REVIEW 6 cited by
HTS-Attack: Heuristic Token Search for Jailbreaking Text-to-Image Models
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
read the original abstract
Text-to-Image(T2I) models have achieved remarkable success in image generation and editing, yet these models still have many potential issues, particularly in generating inappropriate or Not-Safe-For-Work(NSFW) content. Strengthening attacks and uncovering such vulnerabilities can advance the development of reliable and practical T2I models. Most of the previous works treat T2I models as white-box systems, using gradient optimization to generate adversarial prompts. However, accessing the model's gradient is often impossible in real-world scenarios. Moreover, existing defense methods, those using gradient masking, are designed to prevent attackers from obtaining accurate gradient information. While several black-box jailbreak attacks have been explored, they achieve the limited performance of jailbreaking T2I models due to difficulties associated with optimization in discrete spaces. To address this, we propose HTS-Attack, a heuristic token search attack method. HTS-Attack begins with an initialization that removes sensitive tokens, followed by a heuristic search where high-performing candidates are recombined and mutated. This process generates a new pool of candidates, and the optimal adversarial prompt is updated based on their effectiveness. By incorporating both optimal and suboptimal candidates, HTS-Attack avoids local optima and improves robustness in bypassing defenses. Extensive experiments validate the effectiveness of our method in attacking the latest prompt checkers, post-hoc image checkers, securely trained T2I models, and online commercial models.
Forward citations
Cited by 6 Pith papers
-
ZIUM: Zero-Shot Intent-Aware Adversarial Attack on Unlearned Models
ZIUM attacks unlearned diffusion models by optimizing an image-captioning module that turns a target image into a text embedding, then reuses that module zero-shot on unseen images of the same unlearned concept.
-
Red-Teaming Text-to-Image Systems by Rule-based Preference Modeling
RPG-RT iteratively fine-tunes an LLM with rule-based preferences from a decoupled CLIP scoring model, letting it rewrite prompts that bypass unknown safety defenses in black-box text-to-image systems.
-
GIFT: Gradient-aware Immunization of diffusion models against malicious Fine-Tuning with safe concepts retention
GIFT immunizes diffusion models against malicious fine-tuning by combining loss maximization and representation noising, preserving safe concept generation.
-
Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message
Trojan Horse Prompting injects malicious instructions into a fabricated assistant message in the API chat history, aiming to bypass Gemini's safety filters, but no quantitative evidence is provided.
-
Dynamic Optimization and Safety Indicator Injection for Jailbreaking Text-to-Image Models with Multimodal Safety Filters
The OptJail framework (called GhostPrompt in the body) uses dynamic LLM rewriting with filter and CLIP feedback, plus bandit-selected visual indicators, to bypass text and image safety filters in T2I models, reporting...
-
PRJ: Perception-Retrieval-Judgement for Generated Images
A new safety checker for AI-generated images, built from a vision-language model, retrieval-augmented knowledge lookup, and an LLM judge, reports higher detection rates and category-level toxicity scores than three ex...
Discussion (0). Sign in to comment.