 states that the attacker has access only to the generated images of the black-box model M, but the method in §4.2 uses an auxiliary model M_s to produce a target image Itar for the image-image loss Lb. The ablation in Table 4 shows that removing Lb reduces ASR-4 from 93.34 to 79.34 on SLD violence and from 93.41 to 74.66 on SLD nudity, and the latter value falls below the MMA-Diffusion baseline of 76.48 in Table 1. The claimed superiority over the strongest baseline is therefore contingent on access to an unguarded auxiliary model that is not described in the threat model. Please either add M_s explicitly to the attacker capabilities, justify its availability, or provide an evaluation that does not rely on it.","section":"§3.2, §4.2, Table 4"},{"comment":"The ASR-N metric counts a prompt as successful if any of N generated images is NSFW, which inflates success rates: for example, PLA-BERT on SDXLv1.0 nudity reaches ASR-4 of 95.37 but ASR-1 of only 76.20 under the SC checker. The abstract and conclusions state a 'high success rate' without clearly disclosing this any-of-N property. Moreover, no error bars, confidence intervals, or seed variations are reported, and the violence dataset contains only 30 prompts. Please report ASR-1 alongside ASR-4 in the main text and provide variance estimates or a clear statement of statistical significance for the claimed margins over baselines.","section":"§5.1, Tables 1 and 2"},{"comment":"The online-service evaluation uses a subset of only 20 prompts per category and does not report the number of queries required by the ZOO-based optimization for each prompt, which is critical because online services impose rate limits and query caps. Without this information, it is unclear whether the reported 36–70% ASR-4 values reflect a practical attack under realistic query budgets. Please also describe the human-evaluation protocol (e.g., inter-rater agreement, instructions to evaluators) so that the results are reproducible.","section":"§5.3, Table 3"},{"comment":"The proposed gradient update in Eq. (9) and the 'restart' strategy of replacing black images with Gaussian noise are heuristic, and Table 5 shows that the standard ZOO version (GZOO) performs far worse (52.89 ASR-4 on violence vs. 91.69 for the proposed GP LA). This indicates that the success of PLA hinges on these heuristics, yet the paper offers no analysis of why the history-gradient update and the Gaussian-noise substitution yield valid gradient estimates, nor a sensitivity study of the hyperparameters β, η, and c. Please add such an analysis or at least a systematic ablation of these parameters.","section":"§4.4, Table 5"}],"minor_comments":[{"comment":"The zeroth-order gradient formula is written ambiguously: the denominator '2c · Δ' appears to be a vector, but in standard ZOO the denominator is the scalar 2c and the result is multiplied by Δ. Please clarify the notation.","section":"Eq. (8)"},{"comment":"The term 'GP LA' in Table 5 is not defined in the text; it presumably means the proposed gradient method plus PLA, but it should be spelled out when first used.","section":"§5.4"},{"comment":"The paper states that complete PixArt auxiliary-model studies are in the appendix, but the main text does not summarize those results. Please add a sentence reporting whether PixArt as M_s gives similar success rates to SDv1.4, since the choice of auxiliary model is load-bearing.","section":"§5.1"},{"comment":"The phrase 'the high-dimensional features of text embedding are leveraged' in the introduction is vague; the actual mechanism in §4.1 is a two-layer MLP with residual addition. Please align the introduction with the method.","section":"§1"},{"comment":"The related work describes MMA-Diffusion as a white-box attack, but in the experiments it is used as a baseline for black-box attacks without explaining how it is adapted. Please clarify the baseline setup.","section":"§2.2"},{"comment":"The tables report 'AVG' columns, but the text says 'average ASR-4 of PLA-BERT is 91.45%, 90.57%, and 90.82%, which matches only the SDv1.5, SDXLv1.0, and SLD rows. Please ensure the column headers and text are consistent.","section":"§5.2, Tables 1 and 2"},{"comment":"Reference [15] cites Ho et al. for the Gaussian-noise idea, but the restart strategy is a much more specific algorithmic choice; a more direct citation to the specific diffusion-sampling property would help.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The paper's empirical evidence is quantitatively strong, but the central claim depends on an auxiliary-model assumption that is not part of the threat model, and the online-service evaluation lacks query-budget reporting. I recommend major revision: the threat model should be revised to include the auxiliary model, and the evaluation should add error bars, query counts, and a clearer discussion of the ASR-N metric. The novelty is adequate for a security workshop or conference, but the current presentation is not yet compelling enough for a top-tier journal without these revisions."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"PLA is a real step forward for black-box T2I attacks. Instead of substituting words, it trains a small prompt encoder with zero-order gradients, using CLIP text-image and image-image losses plus a history-gradient trick to avoid vanishing gradients. That is new relative to SneakyPrompt and MMA-Diffusion, and the gradient-vanishing fix (replacing black images with noise so early steps do not stall) is a genuine technical insight. The experiments are extensive: three victim models, three checkers, two services, with ablations that honestly include the w/o La and w/o Lb rows.\n\nThe weak point is the gap between the threat model and the method. Section 3.2 says the attacker only sees generated images from the black-box model, but the image-image loss Lb requires a target image produced by an auxiliary unguarded T2I model Ms, and Table 4 shows Lb carries much of the margin. Without Lb, PLA-T5 on SLD nudity drops to 74.66 ASR-4, below MMA-Diffusion's 76.48. So the claimed superiority over the strongest baseline is contingent on having a good auxiliary model. That is not fatal — open-source SDv1.4 is a plausible auxiliary — but it must be stated in the threat model, and the paper should test transfer when the auxiliary and victim distributions differ. The appendix reportedly does PixArt, which is a start, but the main text should show it.\n\nThe ASR-N metric also deserves a flag: counting success if any of N=4 images is NSFW inflates rates, and there are no error bars or multiple seeds. ASR-1 numbers are lower but still favor PLA, so the direction is credible, though the margin's size is uncertain. Online results rest on 20 prompts per category, which is thin, and no code is released, making exact numbers hard to reproduce.\n\nNet: the central idea is sound and worth engaging with. The fixes are mainly about being upfront about the auxiliary model and reporting variance. I would send this to peer review; it will need a major revision, not a desk reject.","headline":"A genuinely new black-box prompt-learning attack with honest ablations, but the headline margin depends on an auxiliary model the threat model does not mention.","tokens_in":15083,"tokens_out":2544,"would_cite":true,"duration_ms":27511,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that black-box text-to-image safety mechanisms can be bypassed reliably by learning adversarial prompts through gradient-based multimodal optimization.","keywords":["adversarial prompts","text-to-image generation","black-box attack","prompt learning","safety mechanisms","NSFW content","zeroth-order optimization","multimodal similarity"],"falsifier":"Run PLA against a victim model whose post-hoc safety checker and image similarity are computed in a space different from CLIP, and separately run it with the auxiliary target image removed from the image-image loss. If the success rate remains near the reported 90 percent under both changes, the central mechanism would not be what the paper says; if either change collapses the success rate, the dependence is confirmed.","tokens_in":14032,"feed_emoji":"🔓","tokens_out":7218,"duration_ms":75822,"temperature":0.7,"pith_summary":"This paper tries to establish that a black-box text-to-image (T2I) service, even when it combines a prompt filter with a post-hoc safety checker, can be made to generate NSFW content by prompts that an attacker learns through gradient-based training rather than word substitution. The proposed framework, PLA, optimizes a learnable embedding that is concatenated with the target prompt and fed into BERT or T5, which then outputs an adversarial prompt. Training is driven by multimodal similarities computed by CLIP, including an image-image term that requires an auxiliary T2I model without safety mechanisms to supply a target image. In the reported comparisons across SDv1.5, SDXLv1.0, and SLD with three safety checkers, average ASR-4 values reach about 86 to 95 percent, roughly 10 to 17 points above the strongest baseline; if the paper is right, attackers with query access and an unguarded auxiliary generator can reliably bypass current black-box defenses.","feed_headline":"Learned adversarial prompts beat T2I safety filters ~90% of the time","feed_subtitle":"Black-box image services can be steered to NSFW output by optimizing prompts with multimodal similarity, not word swaps.","key_machinery":"The load-bearing objects are the sensitive-knowledge-guided prompt encoder and the multimodal loss that trains it. The sensitive knowledge extraction module maps a target prompt's text embedding through a low-then-high projection and injects the resulting sensitive embedding into the middle of the prompt encoder, so the adversarial prompt inherits the target's meaning without its words. The loss combines a text-image cosine-similarity term (target prompt vs. generated image) with an image-image cosine-similarity term (auxiliary target image vs. generated image), both scored by CLIP. The optimizer is a zeroth-order estimator with a momentum-like history term and a restart rule that replaces safety-induced black images with Gaussian noise; this is the mechanism that lets gradients flow despite black-box access and blocked outputs.","core_discovery":"PLA treats the adversarial prompt as the output of a pretrained language model conditioned on a learnable embedding. The embedding is built by extracting sensitive knowledge from the target prompt's text representation, projecting it through a two-layer module, and adding it into a middle layer of the prompt encoder, so the generated prompt keeps the harmful semantics but uses different words. The prompt is evaluated by a multimodal loss that maximizes CLIP similarities between target prompt and generated image and between the auxiliary target image and generated image. Gradients are estimated with zeroth-order finite differences, but because safety mechanisms return black images and make those differences zero, the update keeps a momentum term from previous iterations and, if the first step is all black, restarts with Gaussian noise in place of the black images. The paper claims this makes gradient-driven training feasible in black-box settings and reports success rates that exceed all evaluated baselines.","pith_inferences":["Beyond the paper, this suggests a usable red-team benchmark: report ASR-4 under PLA alongside new T2I safety mechanisms, since it tests robustness to optimization rather than to lexical variants.","Beyond the paper, because the attack optimizes the same CLIP similarity space that many safety checkers use, a straightforward robustness test would be to re-run PLA against a checker that scores images in a different embedding space and see whether transfer fails.","Beyond the paper, the auxiliary-model dependence implies a potential defensive signal: services could look for prompts that consistently ask for images without safety filters or for statistical similarity to a known auxiliary model's output distribution, though the paper itself does not test this."],"forward_implications":["Black-box T2I services that use prompt filters and post-hoc safety checkers of the kind tested cannot rely on those mechanisms alone to stop NSFW generation by a determined attacker with query access.","Gradient-based prompt learning over continuous embeddings can outperform search-based word substitution, so defenses should expect adversarial prompts that are not simple synonyms of banned words.","The strong dependence on the image-image loss means the attacker needs an unguarded auxiliary generator; blocking or detecting such auxiliary outputs would raise the attack's cost.","Because BERT/T5-generated adversarial prompts can be fluent, prompt sanitizers will need to defend semantics rather than lexical content."],"supporting_citations":[{"why":"supplies the Stable Diffusion architecture that the victim models are based on.","marker":"[30]"},{"why":"is the strongest white-box multimodal baseline and the method PLA is compared against and extends.","marker":"[38]"},{"why":"is the black-box word-replacement baseline that motivates the move to gradient-driven training.","marker":"[40]"},{"why":"is a baseline attack on safety mechanisms whose success rates PLA is compared with.","marker":"[43]"},{"why":"provides the CLIP text and image encoders that define both similarity losses.","marker":"[27]"},{"why":"provides the zeroth-order optimization principle that PLA adapts for gradient estimation.","marker":"[35]"},{"why":"contributes the I2P prompt dataset and the SLD victim model used in evaluation.","marker":"[34]"},{"why":"is one of the victim models and the source of the built-in safety checker.","marker":"[8]"},{"why":"is one pretrained language model (BERT) whose prompt outputs constitute the PLA-BERT variant.","marker":"[16]"},{"why":"is the T5 language model whose outputs constitute the PLA-T5 variant.","marker":"[28]"}],"fun_headline_variants":["Optimized prompts breach T2I safety in black-box attacks","Prompt learning attack fools T2I safety checkers","Multimodal similarity drives successful T2I prompt attacks","Learnable prompt embeddings bypass T2I safeguards"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack depends on having an unguarded auxiliary text-to-image model that will generate the target image from the target prompt, since the image-image loss built on that image is the component whose removal hurts performance most; if no such model exists or its images do not resemble the victim's, the training signal weakens.","fun_headline_variants_meta":{"raw":{"variants":["Optimized prompts breach T2I safety in black-box attacks","Prompt learning attack fools T2I safety checkers","Multimodal similarity drives successful T2I prompt attacks","Learnable prompt embeddings bypass T2I safeguards"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000301,"raw_usage":{"total_tokens":1725,"prompt_tokens":927,"completion_tokens":798,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":543,"completion_tokens_details":{"reasoning_tokens":733}},"tokens_in":543,"tokens_out":798,"duration_ms":8865,"temperature":1.0,"reasoning_tokens":733,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T17:37:08.770596+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run PLA against a victim model whose post-hoc safety checker and image similarity are computed in a space different from CLIP, and separately run it with the auxiliary target image removed from the image-image loss. If the success rate remains near the reported 90 percent under both changes, the central mechanism would not be what the paper says; if either change collapses the success rate, the dependence is confirmed.","supporting_citations":[{"cited_title":"Mma-diffusion: Multimodal attack on diffusion models","cited_arxiv_id":null,"evidence_quote":"is the strongest white-box multimodal baseline and the method PLA is compared against and extends."},{"cited_title":"Sneakyprompt: Jailbreaking text-to-image generative models","cited_arxiv_id":null,"evidence_quote":"is the black-box word-replacement baseline that motivates the move to gradient-driven training."},{"cited_title":"Introduction to stochastic search and opti- mization: estimation, simulation, and control","cited_arxiv_id":null,"evidence_quote":"provides the zeroth-order optimization principle that PLA adapts for gradient estimation."},{"cited_title":"Safe latent diffusion: Mitigating inappro- priate degeneration in diffusion models","cited_arxiv_id":null,"evidence_quote":"contributes the I2P prompt dataset and the SLD victim model used in evaluation."},{"cited_title":"Available: https: //huggingface.co/stable- diffusion- v1- 5/ stable-diffusion-v1-5","cited_arxiv_id":null,"evidence_quote":"is one of the victim models and the source of the built-in safety checker."},{"cited_title":"Bert: Pre-training of deep bidirectional trans- formers for language understanding","cited_arxiv_id":null,"evidence_quote":"is one pretrained language model (BERT) whose prompt outputs constitute the PLA-BERT variant."},{"cited_title":"Exploring the limits of transfer learning with a unified text-to-text transformer","cited_arxiv_id":null,"evidence_quote":"is the T5 language model whose outputs constitute the PLA-T5 variant."}],"review_version":1}