{"id":"a5eb1493-1516-467c-8e8a-ac462868e9ac","arxiv_id":"2509.09488","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"Diffusion image tools inherit a 32-bit seed weakness from PyTorch, letting an attacker recover the seed in about 140 minutes and then use it, via a genetic algorithm, to steal the prompt behind a public image.","lead":"AI image generators start from random noise chosen by a small seed value, and this paper shows most tools use seeds small enough to brute-force in a few hours. With the seed recovered, their genetic-algorithm tool steals the secret prompt that produced an image, beating three prior methods on visual similarity.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"SOTA comparison in §4.4 is cross-model: each method is evaluated on images from its own SD variant, so the claimed 8–11% LPIPS improvement may reflect model differences, not method quality.","rationale":"The reader's weakest_assumption emphasizes the exact-pipeline premise and vocabulary overlap, but the more fundamental threat to the central 'seed knowledge improves prompt stealing' claim is the §4.4 comparison design. If the cross-model confound is real, the paper's headline improvement over SOTA is unsubstantiated; the seed-recovery results can still stand, but the 'stealing prompts' benefit is not demonstrated. This is consistent with the reader's issue (2), so my agreement is partial. The fix is straightforward: a same-model controlled comparison, which is exactly the kind of targeted experiment the reader requested. The reader's conditional verdict remains appropriate, so no change to the verdict is needed.","tokens_in":23849,"tokens_out":9368,"duration_ms":107639,"concrete_test":"Run all four methods (PromptStealer, P2HP, CLIP-Interrogator, PromptPirate) on the same 100 test-split prompts rendered with a single Stable Diffusion model (e.g., SD3.5 Medium) using the same shared evaluation seeds, and recompute Table 6. If PromptPirate's LPIPS margin over the best baseline falls below the reported 8–11% or reverses, the cross-model protocol is the cause. Also report paired significance tests (e.g., Wilcoxon) on the per-prompt LPIPS differences.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 4.4 states \"for fairness, each target image was generated using the specific Stable Diffusion model for which the respective approach was developed.\" PromptPirate therefore optimizes on SD3.5 Turbo targets, while PromptStealer/P2HP/CLIP-Interrogator run on their originally intended (likely SD1.x) targets. Table 6 then compares LPIPS/CLIP/Semantic scores across different target image distributions. Any model whose outputs are easier to reconstruct (e.g., newer SD3.5 with Turbo steps) will inflate PromptPirate's scores independent of the genetic algorithm. The paper also reports no significance tests for Table 6, so the 0.52 vs 0.47 LPIPS gap is within one standard deviation (0.14) and not shown to be stable. This confound directly affects the abstract's \"8–11% improvement\" claim.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper argues that prompt stealing from diffusion models is unreliable without knowing the initial noise seed, that the seed is practically recoverable because of a CWE-339 small-seed-space vulnerability (32-bit PyTorch CPU MT19937 or limited ranges like 0–100,000), and that a genetic-algorithm prompt modifier optimizer (PromptPirate), once given the recovered seed (SeedSnitch), outperforms prior prompt-stealing methods. The supporting experiments include: (i) seed-vs-modifier sensitivity comparisons using Latent-MSE, LPIPS, and CLIP with Wilcoxon tests; (ii) a noise-approximation experiment showing optimization cannot get close enough to the true initial noise; (iii) seed brute-force at 100% accuracy on 1,000 self-generated SD3.5 images and 100% on 50 CivitAI images over the full 2^32 space; (iv) a CivitAI case study with 95% seed identification across 895 images; and (v) a comparison of PromptPirate against PromptStealer, CLIP-Interrogator, and P2HP on 100 test-split prompts. The paper also proposes ChaCha20-based countermeasures and a discussion of responsible disclosure.","tokens_in":23883,"tokens_out":4871,"duration_ms":42844,"significance":"If the central claims hold, the paper makes a valuable practical contribution: it demonstrates that seed secrecy does not protect prompt confidentiality for CPU-generated images in current Stable Diffusion deployments, and it provides a reproducible open-source toolchain. Concrete strengths: the seed-recovery core is machine-checkable and evaluated on both self-generated and real images with 100% accuracy over the full 2^32 space; the loss-gap analysis in Figure 4 provides a plausible validation criterion; the paper is unusually transparent in acknowledging the failure cluster (5% post-edited/alternative-RNG images in Section 5.1) and the precondition that the exact pipeline is replicated; the countermeasure discussion is concrete and quantified. The main limitations: the distributional overlap between PromptPirate's modifier vocabulary and the evaluation dataset, and the cross-model SOTA comparison, weaken the 8–11% claim; the attack's real-world applicability is narrower than the abstract suggests because it requires exact knowledge of model, scheduler, CFG, and steps.","major_comments":[{"comment":"The headline '8–11% improvement in LPIPS similarity' is not supported as a method-level claim. For 'fairness,' each target image was generated with the SD model for which the baseline was developed (§4.4). PromptPirate therefore optimizes on SD3.5 Turbo images while PromptStealer/P2HP/CLIP-Interrogator are evaluated on their own (likely SD1.x) image distributions. The LPIPS gain (0.52 vs 0.47 for Known Subject) is within the reported ±0.14 standard deviation, and no significance test is reported for Table 6. Since the dataset and model vary jointly with the method, the 8–11% improvement may reflect target-model ease, not the seed-aware GA. A within-model comparison (all methods on the same target images) or matched-model baselines is needed before the abstract's improvement claim can stand.","section":"Abstract and §4.4, Table 6"},{"comment":"The PromptPirate advantage may be partially built into the evaluation by construction. PromptPirate's modifier vocabulary is filtered from the train split of the Shen et al. dataset (minimum 1% frequency, §3.4), while the evaluation uses the test split of the same dataset. If the test prompts share modifier vocabulary with the train split, the search space is strongly biased toward the ground-truth modifiers, giving PromptPirate an advantage that the other methods (especially CLIP-Interrogator/P2HP, which do not use that vocabulary) do not receive. The manuscript mentions this only as 'to avoid any unfair advantage from leaked parameters' regarding the seed, but does not address the vocabulary overlap. A control using a disjoint modifier vocabulary or an external prompt dataset would clarify how much of the 8–11% gain is method versus benchmark overlap.","section":"§4.4 and §3.4"},{"comment":"The abstract's 'approximately 95% of these images' claim conflates two different experiments. §5.1 reports 95% seed identification when the candidate pool contains the correct seed plus 100,000 distractors—a much easier task than the full 2^32 brute-force in §5.3, which is demonstrated on only 50 images preselected as CPU-generated. The paper's own Section 5.1 attributes the 5% failure cluster to post-generation editing or alternative RNGs, so the 95% figure does not translate directly into '95% ... can be effectively brute-forced in 140 minutes per seed.' I recommend stating precisely which success rate applies to which search space and preselection condition, and reporting the fraction of the 895-image dataset that falls in the CPU-generated cluster (Figure 6 suggests a substantial but not universal fraction).","section":"§5.1, §5.3"},{"comment":"The 100% seed-recovery accuracy on self-generated images uses a candidate range of only 0–100,000 (the SD3.5 reference implementation). This is an important result for that implementation, but it is a 17-bit search, not a 32-bit search. The later §5.3 experiment covers the full 2^32 space on 50 real images and is the load-bearing evidence for the 32-bit claim. I would ask the authors to make this distinction explicit in the abstract and §4.3, and to note that the §4.3 timing (85.2 seconds) does not generalize to the 140-minute full-space attack.","section":"§4.3"},{"comment":"The claimed vulnerability framing (CWE-339) is essentially correct for the small-range case, but the 32-bit CPU MT19937 case deserves more careful wording. PyTorch's MT19937 does use a 32-bit seed state; however, if a user or application draws the seed from a 64-bit sampler, the lower-32-bit truncation still yields only 2^32 distinct noise tensors. The paper documents this precisely with the code quote. The concern is not correctness but overgeneralization: the statement 'approximately 95% of these images' seed values can be effectively brute-forced' depends on the image having been generated with the exact same PRNG and pipeline. The paper's own Section 5.1 admits this. I would ask for a clear statement in the abstract that the 95% applies to images generated with the vulnerable CPU path and known full pipeline, not to all images on CivitAI.","section":"§3.3"}],"minor_comments":[{"comment":"Table 1's qualitative illustration is helpful, but the 'No-seed attack (P2HP)' column should state the seed used for the no-seed baseline and the exact prompt, since one example could be cherry-picked. The paper later conducts a systematic comparison; consider deferring the visual claim to Figure 5/Table 7.","section":"§1, Table 1"},{"comment":"The CLIP boxplot shows substantial overlap between SSDM and DSSM despite the significant p-value; the text acknowledges this. Consider reporting effect sizes (e.g., rank-biserial correlation) in addition to p-values, since the practical claim 'seed dominates modifier' is stronger for Latent-MSE/LPIPS than for CLIP.","section":"§4.1, Figure 2"},{"comment":"The 'optimization' row reports distance 1.00±0.02 but the optimization details (Adam schedule, random-noise regularization weight) are not specified. Please move the details from the appendix into the main text or provide a reproducibility note, since this experiment underpins the claim that optimization cannot approximate the seed.","section":"§4.2, Table 5"},{"comment":"The two-stage filter uses the first 2^13, then 2^15, entries of the noise vector. Please clarify whether these are the first entries of the flattened latent or of the per-channel tensor, and whether the same positions are used across images. This matters for reproduction.","section":"§5.3"},{"comment":"The claim that ChaCha20 with a 256-bit seed is 'quantum resistant' is imprecise. Quantum resistance of a PRNG seed search is about the generic square-root speedup (128-bit security for 256-bit seeds), which is adequate here, but the wording should be softened to 'provides at least 128-bit post-quantum security against brute-force.'","section":"§6"},{"comment":"There are several typos and formatting artifacts: 'CivitAI' is used interchangeably with 'CivitAI' (should be CivitAI); 'Shenet al.' should be 'Shen et al.'; Table 4 headers are misaligned; Figure 5 caption says 'best two approaches' but the figure is described as PromptPirate vs Prompt Stealer; and the appendix Table 8 has repeated phrases (e.g., 'global illumination, peter mohrbacher, centered' and 'detailed face' twice). A careful copyedit is needed.","section":"Throughout"},{"comment":"The genetic algorithm's hyperparameters (population 150, 25 generations, mutation rates) are presented without an ablation or sensitivity analysis. Given that the GA is a core contribution, at least a small sensitivity study (e.g., population size or mutation probability ±50%) would increase confidence that the reported gain is not tuned to the benchmark.","section":"§3.4"},{"comment":"Reference [24] is to the authors' own concurrent arXiv preprint (AutoStub). This is acceptable but should be marked as 'to appear' or 'preprint' if that is the status, to avoid appearing as a self-citation without context.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The paper's seed-recovery core is strong and likely publishable. The main risk is that the headline '8–11% improvement' is not methodologically clean: the cross-model comparison and the train/test vocabulary overlap both inflate PromptPirate's apparent advantage. The authors should be asked to run a within-model comparison (or clearly justify the cross-model protocol) and to test PromptPirate with a vocabulary disjoint from the evaluation set. The 95%/140-minute claim also needs to be scoped precisely to the full 2^32 CPU-search experiment. I would not reject over these points because they are fixable within the paper's scope, but they are load-bearing for the abstract. One additional concern for the editor: the manuscript's novelty is moderate—the seed influence result extends Xu et al. and the GA is a straightforward engineering contribution—but the real-world CWE-339 correlation and the 2^32 brute-force demonstration give it enough practical significance for a security venue."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"SeedSnitch's 32-bit brute-force seed recovery is a real, well-evidenced result. The MSE fingerprint between latent and candidate noise identifies the exact seed across the full 32-bit space, with 100% accuracy on 1,000 self-generated and 50 real CivitAI images. That is a genuine advance beyond Xu et al.'s 1024-candidate classifier, and the paper is refreshingly honest about scope: it names which tools are actually vulnerable, discloses the 5% real-world failure cluster, and discusses countermeasures.\n\nThe soft spots center on the prompt-stealing comparison. The stress-test note is correct: Section 4.4 evaluates each method on images generated by that method's own model (PromptPirate on SD3.5 Turbo, others on SD1.x). That means Table 6's LPIPS gap may reflect target-image difficulty, not method quality, and the abstract's 8-11% improvement claim is not yet supported. No significance tests are reported for Table 6, and the paper's own ablation shows only a 5% drop from a wrong seed, which makes the seed-dominance story more nuanced than the abstract suggests. The 'fundamentally limited' claim about optimization-based recovery is also overstated, given their own noise-approximation data (current optimizers get MSE ~1.0, far from the 0.1 threshold) and CLIP Interrogator's competitive CLIP score.\n\nThe distributional concern about PromptPirate's modifier vocabulary coming from the train split while baselines see the test split is real but minor: it could inflate PromptPirate's semantic scores, but the visual metrics are less likely to benefit from vocabulary overlap. The brute-force prototype's 140 minutes per seed is on a two-CPU Python implementation, so it is a lower bound on attacker effort, not a fundamental limit.\n\nWho this is for: security researchers working on prompt privacy, and anyone building diffusion tooling that sets seeds. The seed-recovery result deserves serious referee time and likely publication after the SOTA comparison is made apples-to-apples. I would not desk-reject this; I would ask for a controlled comparison on a shared model and significance tests before accepting.","headline":"SeedSnitch's 32-bit brute-force seed recovery is a real, well-evidenced result; the PromptPirate SOTA comparison has a cross-model confound that needs fixing before the 8-11% claim can be trusted.","tokens_in":673,"tokens_out":2419,"would_cite":true,"duration_ms":31713,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Prompt theft from AI images fails without the seed; this paper shows seeds are stealable and makes prompt recovery practical.","keywords":["prompt stealing","seed recovery","diffusion models","CWE-339","brute-force attack","genetic algorithm","Stable Diffusion","latent space comparison"],"falsifier":"A direct test would be to take a publicly shared image from a platform like CivitAI, apply even a minor post-processing edit (e.g., a slight color shift or a single inpainting stroke), and attempt SeedSnitch's 32-bit brute-force. If the correct seed is no longer recovered with high confidence, it would demonstrate that real-world image editing breaks the attack. Alternatively, generating an image with a GPU-based RNG (which uses a larger seed space) and checking that brute-force fails would confirm the vulnerability is specific to the CPU MT19937 path.","tokens_in":23544,"feed_emoji":"🔓","tokens_out":1495,"duration_ms":17897,"temperature":0.7,"pith_summary":"The paper argues that effective prompt stealing from diffusion-model images is impossible without recovering the random seed used to generate the initial noise, and that seeds are in practice easy to recover because of a widespread weakness: PyTorch's CPU random number generator uses only 32 bits of the seed, and some tools restrict the seed range even further. The authors build two tools: SeedSnitch, which brute-forces the seed by matching the encoded image latent to candidate noise latents, and PromptPirate, a genetic algorithm that then recovers the prompt modifiers while holding the seed fixed. On real images from CivitAI, SeedSnitch recovers 95% of seeds in about 140 minutes each, and PromptPirate outperforms prior prompt-stealing methods on visual similarity. If true, it means that the confidentiality of prompts used for public images is not protected by keeping the seed secret, and that a simple fix—using a cryptographically secure random generator with a large seed space—would neutralize this attack class.","feed_headline":"Stolen seed makes prompt theft 8–11% more accurate","feed_subtitle":"Brute-forcing the 32-bit noise seed of public AI images cracks open prompt recovery, exposing a widespread flaw.","key_machinery":"The central object is the latent-space MSE match between the final image's encoded latent and the candidate seed's initial noise latent. The paper's core mechanism is that the diffusion model's encoder maps an image to a latent that is still close enough to the initial noise (the seed's PRNG output) that the true seed gives a dramatically lower MSE than any other seed among 2^32 candidates. This is a deterministic, training-free brute-force search. SeedSnitch is the tool that performs this search with a two-stage filtering scheme over the 32-bit seed space. PromptPirate then uses a genetic algorithm (tournament selection, variable-length crossover, mutation, elitism) to evolve a set of style","core_discovery":"The central claim is that the random seed used to generate the initial latent noise of a diffusion model is a security-critical parameter that can be practically recovered from the final image, and that seed recovery transforms prompt stealing from an ill-posed optimization problem into a tractable one. The paper shows empirically that loss functions (latent MSE, LPIPS, CLIP) are more sensitive to seed changes than to modifier changes, so without the exact seed, optimizing a prompt against an image is unreliable. It then exploits a CWE-339 vulnerability, the small 32-bit seed space of PyTorch's MT19937 CPU RNG, to brute-force seeds: for a target image, compute its latent encoding, generate n","pith_inferences":["The attack could extend beyond prompt stealing: if seeds are recoverable, an adversary could also verify whether a given image was generated from a particular prompt and seed, aiding in provenance tracing or digital forensics.","The paper's finding that loss functions are more sensitive to seed than to modifiers suggests that other optimization-based attacks on diffusion models, such as adversarial perturbation or concept erasure, may also need seed-aware formulations to be reliable.","The 95% seed recovery rate on chosen CivitAI images likely overestimates the vulnerability for the whole platform, since the authors preselected images known to be CPU-generated; a broader sample would probably include more post-processed or GPU-generated images, lowering the success rate. This is an editorial caveat, not a paper claim.","The genetic-algorithm approach could be adapted to recover other discrete generation parameters (e.g., sampler, CFG scale) or to refine prompts beyond modifiers, potentially making prompt theft even more effective, though this is speculative."],"forward_implications":["The confidentiality of prompts used to generate publicly shared images is undermined if the seed can be recovered, because an attacker can then optimize a prompt against the exact generation path.","The countermeasure proposed—replacing the 32-bit seeded MT19937 with a cryptographically secure PRNG such as ChaCha20 with a 256-bit seed space—would make brute-force seed recovery infeasible, while preserving reproducibility for legitimate users.","The 95% success rate on real CivitAI images implies that a large fraction of publicly shared AI art is vulnerable to this attack, especially images generated with popular tools like AUTOMATIC1111, ComfyUI, Diffusers, and the Stable Diffusion 3.5 reference implementation.","Seed knowledge also improves the reliability of visual similarity metrics: with the correct seed, fitness evaluation during prompt optimization becomes meaningful, which is why PromptPirate's LPIPS scores exceed those of seed-agnostic methods.","The existence of this vulnerability should motivate platform designers to hide or encrypt generation metadata and to adopt secure RNG practices even when prompts are shared openly."],"fun_headline_variants":["Seed Snitch: 95% of AI images have crackable seeds","Prompt thieves get 8-11% better with stolen seeds","CWE-339 flaw lets attackers brute-force AI image seeds","Brute-force seed recovery boosts prompt theft accuracy by 8-11%","Steal the seed, steal the prompt: better accuracy in prompt theft"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The attack assumes the target image is the direct, unedited output of the exact same diffusion pipeline (same model, encoder, scheduler, step count, CFG scale, and noise generation strategy) used by the attacker; if a user post-processes the image or uses a different RNG, seed brute-force may fail, and the paper's own 5% failure cluster on CivitAI is attributed to such deviations.","fun_headline_variants_meta":{"raw":{"variants":["Seed Snitch: 95% of AI images have crackable seeds","Prompt thieves get 8-11% better with stolen seeds","CWE-339 flaw lets attackers brute-force AI image seeds","Brute-force seed recovery boosts prompt theft accuracy by 8-11%","Steal the seed, steal the prompt: better accuracy in prompt theft"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001114,"raw_usage":{"total_tokens":4510,"prompt_tokens":809,"completion_tokens":3701,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":553,"completion_tokens_details":{"reasoning_tokens":3608}},"tokens_in":553,"tokens_out":3701,"duration_ms":26547,"temperature":1.0,"reasoning_tokens":3608,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-04T19:02:37.352265+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A direct test would be to take a publicly shared image from a platform like CivitAI, apply even a minor post-processing edit (e.g., a slight color shift or a single inpainting stroke), and attempt SeedSnitch's 32-bit brute-force. If the correct seed is no longer recovered with high confidence, it would demonstrate that real-world image editing breaks the attack. Alternatively, generating an image with a GPU-based RNG (which uses a larger seed space) and checking that brute-force fails would confirm the vulnerability is specific to the CPU MT19937 path.","supporting_citations":[],"review_version":1}