Research map / Image generation / Text-to-image diffusion
MMA-Diffusion: MultiModal Attack on Diffusion Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes MMA-Diffusion, a multimodal attack that jointly uses gradient-searched adversarial text prompts (avoiding sensitive words) and adversarial image perturbations to bypass prompt filters and post-hoc safety checkers in T2I diffusion models.
Problem
T2I diffusion models use prompt filters and post-hoc safety checkers to block NSFW generation, but their robustness against adversarial attacks that evade both input and output safeguards is unclear.
Approach
Text-modal attack searches free-form adversarial token sequences via gradient-guided token search that match the target prompt's text-encoder embedding while masking sensitive words; image-modal attack uses PGD on input images to make the post-hoc safety checker's NSFW-embedding loss fall below thresholds, and the two are combined.
Key results
- White-box on SDv1.5 achieves average ASR-4 of 83.37% across Q16, MHSC and SD safety checker, versus 61.27% for human-written I2P prompts and at most 29.10% for QF-Attack GREEDY.
- 10-query black-box attack achieves 83.33% success on Midjourney and 90.00% on Leonardo.Ai.
- Adversarial image attack on SD built-in safety checker reaches 88.52% ASR-4; combined text+image multimodal attack reaches 85.48% ASR-4.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use text-modal adversarial prompts instead of I2P prompts | SDv1.5 · Q16, MHSC, SC (AVG.) | ASR-4: 61.27 -> 83.37 | Helped |
| Use text-modal adversarial prompts instead of I2P prompts | SDv1.5 · Q16, MHSC, SC (AVG.) | ASR-1: 36.58 -> 67.54 | Helped |
| Transfer text-modal adversarial prompts to SDXLv1.0 | MMA-Diffusion · Q16, MHSC, SC (AVG.) | ASR-4: 73.70 | Helped |
| Transfer text-modal adversarial prompts to SLD | MMA-Diffusion · Q16, MHSC, SC (AVG.) | ASR-4: 76.73 | Helped |
| Apply 10-query text-modal attacks | MMA-Diffusion on Midjourney · UnsafeDiff | attack success rate: 83.33% | Helped |
| Apply 10-query text-modal attacks | MMA-Diffusion on Leonardo.Ai · UnsafeDiff | attack success rate: 90.00% | Helped |
| Add image-modal adversarial perturbations to the input image | SD image editing with safety checker · Image editing | ASR-4: 88.52 | Helped |
| Combine adversarial prompts with adversarial images | SD image editing with prompt filter and safety checker · Image editing | ASR-4: 85.48 | Helped |
| Use adversarial prompts in addition to adversarial images | SD image editing · Image editing | ASR-4: 88.52 -> 85.48 | Hurt |
| Use adversarial prompts in addition to adversarial images | SD image editing · Image editing | ASR-1: 78.69 -> 75.52 | Hurt |
Surprising findings
- Midjourney's moderator blocks prompts with sensitive words outright, while Leonardo.Ai's prompt filter only examines explicit content, so adversarial prompts bypass it in 64% of adult-theme cases.
- Adversarial prompts transfer to SDXL and SLD despite architectural differences, achieving 73.70% and 76.73% ASR-4.
Limitations
- Online service evaluation relies on six human evaluators and a small set of 30 prompts.
- Celebrity-targeted attacks fail because adversarial prompts omit names, yielding lookalike individuals.
- Specific attack details are deliberately omitted for ethical reasons, limiting reproducibility.
Experimental setup
Datasets: LAION-COCO UnsafeDiff I2P
Benchmarks: UnsafeDiff LAION-COCO subset
Metrics: ASR-N attack success rate
Baselines: I2P QF-Attack GREEDY QF-Attack GENETIC QF-PGD SLD
Builds on: QF-Attack LLM-attack (GCG) Projected gradient descent I2P
Closest papers by meaning
- Prompting4Debugging: Red-Teaming Text-to-Image Diffusion Models by Finding Problematic Prompts (ICML 2024 · similarity 0.89)
- AdvI2I: Adversarial Image Attack on Image-to-Image Diffusion Models (ICML 2025 · similarity 0.89)
- Detect-and-Guide: Self-regulation of Diffusion Models for Safe Text-to-Image Generation via Guideline Token Optimization (CVPR 2025 · similarity 0.88)
- DiffusionGuard: A Robust Defense Against Malicious Diffusion-based Image Editing (ICLR 2025 · similarity 0.88)
- Ring-A-Bell! How Reliable are Concept Removal Methods For Diffusion Models? (ICLR 2024 · similarity 0.88)
- Anti-Diffusion: Preventing Abuse of Modifications of Diffusion-Based Models (AAAI 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.