Pith. sign in

REVIEW 5 major objections 8 minor 1 cited by

Prompt Pirates Need a Map: Stealing Seeds helps Stealing Prompts

T0 review · 5 major / 8 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Prompt theft from AI images fails without the seed; this paper shows seeds are stealable and makes prompt recovery practical.

desk verdict SeedSnitch's 32-bit brute-force seed recovery is a real, well-evidenced result; the PromptPirate SOTA comparison has a cross-model confound that needs fixing before the 8-11% claim can be trusted. read the letter →

arxiv 2509.09488 v1 pith:W5U2CKD5 submitted 2025-09-11 cs.CR cs.AI

Felix Mächtle , Ashwath Shetty , Jonas Sander , Nils Loose , Sören Pirk , Thomas Eisenbarth This is my paper
classification cs.CRcs.AI
keywords promptstealingseedrecoverydiffusionmodelsCWE-339brute-forceattackgeneticalgorithmStablelatentspacecomparison
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that effective prompt stealing from diffusion-model images is impossible without recovering the random seed used to generate the initial noise, and that seeds are in practice easy to recover because of a widespread weakness: PyTorch's CPU random number generator uses only 32 bits of the seed, and some tools restrict the seed range even further. The authors build two tools: SeedSnitch, which brute-forces the seed by matching the encoded image latent to candidate noise latents, and PromptPirate, a genetic algorithm that then recovers the prompt modifiers while holding the seed fixed. On real images from CivitAI, SeedSnitch recovers 95% of seeds in about 140 minutes each, and PromptPirate outperforms prior prompt-stealing methods on visual similarity. If true, it means that the confidentiality of prompts used for public images is not protected by keeping the seed secret, and that a simple fix—using a cryptographically secure random generator with a large seed space—would neutralize this attack class.

What carries the argument

The central object is the latent-space MSE match between the final image's encoded latent and the candidate seed's initial noise latent. The paper's core mechanism is that the diffusion model's encoder maps an image to a latent that is still close enough to the initial noise (the seed's PRNG output) that the true seed gives a dramatically lower MSE than any other seed among 2^32 candidates. This is a deterministic, training-free brute-force search. SeedSnitch is the tool that performs this search with a two-stage filtering scheme over the 32-bit seed space. PromptPirate then uses a genetic algorithm (tournament selection, variable-length crossover, mutation, elitism) to evolve a set of style

What would settle it

A direct test would be to take a publicly shared image from a platform like CivitAI, apply even a minor post-processing edit (e.g., a slight color shift or a single inpainting stroke), and attempt SeedSnitch's 32-bit brute-force. If the correct seed is no longer recovered with high confidence, it would demonstrate that real-world image editing breaks the attack. Alternatively, generating an image with a GPU-based RNG (which uses a larger seed space) and checking that brute-force fails would confirm the vulnerability is specific to the CPU MT19937 path.

Watch

Extended reading notes

Core claim

The central claim is that the random seed used to generate the initial latent noise of a diffusion model is a security-critical parameter that can be practically recovered from the final image, and that seed recovery transforms prompt stealing from an ill-posed optimization problem into a tractable one. The paper shows empirically that loss functions (latent MSE, LPIPS, CLIP) are more sensitive to seed changes than to modifier changes, so without the exact seed, optimizing a prompt against an image is unreliable. It then exploits a CWE-339 vulnerability, the small 32-bit seed space of PyTorch's MT19937 CPU RNG, to brute-force seeds: for a target image, compute its latent encoding, generate n

Load-bearing premise

The attack assumes the target image is the direct, unedited output of the exact same diffusion pipeline (same model, encoder, scheduler, step count, CFG scale, and noise generation strategy) used by the attacker; if a user post-processes the image or uses a different RNG, seed brute-force may fail, and the paper's own 5% failure cluster on CivitAI is attributed to such deviations.

Editorial extensions

If this is right

  • The confidentiality of prompts used to generate publicly shared images is undermined if the seed can be recovered, because an attacker can then optimize a prompt against the exact generation path.
  • The countermeasure proposed—replacing the 32-bit seeded MT19937 with a cryptographically secure PRNG such as ChaCha20 with a 256-bit seed space—would make brute-force seed recovery infeasible, while preserving reproducibility for legitimate users.
  • The 95% success rate on real CivitAI images implies that a large fraction of publicly shared AI art is vulnerable to this attack, especially images generated with popular tools like AUTOMATIC1111, ComfyUI, Diffusers, and the Stable Diffusion 3.5 reference implementation.
  • Seed knowledge also improves the reliability of visual similarity metrics: with the correct seed, fitness evaluation during prompt optimization becomes meaningful, which is why PromptPirate's LPIPS scores exceed those of seed-agnostic methods.
  • The existence of this vulnerability should motivate platform designers to hide or encrypt generation metadata and to adopt secure RNG practices even when prompts are shared openly.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The attack could extend beyond prompt stealing: if seeds are recoverable, an adversary could also verify whether a given image was generated from a particular prompt and seed, aiding in provenance tracing or digital forensics.
  • The paper's finding that loss functions are more sensitive to seed than to modifiers suggests that other optimization-based attacks on diffusion models, such as adversarial perturbation or concept erasure, may also need seed-aware formulations to be reliable.
  • The 95% seed recovery rate on chosen CivitAI images likely overestimates the vulnerability for the whole platform, since the authors preselected images known to be CPU-generated; a broader sample would probably include more post-processed or GPU-generated images, lowering the success rate. This is an editorial caveat, not a paper claim.
  • The genetic-algorithm approach could be adapted to recover other discrete generation parameters (e.g., sampler, CFG scale) or to refine prompts beyond modifiers, potentially making prompt theft even more effective, though this is speculative.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 8 minor

Summary. This paper argues that prompt stealing from diffusion models is unreliable without knowing the initial noise seed, that the seed is practically recoverable because of a CWE-339 small-seed-space vulnerability (32-bit PyTorch CPU MT19937 or limited ranges like 0–100,000), and that a genetic-algorithm prompt modifier optimizer (PromptPirate), once given the recovered seed (SeedSnitch), outperforms prior prompt-stealing methods. The supporting experiments include: (i) seed-vs-modifier sensitivity comparisons using Latent-MSE, LPIPS, and CLIP with Wilcoxon tests; (ii) a noise-approximation experiment showing optimization cannot get close enough to the true initial noise; (iii) seed brute-force at 100% accuracy on 1,000 self-generated SD3.5 images and 100% on 50 CivitAI images over the full 2^32 space; (iv) a CivitAI case study with 95% seed identification across 895 images; and (v) a comparison of PromptPirate against PromptStealer, CLIP-Interrogator, and P2HP on 100 test-split prompts. The paper also proposes ChaCha20-based countermeasures and a discussion of responsible disclosure.

Significance. If the central claims hold, the paper makes a valuable practical contribution: it demonstrates that seed secrecy does not protect prompt confidentiality for CPU-generated images in current Stable Diffusion deployments, and it provides a reproducible open-source toolchain. Concrete strengths: the seed-recovery core is machine-checkable and evaluated on both self-generated and real images with 100% accuracy over the full 2^32 space; the loss-gap analysis in Figure 4 provides a plausible validation criterion; the paper is unusually transparent in acknowledging the failure cluster (5% post-edited/alternative-RNG images in Section 5.1) and the precondition that the exact pipeline is replicated; the countermeasure discussion is concrete and quantified. The main limitations: the distributional overlap between PromptPirate's modifier vocabulary and the evaluation dataset, and the cross-model SOTA comparison, weaken the 8–11% claim; the attack's real-world applicability is narrower than the abstract suggests because it requires exact knowledge of model, scheduler, CFG, and steps.

major comments (5)
  1. [Abstract and §4.4, Table 6] The headline '8–11% improvement in LPIPS similarity' is not supported as a method-level claim. For 'fairness,' each target image was generated with the SD model for which the baseline was developed (§4.4). PromptPirate therefore optimizes on SD3.5 Turbo images while PromptStealer/P2HP/CLIP-Interrogator are evaluated on their own (likely SD1.x) image distributions. The LPIPS gain (0.52 vs 0.47 for Known Subject) is within the reported ±0.14 standard deviation, and no significance test is reported for Table 6. Since the dataset and model vary jointly with the method, the 8–11% improvement may reflect target-model ease, not the seed-aware GA. A within-model comparison (all methods on the same target images) or matched-model baselines is needed before the abstract's improvement claim can stand.
  2. [§4.4 and §3.4] The PromptPirate advantage may be partially built into the evaluation by construction. PromptPirate's modifier vocabulary is filtered from the train split of the Shen et al. dataset (minimum 1% frequency, §3.4), while the evaluation uses the test split of the same dataset. If the test prompts share modifier vocabulary with the train split, the search space is strongly biased toward the ground-truth modifiers, giving PromptPirate an advantage that the other methods (especially CLIP-Interrogator/P2HP, which do not use that vocabulary) do not receive. The manuscript mentions this only as 'to avoid any unfair advantage from leaked parameters' regarding the seed, but does not address the vocabulary overlap. A control using a disjoint modifier vocabulary or an external prompt dataset would clarify how much of the 8–11% gain is method versus benchmark overlap.
  3. [§5.1, §5.3] The abstract's 'approximately 95% of these images' claim conflates two different experiments. §5.1 reports 95% seed identification when the candidate pool contains the correct seed plus 100,000 distractors—a much easier task than the full 2^32 brute-force in §5.3, which is demonstrated on only 50 images preselected as CPU-generated. The paper's own Section 5.1 attributes the 5% failure cluster to post-generation editing or alternative RNGs, so the 95% figure does not translate directly into '95% ... can be effectively brute-forced in 140 minutes per seed.' I recommend stating precisely which success rate applies to which search space and preselection condition, and reporting the fraction of the 895-image dataset that falls in the CPU-generated cluster (Figure 6 suggests a substantial but not universal fraction).
  4. [§4.3] The 100% seed-recovery accuracy on self-generated images uses a candidate range of only 0–100,000 (the SD3.5 reference implementation). This is an important result for that implementation, but it is a 17-bit search, not a 32-bit search. The later §5.3 experiment covers the full 2^32 space on 50 real images and is the load-bearing evidence for the 32-bit claim. I would ask the authors to make this distinction explicit in the abstract and §4.3, and to note that the §4.3 timing (85.2 seconds) does not generalize to the 140-minute full-space attack.
  5. [§3.3] The claimed vulnerability framing (CWE-339) is essentially correct for the small-range case, but the 32-bit CPU MT19937 case deserves more careful wording. PyTorch's MT19937 does use a 32-bit seed state; however, if a user or application draws the seed from a 64-bit sampler, the lower-32-bit truncation still yields only 2^32 distinct noise tensors. The paper documents this precisely with the code quote. The concern is not correctness but overgeneralization: the statement 'approximately 95% of these images' seed values can be effectively brute-forced' depends on the image having been generated with the exact same PRNG and pipeline. The paper's own Section 5.1 admits this. I would ask for a clear statement in the abstract that the 95% applies to images generated with the vulnerable CPU path and known full pipeline, not to all images on CivitAI.
minor comments (8)
  1. [§1, Table 1] Table 1's qualitative illustration is helpful, but the 'No-seed attack (P2HP)' column should state the seed used for the no-seed baseline and the exact prompt, since one example could be cherry-picked. The paper later conducts a systematic comparison; consider deferring the visual claim to Figure 5/Table 7.
  2. [§4.1, Figure 2] The CLIP boxplot shows substantial overlap between SSDM and DSSM despite the significant p-value; the text acknowledges this. Consider reporting effect sizes (e.g., rank-biserial correlation) in addition to p-values, since the practical claim 'seed dominates modifier' is stronger for Latent-MSE/LPIPS than for CLIP.
  3. [§4.2, Table 5] The 'optimization' row reports distance 1.00±0.02 but the optimization details (Adam schedule, random-noise regularization weight) are not specified. Please move the details from the appendix into the main text or provide a reproducibility note, since this experiment underpins the claim that optimization cannot approximate the seed.
  4. [§5.3] The two-stage filter uses the first 2^13, then 2^15, entries of the noise vector. Please clarify whether these are the first entries of the flattened latent or of the per-channel tensor, and whether the same positions are used across images. This matters for reproduction.
  5. [§6] The claim that ChaCha20 with a 256-bit seed is 'quantum resistant' is imprecise. Quantum resistance of a PRNG seed search is about the generic square-root speedup (128-bit security for 256-bit seeds), which is adequate here, but the wording should be softened to 'provides at least 128-bit post-quantum security against brute-force.'
  6. [Throughout] There are several typos and formatting artifacts: 'CivitAI' is used interchangeably with 'CivitAI' (should be CivitAI); 'Shenet al.' should be 'Shen et al.'; Table 4 headers are misaligned; Figure 5 caption says 'best two approaches' but the figure is described as PromptPirate vs Prompt Stealer; and the appendix Table 8 has repeated phrases (e.g., 'global illumination, peter mohrbacher, centered' and 'detailed face' twice). A careful copyedit is needed.
  7. [§3.4] The genetic algorithm's hyperparameters (population 150, 25 generations, mutation rates) are presented without an ablation or sensitivity analysis. Given that the GA is a core contribution, at least a small sensitivity study (e.g., population size or mutation probability ±50%) would increase confidence that the reported gain is not tuned to the benchmark.
  8. [References] Reference [24] is to the authors' own concurrent arXiv preprint (AutoStub). This is acceptable but should be marked as 'to appear' or 'preprint' if that is the status, to avoid appearing as a self-citation without context.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: seed recovery and prompt recovery are empirical, self-contained measurements; remaining concerns are validity confounds, not circular reductions.

full rationale

The paper's derivation chain contains two load-bearing empirical claims, neither of which reduces to its own inputs by construction. First, SeedSnitch recovers seeds by exhaustive search because the target latent z0=E(I) retains a small but measurable correlation with the true initial noise PRNG(s). The paper validates this against known metadata on self-generated images (Section 4.3) and real CivitAI images (Sections 5.1, 5.3). This is a measurement, not an identity: Table 5 shows the true seed's noise vector is still ~1.98 MSE away from z0, so minimizing MSE(z0, PRNG(s)) is not guaranteed by construction; it is an empirical, falsifiable result. Second, PromptPirate's genetic algorithm minimizes latent MSE between the target and candidate renderings at the recovered seed (Section 3.4). The fitness function does not encode the target prompt, and the ablation with an incorrect seed isolates the seed's contribution. The only self-citations ([20], [21], [22], [24]) are background or generic references and are not load-bearing; no uniqueness theorem or prior ansatz by the authors is used to force the choice of GA. The SOTA comparison in Section 4.4 does use different Stable Diffusion models for each method, and PromptPirate's modifier vocabulary is drawn from the train split of the same Shen et al. dataset whose test split is the benchmark; these are external-validity and benchmark-hygiene concerns, not circularity, because no test-set label or target prompt is used to build the vocabulary and no equation reduces the reported gains to a fitted parameter. Therefore, no significant circularity is present.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The paper's central attack rests on two upstream facts it does not prove: the 32-bit CPU seed truncation (documented only by a source link) and the persistence of a noise fingerprint in final latents (established empirically, not theoretically, and only on SD 3.5 family images). The GA and brute-force hyperparameters are hand-set or tuned on the evaluation data (Section 5.3). The threat model assumption that the attacker knows the full pipeline is stated but not validated on real deployments. No new physical or theoretical entities are postulated; SeedSnitch and PromptPirate are software tools, not entities requiring independent falsifiable handles.

free parameters (5)
  • GA mutation probabilities = replacement 0.15, insertion 0.03, deletion 0.02
    Hand-set in Section 3.4; no sensitivity analysis is reported, and they shape the search behavior of PromptPirate.
  • GA population and generation counts = 150 individuals, 25 generations, 5% elitism, 3-12 modifiers per candidate
    Hand-set in Section 3.4; not justified by ablation, and they define the cost and search coverage of the optimizer.
  • Modifier frequency threshold = 1% of training prompts
    Section 3.4; filters the candidate modifier vocabulary; computed on the train split of Shen et al., matching the distribution of the test-split evaluation.
  • Two-stage brute-force filter sizes = first stage 2^13 noise entries, top-k 2^13, second stage 2^15 entries
    Section 5.3; the paper states the sizes were chosen empirically ('further reduction notably degraded accuracy', 'decreasing k below 2^13 decreased accuracy'), i.e., tuned against evaluation results.
  • Noise-approximation optimizer schedule = Adam, 500 iterations, unstated regularization weights
    Section 4.2; used to argue optimization alone cannot approach the seed; weights are not reported, so the result is hard to interpret.
assumptions (4)
  • standard math PyTorch MT19937 truncates CPU seeds to the lower 32 bits and distinct 64-bit seeds can collide
    Section 3.2; documented via a PyTorch source link (MT19937RNGEngine.h#L158); mechanically verifiable, and it is the load-bearing fact for the entire attack.
  • domain assumption The final image latent retains a measurable fingerprint of the initial noise such that MSE(PRNG(s), E(I)) is minimized at the true seed
    Invoked in Sections 3.3 and 4.3; validated empirically on 1,000 self-generated images over 100,000 candidates and 50 CivitAI images over 2^32 candidates, but not theoretically justified and untested across models, schedulers, and edits.
  • domain assumption The attacker knows the exact model, encoder, hyperparameters, and noise strategy of the target
    Section 3.1 threat model; required for both the fingerprint test and the GA fitness loop; the paper notes the model set is small in practice but does not quantify the guessing burden.
  • domain assumption Shared images on CivitAI are largely unedited and CPU-noise-generated
    Sections 5.1-5.3; the paper attributes the 5% failure cluster to editing or alternative RNGs, conceding this is an empirical regularity rather than a guarantee.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Prompt Pirates Need a Map: Stealing Seeds helps Stealing Prompts." pith.science (2026). https://pith.science/paper/W5U2CKD5

@misc{pith2026250909488,
  author       = {Pith},
  title        = {Pith review of: Prompt Pirates Need a Map: Stealing Seeds helps Stealing Prompts},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/W5U2CKD5}},
  note         = {Machine review of arXiv:2509.09488}
}
abstract

Diffusion models have significantly advanced text-to-image generation, enabling the creation of highly realistic images conditioned on textual prompts and seeds. Given the considerable intellectual and economic value embedded in such prompts, prompt theft poses a critical security and privacy concern. In this paper, we investigate prompt-stealing attacks targeting diffusion models. We reveal that numerical optimization-based prompt recovery methods are fundamentally limited as they do not account for the initial random noise used during image generation. We identify and exploit a noise-generation vulnerability (CWE-339), prevalent in major image-generation frameworks, originating from PyTorch's restriction of seed values to a range of $2^{32}$ when generating the initial random noise on CPUs. Through a large-scale empirical analysis conducted on images shared via the popular platform CivitAI, we demonstrate that approximately 95% of these images' seed values can be effectively brute-forced in 140 minutes per seed using our seed-recovery tool, SeedSnitch. Leveraging the recovered seed, we propose PromptPirate, a genetic algorithm-based optimization method explicitly designed for prompt stealing. PromptPirate surpasses state-of-the-art methods, i.e., PromptStealer, P2HP, and CLIP-Interrogator, achieving an 8-11% improvement in LPIPS similarity. Furthermore, we introduce straightforward and effective countermeasures that render seed stealing, and thus optimization-based prompt stealing, ineffective. We have disclosed our findings responsibly and initiated coordinated mitigation efforts with the developers to address this critical vulnerability.

Figures

Figures reproduced from arXiv: 2509.09488 by the authors.

Figure 1
Figure 1. Our pipeline for prompt recovery. to embed the target image and compares this to the precom￾puted embeddings of candidate textual modifiers. This is possible because CLIP is trained to project text and images into the same embedding space. Each candidate modifier is ranked according to its similarity score, meaning that modifiers with higher similarity scores are considered more relevant and descriptive for construc… view at source ↗
Figure 2
Figure 2. Comparison of perceptual, structural, and semantic differences [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Impact of increasing noise approximation error (MSE) on the [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: The MSE-loss between the initial noise ϵs and the target image z0. The correct seed consistently shows significantly lower loss values compared to the second-best seed and the average loss. Accuracy in seed identification is 100% across all models. the average loss acr…
Figure 5
Figure 5. Figure 5: A detailed comparison between the best two approaches. All data [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 6
Figure 6. Figure 6: Effective seed size on CivitAI Discussion. Our method effectively identifies seeds in realis￾tic, community-generated datasets, highlighting substantial real-world privacy risks. Only 5% of seeds could not be identified. One possible explanation for those 5% is post￾ge…

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Steganography Without Modification: Hidden Communication via LLM Seeds

    cs.CR 2026-06 unverdicted novelty 8.0 of 10

    LLM inference with deterministic PRNG sampling enables encoding and recovering 32-bit secrets in the seed from generated text, achieving high accuracy in both known-prompt and unknown-prompt settings.

Reference graph

Works this paper leans on

41 extracted references · 5 linked inside Pith · cited by 1 Pith paper

  1. [1]

    https://en.wikipedia.org/wiki/Th%C3%A9% C3%A2tre D%27op%C3%A9ra Spatial, May 2025

    Th ´eˆatre d’op ´era spatial. https://en.wikipedia.org/wiki/Th%C3%A9% C3%A2tre D%27op%C3%A9ra Spatial, May 2025. Accessed: 05/2025

    2025

  2. [2]

    Stable diffusion webui: ‘shared options.py‘

    AUTOMATIC1111. Stable diffusion webui: ‘shared options.py‘. https://github.com/AUTOMATIC1111/stable-diffusion-webui/blob/ 82a973c04367123ae98bd9abdf80d9eda9b910e2/modules/shared options.py#L183, 2023. Accessed: 05/2025

    2023

  3. [3]

    Android security vulnerability: Random number generator (rng) bug

    Bitcoin Project. Android security vulnerability: Random number generator (rng) bug. https://bitcoin.org/en/alert/2013-08-11-android, August 2013. A bug in Android’s SecureRandom implementation caused ECDSA private keys to be exposed, allowing attackers to steal funds from Bitcoin wallets

    2013

  4. [4]

    Extracting training data from diffusion models

    Nicholas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tram `er, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. In32nd USENIX Security Symposium, USENIX Security 2023, Anaheim, CA, USA, August 9-11, 2023, pages 5253–5270. USENIX Association, 2023

    2023

  5. [5]

    Reverse stable diffusion: What prompt was used to generate this image?Comput

    Florinel-Alin Croitoru, Vlad Hondru, Radu Tudor Ionescu, and Mubarak Shah. Reverse stable diffusion: What prompt was used to generate this image?Comput. Vis. Image Underst., 249:104210, 2024

    2024

  6. [6]

    Machine learn- ing needs better randomness standards: Randomised smoothing and prng-based attacks

    Pranav Dahiya, Ilia Shumailov, and Ross Anderson. Machine learn- ing needs better randomness standards: Randomised smoothing and prng-based attacks. In33rd USENIX Security Symposium, USENIX Security 2024, Philadelphia, PA, USA, August 14-16, 2024. USENIX Association, 2024

    2024

  7. [7]

    Debian openssl predictable random num- ber generator vulnerability (cve-2008-0166)

    Debian Security Team. Debian openssl predictable random num- ber generator vulnerability (cve-2008-0166). https://security-tracker. debian.org/tracker/CVE-2008-0166, 2008. A critical vulnerability caused by the use of a predictable seed in the OpenSSL PRNG, reducing entropy to 15 bits and affecting all keys generated on Debian-based systems between 2006 and 2008

    2008

  8. [8]

    Comfyui: ‘sample.py‘

    ComfyUI Developers. Comfyui: ‘sample.py‘. https://github.com/comfyanonymous/ComfyUI/blob/ f85c08df0615a587e0974678b01199b88a1caae0/comfy/sample. py#L15, 2024. Accessed: 05/2025

    2024

Show all 41 references
  1. [9]

    Easy diffusion: ‘en- gine.js‘

    EasyDiffusion Developers. Easy diffusion: ‘en- gine.js‘. https://github.com/easydiffusion/easydiffusion/blob/ 38eb8f934e8b3211e8bf7c5e2dad59f54079364f/ui/media/js/engine.js# L801, 2023. Accessed: 05/2025

    2023

  2. [10]

    Invokeai: ‘sd3 denoise.py‘

    InvokeAI Developers. Invokeai: ‘sd3 denoise.py‘. https://github.com/invoke-ai/InvokeAI/blob/ 32df3bdf6e098f0c2acdcae3156c6b909453e302/invokeai/app/ invocations/sd3 denoise.py#L157C9-L167C68, 2024. Accessed: 05/2025

    2024

  3. [11]

    Jinhao Duan, Fei Kong, Shiqi Wang, Xiaoshuang Shi, and Kaidi Xu. Are diffusion models vulnerable to membership inference attacks? In International Conference on Machine Learning, ICML 2023, 23-29 July 2023, Honolulu, Hawaii, USA, volume 202 ofProceedings of Machine Learning Re...

    2023

  4. [12]

    Diffusers library

    Hugging Face. Diffusers library. https://github.com/huggingface/ diffusers, 2025. Accessed: 05/2025

    2025

  5. [13]

    the crow

    Hauke Gierow. Artificial imagination: Art that no human eye has seen before – about “the crow”, aug 2023. Accessed: 05/2025

    2023

  6. [14]

    Goldberg and Kalyanmoy Deb

    David E. Goldberg and Kalyanmoy Deb. A comparative analysis of selection schemes used in genetic algorithms. InProceedings of the First Workshop on Foundations of Genetic Algorithms. Bloomington Campus, Indiana, USA, July 15-18 1990, pages 69–93. Morgan Kaufmann, 1990

    1990

  7. [15]

    David J. Groggel. Practical nonparametric statistics.Technometrics, 42(3):317–318, 2000

    2000

  8. [16]

    Monte carlo and reconstruction membership inference attacks against gen- erative models.Proc

    Benjamin Hilprecht, Martin H ¨arterich, and Daniel Bernau. Monte carlo and reconstruction membership inference attacks against gen- erative models.Proc. Priv. Enhancing Technol., 2019(4):232–249, 2019

    2019

  9. [17]

    Denoising diffusion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. InAdvances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020, virtual, 2020

    2020

  10. [18]

    Junnan Li, Dongxu Li, Caiming Xiong, and Steven C. H. Hoi. BLIP: bootstrapping language-image pre-training for unified vision- language understanding and generation. In Kamalika Chaudhuri, Stefanie Jegelka, Le Song, Csaba Szepesv ´ari, Gang Niu, and Sivan Sabato, editors,Inter...

    2022

  11. [19]

    Lil miquela (@lilmiquela) • instagram photos and videos, 2025

    Lil Miquela. Lil miquela (@lilmiquela) • instagram photos and videos, 2025. Accessed: 2025-05-25

    2025

  12. [20]

    Madvex: Instrumentation-based adversarial attacks on machine learning malware detection

    Nils Loose, Felix M ¨achtle, Claudius Pott, V olodymyr Bezsmertnyi, and Thomas Eisenbarth. Madvex: Instrumentation-based adversarial attacks on machine learning malware detection. InInternational Con- ference on Detection of Intrusions and Malware, and Vulnerability Assessment...

    2023

  13. [21]

    Trace gadgets: Minimizing code context for machine learning-based vulnerability prediction.arXiv preprint arXiv:2504.13676, 2025

    Felix M ¨achtle, Nils Loose, Tim Schulz, Florian Sieck, Jan-Niclas Serr, Ralf M¨oller, and Thomas Eisenbarth. Trace gadgets: Minimizing code context for machine learning-based vulnerability prediction.arXiv preprint arXiv:2504.13676, 2025

    2025

  14. [22]

    OCEAN: open-world contrastive authorship identifica- tion

    Felix M ¨achtle, Jan-Niclas Serr, Nils Loose, Jonas Sander, and Thomas Eisenbarth. OCEAN: open-world contrastive authorship identifica- tion. InApplied Cryptography and Network Security - 23rd Interna- tional Conference, ACNS 2025, Munich, Germany, June 23-26, 2025, Proceeding...

    2025

  15. [23]

    Prompting hard or hardly prompting: Prompt inversion for text-to- image diffusion models

    Shweta Mahajan, Tanzila Rahman, Kwang Moo Yi, and Leonid Sigal. Prompting hard or hardly prompting: Prompt inversion for text-to- image diffusion models. InIEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2024, Seattle, WA, USA, June 16-22, 2024, pages 6808...

    2024

  16. [24]

    Autostub: Genetic programming-based stub creation for symbolic execution.arXiv preprint arXiv:2509.08524, 2025

    Felix M ¨achtle, Nils Loose, Jan-Niclas Serr, Jonas Sander, and Thomas Eisenbarth. Autostub: Genetic programming-based stub creation for symbolic execution.arXiv preprint arXiv:2509.08524, 2025

    2025 arXiv

  17. [25]

    Chacha20 and poly1305 for IETF protocols.RFC, 7539:1–45, 2015

    Yoav Nir and Adam Langley. Chacha20 and poly1305 for IETF protocols.RFC, 7539:1–45, 2015

    2015

  18. [26]

    Clip interrogator, 2022

    PharmaPsychotic. Clip interrogator, 2022. Accessed: 05/2025

    2022

  19. [27]

    Promptbase: Prompt marketplace for gpt, dall·e, and other generative models

    PromptBase. Promptbase: Prompt marketplace for gpt, dall·e, and other generative models. https://promptbase.com/, 2025. Accessed: 05/2025

    2025

  20. [28]

    Learning transferable visual models from natural language supervi- sion

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervi- sion. InProceedings of t...

    2021

  21. [29]

    High-resolution image synthesis with latent diffusion models.CoRR, abs/2112.10752, 2021

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High-resolution image synthesis with latent diffusion models.CoRR, abs/2112.10752, 2021

    2021 arXiv

  22. [30]

    David F. Shanno. Conditioning of quasi-newton methods for function minimization.Mathematics of Computation, 24(111):647–656, 1970

    1970

  23. [31]

    Prompt stealing attacks against text-to-image generation models

    Xinyue Shen, Yiting Qu, Michael Backes, and Yang Zhang. Prompt stealing attacks against text-to-image generation models. In33rd USENIX Security Symposium, USENIX Security 2024, Philadelphia, PA, USA, August 14-16, 2024. USENIX Association, 2024

    2024

  24. [32]

    Denoising diffu- sion implicit models.arXiv:2010.02502, October 2020

    Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffu- sion implicit models.arXiv:2010.02502, October 2020

    2010 arXiv

  25. [33]

    sd3 infer.py – Stable Diffusion 3.5 In- ference Script

    Stability AI. sd3 infer.py – Stable Diffusion 3.5 In- ference Script. https://github.com/Stability-AI/sd3.5/blob/ 8565799a3b41eb0c7ba976d18375f0f753f56402/sd3 infer.py, 2025. Accessed: 05/2025

    2025

  26. [34]

    csprng: Cryptographically secure pseudorandom number generators for pytorch

    PyTorch Team. csprng: Cryptographically secure pseudorandom number generators for pytorch. https://github.com/pytorch/csprng,

  27. [35]

    Gomez, Lukasz Kaiser, and Illia Polosukhin

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Lukasz Kaiser, and Illia Polosukhin. Atten- tion is all you need. InAdvances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017, D...

    2017

  28. [36]

    Hard prompts made easy: Gradient- based discrete optimization for prompt tuning and discovery

    Yuxin Wen, Neel Jain, John Kirchenbauer, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Hard prompts made easy: Gradient- based discrete optimization for prompt tuning and discovery. In Advances in Neural Information Processing Systems 36: Annual Conference on Neural Inform...

    2023

  29. [37]

    Zico Kolter

    Joshua Nathaniel Williams, Avi Schwarzschild, and J. Zico Kolter. Prompt recovery for image generation models: A comparative study of discrete optimizers.CoRR, abs/2408.06502, 2024

    2024 arXiv

  30. [38]

    Good seed makes a good crop: Discovering secret seeds in text-to-image diffusion mod- els

    Katherine Xu, Lingzhi Zhang, and Jianbo Shi. Good seed makes a good crop: Discovering secret seeds in text-to-image diffusion mod- els. InIEEE/CVF Winter Conference on Applications of Computer Vision, WACV 2025, Tucson, AZ, USA, February 26 - March 6, 2025, pages 3024–3034. IEEE, 2025

    2025

  31. [39]

    Team NYCU at defactify4: Robust detec- tion and source identification of ai-generated images using CNN and clip-based models.CoRR, abs/2503.10718, 2025

    Tsan-Tsung Yang, I-Wei Chen, Kuan-Ting Chen, Shang-Hsuan Chi- ang, and Wen-Chih Peng. Team NYCU at defactify4: Robust detec- tion and source identification of ai-generated images using CNN and clip-based models.CoRR, abs/2503.10718, 2025

    2025 arXiv

  32. [40]

    Efros, Eli Shechtman, and Oliver Wang

    Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In2018 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2018, Salt Lake City, UT, USA, June 18-22, 2018, pages...

    2018

  33. [41]

    Appendix Known Subject #img Type Prompt 1 Original evil elves fight evil dwarves, composition, trending on artstation, cinematic Prompt Stealer evil elves fight evil dwarves, artstation, 8k, intricate, 4k, epic lighting, award winning photograph CLIP I. evil elves fight evil d...

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.