Prompt Recovery for Image Generation Models: A Comparative Study of Discrete Optimizers

## Abstract

Abstract Recovering natural language prompts for image generation models, solely based on the generated images is a difficult discrete optimization problem.
In this work, we present the first head-to-head comparison of recent discrete optimization techniques for the problem of prompt inversion . We evaluate Greedy Coordinate Gradients (GCG) (Zou et al., 2023 ) , PEZ (Wen et al., 2023 ) , Random Search, AutoDAN Zhu et al. ( 2023 ) and BLIP2’s image captioner (Li et al., 2023 ) across various evaluation metrics related to the quality of inverted prompts and the quality of the images generated by the inverted prompts.
We find that focusing on the CLIP similarity between the inverted prompts and the ground truth image acts as a poor proxy for the similarity between ground truth image and the image generated by the inverted prompts.
While the discrete optimizers effectively minimize their objectives, simply using responses from a well-trained captioner often leads to generated images that more closely resemble those produced by the original prompts.

## 1 Introduction

Images generated by AI models are flooding the internet and the models and prompts used for generation often feel like components of alchemy.
Naturally, the academic community aims to better understand the mechanisms at play in these generative systems, with one crucial area focusing on inverting the generative process by recovering natural language prompts from generated images (Fan et al., ).
Prompt recovery can help control image generation by providing words and concepts from images so users can combine and manipulate prompts for their own use (Wen et al., ; Brade et al., ) and help analyze the biases and study the possibly harmful associations built into these models (Chin et al., ).

Several recently introduced discrete optimization algorithms can invert the generation process and recover prompts from images.
Yet, to date, there is no standardized comparison of these methods for prompt inversion from image generation models.
In this work, we use a CLIP guided diffusion model to compare and contrast discrete optimizers suited for prompt inversion.
Specifically, we measure how PEZ (Wen et al., ), GCG (Zou et al., ), AutoDAN Zhu et al. (), BLIP2’s image captioner (Li et al., ), and random search stack up against one another.
Our experiments compare the natural language prompt recovered by each method using several metrics and they are followed by a discussion on the proficiency of each method for recovering prompts for image generation.

## 2 Related Work

To best situate this paper among prior work, we discuss several motivations for executing prompt inversion, other domains where discrete optimization is relevant, and the overall goal of our work in contrast to related papers.

While prompt inversion is an interesting task in its own right, there are two practical motivations to develop strong methods.
First, those interested in better controlling the output of image generation models may want to find a prompt from an image as a starting point for their own prompt engineering.
Second, by extracting prompts from images, one might better understand the various associations these text-to-image models have and debug them to avoid explicit content generation, for example (Chin et al., ).
Wen et al. () list iteratively improving prompts as one of the catalysts in their work on discrete optimization for prompt inversion.
In fact, image generation can easily and effectively be controlled by strategically refining the text input (Sohn et al., ).
Refining these prompts can be difficult though and Wen et al. () propose PEZ to optimize natural language inputs to be close in CLIP (Radford et al., ) embedding space to target images (we provide more detail on this optimizer in Section 3.1).
In contrast, Mahajan et al. () propose an inversion technique that considers the diffusion process instead of relying on CLIP embeddings.

Our focus is on discrete optimization methods for recovering prompts, but discrete optimization over natural language has several other applications like jailbreaking LLMs (Andriushchenko, ; Zou et al., ; Zhu et al., ) and measuring memorization (Schwarzschild et al., ; Kassem et al., ).
In particular, Zou et al. () propose Greedy Coordinate Gradients as a method to find adversarial prompts for LLMs that break their safety alignment.
We experiment with this optimizer for image generation inversion as Zou et al. () compare their optimizer to PEZ in their work, but only with the goal of jailbreaking LLMs.

Direct discrete optimization is not the only method for finding viable prompts, however.
Several approaches focus on using black box models to sample prompts.
Both Zhang et al. () and He et al. () use pretrained language models to extract prompts for given a output across text generation and image generation tasks respectively.
Moreover, as we show in this work, even a simple captioner that has not been finetuned for prompt generation often outperforms discrete optimization methods.

Yet, directly optimizing the prompts for inversion tasks remains an important area of study. Similar to prior work on counterfactual explanations (Verma et al., ), directly optimizing inputs for a desired outputs helps to better understand the decision boundaries of classifiers (Ribeiro et al., ). While generative models are not classifiers with explicit decisions and accuracy metrics, they are constantly making decisions on their representations based on the prompts. From background color to subject ethnicity, discrete optimization methods may provide a useful understanding of the relationship between prompts and images (Williams et al., ).

In this work, we emphasize solidifying ways of comparing discrete optimizers for image generation tasks.
Even with the rise of novel discrete optimization methods (Zou et al., ; Wen et al., ; Andriushchenko, ), standard comparison on prompt recovery from image generation is missing.
We focus on a holistic benchmark that focuses not only on the similarity between prompt and image, but also on the similarity among images generated by the inverted prompts which to the best of our knowledge has not been standardized for this setting.

## 3 The Optimizers

To best introduce the optimizers we study, it is critical to pose the prompt inversion problem formally.
Consider a tokenizer that maps from natural language to sequences of integer valued tokens corresponding to a list of indices in a vocabulary of tokens $\mathbb{T}$.
Let $x\in\mathbb{T}^{s}$ be a length $s$ sequence of tokens.
Next, let $\mathbf{E}\in\mathbb{R}^{|\mathbb{T}|\times d}$ be a matrix whose rows are $d$-dimensional embedding vectors, one for each token in the vocabulary.
To embed a sequence $x$, we can define $\mathbf{X}\in\{0,1\}^{s\times|\mathbb{T}|}$ s.t. $\mathbf{X}\mathbf{1}_{|\mathbb{T}|}=\mathbf{1}_{s}$ to be a matrix whose rows are one-hot encodings of the integers in the sequence $x$ allowing the product $\mathbf{XE}$ to define an $s\times d$ embedding of $x$.

As the name suggests, prompt inversion techniques seek to find the sequence
of tokens $x$, or equivalently their corresponding one-hot encodings $\mathbf{X}$, that solve the inverse equation, $\mathcal{M}^{-1}(Y)$, where $\mathcal{M}$ is a stochastic generative model that maps a sequence of tokens $x$ to an
image $Y$.
Typically we express the solution as the minimizer of some loss function $\mathcal{L}$, or the solution to the following optimization problem.

$$ $\displaystyle\underset{\mathbf{X}\in\{0,1\}^{s\times|\mathbb{T}|}}{\text{ argmin}}\quad$ $\displaystyle\mathcal{L}(\mathcal{M}(\mathbf{XE}),Y)$ (1) s.t. $\displaystyle\begin{aligned} &\mathbf{X}\mathbf{1}_{|\mathbb{T}|}=\mathbf{1}_{ s}\end{aligned}$ $$

Khashabi et al. () show that embeddings in $\mathbb{R}^{d}$ outside of the discrete set of the rows of $\mathbf{E}$ have little meaning to the generative model $\mathcal{M}$.
As a consequence, most prompt inversion methods focus on strategies for discrete optimization within the embedding table $\mathbf{E}$; we call this ‘hard prompting’ in a discrete space rather than ‘soft prompting’ in a continuous space.
While the gradient exists with respect to the entries of the input $\mathbf{XE}\in\mathbb{R}^{s\times d}$, continuous descent-based methods risk finding minima outside of $\mathbb{T}^{s}$, leaving us without hard tokens.

Moreover, computing the gradient through the full generation model $\mathcal{M}$ may be too expensive (for example when $\mathcal{M}$ is a diffusion model and every forward pass may take multiple seconds), but prior work uses CLIP (Radford et al., ) to encode images and text in a shared latent space.
Some of the methods we examine operate wholly within CLIP’s latent space to compute the loss between the prompt (text) and the target (image).
These methods approximate Equation 1 by solving the following problem where $\mathcal{L}_{\text{CLIP}}$ is a similarity loss defined over CLIP embeddings.

$$ $\displaystyle\underset{\mathbf{X}\in\{0,1\}^{s\times|\mathbb{T}|}}{\text{ argmin}}\quad$ $\displaystyle\mathcal{L}_{\text{CLIP}}(\mathbf{XE},Y)$ (2) s.t. $\displaystyle\begin{aligned} &\mathbf{X}\mathbf{1}_{|\mathbb{T}|}=\mathbf{1}_{ s}\end{aligned}$ $$

### 3.1 PEZ

The first approach we consider is PEZ (Wen et al., ), a version of projected gradient descent where descent steps are made in the continuous embedding space.
The gradients of the objective in Equation 2 are evaluated at points in embedding space corresponding to real tokens, but the trajectory of the iterates may deviate from the set of hard token embeddings.

More formally, let $\mathtt{Proj}_{\mathbf{E}}(\cdot)$ be an operator that projects vectors (or matrices row-wise) from $\mathbb{R}^{d}$ to their nearest row-vector of $\mathbf{E}$, and let $\xi_{i}\in\mathbb{R}^{s\times d}$ be a soft prompt.
As an iterative gradient-based optimizer, PEZ produces a sequence of iterates $[\xi_{0},\xi_{1},...,\xi_{n}]$ as it solves the minimization problem in Equation 2.
To update from $\xi_{i}$ to $\xi_{i+1}$, PEZ computes the gradient of the loss at the hard prompt $\mathtt{Proj}_{\mathbf{E}}(\xi_{i})$ and takes a step in the direction of this gradient from the soft prompt $\xi_{i}$.
Thus, PEZ gives a fast, lightweight method of discrete optimization while still allowing the use of gradient-based descent to approximately solve the problem in Equation 1.
For more information, see Algorithm 1 as described by Wen et al. ().

### 3.2 Greedy Coordinate Gradients

Greedy Coordinate Gradients (GCG) (Zou et al., ) is an alternative method for optimizing over the discrete vocabulary using the gradients of the objective with respect to the matrix $\mathbf{X}$ in Equation 2.
In particular, we compute the gradient of the loss with respect to $\mathbf{X}$, which is a matrix of the same shape that approximately ranks token swaps.
As each entry in a given row of $\mathbf{X}$ corresponds to a token in the vocabulary, each row $i$ in its gradient relays to us how influential changing the token $x_{i}$ to each other token in the vocabulary might be in lowering the loss.
More formally, we compute $\nabla_{\mathbf{X}}\mathcal{L}_{\text{CLIP}}(\mathcal{M}(\mathbf{X}\mathbf{E})
,Y)$, then, just as gradient descent methods takes steps in the opposite direction of the gradient, we select a random batch of candidate swaps from the top $k$ largest entries of the *negative* gradient.
A given swap corresponds to a single token change in $x$ and we directly compute the loss for each of these candidates and greedily accept the best one as our new iterate.

### 3.3 AutoDAN

AutoDAN (Zhu et al., ) is an optimizer proposed as a method of finding human-readable adversarial attacks on aligned language models. The optimizer solves Eq. (1) by iteratively optimizing a single token appended to the current prompt. Given an initial prefix, e.g., “Image of a”, the algorithm searches for the token that follows ‘a’ that minimizes the objective function.

The optimizer incorporates a ‘readability’ objective based on the log probability of the next token given an underlying language model. Similarly to GCG, the algorithm employs a coarse-to-fine search strategy. The algorithm appends an initial token, $\hat{x}$ to the current iterate $x$, and scores each token in the vocabulary according to the following scoring function:

$$ $\text{score}(x_{i})=-\big{(}\nabla_{\hat{x}}\mathcal{L}([x,\hat{x}]E)\big{)}+ \log(p(x_{i}|x))$ (3) $$

The algorithm selects the top $k$ scoring tokens and performs a fine-grained search by computing the exact loss over each, taking the token that minimizes the loss, $\mathcal{L}$. This minimizing token is then appended to $x$, giving $x_{t+1}=\begin{bmatrix}x_{t}&x^{*}_{i}\end{bmatrix}$.

AutoDAN was originally designed for text-to-text language models, where the log probability, $\log(p(x_{i}|x))$ was directly available. However, in this review, we use CLIP to determine the quality of the prompt, which does not inherently compute the log probability. We thus use FUSE Williams and Kolter (), a recently proposed approach for solving multi-objective problems across models and tokenizers. FUSE approximates the jacobian of a mapping between the two models. By using the embeddings of a text-to-text language model, such as GPT2 to compute both the log probability, $\log(p(x_{i}|x))$, and the gradient, $\nabla_{\hat{x}_{GPT}}\mathcal{L}_{CLIP}(f([x_{GPT},\hat{x}_{GPT}]))$, where $f$ is the mapping from GPT’s embeddings to CLIP’s embeddings. This allows us to apply a language prior when optimizing a prompt with CLIP. We additionally explore the scenario in which we do not use a language prior, by reverting to the standard case in which we optimize over CLIP embeddings, and fix $p(x_{i}|x)=\frac{1}{|\mathbb{T}|}$.

In our experiments, we run AutoDAN for $16$ steps, which enforces a a maximum token length of $16$ due to one-by-one generation of new tokens. We also utilize a beam search with a beam width of 5.

### 3.4 Random Search

Andriushchenko () suggests that such sophisticated strategies may not be critical for prompt optimization—given enough time, random searches can perform adequately in a variety of settings.
Thus, we explore a variant of random search (Rastrigin, ).
While random search traditionally selects random candidates from within a ball around the the current iterate, this approach does not directly map to hard prompting.
Due to the curse of dimensionality, true random samples around these high-dimensional embedding spaces are sampled from a ball of with negligible volume around the initial embedding; a nearest neighbor projection would often fail to return a new candidate.

In order to address this limitation, rather than randomly sampling from the ball around a given embedding, $\mathbf{XE}$, we simulate the behavior of a random sample, by randomly selecting from an $l_{0}$ ball around each element of the sequence in $\mathbf{XE}$.
At every iteration, we randomly select a batch of candidates from all embeddings in the $l_{0}$ ball and greedily accept the best single-token replacement as the next iterate.

### 3.5 Captioning

Lastly, we use automated image captions as a proxy for the inverted prompts.
Given that a prompt for an image generation model likely encodes information about the setting of the desired image, its subject, its quality, and other properties, we assume that captioning an image provides a human-readable token sequence with some or all of these same properties necessary to generate the image.
Moreover, as captioners are typically autoregressive, they have the potential to return an approximate inversion much faster than other methods.

Here, we focus on a single model, BLIP-2 (Li et al., ).
This model is a generic and compute-efficient vision-langauge pre-training (VLP) method.
VLP techniques aim to learn multimodal foundation models on a variety of vision-language tasks.
BLIP-2 leverages a trainable module, the Q-former, in order to bridge the gap between a frozen image encoder and a frozen LLM, facilitating image-text matching tasks, image-grounded text generation tasks, and image-text contrastive learning tasks. We prioritize BLIP-2’s image-grounded text generation over other captioners as BLIP-2’s emphasis on the frozen CLIP-style encoder aligns well with the above prompt inversion methods, all of which use frozen CLIP encoders.

## 4 Evaluation

For each optimizer detailed above, we assess their performance across several criteria. Considering the stochastic nature of image generation, we measure the effectiveness of an inverted prompt by asking the following questions (and we include the units of measurement in parentheses).

- 1.
How similar (FID Score (Heusel et al., ), KID Score (Bińkowski et al., )) are images generated with the inverted prompt to images generated by the original prompt?
- 2.
How well (CLIP Score (Hessel et al., )) does the inverted prompt align with the original image?
- 3.
How well (Text Embedding Similarity (Reade et al., )) does the semantic content of the inverted prompt align with the semantic content of the original prompt?

We address the stochasticity inherent to the image generation process by averaging the performance of each method across several images generated by the original prompt and the inverted prompts.
First, we randomly sample $250$ prompts from an existing dataset of prompts(^1^11We use samples from the Poloclub DiffusionDB dataset of prompt-image pairs (Wang et al., ) to find our evaluation prompts.) used by Stable Diffusion (Rombach et al., ).(^2^22All images are generated with StableDiffusion 2-1: stabilityai/stable-diffusion.)
Given each of these prompts, we generate $10$ baseline images for each baseline prompt, and apply the various discrete optimizers to each.
Once we have found an inverted prompts for each baseline image, we generate $2$ images with each of the inverted prompts. We then compute our metrics across the $10$ baseline prompts and images and the $20$ images based on the $10$ inverted prompts.

## 5 Empirical Results

In this section we present quantitative and qualitative results comparing each method.
Across several metrics, we see the quantitative rankings are consistent, but we find upon qualitative examination that these numeric rankings show only a partial picture.
When examining the images and the recovered prompts themselves we see complicated trade offs between methods.

### 5.1 Quantitatively Ranking Methods

#### Image to Image Comparisons

Figure: (a) FID (top) and KID (bottom) comparison by method
Refer to caption: x1.png

For image to image comparisons (Figure 1), we analyze images generated by the best early-stopped prompt for each method and the convergence rates across our considered image similarity metrics for each algorithm. Our validation set, which consists of the ground truth prompts has an FID of $209.78$ and a KID of $-0.001$. The KID score in particular tells us that the closer any algorithm gets to a KID of 0 0, the more similar that prompt will be to the ground truth, whereas, while the ordering may be consistent with FID scores, it is possible that using FID rather than KID may incorrectly show that a method improves over the validation set.

We find that generating images from BLIP-2 captions provide the most similar images to those generated by the original prompt, with those images generated by PEZ as a close second, with the captioner generating images with with average FID and KID values of $209.78$ and $0.0489$, while the average across all prompt lengths for PEZ gives an FID and KID of and $280.39$ and $0.0482$. In addition, we see a significant gap in performance between AutoDAN with a prior and AutoDAN without a prior, where the former performs much more similarly the captioner and the latter performing in line with GCG and a Random Search.

Analyzing the ojective trajectory over the course of optimization reveals interesting trade-offs.
We used a small validation set to determine the number of steps for all algorithms to converge for the given prompts and images used in this study. We determined that all optimizers stop receiving meaningful improvements after $3000$ steps. We observe that GCG and a Random Search find a prompt comparable to their best early-stopped prompt within the first $25$ steps and then struggle to descend further, analagous to applying too high of a learning rate to optimization problems. On the other hand, PEZ has a slower convergence, but it descends consistently across all steps until it finds prompts that improve over both the GCG and Random Search prompts. Moreover, as PEZ uses a single forward and backward pass, it requires much less time to run than the comparison methods. In other words, PEZ finds prompts that generate images more similar to the ground truth in much less time than all other optimizers considered here, except for the BLIP-2 Captioner.

#### Text to Image Comparisons

When we focus on the alignment between the text and images we see an interesting trend emerge. We first compare the CLIP similarity between the inverted prompts and the original image (in the top of Figure 2). Note that this is the optimization objective used across all optimizers.

We find that all optimizers do a good job maximizing their objective. While AutoDAN without a language prior performs the worst over all optimizers, it still does a better job of maximizing the CLIP similarity over both our validation set and the BLIP2 Captioner. Optimizing the objective with GCG and AutoDAN with a language prior performs the best over the discrete optimizers, with PEZ coming a close third. The contrast between the performance of each optimizer on their objective and their relative lack of performance across the image-to-image and text-to-text metrics suggests that the CLIP objective is acting as a poor proxy for finding prompts for generative image models.

While there may be room for improvement over the CLIP objective for this task, this comparison allows us to take a better look at the convergence rates of all optimizers. Just as in the image-to-image comparison, GCG and Random Search quickly find a good prompt and then very slowly improve from there. Whereas PEZ follows a much more gradual curve, with sharp peaks when new optima are found. As these are log scaled in their x-axes, we do not see all peaks except for the early stopped result. The average prompt found with PEZ is much lower than the comparison methods, but the peaks are in line with the other methods. Additionally, GCG and Random Search again very quickly within the first $20$ steps and then very slowly update from there.

#### Text to Text Comparisons

Figure: Figure 2: CLIP Similarity between the inverted prompt and images generated by the original prompt. This CLIP Similarity is the objective that each optimizer is maximizing.
Refer to caption: x5.png

Lastly, we compare the similarity in the text of the found prompts to the ground truth prompts.
Figure 3 shows the cosine similarity between the text embeddings(^3^33Embeddings were computed using sentence-transformers/all-MiniLM-L6-v2 to be in line with (Reade et al., )) of the found prompts and the ground truth prompts.

Just as in the above cases, we find that the BLIP-2 captioner finds prompts more similar to the ground truth than all other metrics, with AutoDAN with a language prior and PEZ as close seconds. GCG, Random Search, and AutoDAN without a language prior remain clustered together in terms of their performance. Moreover, when looking at their convergence rate, we see the same story as above. GCG and Random Search very quickly ascend, and while PEZ ascends more slowly it eventually exceeds GCG and Random Search in their performance within the first $100$ optimizations steps of its allowed $3000$ steps.

#### Hyperparameter Choice

Each optimizer has various hyperparameters that can be adjusted. Intuitively, it may seem that the number of free tokens (tokens that can be optimized) is a particularly relevant parameter. However, this is not always the case. In line with the findings by Wen et al. (), PEZ’s performance remains fairly independent of the number of free tokens up to a certain point. Given that we allowed no fewer than 8 free tokens, there may be a performance drop-off if we further decrease the number of tokens. However, PEZ’s performance across all metrics does not appear to be significantly dependent on its free tokens. For context, the BLIP-2 captioner, which does not have a fixed length, can serve as a benchmark for reasonable prompt length. Its captions average 10.6 tokens using CLIP’s tokenizer, and 5.8 tokens after removing stop-words. Similarly, we see that neither GCG nor Random Search dependent on the number of free tokens. With no metric showing a statistically significant improvement for when adding more or fewer optimizable tokens.

AutoDAN, similar to the BLIP-2 captioner, can return a variable number of tokens due to early stopping. However, we use AutoDAN with a beam search, where each individual step uses a much smaller batch size for its fine-grained search, unlike GCG and Random Search. The latter have a 512 batch size, while AutoDAN with 4 beams and 128 tokens evaluates the same number of tokens for the fine-grained search. Increasing AutoDAN to 256 tokens, effectively doubling the number of tokens it searches over compared to GCG and Random Search, results in a small improvement across the board. Based on the optimal batch sizes described by Zou et al. (), further improvements in AutoDAN might be achieved by allowing a 512 batch size. However, there are likely diminishing returns, especially as computation time increases with larger batch sizes.

Figure: (a) Original images v. recovered images
Refer to caption: x7.png

### 5.2 Qualitatively Assessing Inverted Prompts

In the quantitative evaluation above, we show that captioning images to find prompts may result in better prompts across several metrics compared to searching for a prompt via discrete optimization. Other than BLIP-2 and AutoDAN with the language prior applied, no inversion method produces human-readable prompts despite the quantitative similarities in their performance. Comparing these two methods, BLIP-2 provides simpler and more concrete captions, such as “a plant in a pot”, while AutoDAN finds natural language prompts that evoke the imagery described by the image, “…being marketed ‘Round Cake Mountain in Amber Candy Ball Land”’ to describe Section 5.2 (top).

When comparing each recovered prompt to the original prompt, there is often a significant amount of information lost during the generation process that is unrecoverable. In the pink elephant example (top of Section 5.2), both random search and PEZ capture basic information such as “elephant” and “pink”. However, more nuanced descriptors like “futuristic” or “photorealistic” are harder to extract from the image alone. This comparison sheds light on why PEZ outperforms GCG and random search, as PEZ appears to stay more on topic. For the clay lion example, PEZ includes tokens like “gnome”, “plant”, “acorn”, “plush”, and “coconut”, while GCG and Random Search do not provide significantly more specificity than “acorn” and “planter”; and “hilltop” and “rainbow” respectively.

At its core, PEZ is a projected gradient descent method, using common optimizers, such as SGD or Adam with a weight decay. This approach encourages some form of regularization in its optimization, that discourages the one-and-done approach that GCG and Random Search seem to use, where they discourage repeating the same general concepts or tokens in a prompt.

Table: Table 1: Example images and corresponding $16$-token prompts. Each image is generated by the *original prompt* and we show examples of the inversion result from each method. Other than BLIP-2 and AutoDAN with the language prior applied, no inversion method produces more human-readable prompts than another despite the quantitative differences their performance.

## 6 Discussion

Our results prompt discussion on the practical implications, the limitations, and the future directions related to prompt inversion.
To begin, someone interested in finding good prompts from images can conclude from our work that image captioning tools are a good approach.
They are fast, as the heavy lifting is done ahead of time in training these models rather than optimizing anything per image in deployment.
They also best capture natural sounding language, a goal that discrete optimizers might better incorporate as these tools mature.

The limitations of our work center mostly on the fact that the diffusion and image-text embedding space is so heavily driven by only a few models.
As the set of state-of-the-art large text-prompted image generations models grows, the trends we report may no longer hold.
In the same vein, small variations in the optimization strategies could have large impacts on these results.
In short, like any empirical benchmark results, our findings are subject to change as the field progresses.

Here, we enumerate several questions and quirks arising from our work that warrant further investigation.
First, Zou et al. () report that GCG is effective at jailbreaking LLMs and PEZ is not.
This stands in stark contrast to these two methods relative performance at prompt inversion.
Why might optimizing over natural language be so different in these settings?
This could be a difference in the particular models or in the loss landscapes.
Second, GCG and random search perform so similarly begging the question why does gradient information make so little difference?
The intuition that the gradient signal is informative comes from observing the success of PEZ, so why is the combination of search and gradient-based optimization in GCG leave it so similar to random search alone?
Finally, we posit that there is a lot of room for improvement.
In other words, prompt inversion is far from solved, and it makes for a great test bed for new discrete optimization approaches.

## Peer Reviews

confidence: 3
contribution: 2
initial_rating: 3
presentation: 4
questions: [Questions numbered according to each Weakness above]
1. The Discussion includes "details and quirks" for further investigation. Could there be more clarity about possible experimental directions to take steps towards improving the methods informed by these insights? Are there preliminary studies enabled by the existing analytical set-up that can provide initial guidance into these direction? 
2. Do quantitative analyses using CLIPScore for text:image analyses hold when extended to more robust consistency metrics such as DSG and VQAScore?
3. Should we expect these patterns to hold for other image generation models?
4. Do the patterns described in the qualitative analysis section hold for other kinds of prompts and concept?
soundness: 3
strengths: * The paper is well-written, clear and easy to read with methodologies explained well and experimental set-up very clear
* The analysis contains broad coverage over six different prompt recovery methodologies 
* The provided qualitative analysis is very thorough for the given example, usefully highlighting connections between related concepts mentioned in prompts and rarity/imagniation of certain terminologies.
* The quantitative analysis covers a variety of evaluation types, including image:image, text:image, and text:text, including between original and updated images, new prompt and original image, and new prompt and original prompt.
* The work is well-motivated and highly contextualized among previous works, defining why prompt inversion techniques are useful compared to other methods.
* The work usefully adapts existing methods used in language models to allow extensibility for text-to-image generative models.
summary: This paper presents an analysis of existing prompt optimization methodologies, including PEZ, Greedy Coordinate Gradients, AutoDAN, Random Search, PRISM, and Captioning. It contains extensive quantitative analysis of 100 prompts and images from the Stable Diffusion model across image:image, text:image, and text:text metrics for overall perfrmance and performance throughout the optimization process (for relevant methods). In addition, it includes a discussion of a qualitative prompt example and possible concept relations between specific terms in the prompts and original image.
weaknesses: 1. While the provided analysis is insightful and sets the groundwork for improved methods, the work lacks thorough discussion or early experimentation of proposed solutions to the challenges observed with the existing prompt inversion methods. The contribution of the work is limited without studies or even specific proposals for improvements of existing methods contextualized by findings of the paper.
2. CLIP has known issues as a consistency metric, including bias in its representations [1,2] and issues with compositionality [3,4], that could make CLIPScore vulnerable. More robust alternatives such as DSG and VQAScore should be considered for the text:image analyses. 
3. The analysis is only used on images generated from Stable Diffusion, thus limiting its insights. The work would be strengthened with study of prompt inversion techniques for images that come from other models, e.g. DALLE.
4. The qualitative analysis, while very thorough and insightful, seems limited to only a single image. This limits its utility and the takeaways may not be extensible to other prompt styles or concepts.

[References]
1. Evaluating clip: towards characterization of broader capabilities and downstream implications
2. Vision-Language Models Performing Zero-Shot Tasks Exhibit Disparities Between Gender Groups
3. Winoground: Probing Vision and Language Models for Visio-Linguistic Compositionality
4. WHEN AND WHY VISION-LANGUAGE MODELS BEHAVE LIKE BAGS-OF-WORDS, AND WHAT TO DO ABOUT IT?

---

confidence: 5
contribution: 2
initial_rating: 3
presentation: 3
questions: - Are the results biased towards models which actually perform inversion (not captioning based) in the CLIP-space. Can an independent model be used to verify the validity of the claims? 

- As mentioned in the weaknesses, for the claim that captioning based models are better suited, the vocabulary of the pretrained text-to-image diffusion model should align with that of the captioning model?
soundness: 2
strengths: + The paper is easy to read and self-contained.
+ The work performs a comparative analysis on different prompt optimization strategies for text-to-image generation across different metrics such as CLIP-scores, FiD, and KID.
summary: This work performs a comparative study on the different discrete optimization frameworks for hard prompt optimization. The methods compared are PEZ, PRISM, GCD, random search and captioning based models. The paper performs qualitative and quantitative analysis on different discrete optimization strategies for finding the best prompt for text-to-image generation. Experiments are performed on a set of 100 prompts from Stable diffusion and the inverted prompts along with the generated images are evaluated on the CLIP-scores, Cosine-similarity, FiD and KiD metrics.
weaknesses: - The work considers Stable-diffusion 2.1 which uses a fixed pretrained CLIP-based text encoder. Therefore, the study will yield biased results towards approaches which minimize CLIP objective or have same distribution of image-prompt pairs. For example, PEZ optimizes in the CLIP space and therefore has better CLIP-scores in quantitative analysis.

- The work concludes captioning based models to yield better prompts for generating images. However, this is not necessarily true. The vocabulary and the distribution of a captioning model and the image generation model can be very different. 

- Prompt inversion directly from SD model as in Mahajan et al. 2024 is not considered. The diffusion objective with a PEZ -like optimizer would provide insights into the impact of loss in eq.1 and eq.2 of the paper.  

- For text-to-image generation, is the fluency of the prompt an important factor? 

Minor:
The formatting is different from the ICLR template (package times in latex).

---

confidence: 4
contribution: 1
initial_rating: 3
presentation: 2
questions: 1. What new observation we can have, as a community, on different prompt inversion techniques, and why this is important?
2. How can we complement this analysis with proper results on multiple aspects of prompt inversion?
3. Why Section 3 is needed rather than other experiments?
soundness: 2
strengths: I recognize the novelty of the proposed approach. To the best of my knowledge, this is the first work comparing different prompt inversion techniques for text-to-image models. The paper is overall well-written and easy to follow and understand.
summary: The paper presents an empirical study of different techniques for prompt recovery in text-to-image diffusion model. The idea is to select 6 baseline methods (PRISM, Captioning, AutoDAN, PEZ, GCG) and assess their performance in recovering the input prompt for an input image. The study is conducted by sampling 10 images for each one of 100 prompts used as input in Stable Diffusion 2.1, where the prompt is reconstructed by each of the proposed methods. The quality of the reconstruction is then evaluated with FID/KID score among images of the original and reconstructed prompts, CLIP score among inverted prompts and original images, and text embedding similarity between the original and inverted prompts.
weaknesses: I have several concerns about this manuscript. Overall, I believe that unfortunately, the proposed study lacks the importance of the results to be at the level of ICLR. I will detail my viewpoint in separate sections.
1. My main concern is related to the impact of the proposed results on the community. In a comparative study like this, I believe the most important factor is providing the community with a new viewpoint on an important issue, potentially encouraging new research or raising new questions. I struggle to see this in the proposed manuscript. By reading the paper, it looks to me that results are just presented, without further interpretation that may give new perspectives. There is a Discussion section but it is quite rudimentary, stating that captioning is a good alternative to prompt inversion and re-assessing questions already known in the literature, properly cited.
2. I also believe that the experimental effort in this study is quite limited. There is only one diffusion model considered (SD v2.1), 1000 generated images for each method under analysis. This can be done in just a few days in any laboratory with sufficient computational power. The evaluation itself is quite limited. For instance, there is no comparison of the effect on fine-grained details of prompt inversion with respect to captioning, nor a proper analysis of the variability of results for the same prompt (variability is included in the experiments but not treated separately). For the qualitative evaluation, there is no user study allowing to trace of new conclusions following human judgment.
3. While the text is easy to follow, I believe that Section 3 of the paper can be completely removed and replaced with a paragraph, to allow for more space for experiments, which is highly needed in this case. Why describe all methods in detail when we can simply refer to the literature and quickly summarise them? The entire section feels unnecessary.

---

confidence: 4
contribution: 1
initial_rating: 3
presentation: 3
questions: See questions and suggestions in the weakness section.

Particularly, if the scope of the work remains just CLIP-based discrete inversion methods, I would have liked to see more extensive evaluation and insights into the specific scenarios where different methods excel or underperform. Moreover, I would have liked to see a more robust evaluation of the claims surrounding CLIP being a poor proxy (trying to control for adversarial solutions, adding human evaluations).
soundness: 1
strengths: The paper’s main strength is the attempt at a more thorough evaluation and better benchmarking of methods in the prompt-inversion field. The metrics used are mostly reasonable, and are used to evaluate a range of baselines, which are clearly presented in the paper.

Overall, the paper was also fairly easy to read, the experiments easy to understand, and I believe this paper could be fairly easily replicated.
summary: The paper investigates solutions for the task of prompt inversion, where the goal is to recover discrete text-to-image prompts that lead to the reconstruction of images from the same distribution as a given target image.

Specifically, they consider a set of existing discrete optimization techniques, as well as a feed-forward captioning model and an in-context learning based approach that leverages a VLM judge to iteratively refine prompts.

To evaluate these, the authors create a set of images with a fixed prompt benchmark, invert the prompts using each method, and then generate novel images using the inverted prompts. These new images are evaluated against the original generated images using standard quality metrics (FID, KID). Furthermore, CLIP-score is used to compare the new images to the original prompt set, and a text-to-text CLIP similarity metric is used to evaluate the inverted prompts.

The authors conclude that CLIP similarity between inverted prompts and the ground truth images is a poor proxy for the prompt inversion task, and that further research is needed in this direction.
weaknesses: Unfortunately, the paper is very limited in scope and grounds some of its choices in claims that are probably incorrect. For example:

1) 
The motivation for focusing on discrete prompts (L138) is probably wrong.
The findings of Khashabi do not seem relevant in this scenario since the text-to-image field uses soft prompting very extensively (Textual Inversion [Gal et al, ICLR 2023], Null-Text Inversion [Mokady et al, CVPR 2023], Custom Diffusion [Kumari et al, CVPR 2023], Imagic [Kawar et al, CVPR 2023], Reversion [Huang et al, 2023]). 

Similarly, the claim “As a consequence, most prompt inversion methods focus on strategies for discrete optimization within the embedding table E” is likely wrong. This is difficult to gauge, but prominent soft prompting techniques in the text-to-image setting are cited 10-20 times as often as their discrete counterparts.

2) 
The work focuses on CLIP-based inversion, where CLIP-space similarity is used to gauge the alignment between prompts and images. This is a very limiting restriction, and likely leads to much of the author’s conclusions. 

A lot of prior art does use the diffusion model to compute a loss, and the signal there is stronger and more aligned with the diffusion distribution itself (see e.g., all the papers cited in point (1) above, or the work of Mahajan et al (CVPR 2024) which outperforms PEZ across the board. 

If a range of methods is being benchmarked, it would be revealing to see how different families of approaches behave when compared with each-other, and specifically if and how the use of a diffusion loss changes the findings on CLIP-based optimizers.
This holds doubly true these days since most large-scale models are shifting away from using CLIP as the text encoder and its not clear if the findings here will even generalize to such models.

3) 
The authors demonstrate that CLIP alignment is decoupled from FID, KID improvements and conclude that CLIP is a poor proxy for the prompt inversion task (L374). However, most of the benchmarked methods use the same CLIP model for a loss and for the evaluation. I am not entirely convinced that this is this a matter of CLIP acting as a poor proxy, instead of the proposed methods simply finding solutions which are adversarial to CLIP (see e.g., EditBench [Wang et al, CVPR 2023] which arrive at an opposite conclusion regarding CLIP). When you consider AutoDAN with the prior, for example, you get improved results on the visual side, indicating that making it harder for the model to find adversarial solutions may help? 

It would be informative to see CLIP results also using a different CLIP model (e.g., OpenCLIP). This could help somewhat in disambiguating adversarialness vs a disconnect between CLIP and image alignment.

Additional concerns:

4) 
The evaluation is relatively basic. In a paper focused on this kind of benchmarking, I would have expected to see far more in-depth experiments. For example, does the performance of different approaches depend on the type of image being inverted (style reference, dense scene with lots of content, single vs multiple subjects etc.)? Do these findings generalize across different generative models? What about models not using CLIP as a text encoder?

5) 
I would have liked to see human evaluation to back up most of the core experiments in the paper (even at a smaller scale). 

6) 
There is only a single qualitative example of inverted prompts, and no examples of the reconstructed images for any of the methods. Please add some visual examples. 

I will note that my biggest concern is the extremely limited scope of the work, and I’m not sure this can be addressed in a rebuttal. However, I’m willing to discuss matters if the authors believe they can convince me otherwise.

Meta-review: The paper presents an empirical analysis of prompt recovery methods in text-to-image models, showcasing both qualitative and quantitative results.

The paper was reviewed by four experts in the domain who acknowledged that the paper was well written and easy to follow (BePT, uWcM, Uzm8, 4nSo), the quantitative analysis considered several evaluation types / metrics (BePT, uWcM), the work was well positioned in the literature (BePT), and the experiments were easy to understand (4nSo).

The main concerns raised by the reviewers were:
1. Missing sufficiently in-depth discussion on the findings and early experimentation of proposed solutions to the observed challenges, making the contribution rather limited (BePT, 4nSo)
2. The use of CLIPscore should be revised to increase the reliability of the observations (BePT)
3. Analysis performed on stable diffusion images only, and the model of choice relying on CLIP, thus limiting its insights and takeaways (BePT, uWcM, Uzm8, 4nSo)
4. Claims not well supported by experimental evidence -- e.g. differences in vocabulary in image captioning and generation models (uWcM)
5. Missing related works in the discussion (uWcM, 4nSo)
6. Unclear significance of the presented results (Uzm8)

During rebuttal and discussion, the authors acknowledge the relevance of some of the points raised by the reviewers and consider those to improve future iterations of their work. Unfortunately, the rebuttal does not take the opportunity to strengthen the analysis and back up claims with additional empirical evidence, as requested by the reviewers. After discussion, the reviewers unanimously recommend rejection. The AC agrees with the reviewers' assessment and recommends to reject. The AC encourages the authors to consider the feedback received to improve future iterations of their work.

Decision: Reject