Summary
The paper introduces Auto-attack on Text-to-image Models (ATM), a method to efficiently generate attack prompts that closely resemble clean prompts.
The method modifies text prompts by replacing or extending words, using a Gumbel Softmax distribution for differentiability.
It further applies a binary mask to preserve the desired object noun and imposes fluency and similarity constraints to ensure similarity.
The authors identify four distinct attack patterns through this attack method.
The method utilizes Stable Diffusion as the target model, allowing for white-box attacks, and demonstrates the transferability of these attacks to other generative models (black-box attacks).
Strengths
1. The authors introduce a novel method to generate successful attack prompts in text-to-image generation pipelines. It can aid in vulnerability investigation. The method enables the identification of a broader range of attack patterns, prompting further research in both attack and defense mechanisms. Therefore, it can enhance security in the industry.
2. Related to the previous point, the authors themselves employ their method to uncover four distinct attack patterns, which are highly enlightening. This convincingly demonstrates the significant importance of this approach in studying the vulnerability of generative models and enhancing their robustness.
3. In their experiments, the proposed method demonstrates a high success rate in white-box attacks. It also exhibits excellent transferability to other generative models, e.g. DALL-E 2 and Midjourney. This proves that the method has a broad range of applications and can be used for various generative models, not just limited to Stable Diffusion.
Weaknesses
1. Two types of modifications, namely replacing and extending, are considered. It can be confusing to determine when to use each type. How do they determine whether to replace or extend a word?
2. Most of the analyses are solid. However, in Section 3.1, the authors mention embedding two prompts c_1 and c_2 separately to "eliminate the additional impact of all possible extraneous factors". It is unclear what specific impact they want to eliminate and how embedding prompts separately can achieve this.
3. The authors mention the use of the method to design defensive strategies but do not discuss how to utilize it. Is it possible to provide an example?
4. A minor issue: In Fig. 6, the steps should range from 49 to 0 instead of 1 to 50. This is because in the reverse diffusion process, T represents noise, and 0 represents the generated image (similar to the steps shown in Fig. 4).
Questions
Please address questions mentioned in "Weaknesses".
Rating
6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
Confidence
4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Limitations
There are no potential negative societal impacts.