Coordinated disclosure: rank-deficient prompt-encoder projections in DreamShaper 7
Hello DreamShaper Maintainer,
We identified numerical rank deficiency and strong spectral imbalance in DreamShaper 7's CLIP-L/14 prompt encoder. For a projection $W=U\Sigma V^T$, a perturbation $cv_i$ along right-singular vector $v_i$ becomes $c\sigma_i u_i$. A singular value below the numerical-rank tolerance effectively removes that direction; a very small nonzero value strongly attenuates it. Across the first 12 layers, multiple Q/K/V projections contain deficient directions, while others have condition ratios up to approximately 11,000. Thus, a difference visible before projection can nearly disappear downstream.
Rank deficiency here is local to individual attention projections, not a claim that the complete CLIP encoder is globally low rank. Numerically deficient directions form an effective null space, while strongly imbalanced but full-rank projections create approximate null directions. Both can cause a safeguard/generator mismatch: a checker operating on text or an early embedding may observe a substantial change, but later Q/K/V projections suppress that change and leave the representation driving image generation close to the original.
We construct equal-norm perturbations along these directions and recover the perturbed representations as alternative textual prompts. Generated images remain similar to outputs from the original prompt: mean CLIP image cosine similarity was 0.972, 0.950, 0.931, and 0.909 at relative perturbation scales of 2%, 5%, 10%, and 20%, respectively.
Operationally, we combine weak Q/K/V directions into a joint low-energy subspace, add a perturbation with a controlled norm relative to the editable prompt embedding, and recover the result as discrete text. No checkpoint parameters or inference code are modified. The final input is an ordinary prompt, so the weakness can affect standard deployments that rely on the built-in checker without rechecking the downstream representation or generated image.
An attacker with local access to the public model weights can identify these weak directions and prepare a transformed prompt offline. No modification of a deployed checkpoint or inference pipeline is required: the resulting text can be submitted through the normal prompt interface. If a deployment's safeguard evaluates surface text or an early representation, the transformed prompt may cross the filtering boundary while later projections suppress the change and preserve prohibited visual intent. This can enable generation attempts involving sexual, violent, hateful, disturbing, or illegal content that the corresponding original prompt would have caused the deployment to reject.
When evaluated against DreamShaper 7's built-in safety checker across five harmful-content categories, average generation success increased from 76.36% for original prompts to 96.27% for recovered prompts. For pornography prompts, success increased from 13.33% to 90.00%.
The issue is architectural rather than a software exploit: differences visible to an early safeguard can be attenuated by weak prompt-encoder projections while unsafe downstream visual intent is retained.