DiffZOO: A Purely Query-Based Black-Box Attack for red-teaming Text-to-Image Generative Model via Zeroth Order Optimization
Authors: Pucheng Dang, Xing Hu, Dong Li, Rui Zhang, Qi Guo, Kaidi Xu


Reviewer paper summaries: This paper introduces a black-box text-to-image (T2I) attack method specifically designed to target content related to nudity and violence. The approach is predicated on the assumption that the specifics of the text encoder model within diffusion models are unknown. To facilitate attacks from a discrete prompt space (tokens), the authors utilize a combination known as C-PRV and its sampled vector D-PRV to substitute the original prompt. C-PRV is optimized through Zeroth Order Optimization using a Q16 classifier in a white-box setting.
Summary of strengths: - This paper demonstrates the ability to launch attacks directly from the prompt, offering a more black-box approach compared to other methods, while maintaining comparable performance in terms of Attack Success Rate (ASR) on both removal-based and detection-based methods.
- The authors present a thorough ablation study that validates the effectiveness of each proposed module.
Summary of weaknesses: - There is a significant performance decline observed in the Ring-a-bell test, where the success rate dramatically falls from 97.2% (as reported in Table 2 of the original paper) to 17% in DiffZOO for the SLD-Medium on the Violence category, using the same Q16 classifier for evaluation in both studies. Please correct me if I have overlooked anything.
- Regarding Algorithm 1, as the S increases, the number of API calls in DiffZOO also rises linearly. It would be advantageous to include a comparison concerning the number of API calls in the ablation study and against other methods.
Comments, suggestions and typos: - Please see the weaknesses.
- It is beneficial to include example pairs: original prompt, attacked prompt, original image, and attack success image for the reader.
Overall assessment scores: 3