Discovering Universal Semantic Triggers for Text-to-Image Synthesis

Hang Su; Jiajun Li; Qingni Shen; Shengfang Zhai; Weilong Wang; Yinpeng Dong

RECORD

Discovering Universal Semantic Triggers for Text-to-Image Synthesis

Shengfang Zhai, Weilong Wang, Jiajun Li, Yinpeng Dong, Hang Su, Qingni Shen

Cryptography and Security · Submitted 12 Feb 2024

abstract compiled · 2026-09-23 · no language-model review

The authors' main claim And our empirical analyses reveal that the mainstream open-source text-to-image models are vulnerable to our triggers, which could pose significant ethical threats.

how it is stated · hedged possibility 0.55 read the record →

Comment (0) Read on arXiv ↗

Cite ▾

arXiv ID2402.07562 (version 1)

Pith IDHDHIT7GZ, Pith's permanent record of this paper and its review

CitationHang Su, Jiajun Li, Qingni Shen, Shengfang Zhai, Weilong Wang, Yinpeng Dong. "Discovering Universal Semantic Triggers for Text-to-Image Synthesis." arXiv:2402.07562 (2024). https://pith.science/paper/HDHIT7GZ

Claim paper

The compiled record

The paper's own sentences, arranged. Each label is drawn from a closed vocabulary; the number beside it is the probability the classifier gave that label. Numbers in the tables are the authors', checked by code. No sentence in this record was written by a model.

Open the compiled record

Compiled by classifier-1.13.0 via TypeSafe API, question bank abstract-p1-20260923, 2026-09-23: 1 request, 5,501 input tokens.

What the abstract itself states, as probabilities: claims first 0.07 · states limitation 0.15 · human participants 0.04 · controlled comparison 0.09 · randomized assignment 0.01 · states quantitative result 0.05 · compares with prior results 0.16 · mentions code or data availability 0.04.

The abstract, sentence by sentence

arXiv listing abstract v1. Results and the main claim are underlined; show every role.

Recently text-to-image models have gained widespread attention in the community due to their controllable and high-quality generation ability. However, the robustness of such models and their potential ethical issues have not been fully explored. In this paper, we introduce Universal Semantic Trigger, a meaningless token sequence that can be added at any location within the input text yet can induce generated images towards a preset semantic target.To thoroughly investigate it, we propose Semantic Gradient-based Search (SGS) framework. SGS automatically discovers the potential universal semantic triggers based on the given semantic targets. Furthermore, we design evaluation metrics to comprehensively evaluate semantic shift of images caused by these triggers. And our empirical analyses reveal that the mainstream open-source text-to-image models are vulnerable to our triggers, which could pose significant ethical threats. Our work contributes to a further understanding of text-to-image synthesis and helps users to automatically auditing their models before deployment.

background contribution method result interpretation main claim

What the classifier reports for each sentence. The number is the probability it gave the label.
#	sentence	role	the authors' own work	states the main conclusion	strength
s0	Recently text-to-image models have gained widespread attention in the community due to their controllable and high-quality generation ability.	background 1.00	0.04	0.02	asserted 1.00
s1	However, the robustness of such models and their potential ethical issues have not been fully explored.	gap 0.99	0.05	0.03	asserted 0.94
s2	In this paper, we introduce Universal Semantic Trigger, a meaningless token sequence that can be added at any location within the input text yet can induce generated images towards a preset semantic target.To thoroughly investigate it, we propose Semantic Gradient-based Search (SGS) framework.	contribution 0.93	0.92	0.09	asserted 0.99
s3	SGS automatically discovers the potential universal semantic triggers based on the given semantic targets.	method 0.94	0.89	0.06	asserted 1.00
s4	Furthermore, we design evaluation metrics to comprehensively evaluate semantic shift of images caused by these triggers.	method 0.70	0.95	0.04	asserted 0.98
s5	And our empirical analyses reveal that the mainstream open-source text-to-image models are vulnerable to our triggers, which could pose significant ethical threats.	result 0.73	0.94	0.76	hedged possibility 0.55
s6	Our work contributes to a further understanding of text-to-image synthesis and helps users to automatically auditing their models before deployment.	contribution 0.76	0.46	0.15	asserted 0.76

What kind of paper the classifier reports this is: method or tool 0.99 · evidence from observation or experiment 0.97.

What was examined, and what was not

sources read

arXiv listing abstract v1

not examined

full text
figures and tables
references and citing sentences
relations to other papers

levels run

P abstract

not run

S sections
T body sentences
C citations
R cross-paper relations

Every quoted sentence on this record is the authors'. Every label is from Pith's closed vocabulary, with the probability shown beside it. Every number in the measurements table is the authors', checked by code. Record as JSON

The paper

Original abstract

Recently text-to-image models have gained widespread attention in the community due to their controllable and high-quality generation ability. However, the robustness of such models and their potential ethical issues have not been fully explored. In this paper, we introduce Universal Semantic Trigger, a meaningless token sequence that can be added at any location within the input text yet can induce generated images towards a preset semantic target.To thoroughly investigate it, we propose Semantic Gradient-based Search (SGS) framework. SGS automatically discovers the potential universal semantic triggers based on the given semantic targets. Furthermore, we design evaluation metrics to comprehensively evaluate semantic shift of images caused by these triggers. And our empirical analyses reveal that the mainstream open-source text-to-image models are vulnerable to our triggers, which could pose significant ethical threats. Our work contributes to a further understanding of text-to-image synthesis and helps users to automatically auditing their models before deployment.

Human review

How Pith checks papers → · Full audit of this paper →

References

How the literature uses it

6 arXiv papers cite this in 7 sentences

Each citing sentence is taken from the citing paper's LaTeX source and typed by Pith's classifier. A label appears at probability 0.8 or more (0.95 for support), a contest at 0.7 or more; the quoted words are the citing authors'. How each label was checked · JSON

Papers citing it · 5 sentences without a confident label

Uses its method or tool 1 paper

For a quantitative measure to evaluate the efficacy of adversarial suffix tokens, we utilized SemSR (Semantic Shift Rate) [ref] which measures the semantics between a generated image and a text prompt.

Adversarial Attacks on Parts of Speech: An Empirical Study in Text-to-Image Generation · Evaluation Metrics · 0.99

Cites it as background 1 paper

With the rapid development of T2I DMs, researchers have primarily focused on two main aspects: safety issue and fundamental performance issue [ref] .

Repairing Catastrophic-Neglect in Text-to-Image Diffusion Models via Attention-Guided Feature Enhancement · Different Issue Types in T2I DM · 0.81

What it cites · 14 sentences without a confident label

Uses the method or tool of 1 paper

Therefore, we design the pairwise comparison based user study inspired by [ref] : We construct pairwise comparisons, with one side being the original images (generated by original texts), and the other side being the random triggers inserted images, our triggers inserted images and images generate by explicit semantic texts, respectively.

Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena · Main Results · 0.98

Cites as support 1 paper

Given the study [ref] showing the harmful effects of using celebrity images for meme creation, these triggers may allow malicious users to easily generate harmful memes without manual works.

Unsafe Diffusion: On the Generation of Unsafe Images and Hateful Memes From Text-To-Image Models · Main Results · 0.99

Cites as background 8 papers

Text-to-Image models [ref] allow users to input natural language descriptions to generate synthetic images.

SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesis · Text-to-Image Synthesis · 1.00
Text-to-Image models [ref] allow users to input natural language descriptions to generate synthetic images.

Hierarchical Text-Conditional Image Generation with CLIP Latents · Text-to-Image Synthesis · 1.00
This paper mainly focus on a special type of adversarial attacks known as the "hidden vocabulary" within generative models [ref] .

Discovering the Hidden Vocabulary of DALLE-2 · Introduction · 0.89

Discussion

Know something about this paper? Leave a comment, or highlight any passage above to comment on it.