Research map / Image generation / Text-to-image diffusion
AdvI2I: Adversarial Image Attack on Image-to-Image Diffusion Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes AdvI2I, an adversarial image generator that perturbs input images to make image-to-image diffusion models produce NSFW content, bypassing text filters and defenses like SLD, negative prompts, and safety checkers.
Problem
Safety of image-to-image diffusion models: existing NSFW attacks use adversarial text prompts that text filters can detect, leaving the image-condition pathway of I2I models underexplored.
Approach
Train a VAE-based adversarial image generator so that the denoised latent under a benign prompt matches the latent produced by an NSFW-shifted text embedding (derived from contrastive prompt pairs), so the perturbed image alone induces NSFW output; an adaptive variant adds a safety-checker loss and Gaussian noise during training.
Key results
- AdvI2I reaches 81.5% ASR on nudity for InstructPix2Pix without defense and 82.5% on SDv1.5-Inpainting, versus 68.5% and 42.0% for the best baselines (MMA, Attack VAE).
- Under the safety checker (SC) defense, standard AdvI2I drops to 10.5-18.0% ASR for nudity, while AdvI2I-Adaptive keeps 70.5-72.0%.
- Adversarial images transfer from SDv1.5-Inpainting to SDv2.0 (80.5%) and SDv2.1 (84.0%) but only 34.0% to SDv3.0, which is conjectured to be due to filtered training data.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use AdvI2I instead of MMA | InstructPix2Pix · Nudity, w/o Defense | ASR: 68.5% -> 81.5% | Helped |
| Use AdvI2I-Adaptive instead of AdvI2I | InstructPix2Pix · Nudity, SC | ASR: 18.0% -> 70.5% | Helped |
| Use AdvI2I-Adaptive instead of AdvI2I | InstructPix2Pix · Violence, SC | ASR: 32.5% -> 70.5% | Helped |
| Use AdvI2I instead of MMA | SDv1.5-Inpainting · Nudity, w/o Defense | ASR: 42.0% -> 82.5% | Helped |
| Use AdvI2I-Adaptive instead of AdvI2I | SDv1.5-Inpainting · Nudity, SC | ASR: 10.5% -> 72.0% | Helped |
| Use AdvI2I-Adaptive instead of AdvI2I | SDv1.5-Inpainting · Violence, SC | ASR: 31.5% -> 71.5% | Helped |
| Add an adversarial image generator rather than directly optimizing perturbations (ablation) | AdvI2I · InstructPix2Pix and SDv1.5-Inpainting, nudity and violence, w/o Defense | ASR: 18.5% -> 81.5%; 18.0% -> 80.0%; 55.0% -> 82.5%; 52.5% -> 81.0% | Helped |
| Increase noise bound ε from 32/255 to 128/255 (ablation) | AdvI2I on InstructPix2Pix · Nudity, w/o Defense | ASR: 76.5% -> 84.5% | Helped |
| Increase concept strength α from 2.2 to 2.8 (ablation) | AdvI2I on InstructPix2Pix · Nudity, w/o Defense | ASR: 80.5% -> 82.5% | Helped |
Surprising findings
- Simple text filters such as perplexity filtering cut adversarial prompt ASR substantially, but the authors argue rejecting text prompts does not secure I2I models because the image pathway remains open.
- Standard AdvI2I is effectively neutralized by the safety checker, yet the adaptive variant with a safety-checker loss and Gaussian noise retains high ASR.
Limitations
- Transfer to SDv3.0 is poor (34% ASR), which the authors attribute to its NSFW-filtered training data.
- Evaluation relies on NudeNet and Q16 classifiers as NSFW judges, with a small 200-sample evaluation set.
- Attack requires a trained generator per NSFW concept and uses a fixed benign-prompt setup.
Experimental setup
Datasets: NSFW Data Scraper 'sexy' category images ChatGPT-4o generated image-editing prompts
Benchmarks: NudeNet nudity detection on generated images Q16 classifier for violence
Metrics: attack success rate (ASR) LPIPS SSIM PSNR FSIM VIF TOPIQ NIQE PIQE FID
Baselines: Attack VAE MMA-Diffusion W/o Generator
Builds on: MMA-Diffusion Ring-A-Bell SneakyPrompt Glaze Safe Latent Diffusion
Closest papers by meaning
- DiffusionGuard: A Robust Defense Against Malicious Diffusion-based Image Editing (ICLR 2025 · similarity 0.90)
- MMA-Diffusion: MultiModal Attack on Diffusion Models (CVPR 2024 · similarity 0.89)
- AdvAD: Exploring Non-Parametric Diffusion for Imperceptible Adversarial Attacks (NeurIPS 2024 · similarity 0.88)
- Perturbing Attention Gives You More Bang for the Buck: Subtle Imaging Perturbations That Efficiently Fool Customized Diffusion Models (CVPR 2024 · similarity 0.88)
- AdvPaint: Protecting Images from Inpainting Manipulation via Adversarial Attention Disruption (ICLR 2025 · similarity 0.88)
- Adv-Diffusion: Imperceptible Adversarial Face Identity Attack via Latent Diffusion Model (AAAI 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.