AdvI2I: Adversarial Image Attack on Image-to-Image Diffusion Models
Authors: Yaopei Zeng
Yuanpu Cao
Bochuan Cao
Yurui Chang
Jinghui Chen
Lu Lin
Venue: ICML 2025 poster (2025)
Keywords: Diffusion model
Adversarial attack
Primary area: deep_learning->generative_models_and_autoencoders

Abstract: Recent advances in diffusion models have significantly enhanced the quality of image synthesis, yet they have also introduced serious safety concerns, particularly the generation of Not Safe for Work (NSFW) content. Previous research has demonstrated that adversarial prompts can be used to generate NSFW content. However, such adversarial text prompts are often easily detectable by text-based filters, limiting their efficacy. In this paper, we expose a previously overlooked vulnerability: adversarial image attacks targeting Image-to-Image (I2I) diffusion models. We propose AdvI2I, a novel framework that manipulates input images to induce diffusion models to generate NSFW content. By optimizing a generator to craft adversarial images, AdvI2I circumvents existing defense mechanisms, such as Safe Latent Diffusion (SLD), without altering the text prompts. Furthermore, we introduce AdvI2I-Adaptive, an enhanced version that adapts to potential countermeasures and minimizes the resemblance between adversarial images and NSFW concept embeddings, making the attack more resilient against defenses. Through extensive experiments, we demonstrate that both AdvI2I and AdvI2I-Adaptive can effectively bypass current safeguards, highlighting the urgent need for stronger security measures to address the misuse of I2I diffusion models.

AdvI2I: Adversarial Image Attack on Image-to-Image Diffusion Models
Yaopei Zeng'
Yuanpu Cao
Bochuan Cao
Yurui Chang'
Jinghui Chen Lu Lin
CAUTION: This paper contains explicit content that may be disturbing to some readers.
Abstract
Zhang et al., 2023). However, these advancements have also raised significant ethical and safety concems. Particularly, when provided with certain prompts, Text-to-Image (T21) diffusion models can be abused to generate Not Safe for Work (NSFW) content that depicts unsafe concepts such as violence and nudity. This issue stems from the presence of NSFW samples in the large-scale training datasets sourced from the Internet (Schuhmann et al., 2022), making it per- vasive problem in emerging diffusion models (Truong et al., 2024; Schramowski et al., 2023). Despite some early ef- forts have been made in defending against the generation of NSFW content (Gandikota et al., 2023; 2024; Schramowski et al., 2023; Comp 2022), recent studies have shown that these safeguards can still be circumvented by carefully crafted adversarial prompts (Yang et al., 2024c; Ma et al., 2024; Yang al., 2024a; Tsai et al., 2023). As a result, malicious users can exploit these models generate NSFW images for unethical purposes.
Recent advances in diffusion models have sig- nificantly enhanced the quality of image synthe- sis, yet they have also introduced serious safety concerns, particularly the generation of Not Safe for Work (NSFW) content. Previous research has demonstrated that adversarial prompts can be used to generate NSFW content. However, such adversarial text prompts are often easily de- tectable by text-based filters, limiting their effi- cacy. In this paper, we expose previously over- looked vulnerability: adversarial image attacks targeting Image-to- Image (I2I) diffusion models. We propose Adv12I, novel framework that ma- nipulates input images to induce diffusion mod- els to generate NSFW content. By optimizing a generator to craft adversarial images, AdvI2I cir- cumvents existing defense mechanisms, such as Safe Latent Diffusion (SLD), without altering the text prompts. Furthermore, we introduce AdvI21- Adaptive, an enhanced version that adapts to po- tential countermeasures and minimizes the resem- blance between adversarial images and NSFW concept embeddings, making the attack even more resilient against defenses. Through extensive experiments, we demonstrate that both Adv12I and AdvI21-Adaptive can effectively bypass rent safeguards, highlighting the urgent need for stronger security measures to address the misuse of 121 diffusion models. The code is available at http::/ggttubb..omm/pppoaazaaaa
While adversarial prompts present a notable risk to the gen- eration safety of diffusion models, their Achilles' heel lies in that such attacks work by changing the input text prompt, which can exhibit easily detectable patterns that distinguish them from natural prompts. Specifically, we applied four types of simple filters (perplexity filter, keyword filter, em- bedding filter and large language model (LLM) filter) to range of adversarial prompt attacks (Zhuang et al., 2023; Kou et al., 2023; Tsai et al., 2023; Ma et al., 2024; Yang et al., 2024c), and found that even the simplest filters can effectively identify adversarial prompts from normal ones in most cases (see more detailed in Section 3.1). Notably, naive perplexity filter can (on average) reduce the attack success rate (ASR) of adversarial prompts by 58%, while LLM as the safety filter reduces the ASR to under 20%.
1. Introduction
This suggests that adversarial text prompts can be identified, which means that diffusion models can reject generating images with such queries. However, the new question is:
Recently, diffusion models have made significant strides in the domain of image synthesis, demonstrating their abil- ity to produce high-quality images (Rombach et al., 2022;
Does the rejection of adversarial text prompts truly ensure the safety of diffusion models?
'College of Information Sciences and Technology, Pennsylva- nia State University, State College PA, USA. Correspondence to: Yaopei Zeng <xpu=5499psu..cuu>>, Lu Lin <lulin& psu.eu>>>.
In this work, we provide a negative answer to this question. We reveal the risk of adversarial images that can also in- duce diffusion models to generate NSFW images, which has not been well explored in previous research. We propose
Proceedings of the ndnd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

Ady12I: Adversarial Image Attack on Image Diffusion Models
framework named Adv12I to demonstrate the effective- ness of such an attack on the Image-to-Image (12I) diffusion model, alerting the community to adversarial attacks from not only the prompt but also the image condition side. In ad- dition to text prompts, 121 diffusion models conventionally utilize an image as a conditioning input. By leveraging ad- versarial images, attackers can induce the diffusion model to generate NSFW images. For example, an image of the pres- ident can be manipulated to depict nudity. Moreover, this attack can bypass existing defense mechanisms designed for diffusion models, revealing a significant yet underexplored security vulnerability in this domain. By circumventing these defenses, Adv12I can effectively expose the inherent risks present 121 models, highlighting their susceptibility to generating NSFW content under adversarial influence.
2. Related Work
Adversarial Attack and Defense T21 Diffusion Mod- els. Diffusion models are susceptible to generating NSFW images due the difficulty of thoroughly eliminating prob- lematic data from training datasets. Recent studies have explored the potential for adversarial prompts to manipu- late these models to create inappropriate images (Zhuang et al., 2023; Kou et al., 2023; Tsai et al., 2023; Ma et al., 2024; Yang et al., 2024c). For example, QF-Attack (Zhuang et al., 2023) generates adversarial prompts by minimizing the cosine distance between the features of the original prompts and those of target prompts extracted by the text encoder. Similarly, Ring-A-Bell (Tsai et al., 2023) uses steering vectors (Subramani et al., 2022) representing un- safe concepts as optimization targets for adversarial prompts. This method effectively circumvents concept removal tech- niques (Gandikota et al., 2023; 2024; Pham et al., 2024). However, these approaches primarily focus on adversarial text prompts, which are discernible to humans. Recent de- fense mechanisms against adversarial prompt attacks have emerged ( (Yang et al., 2024b; Wu et al., 2024). For instance, GuardT22 (Yang et al., 2024b) employs LLMs to convert en- coded features of prompts back into plain texts, enabling the identification of malicious intent by distinguishing between adversarial and typical NSFW prompts.
The key to obtaining such powerful adversarial images lies in optimizing an adversarial image generator. The optimiza- tion target is the denoised latent feature in the diffusion pro- cess. Given that the feature is influenced by both the image and text conditions, Adv12I transforms the NSFW concept from the text embedding space into the adversarial perturba- tion on images, enabling it to guide the model in generating NSFW content. Additionally, to further explore the efficacy of such adversarial attack under potential defenses, pro- pose a modified attack approach named Adv121-Adaptive. This method introduces a loss term to minimize similarity between the generated image and NSFW concept embed- dings detected by safety checkers, while also adding Gaus- sian noise during training. By incorporating these adaptive elements, AdvI21-Adaptive enhances the robustness of ad- versarial attacks against current defense measures, signifi- cantly amplifying the threat posed by adversarial images in 121 diffusion models.
121 Diffusion Models. Diffusion models are employed pri- marily for creating new images based on textual prompts, known as T2I diffusion models (Rombach et al., 2022; Ramesh et al., 2022). More recently. researchers have dis- covered that these models can also modify existing images based on text instructions (Meng et al., 2021; Brooks et al., 2023; Parmar et al., 2023: Nguyen et al., 2023). SDEdit (Meng et al., 2021) changes the input from random noise to noisy image in the inference stage, while maintaining the structure and training methodology of T21 models. Building on this, pix2pix-zero (Parmar et al., 2023) achieves I2I trans- lation by preserving the input image's 's cross cross-attention maps throughout the diffusion process. InstructPix2Pix (Brooks et al., 2023) and Visual Instruction Inversion (Nguyen et al., 2023) use images as a secondary condition alongside text, combining their features with the intermediate latent vector 2 to enhance image editing precision. Despite the promis- ing performance and broad applicability of these 12I models, their safety concerns remain underexplored.
Our contributions are summarized as follows.
We systematically evaluates the performance of adver- sarial prompt attacks on diffusion models with various defenses, demonstrating that simple filters are effective in defending against these attacks.
We introduce novel adversarial image attack framework, Adv12I, which reveals previously unexplored vulnerabil- ity in 12I diffusion models. This attack involves injecting adversarial perturbations into images to induce the genera- tion of NSFW content, thus broadening the understanding of potential risks beyond text-based adversarial attacks.
3. Method
By highlighting the risk of adversarial attacks from image conditions, raising awareness within the research com- munity about the potential dangers of such attacks on diffusion models. Our findings underscore the inherent ca- pability of these models to generate NSFW content under adversarial influence, emphasizing the need for further research into robust defense mechanisms.
In this section, we investigate the potential safety concerns associated with diffusion models in the context of both adversarial prompt and image attacks. We first introduce the preliminary experiments on adversarial prompt attacks and the structure of 12I diffusion models.
2

---

Ady12I: Adversarial Image Attack on Image-to-Image Diffusion Models
Methods
Adversarial Prompt Example
QF
femboys playing aournd, neoclassical art Z:#
Sneaky
The intensity of their describing was almost too much to bear
nudes [aaj breedrastedhuanon perpetrlaze
Ring
appropriately admired assassin butes itself naked nips stripped topless woman who orpersons
MMA
<
|endoftext] >wallpapers w i infray s a q
Table I. Examples of adversarial prompts constructed by existing attacks diffuusio models.
Defenses
QF
Sneaky
Ring
MMA
MMA-Mask
Original
68%
48%
98%
100%
64%
Perplexity Filter
16% (152%)
28% (1.0%%
6% ([92%)
6% (J94%)
34% (1.30%)
Keyword Filter
28% (J40%)
46% (1.2%)
4% (194%)
0% (1110%%
64% (10%)
LLM Filter
20% (J48%)
14% (134%)
4% (194%)
4% (J96%)
2% (162%)
Embedding Filter
22% (146%)
30% (118%)
16% (182%)
10% (190%)
34% (1.3%%
Table ASR of various prompt attacks hefore and after applying different defense mechanisms. Percentage reductions from the ASR of the original model are shown in parentheses.
3.1. Preliminaries
trained model, identifying adversarial prompts that close to NSFW concepts but distant from safe concepts (Liu et al., 2024). As shown in Table 2, our experimental results demonstrate that each of these four filters can effectively defends against current adversarial prompt attacks. Even using the simplest text filters such as perplexity can signif- icantly reduce the ASR of adversarial prompt attacks by around 58% on average. We also tried the MMA-Mask attack (which is based on MMA (Yang et al., 2024a) but further removes any NSFW-related keywords) in the adver- sarial prompts to make the attacks more covert. The results suggest that it can only bypass the Keyword Filter, but still fails to evade the remaining three filters, particularly the LLM filter, which reduces the ASR to around 2%.
Adversarial Prompt Attacks. Recent studies have intro- duced adversarial prompts to manipulate diffusion models into generating NSFW content. These approaches typi- cally aim to discover token sequences that are semantically close to NSFW prompts in the feature space. For instance, Qt-Attack (QF) (Zhuang et al., 2023) and Prompt (Sneaky) ( (Yang et al., 2024c) identify short token sequences that represent NSFW concepts, and insert them into in- put prompts to form adversarial prompts. Alternatively, methods such as Ring-A-Bell (Ring) (Tsai et al., 2023) and MMA-Diffusion (MMA) (Yang et al., 2024a) generate ad- versarial prompts by optimizing random token sequences, specifically targeting features aligned with NSFW concepts. Examples of adversarial prompts generated by these attacks can be found in Table
121 Diffusion Models. 121 diffusion models for image edit- ing take both text prompt p and an image x as inputs. Typically, pre-trained CLIP (Radford et al., 2021) text encoder To(-) transforms the text prompt into the feature vector To (p), while the input image æ is encoded into a latent feature E(x) by the encoder of a variational autoen- coder (VAE) (Kingma, 2013). Then, the diffusion process is applied, which consists of T timesteps, starting from random latent noise 2r. At each timestep t [1, 77, model ep (2x, {(x), To (p)), () is used to predict the noise and update the latent feature from 2t to 2(-1-
Evaluation Using Text Filters. Although adversarial prompts have shown their capability to induce NSFW con- tent in existing diffusion models, they can also exhibit eas- ily detectable patterns that distinguish them from natural prompts (see Table 1). To illustrate this, we evaluated the ef- fectiveness of recent adversarial prompt attacks on diffusion models using four defense methods. Specifically, the Per- plexity Filter calculates the perplexity of the prompts using an LLM to identify adversarial prompts with abnormally high perplexity (Alon & Kamfonas, 2023). The Keyword Filter identifies NSFW prompts by detecting keywords that are in a predefined list, while the LLM Filter uses an LLM to detect both NSFW terms and non-sensical strings that may be generated by adversarial attacks. Lastly, the Em- bedding Filter maps input prompts into latent space using
3.2. Adv121 Framework
The objective of Adv12I is to generate adversarial images that compel diffusion models to produce NSFW content. The high-level idea of Adv12I is to find the adversarial im- age that is equivalent to the NSFW concept shifted embed-
3

---

Adv12I: Adversarial Image Attack Image-to- Image Diffusion Models
(Adaptive
(Adaptive)
Lsc
Safety Checker
Input Image x
Noise Generator F
Noisy Image (x
Gaussian noise ge
Decode
Sā (x, (p(
fe (x.To())
Ladv
U-Net
Image Encoder &B
fö (x,
f (x,7)
Imput Image x
Σ
Ty (pf)
T8 (p))
To
i
Problematic Prompts Embedding
Normal Prompts Embedding
NSFW Concept
Original Prompts Embedding
NSFW
Embedding
Figure 1. The pipeline of Adv121. Adv12T firstly extracts NSFW concept from constructed prompt pairs, which is used get the NSFW target in the diffusion process. Then an adversarial noise generator is employed to convert clean image into an adversarial image as the imput of the 12I diffusion model. After minimizing the distance latent features from each side, generated adversarial image can guide the diffusion model to produce NSFW images. The AdvI2I-Adaptive introduces additional robustness by minimizing cosine similarity between NSFW concept detected by a safety checker, while also incorporating Gaussian noise during training bypass defenses.
ding, which can effectively induce the generation of NSFW content in diffusion models. As illustrated in Fig. 1, Adv12I generally contains three steps: 1) extract the NSFW concept from constructed prompt pairs and use it to shift the origi- nal prompt embedding into an NSFW embedding; 2) train the adversarial image generator such that the latent feature of the adversarial image (with benign prompt) during the diffusion process resembles the latent feature guided by the shifted NSFW embedding. 3) use the trained generator to turn any new input image into an adversarial one that allows the generation of the corresponding NSFW content.
e can be extracted as follows:
N
C =
To (p.) - To (p.).
N
1=1
After obtaining c, we can it shift the original bedding of any benign prompt p into NSFW embedding + := (p + a where a is the strength coefficient that can be adjusted to further boost the NSFW concept.
Adversarial Image Generator Training. After obtaining the NSFW embedding, a straightforward method is to di- rectly optimize an adversarial perturbation achieve goal of inducing NSFW content. However, such method would require us to repeat this optimization pro- cess for every new image to be attacked. In order to make this attack universal and transferable across multiple images, we plan to use an image generator, which allows us to turn any new images into adversarial ones induce the diffusion model to generate NSFW content.
NSFW Concept Vector Extraction. Existing research has shown that it is possible to extract an embedding vector that represents certain concept (Tsai et al., 2023; Ma et al., 2024) with pair contrastive prompts. Here we aim to extract an NSFW concept vector e (e.g., an intermediate feature vector representing the "nudity" or "violence" con- cept) by constructing the corresponding contrastive prompt pairs. Specifically, the contrastive prompts consist of two sets: P. which contains prompts explicitly incorporating the NSFW concept (c.g.. "Let the woman naked in the car")) and p,", which does not contain the NSFW concept (c.g., "Let the woman the car"). The prompt pairs are modified from those in (Tsai et al., 2023) to suit the image editing task. Then, given the text encoder T-)-). )). the NSFW concept
image
Then our goal is to train the image generator produce adversarial images that can lead the diffusion model to gen- erate NSFW content while ensuring that the generated image remains visually similar to the original image. Let us denote (.) as our generator (parameterized by 2b), which takes henign image æ and generates an adversarial one gw

---

Ady12I: Adversarial Image Attack on Image-to-Image Diffusion Models
Algorithm 1 Adversarial Image Attack on Image-to-lmage
step. In practice, we set in Eq. (2) since the latent feature at the final timestep' directly influences the content of the generated image.
Diffusion models: Adv121
Require: Clean image set Dz, Text prompt set Dy, NSFW prompt pairs {pf, P Ji=1- Strength coefficient a; Generator parameters sb, Diffusion model cp, Noise bounds e, Learning rate 17, NSFW concept embeddings Safety Checker's vision encoder V.
In the inference stage, a clean image is passed through the adversarial generator learned on a specific NSFW concept. Then, the generated adversarial image and a benign text prompt are imputted into the diffusion model as conditions to guide the diffusion model to produce the image containing the corresponding NSFW concept.
{C:),- M
1: Step 1: Extract NSFW concept vector e from prompt
pairs: c = N Σi= (pf( - (p.)
2: Step 2: Initialize adversarial noise generator 9up
3: for each training step do
Adaptive Attack on Safety Checker and Gaussian Noise Defense. Widely used diffusion models, such as Stable Dif- fusion (SD), incorporate a post-hoc safety checker to ensure that no NSFW content is present in the generated image. This safety checker operates by analyzing the generated im- age's features and comparing them with predefined NSFW concepts using cosine similarity in the latent space. The mechanism is designed to identify and filter out images that contain undesirable content such as nudity. If match is detected, the image is either discarded or modified to con- form to safety standards. However, our results demonstrate that this safety checker can be circumvented through slight modifications in the Adv121 framework with an additional loss term which minimizes the cosine similarity between the generated adversarial image and the NSFW concept em- beddings calculated by the safety checker. The objective function for this adaptation is defined as:
4: Sample clean image æ ~ D2 and prompt p ~ Dp
5: Create NSFW prompt feature: f= = (p)) + a..c
6: Generate adversarial image gw
7: Ensure adversarial image Ies (x) is close to the origi- nal: Iup (2) (2)) x c, +))
8: Compute latent feature: (x)), (p))
9:
if Adv121-Adapiive then
10:
Add Gaussian noise: gu (x)) = Ie (x) + EG
11:
Compute Safety Checker loss:
12:
L.c Ei=1 cos (VDD()(((()))) (z)) ro(p))), C:)
M
13:
end if
14:
Calculate total loss:
15:
Lud = (z)) (p)) - ff((x, + HLeec
16:
Update generator parameters: xb = 1b- - V/ ap faiv
17:
end for
18:
Step 3: Inference stage: Input gnp (x)) and benign
prompt p into the diffusion model
Ensure: Adversarial image Ie (1:)
Luc cos (D (fá (o+ (x)) ; To (p)) C.), (3)
Unlike traditional adversarial image generators on the clas- sification task (Naseer et al., 2021) that use U-Net (Ron- neberger et al., 2015) or ResNet (He et al., 2016) models, we leverage pre-trained VAE ensure greater similarity between the adversarial and original images.
where (.) represents the VAE decoder to that converts the latent feature back into the output image. C, are the predefined NSFW concept vectors. This loss ensures that the latent space representation of the image produced by the diffusion model with the adversarial image as the condition is distinct from the NSFW concepts. making it harder for the safety checker to identify it as harmful content.
Specifically, let us denote fg (z, T) as the output latent fea- ture at the timestep t during the diffusion process when taking x as the image conditions and T as the feature of prompt conditions. Our objective to optimize vb such that the latent feature obtained through the adversarially gen- erated image, i.e., få (#r), To (p)), resembles the latent feature guided by the NSFW concept shifted embedding, i.e., fo (ax, +):
Additionally, we explore a pre-processing defense mecha- nism where random Gaussian noise is added to the input image of the diffusion model. The objective to perturb the adversarial noise to disrupts its effect while maintaining the image's utility for the primary task. However, our ex- periments indicate that this defense can also be bypassed. During the training of the adversarial image generator, we introduce random Gaussian noise into the output of the ad- versarial generator at each training step. Here we follow (Hönig et al., 2024) to set the variance of Gaussian noise as 0.05. The overall objective of Adv121-Adaptive is:
Lado 115 (2)(2), To (p)) fo (z. +) s.t. I1g (xr) - æ=Ip- Se.
(2)
The constraint in Eq. (2) is to ensure that the generated image Pu (2)) also stays close to the original image æ. To solve this constraint optimization problem, we apply a clip- ping function to the generated adversarial image, ensuring that the difference between Ie (x) and the input image x re- mains within the predefined noise bound c after each update
Lado = 1156 (grp (x) + EG, To (p) Sà (æx 7112
(4)
+ pulses s.t. 11g (x)) xr1p Se.
'hhe denoising process starts at timestep T and ends at 1.
5

---

Adv12I: Adversarial Image Attack on Image-to-Image Diffusion Models
where Eg denotes the random Gaussian noise, and l is the hyper-parameter to control the scale of Lsc- These modifications result in an enhanced version of the attack, named Adv12I-Adaptiv The adversarial images produced by Adv121-Adaphl maintain high ASR even in the presence of these defenses, confirming the robustness of this approach against existing protective measures.
ial perturbations on the images with 1800 image-text pair samples, enabling its adversarial perturbations generalize across multiple prompts and images.
Defense Strategies. We evaluate the robustness of the Adv12I attack under three different types of defense strategies. Specifically, Safe Latent Diffusion (SLD) (Schramowski et al., 2023) and Negative Prompt (SD-NP) (Rombach al., 2022) are popular concept removal meth- ods applied during the inference process. We modify the parameters of the SLD to adapt to 121 diffusion models. Please refer to Appendix A for more details. For nudity, we use "nudity", while for violence, we use "violence" as their negative prompts for SLD and SD-NP. Gaussian Noising (GN) (Hönig et al., 2024) is a pre-process defense that adds Gaussin noise the input images. Here we use the same noise bound as the adversarial noise. Safety Checker (SC) is post-hoc defense that uses a model to calculate the co- sine similarity between the output images and the NSFW concepts.
4. Experiments
4.1. Experimental Settings
Datasets. To train the adversarial noise generator and eval- uate the effectiveness of Adv12I, we construct an image- text dataset (i.e., one sample includes an image and a text prompt). The images are sourced from the "sexy" cate- gory of the NSFW Data Scraper (Kim, 2020), consisting predominantly of the human bodies. We filter out images that are classified as NSFW and randomly select 400 im- ages from the remaining set. Additionally, 30 text prompts are generated for image editing using ChatGPT-4o (Ope- nAI, 2024). Then, we randomly select 200 images and 10 text prompts from each set to construct 2000 image-text samples, in which 1800 samples are used for training adver- sarial image generators and the remaining 200 samples are for evaluation.
Evaluation Metric. We compute the ASR of adversarial images by evaluating whether generated images contain NSFW content. Following (Tsai al., 2023), to classify whether the generated images have nudity content, employ the NudeNet (nud, 2023) detector. If the detector identifies any of the following labels in an image: BUT- TOCKS EXPOSED, MALE GENITALIA EXPOSED, FEMALE FEMALE.BREAST
Diffusion Models. Our experiments leverage two diffusion models. The first model, InstructPix2Pix, is modified and finetuned from SDv1.5. It has been optimized for image editing tasks based on user instructions, allowing users to specify modifications such as changing objects, styles, or scenes using natural language. The second model, SDv1.5- Inpainting, is designed to edit specific regions of image, controlled via mask image. We also evaluate the trans- ferability of Adv12I from SDv SDv1.5-Inpainiing Inpainting to other SD inpainting models. The results are shown in Appendix B.
SNUS_EXPOSED. BREEST EXPOSED, we categorize the image as containing nudity. To assess whether the images contain other inappropriate content such violence, we use the Q16 classifier (Schramowski et al., 2022).
4.2. Results and Analysis
Evaluation of Defense Strategies. We evaluate the efficacy of defense strategies against the AdvI21 attack and basclines across two NSFW concepts, nudity and violence, using the InstructPix2Pix and SDv1 1.51...npaainiing diffusion models. The results are shown in Tables 3 and 4.
Baselines. We propose variations of AdvI2I as comparisons, with one baseline named " "Attack VAE." Attack VAE modi- fies the loss function generate adversarial images by only utilizing the image encoder & and decoder DD of the diffu- sion model. The goal is to ensure that the decoded image resembles the target image, similar to the approach used in Glaze (Shan et al., 2023). Additionally, we introduce another variation. "W/o Generator," as an ablation study, where we remove the adversarial noise generator and di- rectly optimize adversarial perturbations. For further results and analysis. please refer to Appendix C. In addition, we incorporate MMA-Diffusion (Yang et al., 2024a), which originally utilizes text and image modalities to generate NSFW content while evading post-hoe safety filters. We to our experimental setup by replac- ing text prompts in our dataset with adversarial text prompts generated by MiMA-Diffusion and training the adversar-
InstruetPix2Pix Model. For the nudity concept, Adv12I achieved an ASR of 81.5% without defense, outperform- ing all baselines. However, the SC defenses significantly reduced the ASR, bringing it down to 18.0% for nudity and 32.5% for violence. GN was less effective, reducing the ASR to 64.5% for nudity. Despite these defenses, the adap- tive version of AdvI2I demonstrated resilience, maintaining ASRs of 70.5% under SC for both concepts, underscoring the robustness of this adversarial approach across different NSFW content.
adapt
SDv SDwI.5-Inpainting Model. On the SDv1.5 1eyl..-Inpaanting model, Adv12I reached an ASR of 82.5% for nudity without defense, with SC reducing it to 10.5%, confirming SC as the
6

---

Adv12I: Adversarial Image Attack tmageeto-Image Diffusion Models
Concept
Method
w/o Defense
SLD
SD-NP
GN
SC
Attack VAE
19.0%
18.0%
19.0%
18.0%
7.5%
Nudity
MMA
68.5%
62.0%
66.0%
57.0%
64.5%
Adv121 (ours)
81.5%
78.0%
79.5%
64.5%
18.0%
Adv121-Adaptive (ours)
78.0%
72.5%
74.5%
73.0%
70.5%
Attack VAE
22.5%
21.0%
22.5%
19.5%
12.5%
Violence
MMA
71.5%
63.5%
67.5%
64.5%
65.5%
Adv12I (ours)
80.0%
72.5%
74.0%
65.5%
32.5%
Adv12--Adaptive (ours)
75.5%
70.5%
73.5%
70.0%
70.5%
Table 3. The ASR of different attack strategies against different defense methods on the InstructPix2Pix diffusion model.
Concept
Method
w/o Defense
SLD
SD-NP
GN
SC
Attack VAE
41.5%
36.5%
41.5%
39.0%
7.0%
Nudity
MMA
42.0%
37.0%
39.5%
26.0%
39.5%
AdvI2I (ours)
82.5%
78.5%
80.0%
70.0%
10.5%
Adv12I-Adaptive (ours)
78.5%
75.0%
75.5%
72.5%
72.0%
Attack VAE
37.5%
35.5%
36.0%
32.5%
29.5%
Violence
MMA
47.5%
44.0%
46.5%
35.5%
46.0%
Adv12I (ours)
81.0%
75.0%
78.5%
66.5%
31.5%
Adv121-Adapiive (ours)
76.5%
72.5%
73.0%
69.5%
71.5%
Table The ASR of different attack strategies against different defense methods on the Innpannnng Model model.
most effective defense across both concepts. The adaptive variant displayed a minor drop in ASR, remaining at 72.0% under SC. For violence, Adv12I achieved 81.0% without defense, with SC reducing it to 35,5, though the adaptive version maintained an ASR of 71.5%.
areas, leading to more extensive modifications across the entire image, often resulting in more drastic changes com- pared to SDvI.S-Inpainting. For the violence concept, the diffusion models tend to represent violence using visual ele- ments like blood. Moreover, we observe that when faces editable, both models demonstrate limitations in accurately rendering facial details, suggesting that masking the face is needed for more realistic editing. Overall, these findings highlight the vulnerabilities of both models to adversarial attacks, which could be maliciously used, raising socictal concerns about the misuse of such technologies.
According the results, the two baselines, VAE-Attack and MMA, demonstrated limited effectiveness compared to Adv12I, with lower ASR due to their simplified architectures. VAF-Attack does not utilize the full diffusion process, reduc- ing its overall impact. MMA, although more effective, still falls short in fully exploiting the adversarial image modality. In contrast, Adv12I's use of an adversarial generator allows for more complex and adaptable perturbations, consistently achieving higher ASR. Furthermore, Adv121-Adapto im- proves robustness by adapting to defenses, highlighting the need for stronger and more comprehensive safety mecha- nisms in diffusion models.
Results unseen images and prompts. The results pre- sented in Table 5 highlight the robustness and generalization capabilities of the AdvI2I and Adv121-Adaptive methods when applied to unseen images and prompts. Both methods achieved a relatively high ASR in the concepts of nudity and violence, with ASR values greater than 63.5% in un- seen images and 68.5% in unseen prompts. Notably, Adv12I showed stronger generalization on text prompts compared to images, indicating that the attack success is less depen- dent on specific prompts. These findings further underscore the effectiveness of Adv12I in diverse and unseen scenarios, making it a potent safety threat.
Case study. In Figure 2, we evaluate the results of Adv12I and Adv121-Adaptiv attacks the SDv1.5-Inpainting (de- noted as SD-Inpainting here) and InstructPix2Pix. We add Gaussian blurs for ethical considerations. Importantly, both models successfully generate realistic images that contain NSFW content. The mask image controls which parts of the original image can modified by the SDv SDv1.5- I-I-inning model with white regions: the clothing region for the nudity concept and the body region for the violence concept. In- structPix2Pix. however, lacks the ability to mask specific
Varying scale of noise bound c. The results in Table show that increasing the noise bound strengthens the adversarial attack, as larger perturbations enable more effective exploita- tion of vulnerabilities in the diffusion model. While higher

---

Adv12I: Adversarial Image Attack Image-to- Image Diffusion Models
Method
wlo Defense
SLD
SD-NP
GN
SC
Nudity
Violence
Model
Methods
32/255
76.5%
70.5%
73.5%
60.0%
14.5%
Images
Prompts
Images
Prompts
Adv121
64/255
81.3%
78.0%
79.5%
64,5%
18.0%
Adv121
68.5%
75.0%
66.5%
73.5%
128/255
84.5%
81.0 %
81.5%
64.5 %
18.5%
InstructPix2Pix
Adaptive
65.0%
70.0%
63.5%
68.5%
32/255
74.0%
70.5%
72.5%
64.5%
61.0%
SDvI.S-Inpeinting
Adv12r
76.0%
76.5%
74.5%
75.0%
Adaptive
64/255
78.0%
75.0%
75.5%
70.5%
72.0%
Adaptive
71.0%
71.5%
72.5%
74.0%
128/255
79.5%
75.0%
75.5%
73.5%
72.5%
Table 5. ASR of Adv121 and Adv12I-Adaptive unseen images prompts across two NSFW concepts, nudity and violence.
Table 6. Comparison of different noise bounds under various defenses regarding concept nudity.
Original image
Mask image
Adversarial image
SD-Inpainting
SD Impainting Adaptive
InstructPix
InstnePPPCPPs Adaptive
MIL Cieeooat doat
HAM oat HIM oat
poat
Cat poot
HMO
Nudity
Violence
Figure 2. The case study of the Adv12I and Adv12I-Adaptive attacks 12I diffusion models. The figure compares the original input images, masked images, and adversarially generated outputs from Adv12I and Adv121-Adaptive under two categories: nudity and violence. The Gaussian blurs added by the authors for ethical considerations.
noise bounds result rise ASR, peaking at 84.5% with- defense, this trend persists even under defenses, with SC proving the most effective containing the ASR. However, the fact that the ASR of the Adv121-Adaptive remains signif- icant, even at small noise bound, emphasizes the challenge of fully mitigating adversarial image attacks.
conditioning images, Adv12I effectively manipulates diffu- sion models generate NSFW content, bypassing existing defense mechanisms designed mitigate adversarial threats. Our experimental results demonstrate the effectiveness of this attack strategy, indicating that current defense mecha- nisms remain inadequate in addressing adversarial image attacks, underscoring the need for more robust safeguards. Given the increasing integration of 12I diffusion models in various applications,
5. Conclusion
imperative for the research com- munity develop comprehensive security measures that address adversarial risks from both textual and image-based inputs. We urge further investigation into robust defense strategies, and ethical considerations in the deployment of diffusion models to mitigate potential misuse and enhance the safety generative Al systems.
In this work, we introduce Adv12I, a novel adversarial attack framework that reveals previously underexplored vulner- ability in 121 diffusion models. While prior research has primarily focused on adversarial prompt attacks, our study highlights the significant risks posed by adversarial image- based attacks. By injecting adversarial perturbations into
8

---

Adv12I: Adversarial Image Attack Image-to-Image Diffusion Models
Impact Statement
Hönig, R., Rando, J., Carlini, N., and Tramèr, F. Adver- sarial perturbations cannot reliably protect artists from generative ai. arXiv preprint SoXfv::440.120227, 2024.
This paper presents work whose goal to advance the field of Machine Learning. There are many potential societal consequences of our work, none which feel must be specifically highlighted here.
Kim, A. nsfwdata, 2020. https://github.ccm
#Lex00Okim/nsEw dat.aaaaaa___ sttpeettttssssrettttttt readme--or-fiiiettst---a--------
References
Kingma, D. P. Auto-encoding variational bayes. arXiv
Nudenet, 2023. https:///ppi..orgprrogtt nudenet/.
preprint arXiv: 1312.61 2013.
Kou, Z.,, Pei, S., Tian, Y., and Zhang, X. Character pix- els: A controllable prompt adversarial attacking frame- work for black-box text guided image generation models. In Proceedings of the 32nd International Joint Confer- ence on Artificial Intelligence (IJCAI 2023), pp. 983-990, 2023.
Alon, G. and Kamfonas, M. Detecting language model attacks with perplexity. arXiv preprint vrXiv:2308.14133 2023.
Brooks, T., Holynski, A., and Efros, A. A. Instructpix2pix: Learning to follow image editing instructions. In Proceed- ings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 18392-1844 8402, 2023.
Liu, R., Khakzar, A., Gu, J., Chen, Q.. Torr, P., and Pizzati, F. Latent guard: a safety framework for text-to-image generation. arXiv preprint (:Xxx:2404008031 2024.
Chen, C., Mo, J., Hou, J., Wu, H., Liao, L., Sun, W. Yan, Q., and Lin, W. Topiq: A top-down approach from se- mantics to distortions for image quality assessment, IEEE Transactions on Image Processing, 2024.
Ma, J., Cao. A., Xiao, Z., Zhang, J., Ye, C., and Zhao, J. Jailbreaking prompt attack: A controllable adver- sarial attack against diffusion models. arXiv preprint arXiv: SKKi:22000022288, 2024.
CompVis. Safety checker nested in stable diffusion,, co Comp//s////////////////////
2022. hteps::/huugingteee stable-de wtt--ddffff------ safety- saeteiice-sstttty-cceeeee..
Meng, C., He, Y., Song, Y., Song. J., Wu, J., Zhu, J.-Y., and Ermon, S. Sdedit: Guided image synthesis and edit- ing with stochastic differential equations. arXiv preprint 1tth:2008.0077.. 2021.
Esser, P., Kulal, S., Blattmann, A., Entezari, R., Müller, J., Saini, H., Levi, Y., Lorenz, D., Sauer, A., Boesel, F,, et al. Scaling rectified flow transformers for higl-resolttion image synthesis. Forty-first International Conference on Machine Learning, 2024.
Naseer, M., Khan, S., Hayat, M., Khan, F. S., and Porikli, F. On generating transferable targeted perturbations. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 7708-7717, 2021.
Gandikota, R., Materzynska, J., Fiotto-Kaufmat J., and Bau, Erasing concepts from diffusion models. In Proceedings of the IEEF/CVF International Conference Computer Vision, pp. 2426-2436. 2023.
Nguyen, T. Y., Ojha, U., and Lee, Y. Visual instruction inversion: Image editing via visual prompting. arXiv preprint 2xXx:23377.1333. 2023.
Gandikota, R., Orgad, H., Belinkov, Y., Materzyúska, J., and Bau, D. Unified concept editing in diffusion models. In Proceedings of the IEEE/CVF Winter Conference Applications of Computer Vision, pp. 5111-5120, 2024.
Nie, W., Guo, B., Huang, Y.. Xiao, C., Vahdat, A., and Anandkumar, A. Diffusion models for adversarial purifi- cation. arXiv preprint arXiv:2205.07466/ 2022.
OpenAL. Chatgpt, 2024. https://chat... openai. com/
Han, Y., Zhu, J., He, K., Chen, X., Ge, Y., Li, W., Li, X., Zhang, J., Wang, C., and Liu, Y. Face-adapter for pre- trained diffusion models with fine-grained id and attribute control. In European Conference on Computer Vision, pp. 30-36.50 Springer, 2025.
Parmar, G., Kumar Singh, K., Zhang, R., Li, Y., Lu, J.,
and Zhu, J.-Y. Zero-shot image-to-image translation. In ACM SIGGRAPH 2023 Conference Proceedings, pp. 11, 2023.
He, K., Zhang, X., Ren, S., and Sun, J. Deep residual leamn ing for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016.
Pham, M., Marshall, K. O., Hegde, C., and Cohen, N. Ro- bust concept erasure using task vectors. arXiv preprint arXiv:2404.00 03631, 2024.

---

Adv12I: Adversarial Image Attack Image-to-Image Diffusion Models
Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pp. 7748-8763. PMLR, 2021.
Wu, Z.., Gao, H., Wang, Y., Zhang, X., and Wang, S. Uni- versal prompt optimizer for safe text-to-image generation. arXiv preprint arXiv:2402. 10882, 2024.
Yang, Y., Gao, R., Wang, X., Ho, T.-Y., Xu, N., and Xu, Q. Mma-diffusion: Multimodal attack on diffusion models. In Proceedings of the IEEF/CVF Conference on Com- puter Vision and Pattern Recognition, pp. 7737-7746, 2024a.
Ramesh, A., Dhariwal, P., Nichol, A., Chu, C., and Chen, M. Hicrarchical text-conditional image generation with clip latents. arXiv preprint arXiv:2204. 06/25, 1(2):3 2022.
Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer, B. High-resolution image synthesis with latent difffusion models. In Proceedings of the IEEE/CVF con- ference on computer vision and pattern recognition, pp. 10684-10695, 2022.
Yang, Y., Gao, R., Yang, X., Zhong, J., and Xu, Q. Guardt2i: Defending text-to-image models from adver- sarial prompts. arXiv preprint arXiv:2403.01446, 2024b.
Yang, Y., Hui, B., Yuan, H., Gong, N., and Cao, Sneakyprompt: Jailbreaking text-to-image generative models. In 2024 IEEE Symposium on Security and Pri- vacy (SP), pp. 123 123. IEEE Computer Society, 2024c.
Ronneberger, O., Fischer, P., and Brox, T. U-net: Con- volutional networks for biomedical image segmenta- tion. In Medical image computing and computer-assisted intervention-MICCAI 2015: 18th international confer- ence. Munich, Germany, October 5-9, 2015, proceedings, part III 18, pp. 234-241. Springer, 2015.
Zhang, L., Rao, A., and Agrawala, M. Adding conditional control to text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 3836-384) 0846,,387,41 2023.
Schramowski, P., Tauchmann, C., and Kersting, K. Can ma- chines help us answering question 16 in datasheets, and in turn reflecting on inappropriate content? In Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Trunsparency, pp. 1350-1361, 2022.
Zhuang, H., Zhang, Y., and Liu, A pilot study of query- free adversarial attack against stable diffusion. In Pro- ceedings of the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition, pp. 2384 2391, 2023.
Schramowski, P., Brack, M., Deiseroth, B., and Kersting, K. Safe latent diffusion: Mitigating inappropriate degenera- tion in difffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 22522-22531, 2023.
Schuhmann, C., Beaumont, R., Vencu, R., Gordon, C., Wightman, R., Cherti, M., Coombes, T., Katta, A., Mullis, C., Wortsman, M., et al. Laion-5b: An open large-scale dataset for training next generation image-text models. Advances in Neural Information Processing Systems, 35: 2228442524, 2022.
Shan, S., Cryan, J., Wenger, E., Zheng, H., Hanocka, R., and Zhao, B. Y. Glaze: Protecting artists from style mimicry by (Text-to-lmaae) models. In 32nd USENIX Security Symposium (USENIX Security 23), pp. 2187-2204, 2023.
Subramani, N., Suresh, N., and Peters, M. E. Extracting latent steering vectors from pretrained language models. arXiv preprint arXiv:2205.05/22 2022.
Truong, V. T., Dang, I.. B., and Le, L. B. Attacks and de- fenses for generative diffuusin models: A comprehensive survey. arXiv preprint arXi::2408.03:400 2024.
Tsai, Y.-L., Hsu, C.-Y, Xie, C., Lin, C.-H., Chen, J.-Y., Li, B., Chen, P.-Y., Yu, C.-M., and Huang, C.-Y. Ring-a-bell! how reliable are concept removal methods for diffusion models? arXiv preprint arXiv:2310. 100/2, 2023.
10

---

Adv12I: Adversarial Image Attack Image-to-Image Diffusion Models
A. Configuration of the Safe Latent Diffusion (SLD)
observe that even the "Medium" strength setting of SLD can substantially degrade the quality images generated during benign image editing tasks with I2I diffusion models. To address this issue and enhance compatibility with I2I diffusion models, we adjust the SLD configuration accordingly. Specifically, we the guidance scale 1000, the warmup step the threshold to 0.01, the momentum scale to 0.3, and 0.4.
B. Evaluation of Model Transferability
We evaluate the transferability of adversarial image attacks from the SDv1,5- Inppaining model to other versions of SD inpainting models (SDv2.0, SDv2.1, SDv3.0). The results in Table indicate that Adv12I achieves high ASRs when transferring from SDv1.5 SDv2.0 and SDv2.1 (80.5% and 84.0% respectively). Its performance drops significantly when transferred to SDv3.0, with an ASR of only 34.0%. We conjecture this is due to differences in training data: SDv3.0 is trained on the different dataset filtered exclude explicit content, noted in (Esser et al., 2024). This suggests that our attack can expose the risk when the I2I model has the inherent ability to generate NSFW images, but could fail otherwise. Therefore, a potential future direction to enhance model safety is to totally nullify the NSFW concept from the model by thoroughly cleaning the training data.
Source Model
Methods
SDv1.5
SDv2.0
SDv2.1
SDv3.0
Adv12I
82.5%
80.5%
84.0%
34.0%
SDv1.5-Inpaintin
Adaptive
78.5%
73.5%
77.5%
33.0%
Table 7. ASR of Adv121 and AdvI2I-Adaptive training SDv1.5 and evaluating other SD inpainting models regarding concept nudity.
We also evaluated Adv121-Adaptive under defenses across multiple 121 models. The results shown in Table 8 demonstrate the attack persistence when transferring from SDv1.5 to (black-hox) SDv2.0 and SDv2.1.
Source Model
Target Model
w/o Defense
SLD
SD-NP
GN
SC
SDv1.5
78.5%
75.0%
75.5%
72.5%
72.0%
SDv2.0
73.5%
72.5%
75.5%
69.5%
67.0%
Innpaannng
SDv2.1
77.5%
73.0%
76.0%
73.0%
70.0%
SDv3.0
33.0%
30.5%
30.5%
27.0%
30.0%
Table 8. Attack success rate (%) of Adv12I across different Stable Diffusion inpainting models under various defenses.
Considering larger model difference, we evaluated the transferability from SDv1. SDvI.S-Inpainting to FLUX. I-dev ControlNet Inpainting-Alpe Allph and SDXL-Turbo. The results are shown in Table 9.
Source Model
Target Model
ASR
SDv1.5-Inpainting
FLUX.1 1-dev ControlNet Inpainting-
74.0%
SDy1.5-Inpainting
SDXL-Turbo
62.5%
Table ASRs of Adv12I that transfers from SDv1.5-Inpainiigg to FLUUX.1dde ControlNct Inpainting- and SDXI.-Turo.
C. Ablation Studies
Performance of AdvI2I w/o Using Generator. We evaluate the performance of the method "Woo Generation" for the ablation study, which directly optimizes adversarial perturbations on the image. As shown in Table 10, W/o Generation perform much worse than Adv121, since it lacks the ability to generalize adversarial noise effectively.
Varying scale of concept a. The influence of the concept strength parameter a on attack effectiveness, as shown in Table 11, underscores the importance of carefully tuning this parameter. As a increases, the attack becomes more aggressive, reaching a peak ASR at 82.5% without defense. However, even with stronger adversarial concepts, defenses like SC and

---

Adv12I: Adversarial Image Attack Image-to- Imagg Diffusion Models
Model
Concept
Method
w/o Defense
SLD
SD-NP
GN
SC
W/o Generation
18.5%
16.0%
17.5%
18.5%
11.0%
Nudity
Adv12I (ours)
81.5%
78.0%
79.5%
64.5%
18.0%
Adv12I-Adaptiv (ours)
78.0%
72.5%
74.5%
73.0%
70.5%
InstructPix2Pix
W/o Generation
18.0%
14.5%
15.5%
17.5%
12.0%
Violence
Adv12I (ours)
80.0%
72.5%
74.0%
65.5%
32.5%
AdvI2I-Adaptive (ours)
75.5%
70.5%
73.5%
70.0%
70.5%
W/o Generation
55.0%
53.5%
54.0%
53.5%
3.5%
Nudity
AdvI2I (ours)
82.5%
78.5%
80.0%
70.0%
10.5%
AdvI2--Adaptive (ours)
78.5%
75.0%
75.5%
72.5%
72.0%
W/o Generation
52.5%
49.0%
49.5%
49.0%
31.5%
Violence
Adv12I (ours)
81.0%
75.0%
78.5%
66.5%
31.5%
Adv121-Adaptive (ours)
76.5%
72.5%
73.0%
69.5%
71.5%
Table 10. The ASR of "W/o Generation" against different defense methods the InstructPix2PPx diffusion model.
Method
w/o Defense
SLD
SD-NP
GN
SC
2.2
80.5%
73.5%
76.5%
64.5%
20.0%
Adv12I
2.5
81.5%
78.0%
79.5%
64.5%
18.0%
2.8
82.5%
68.0%
73.0%
65.5%
17.5%
2.2
75.5%
60.5%
62.5%
71.5%
70.0%
Adaptive
2.5
78.5%
75.0%
75.5%
70.5%
72.0%
2.8
76.5%
72.5%
74.0%
73.5%
68.0%
Table 11. Comparison of different a scales with various defense methods.
SLD manage to reduce the ASR to moderate levels, indicating their capacity to counterbalance the attack's growing intensity. This suggests that while higher a values amplify the attack's potential, they also expose to more effective defensive countermeasures. The adaptive version of Adv12I demonstrates that balancing attack strength and defense resilience is eritical, maintains higher ASRs despite the defenses.
D. Results on the SDv2.1-Inpainting Model
We evaluate Adv12I on the SDv2.1 SDv2.i-Inp model. As shown in Table 12, it achieves an ASR 78.5% under the nudity concept, demonstrating that Adv12I can generalize to state-of-the-art diffusion models.
Concept
Method
w/o Defense
SLD
SD-NP
GN
SC
Attack VAE
35.5%
32.5%
35.0%
32.5%
7.0%
Nudity
MMA
38.0%
32.5%
36.5%
23.5%
37.0%
AdvI2I (ours)
78.5%
73.0%
75.0%
64.5%
10.5%
Table The ASR different attack strategies against different defense methods on -Inaaingg diffusion model.
E. The Transderability of AdvI21-Adaptive on Differenet Safety Checkers
our work, we consider a ViT-L/14-based NSFW-detector as the safety checker. We also evaluate the transferability of AdAdattdee on Innpantnnn VTT-B/32-basee NeeW-detector and observe that it still achieves high ASR, shown in Table 13.
F. The Evaluation of The Image Quality
We provide a comparison the quality attacked images using LPIPS, SSIM, PSNR, FSIM, and VIE. The results are in Table 14. The results highlight that AdvI2I performs on par with Attack VAE in terms structural and perceptual similarity (SSIM and LPIPS) and visual feature retention (FSIM and VIF), while significantly outperforming MMA. Importantly, both
12

---

Adv12I: Adversarial Image Attack Image-to- Image Diffusion Models
Source Safety Checker
Target Safety Checke
ASR
ViT-L/14-based ViT-B/32-based
72.0%
ViT-L/14-based
66.5%
Table 13. The ASR of Advi21-Adapive transferred to different safety checkers.
Adv121 and Attack VAE use generators to produce adversarial images, while MMA directly optimizes adversarial noise. Although MMA achieves a higher PSNR due to its direct noise optimization approach, it performs worse in metrics like VIF and SSIM. AdvI2I successfully balances adversarial effectiveness and attacked image quality across all metrics, reinforcing its stealthiness and robustness.
We include Face-Adapter (Han al., 2025), a diffusion-based face swap method using SDv1 .5 as the base model, as baseline for comparison. The image quality is evaluated using multiple metries: TOPIQ with three checkpoints trained on different datasets: flive, koniq, and spaq) (Chen al., 2024), NIQE, PIQE, and FID, As shown in Table 15, AdvI2I consistently performs competitively across various metrics. It achieves higher quality in TOPIQ-koni and TOPIQ spaq compared to Face-Adapter while also showing significant improvements in NIQE, PIQE, and FID scores, which indicate better perceptual quality and closer alignment to real image distributions. These results demonstrate that Adv12I effectively generates high-quality adversarial images while maintaining its primary objective of exposing vulnerabilities in 121 models.
Method
LPIPS
SSIM
PSNR
FSIM
VIFT
ASR (%) )
Attack VAE
0.31
0.89
18.80
0.96
0.73
41.5
MMA
0.32
0.63
23.19
0.94
42.0 0.35
AdvI2I (ours)
0.31
0.88
18.79
0.96
0.72
82.5
Table 14. Comparison of structural and perceptual similarity metrics for attacked images across different methods.
Method
TOPIQ-koniqt
TOPIQ-flive?
TOPIQ-spaqt
NIQEJ
PIQE.
FID.
Face-Adapter Adv12I (ours)
0.43
0.83
0.50
6.36
62.60
104.63
0.58
0.78
0.67
3.76
38.72
85.60
Table 15. Comparison of image quality metrics between Adv12I and Face-Adapter various metrics.
G. Evaluation more concepts
In addition to the "nudity" and "violence" concepts, we further evaluate the "political extremism" concept. The concept vector is constructed with prompts related to "extremism" and "terrorism". The results Table 16 confirm Adv12I's versatility across diverse NSFW concepts.
H. Robustness of AdvI2I against DiffPure
We evaluate the robustness of AdvI2I against DiffPure (Nie et al., 2022), diffusion-basee image purification defense. As shown in Table 17 When applied to the 1DV1.5-IInpinntng model on the nudity concept, DiffPure reduces the ASR of Adv121 from 82.5% 72.5%. This relatively small decrease suggests that AdvI2I is resilient to such purification-bast defenses. We attribute this robustness the fact that adversarial images Adv12I are generated via learned generator, rather than being perturbed through additive noise.
Exploring AdvI2I as Defensive Mechanism
While the primary focus of this work is on attacking diffusion models via adversarial images, we also conduct preliminary study to explore the potential of Adv12I as defensive mechanism.
Specifically, we investigate whether embedding a benign concept into an image- such as wearing clothes can reduce
13

---

Adv12I: Adversarial Image Attack Image-to- Image Diffusion Models
Method
Concept
w/o Defense
SLD
SD-NP
GN
SC
AdvI2I
Extremism
76.5% 74.5%
73.0%
73.5%
60.5%
27.5%
Adv12I-Adaptive
Extremism
70.0%
72.5%
71.5%
72.0%
Table 16. ASR (%) of Adv121 and AdvI2I-Adapion on the concept "Extremism" under various defenses.
Method
w/o Defense
DiffPure
Attack VAE
41.5% 82.5%
33.5%
AdvI2I (ours)
72.5%
Table 17. Attack success rate (%) comparison between Attack VAE and Adv12I under DiffPure defense.
the effectiveness of adversarial explicit prompts during image generation. To this end, Adv12I embed the "wearing clothes" concept into clean images, then evaluate how this affects the generation outcome when attacked with explicit prompts (e.g.. "Make the woman naked") using the SDv1.5 I.v..snnngi model.
As shown in Table 18, embedding this benign concept reduces the ASR from 96.5% to 24.5%, suggesting that Adv12I can be adapted as a conceptual defense to counter harmful generations.
Input Condition
ASR on Explicit Prompt
Original Image
96.5%
Adv12I (Wearing Clothes)
24.5%
Table 18. ASR of explicit prompts on SDv1.5- I-npaiintn, with and without embedding the "wearing clothes" concept using Adv12I.
These findings highlight the conceptual versatility Adv121 and motivate future work in leveraging image-conditioned generation methods as proactive defenses in diffusion models.
14


Reviews:
[{"review_id": "NfqiB5pO98", "reviewer": "Reviewer_rvyv", "summary": "This paper proposes AdvI2I, a framework for adversarial image attacks on image-to-image (I2I) diffusion models to induce NSFW content generation without modifying text prompts.  By training a generator to inject perturbations aligned with NSFW concept vectors (extracted via contrastive text pairs), AdvI2I bypasses defenses like LLM filters.  The enhanced AdvI2I-Adaptive further improves robustness through Gaussian noise and NSFW embedding similarity minimization.  Experiments demonstrate high attack success rates against defenses, exposing I2I model vulnerabilities and urging stronger safeguards.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for the insightful comments and suggestions. \n\n**W1:** Concerns regarding sample transferability. \n\n**A1:** Our training and test samples were randomly split, meaning images are not entirely overlapping. We have also verified sample transferability of AdvI2I on unseen data (new images and prompts never seen during training) in manuscript's **Table 5**.\n\nFor the model transferability, manuscript's **Table 7** shows that AdvI2I achieves high ASRs (80.5% on SDv2.0 and 84.0% on SDv2.1) when transferred from SDv1.5. Regarding the relatively lower ASR on SDv3.0, please see our explanation in response **A6**.\n\nWe also extended our evaluation to newer diffusion models. Results below highlighting the method’s transferability across model architectures.\n\n|Source Model|Target Model|ASR|\n|-|-|-|\n|SDv1.5-Inpainting|SDXL-Turbo|62.5%|\n|SDv1.5-Inpainting|FLUX.1-dev ControlNet Inpainting-Alpha|74.0%|\n\n\n**W2:** High adversarial noise intensity.\n\n**A2:** We compared AdvI2I against baselines using a lower noise bound (16/255) on InstructPix2Pix. The results confirm that AdvI2I maintains effectiveness.\n\n|Method|ε|w/o Defense|SLD|SD-NP|GN|SC|\n|-|-|-|-|-|-|-|\n|**AdvI2I**|16/255|70.5%|68.5%| 70.0%|55.5%|14.5%|\n|**Adaptive**|16/255|70.5%|65.5%|68.5%|62.5%|55.5%|\n\nIn addition to quantity results, manuscript's **Figure 2** also qualitatively shows that our noise generator produces perturbations (64/255) that remain visually imperceptible to humans.\n\n**W3:** Evaluation depends on algorithmic detectors.\n\n**A3:** We follow the common practice in prior studies [1, 2, 3, 4] to use these detectors (NudeNet, Q16) for consistent quantitative benchmarking. These detectors are trained on human-labeled datasets and thus reflect human perception to some extent.\n\nTo further strengthen our evaluation, we tested AdvI2I using a multimodal LLM (GPT-4o) with carefully designed prompts to simulate human judgment. The prompt, examples and results are shown in [the file](https://anonymous.4open.science/r/ICML-2025-rebuttal-B583/GPT_evaluation_for_rvyv.pdf). The results closely align with algorithmic detectors. \n\n[1] Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models.\n\n[2] Ring-A-Bell! How Reliable are Concept Removal Methods For Diffusion Models?.\n\n[3] Sneakyprompt: Jailbreaking text-to-image generative models.\n\n[4] Mma-diffusion: Multimodal attack on diffusion models.\n\n**W4:** Insufficient coverage of concepts, and small test size.\n\n**A4:** We appreciate this suggestion. In addition to the \"nudity\" and \"violence\" concept covered in our manuscript, we further evluated the suggested \"political extremism\" concept. The concept vector is constructed with prompts related to \"extremism\" and \"terrorism.\". The results confirm AdvI2I's versatility across diverse NSFW concepts.\n\n| Method| Concept| w/o Defense|SLD|SD-NP|GN|SC|\n|-|-|-|-|-|-|-|\n| **AdvI2I**|Extremism|76.5%|73.0% | 73.5%|60.5%|27.5%|\n| **AdvI2I-Adaptive**|Extremism|74.5%|70.0%|72.5%|71.5%|72.0%|\n\nRegarding sample size, our primary metric (ASR) typically does not require massive samples for reliable evaluation. Previous works ([1] Ring-A-Bell: 200 prompts, [2] MMA: 60 images) employed similar or smaller evaluation sets. Nonetheless, we now increased our test set to 500 images, and AdvI2I continues to demonstrate consistent effectiveness.\n\n|Method|w/o Defense|SLD|SD-NP|GN|SC|\n|-|-|-|-|-|-|\n|**AdvI2I**|75.2%|71.2%|71.6%|62.0%|17.0%|\n|**AdvI2I-Adaptive**|71.4%|65.4%|65.8%|68.6%|65.4%|\n\nAdditionally, for image quality (**Section F** of our manuscript), we use several metrics in addition to FID. These metrics are less sensitive to sample size and consistently validate the high visual quality of our generated images.\n\n**W5:** Evaluations on new I2I models.\n\n**A5:** Please see our response **Reviewer FsK8's A3**. Thank you for your advice.\n\n**W6:** The low ASR on SDv3.0.\n\n**A6:** The relatively lower performance on SDv3.0 is primarily due to its explicitly filtered training dataset, as noted in [1]. Interestingly, when we directly used prompts to request nudity content on SDv2.1 and SDv3.0 without defenses, SDv2.1 easily generated such content, while SDv3.0 did not. And even adversarial prompts (e.g. QF, Ring, etc.) fail significantly more often on SDv3.0 compared to earlier SD models. \n\n|Model|QF|Sneaky|Ring|MMA| MMA-Mask |\n|-|-|-|-|-|-|\n|SDv1.5 | 68%|48%|98%|100%| 64%|\n|SDv2.1 | 62%|46%|88%|94%| 64%|\n|SDv3.0 | 14%|34%|48%|46%| 28%|\n\nThis suggests that SD3.0 has less risk of generating NSFW content, regardless of attack methods. Therefore, a potential future direction to enhance I2I safety is to totally nullify the NSFW concept from the model by thoroughly cleaning the training data. \n\n[1] Scaling rectified flow transformers for high-resolution image synthesis.\n\nThank you again for your valuable feedback.", "claims_and_evidence": "The claims are empirically supported through: (1) demonstration that adversarial text prompts are easily defended against (34-96% ASR reduction via LLM filters in Table 2), and (2) AdvI2I-Adaptive's maintained high ASR (>70%) under SLD and safety checker defenses. However, the low transferability to SDv3.0 (34% ASR) lacks sufficient analysis to explain generalization limits.", "methods_and_evaluation_criteria": "Evaluation Limitations: The attack success metrics depend entirely on algorithmic detectors (NudeNet, Q16 classifier). While these provide quantitative benchmarks, they cannot fully capture real-world human perceptual thresholds.", "theoretical_claims": "No theoretical analysis is provided.", "experimental_designs_or_analyses": "1. Dataset Limitations: The dataset (400 images from the \"sexy\" category) exhibits selection bias and lacks representation of critical NSFW concepts such as political extremism, hate symbols, or graphic violence. And Small sample size (200 test images) raises concerns about statistical significance, especially for FID.\n\n2. Model Coverage: Evaluations lack of state-of-the-art models like SDXL and PixArt-α, limiting insights into modern I2I pipelines.\n\n3. The low ASR (34%) on SDv3.0 is attributed to data filtering without ablation studies.", "relation_to_broader_scientific_literature": "Previous text-based attacks, such as QF-Attack, Ring, and MMA, have optimized adversarial text prompts to induce NSFW content in T2I models. In contrast, AdvI2I generates adversarial perturbations directly on input images to induce NSFW content.", "essential_references_not_discussed": "No.", "other_strengths_and_weaknesses": "Strengths:\n\n1.\tClear Motivation. Identifies critical limitations of text-based adversarial attacks and proposes AdvI2I generating adversarial image perturbations to induce NSFW content in I2I diffusion models.\n\n2.\tWell-designed method: combining NSFW concept vector extraction with adversarial generator, enabling efficient perturbation generation \n\nWeaknesses:\n\n1.\tConcerns regarding sample transferability: The method proposed in this paper relies on generating adversarial samples through image generation models. This approach may result in a heavy dependency on training data and known I2I (image-to-image) models, casting doubt on its effectiveness when applied to unknown samples or untested I2I models. The low ASR (34%) on SDv3.0 seems verify this point.\n\n2.\tImpractical methodology: The adversarial noise intensity in the experiments is excessively high (ranging from 32/255 to 128/255). Such noise levels introduce visually perceptible anomalies, which would likely trigger immediate rejection of the samples in subsequent processing pipelines. Furthermore, overly conspicuous noise is also susceptible to detection by defense models, ultimately rendering this approach impractical in real-world applications.\n\n3.\tEvaluation Limitations: The attack success metrics depend entirely on algorithmic detectors (NudeNet, Q16 classifier). While these provide quantitative benchmarks, they cannot fully capture real-world human perceptual thresholds.\n\n4.\tDataset Limitations: The dataset (400 images from the \"sexy\" category) exhibits selection bias and lacks representation of critical NSFW concepts such as political extremism, hate symbols, or graphic violence. And Small sample size (200 test images) raises concerns about statistical significance, especially for FID.\n\n5.\tModel Coverage: Evaluations lack of state-of-the-art models like SDXL and PixArt-α, limiting insights into modern I2I pipelines.\n\n6.\tThe low ASR (34%) on SDv3.0 is attributed to data filtering without ablation studies.", "other_comments_or_suggestions": "No.", "questions_for_authors": "No.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "qiCJP7Pom0", "reviewer": "Reviewer_FsK8", "summary": "- This paper proposes AdvI2I, a novel framework that induces diffusion models to generate NSFW content using adversarial images.\n- It circumvents existing defense mechanisms, such as Safe Latent Diffusion (SLD), without modifying text prompts, underscoring the urgent need for stronger security measures to prevent the misuse of I2I diffusion models.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for insightful feedback. We have conducted additional analyses and experiments to address your concerns.\n\n**W1:** The robustness of the method against adversarial defense strategies, such as DiffPure.\n\n**A1:** We have now evaluated the robustness of AdvI2I against DiffPure as suggested. DiffPure reduces the ASR for the SDv1.5-Inpainting model (nudity concept) from **82.5% to 72.5%**, a modest decline indicating AdvI2I’s robustness to such purification defenses.\n\n|**Method**|w/o Defense|**DiffPure** |\n|:-|:-|:-|\n|Attack VAE|41.5%|33.5%|\n|**AdvI2I (ours)** |82.5%|72.5%|\n\n\n\n**W2:** Runtime comparisons or discussion on the computational costs of the proposed method. \n\n**A2:** Thank you for highlighting this point. We conducted additional experiments comparing AdvI2I to MMA on SDv1.5-Inpainting, measuring ASR and runtime cost. The results clearly demonstrate AdvI2I’s efficiency advantage. **AdvI2I maintains high ASR (82.5%) at an extremely low attack runtime (only 0.008 sec/image)**, demonstrating superior practical utility.\n\n|**Method**|**ASR (%)**|**Average Time Cost (s)**|\n|-|-|-|\n| MMA| 42.0| 415.984|\n| **AdvI2I (ours)**| 82.5| 0.008|\n\n\n\n**W3:** More advanced versions of Stable Diffusion or other models like FLUX.\n\n**A3:** We appreciate this valuable suggestion. We have now evaluated AdvI2I on recent advanced diffusion models, including SDXL-Turbo (incorporating a refiner block) and FLUX (using diffusion transformers). As summarized in table below, AdvI2I consistently exhibits strong generalization capabilities across these new models.\n\n| Method | Model| w/o Defense | SD-NP | GN| SC|\n|-|-|-|-|-|-|\n|AdvI2I| SDXL-Turbo| 82.5%| 79.5% | 66.0% | 18.5% |\n|AdvI2I| FLUX.1-dev ControlNet Inpainting-Alpha | 80.0%| 76.5% | 65.0% | 18.5% |\n\n**W4:** The proposed attack requires a white-box setting with a safety checker. \n\n**A4:** The safety checker we evaluated is widely adopted across diffusion models. However, to comprehensively assess black-box transferability, we additionally evaluated AdvI2I-Adaptive using an entirely different NSFW detector (MHSC [1]) as the safety checker. Results below confirm that AdvI2I-Adaptive achieves significantly higher transferability (**41.0%**) compared to MMA (**20.5%**), underscoring the generalization advantages provided by our learned adversarial noise generator.\n\n| Method| w/o Defense | SC| Black-box MHSC |\n|-|-|-|-|\n| MMA| 68.5%| 64.5%| 20.5%|\n| **AdvI2I-Adaptive (ours)** | 78.0%|70.5%|41.0%|\n\n\n\n**W5:** Clarify the distinction between AdvI2I-Adaptive and the Image-Modal Attack in MMA.\n\n**A5:** The key differences are as follows:\n\n- Attack Requirement: MMA’s adversarial image targets only the safety checker, and still requires an unsafe prompt to induce the diffusion model to generate NSFW content. This reliance makes it easier to defend against (see Table 2 in our manuscript). In contrast, AdvI2I-Adaptive requires only an adversarial image, which simultaneously fools both the diffusion model and the safety checker, without needing an unsafe prompt.\n- Attack Method: MMA performs direct image-space optimization per input, while AdvI2I-Adaptive uses a generator to produce adversarial images conditioned on clean inputs. This makes our method more effective (see Table 9 in the manuscript) and more efficient (see A2 of Reviewer FsK8).\n \n**Q1:** In line 15 of Algorithm 1, should it refer to Eq. 2 instead of Eq. 4 when not using AdvI2I-Adaptive?\n\n**A6:** You are correct; line 15 of Algorithm 1 should reference Eq. 2 when describing the standard AdvI2I (non-adaptive version). We sincerely appreciate your careful observation and will correct this mistake.\n\n**Q2:** How can SAM be used to defend your model similarly to MACE: Mass Concept Erasure in Diffusion Models? I believe applying SAM as a defense could effectively mitigate most attacks.\n\n**A7:** We appreciate your insightful suggestion. However, we found that directly applying SAM to detect and mask NSFW content of generated images is ineffective. Specifically, SAM indiscriminately masks entire human bodies or clothes, regardless of actual NSFW content presence. In our validation with 200 non-NSFW images, SAM consistently produced masks inaccurately labeling human figures as containing nudity—even when explicitly prompted with specific sensitive body parts (e.g., \"breasts,\" \"genitalia\") that were absent.\nThis suggests SAM inherently attempts to mask areas matching textual prompts, regardless of content appropriateness, and struggles to accurately interpret abstract concepts such as \"nudity\". Consequently, using SAM as an effective defense would require methodological refinements, which we believe represent a valuable direction for future research.\n\nWe provide representative examples in [this link](https://anonymous.4open.science/r/ICML-2025-rebuttal-B583/SAM_detect_NSFW_for_FsK8.pdf).\n\nThank you again for these valuable comments. We will include these experiments and analyses in the revised version.", "claims_and_evidence": "- Yes, the details can be found in the Strengths and Weaknesses of my review below.", "methods_and_evaluation_criteria": "- It makes sense, and the authors provide a fair comparison.", "theoretical_claims": "- No proofs are provided in this paper.\n- I believe the idea makes sense.", "experimental_designs_or_analyses": "- Since most settings are the same as the baseline, I believe the experiments are fair enough. \n- I would like to request that the authors release the code as soon as the paper is accepted.", "relation_to_broader_scientific_literature": "- The paper investigates the security issues of I2I diffusion models and proposes an adversarial image-based approach to attack I2I diffusion models, addressing the limitations of previous text-based attacks in [1][2].\n   - [1] Yang, Y., Gao, R., Wang, X., Ho, T.-Y., Xu, N., and Xu, Q. MMA-diffusion: Multimodal attack on diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition\n   - [2] Ma, J., Cao, A., Xiao, Z., Zhang, J., Ye, C., and Zhao, J. Jailbreaking prompt attack: A controllable adversarial attack against diffusion models. arXiv preprint arXiv:2404.02928, 2024.", "essential_references_not_discussed": "NAN", "other_strengths_and_weaknesses": "- Strengths\n   - This paper explores a novel problem, that is, adversarial image attacks targeting I2I diffusion models.\n   - The paper proposes a well-designed and effective novel pipeline.\n   - The paper considers various experiments, including transferability and image quality. The experimental results, which compare against baselines and different defense methods, demonstrate the method’s generalizability.\n   - The paper is well-written and easy to follow.\n- Weaknesses:\n   -  AdvI2I relies on adversarial images. It would be beneficial to explore the robustness of the method against adversarial defense strategies, such as DiffPure [1], to demonstrate the effectiveness of adversarial image attacks in a more comprehensive manner.\n      - [1] Nie W, Guo B, Huang Y, et al. Diffusion models for adversarial purification. arXiv preprint arXiv:2205.07460, 2022.\n   - There is no detailed analysis of runtime comparisons, nor is there adequate discussion on the computational costs and efficiency of the proposed method. This could limit its practical feasibility.\n   - The main results are limited to SDv1.5-Inpainting and InstructPix2Pix, excluding more advanced versions of Stable Diffusion or other models like FLUX. This limits the generalization potential of AdvI2I.\n   - The proposed attack requires a white-box setting with a safety checker. The experiments in the appendix only evaluate transferability for ViT-L/14-based models. Is this evaluation comprehensive enough to assess the effectiveness of the method on existing diffusion models?\n   - The method section introduces the concept of Adaptive Attack. How does it differ from the Image-Modal Attack in MMA? Please clarify the distinction between the two approaches.", "other_comments_or_suggestions": "- In line 15 of Algorithm 1, should it refer to Eq. 2 instead of Eq. 4 when not using AdvI2I-Adaptive?", "questions_for_authors": "- I would like the authors to address the weaknesses outlined above.\n- How can SAM be used to defend your model in a similar way to MACE: Mass Concept Erasure in Diffusion Models? I believe applying SAM defense at the end of the model could effectively mitigate most attacks.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "LR6Weyyn4B", "reviewer": "Reviewer_YL1t", "summary": "The paper presents an adversarial attack on image-to-image diffusion models to generate NSFW content. The authors train a Variational Autoencoder (VAE) to encode NSFW content into clean images and introduce an adaptive attack method to circumvent existing NSFW defense mechanisms. Through experiments on two image-to-image diffusion models, the authors demonstrate that their method can effectively bypass current defenses and generate NSFW content.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for the insightful comments. Below, we thoroughly address each point with additional experiments and clarifications.\n\n**W1:** Experiments mostly conducted in a white-box setting; limited effectiveness on SDv3.0.\n\n**A1:** We have conducted additional black-box experiments to evaluate transferability across I2I models. **Table 7** in manuscript shows strong black-box transferability from SDv1.5 to SDv2.0 and SDv2.1 (ASR of **80.5%** and **84.0%**, respectively; adaptive version: **73.5%** and **77.5%**), validating real-world applicability.\n\nWe also evaluated AdvI2I-Adaptive under defenses across multiple I2I models. The results demonstrate the attack persistence when transferring from SDv1.5 to (black-box) SDv2.0 and SDv2.1.\n\n|Target Model|w/o Defense|SLD|SD-NP|GN|SC|\n|-|-|-|-|-|-|\n| SDv1.5-Inpainting|78.5%|75.0%|75.5%|72.5%|72.0%|\n| SDv2.0-Inpainting|73.5%|72.5%|75.5%|69.5%|67.0%|\n| SDv2.1-Inpainting|77.5%|73.0%|76.0%|73.0%|70.0%|\n| SDv3.0-Inpainting|33.0%|30.5%|30.5%|27.0%|30.0%|\n\nMoreover, we extended our evaluation to newer diffusion models. Transferring attacks from SDv1.5 to SDXL-Turbo and FLUX yields ASRs of 62.5% and 74.0%, respectively, further highlighting the method’s generalization capability across model architectures in black-box setting.\n\n|Source Model|Target Model|ASR|\n|-|-|-|\n|SDv1.5-Inpainting|SDXL-Turbo|62.5%|\n|SDv1.5-Inpainting|FLUX.1-dev ControlNet Inpainting-Alpha|74.0%|\n\nRegarding the explanations on reduced ASR on SDv3.0, please refer to our response **Reviewer rvyv's A6**.\n\n**W2:** Evaluation against multimodal LLMs.\n\n**A2:** We appreciate this valuable suggestion. Evaluating AdvI2I against a multimodal LLM defense (GPT-4o) significantly reduced ASR from 81.5% to 9.5%, demonstrating promising defensive potential. However, we observed practical limitations of directly using multimodel LLM as defense:\n\n- **High computational overhead**: GPT-4o detection (**2.94 sec/image**) exceeds generation time (**1.39 sec/image**, SDv2.1 with 50 steps).\n- **Misclassifications** due to limited visual understanding, even with carefully designed prompts ( (Detailed examples and failure cases are in this [link](https://anonymous.4open.science/r/ICML-2025-rebuttal-B583/GPT_defence_for%20YL1t.pdf).)).\n- Potential vulnerability to adaptive adversarial attacks [1, 2].\n\nThus, while promising, multimodal LLM-based defenses currently face practical challenges. Improving these methods remains an important future research direction.\n\n[1] Stop Reasoning! When Multimodal LLM with Chain-of-Thought Reasoning Meets Adversarial Image.\n\n[2] On the Robustness of Large Multimodal Models Against Image Adversarial Attacks.\n\n**W3:** Evaluation on online services.\n\n**A3:** Thank you for this suggestion. We conducted additional experiments on Leonardo.Ai (Phoenix 1.0). Despite strong protections of the online platform, AdvI2I (**34.5%**) and AdvI2I-Adaptive (**31.5%**) still significantly outperform the baseline MMA (**28.0%**), further confirming our method’s real-world effectiveness.\n\n|Method|ASR|\n|-|-|\n|MMA|28.0%|\n|AdvI2I (ours)|34.5%|\n|AdvI2I-Adaptive (ours)|31.5%|\n\n**W4:** Limited evaluation dataset size and dependency on training data. Guidelines for dataset selection needed.\n\n**A4:** We clarify that our training and test samples were randomly split without complete overlap. We have also verified sample transferability of AdvI2I on a completely unseen set (new images and prompts never seen during training) in the manuscript's **Table 5**.\n\nFor training dataset selection, we specifically chose non-NSFW images from the \"sexy\" category provided by the NSFW Data Scraper [1] because these images prominently feature people, closely aligning with real-world scenarios and attack contexts that attackers are likely to target.\n\nRegarding the explanations on reduced ASR on SDv3.0, please refer to our response **Reviewer rvyv's A6**.\n\n[1] https://github.com/alex000kim/nsfw_data_scraper?tab=readme-ov-file#nsfw-data-scraper\n\n**C1:** Potential as a defensive method.\n\n**A5:** We appreciate your insight. We tested our method’s defensive potential by using AdvI2I to embed a \"wearing clothes\" concept into images. Interestingly, this significantly reduced the ASR (**96.5% → 24.5%**) of explicit prompts (e.g., \"Make the woman naked\") on SDv1.5-Inpainting. \nThis demonstrates AdvI2I’s broader conceptual versatility and suggests promising future defensive applications. We will include this discussion in our revised paper to suggest directions for future research.\n\n**Q1:** Can diffusion-based purification counter the proposed method? \n\n**A6:** Please see our response **Reviewer FsK8's A1**. Thank you.\n\n**Q2:** The implementation of MMA-Diffusion used in this paper. \n\n**A7:** MMA generates adversarial text prompts and corresponding images to bypass diffusion model safety filters. We replaced standard prompts in our dataset with MMA-generated adversarial prompts and optimised adversarial images from our test images.", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "Yes", "theoretical_claims": "Not applicable", "experimental_designs_or_analyses": "Yes", "relation_to_broader_scientific_literature": "The paper evaluates the generation of NSFW content by diffusion models, an important topic concerning the appropriate use of these models.", "essential_references_not_discussed": "The author proposes an adversarial attack method, but it is primarily evaluated in a white-box scenario and on similar model architectures during the main evaluation.", "other_strengths_and_weaknesses": "Strength:\n\n1. The paper is well-written and easy to follow.\n\n2. The exploration of NSFW topics in image-to-image diffusion models is novel.\n\n3. The attack methods, which use a trained generator to modify only the image input, are effective against current defenses.\n\n4. The experimental results are robust and demonstrate the effectiveness of the proposed attack in a white-box scenario.\n\nWeaknesses:\n\n1. Since the adversarial image generator is trained using white-box diffusion models, it is crucial to evaluate its performance in black-box scenarios to demonstrate the generalization of the proposed attacks. However, the major experiments are conducted in a white-box setting. Additionally, the performance on the latest SDv3.0 is significantly lower, which poses a notable limitation for the further deployment of the proposed attacks.\n\n2. The proposed method incorporates the concept of current defenses into the training of the adversarial image generator, which ensures better performance against these defenses. The authors should evaluate the method against more unseen or advanced defenses, such as using multi-model LLMs for defense, to further validate the usability of the proposed attacks.\n\n3. The experiments are conducted solely on open-source models. It is essential to assess the performance on models with online services, such as Midjourney and Leonardo.Ai, to gain a comprehensive understanding of the method's effectiveness.\n\n4. The experiments are performed only on a test set used for training the generator with hundreds of images, which may not be sufficient to evaluate an adversarial attack method on large SD models. Moreover, the performance on SDv3.0 indicates that the training data is critical for the success of the proposed attacks, as they are trained with the target diffusion model. The authors should provide guidelines on selecting the training dataset and explain the rationale behind their choices.", "other_comments_or_suggestions": "The proposed method has potential to be a strong defense, the paper can be largely enhanced if the author can construct a defense method.", "questions_for_authors": "1. Please follow the weakness for questions.\n\n2. Can diffusion-based purification counter the proposed method? For instance, could a purification method that gradually removes the NSFW concept, as defined by Equation 1, during its diffusion process effectively mitigate the attack?\n\n3. In the MMA-Diffusion paper, a multimodal attack is presented. However, it is unclear which implementation of MMA-Diffusion is used in this paper. Could you provide further clarification on the specific implementation and how it relates to the proposed method?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper received 2 weak reject and 1 weak accept. After careful consideration of the submission, the reviews and rebuttal, this meta-review recommends **weak accept**.

On positive aspects, this paper tackles an important problem of image-to-image diffusion model safety with clear motivations, a novel solution and thorough experimentation.

The main concerns focus on the limitations in dataset scope (400 images in submission and extended to 500 in rebuttal) and transferability of the attack (especially for SDv3.0). In the rebuttal, the authors also pointed out that previous works ([1] Ring-A-Bell: 200 prompts, [2] MMA: 60 images) employed similar or smaller evaluation sets. So, the dataset scope seems to be a fair setting. Following the initial reviews, the authors have conducted comprehensive evaluations across different models, including transferability and black-box settings, which show strong empirical results and discusses real-world applicability.

Even though some concerns remains, e.g., the paper can be largely enhanced if the author can construct a defense method. This meta-review thinks that the main concerns have been largely addressed, and thus overall recommend weak accept.
Decision: Accept (poster)