Paper: Multi-modality Adversarial Attacks on Latent Diffusion Models (ICLR-2024)

Reviewer comment (Novelty):
Related missing references: [1] Diffusion Models for Imperceptible and Transferable Adversarial Attack [2] Towards Adversarial Attack on Vision-Language Pre-training Models

Author response:
Q1: Related work.

We focus on attacking diffusion models. In contrast, [1] uses diffusion models to generate adversarial examples against image classifiers, and [2] focuses on attacking vision-language pre-training models. We have added the discussion in our paper.

Reviewer comment (Experiments):
What's the difference between the Image and MMA w/o Image, and Text and MMA w/o Text in experiments? Please describe in detail.

Author response:
Q3: Difference of baselines.

As we introduce in Section 5.1, the four baselines are single-modality attacks in our MMA framework. Suppose we update the adversarial pairs for $T$ iterations by our MMA. We perturb images for $T_1$ iterations and text for $T_2$ iterations. Therefore, $T = T_1 + T_2$. “Image” and “Text” run the MMA framework only on one modality. “Image” only perturbs the input image for $T$ iterations by the MMA framework without changing the input text. Similarly, “Text” only perturbs the input text for $T$ iterations by the MMA framework without changing the input image. “MMA w/o Image” and “MMA w/o Text” mean that we run MMA on both modalities, but we only use the perturbations from one modality. Specifically, “MMA w/o Text” means we only perturb the input image by the generated image perturbation of MMA, which is to perturb the image for $T_1$ iterations. “MMA w/o Image” means we only perturb the input text by the generated text perturbation of MMA, which is to perturb the text for $T_2$ iterations.

Reviewer comment (Experiments):
Co-attack is a multimodal adversarial attack designed for vision-language pretraining models, integrating both BERT-attack and PGD methods. Would it be feasible to deploy Co-attack against the LDMs discussed in the paper and subsequently contrast its efficacy with the proposed MMA? Co-attack: Towards Adversarial Attack on Vision-Language Pre-training Models

Author response:
Q4: Co-attack.

We compare our method with Co-attack. We can see that our approach achieves better performance.

| Methods | $L_2$ | $Sim_{img}$ | $Lev$ | $Sim_{text}$ | PSNR | SSIM | MSSSIM | CLIP |FID | IS |
| :------: | :-----: | :-----: | :-----: | :-----: | :-----: | :-----: | :-----: | :-------: | :----: | :----: |
| Co-Attack | 23.62 | 0.42 | 3.86 | 0.77| 10.44 |0.136 |0.284 |29.32 | 202.27 |13.51 |
| Ours | **16.51** | **0.56** | **3.78** | **0.80** |**10.14** |**0.123** |**0.263** |**28.65** | **205.06** |**13.38** |

Reviewer comment (Experiments):
In the transfer-based attack, can the methods, such as TI-FGSM and DI-FGSM be used to attack the target LDMs?

Author response:
Q5: Transfer setting.

We can incorporate DIM and SIM into our method to improve adversarial transferability. We find that the adversarial transferability is improved.

Black-box on SD1-5

| Methods | PSNR | SSIM | MSSSIM | CLIP |FID | IS |
| :------: |  :-----: | :-----: | :-----: | :-------: | :----: | :----: |
| Ours | 11.26 |0.181 |0.343 |30.13 | 189.27 |16.31 |
| Ours + DIM | 11.18 |0.172 |0.327 |29.97 | 189.76 |16.92 |
| Ours + SIM | **11.12** |**0.168** |**0.322** |**29.93** | **189.92** |**17.13** |

Reviewer comment (Novelty):
The method in the paper is not particularly innovative and is overly simplistic. The approach, especially the text search mechanism, seems rather basic and lacks novelty. No theoretical analysis is provided on the distortion induced by multi-modality attacks compared to single modality.

Author response:
Q1: Theoretical analysis.

Compared with single-modality attacks, multi-modality attacks have a lower upper bound of the perturbation. The proof is as follows.

We suppose the perturbation of each step is $(\delta^j_i, \delta^j_t)$ for multi-modality adversarial attacks, where $\delta^j_i$ and $\delta^j_t$ are the perturbation on the image and text respectively. 

In our MMA approach, we only update image or text in each step, so $\delta^j_i = \textbf{0}$ or $\delta^j_t = \textbf{0}$. 

Without loss of generalization, we focus on the perturbation on the image. Thus, the total perturbation on the image $\Delta_i = \sum_{j}^{T} \delta^j_i$, where $T$ is the total iteration. 

Then the $L_2$ norm of the total image perturbation holds the inequality $|| \Delta_i ||_2 = || \delta^1_i + \cdot + \delta^T_i||_2 \leq  || \delta^1_i||_2 + \cdot + || \delta^T_i||_2$. For each perturbation $|| \delta^j_i||_2$, we have the constraint that $|| \delta^j_i||_2 = \alpha$, where is the step length for each iteration. 

As a result, the $|| \Delta_i ||_2 \leq \alpha * M$, where $M \leq T$ is the iteration times to update image. 

However, for single-modality attack, the total image perturbation $|| \Delta_i ||_2 \leq \alpha * T$. 

All in all, multi-modality attacks have a lower upper bound of the perturbation unless the multi-modality attack is degenerated to single-modality attack.

Reviewer comment (Experiments):
The paper's primary method appears constrained to untargeted attacks. This limitation curtails its adaptability and potentially its effectiveness in targeted adversarial scenarios.

Author response:
Q2: Targeted attack.

Our approach can be adapted to the targeted adversarial scenario. Specifically, we minimize the distance between the adversarial input pair and the target image-prompt pair in the latent space of the cross-attention module. The results are as follows. Our attack is still effective and imperceptible in targeted adversarial scenarios.

| Methods | $L_2$ | $Sim_{img}$ | $Lev$ | $Sim_{text}$ | PSNR | SSIM | MSSSIM | CLIP |FID | IS |
| :------: | :-----: | :-----: | :-----: | :-----: | :-----: | :-----: | :-----: | :-------: | :----: | :----: |
| LDMR| 29.14 | 0.38 | - | - | 9.66 |0.232 |0.425 |32.22 | 292.53 |14.87 |
| QF| - | - | 9.95 | **0.83**| 10.16 |0.268 |0.484 |32.56 | 189.61 |16.73 |
| Ours | **16.72** | **0.53** | **3.74** | 0.81 |**8.62** |**0.214** |**0.403** |**31.92** | **203.72** |**14.63** |

Reviewer comment (Evaluation):
The efficiency and computational overhead of the method are not analyzed or compared to baselines.

Author response:
Q4: Efficiency.

We compare our time efficiency with baselines. We compute the average time to generate one adversarial example. MMA, LDMR, and QF use 53.2, 49.2, and 44.7 seconds, respectively. Although our time efficiency is similar to the previous works, we can achieve better imperceptibility and attacking performance.

Reviewer comment (Novelty):
lacking deep consideration about the multi-modal generation problem.

Author response:
Q1: Challenges & contributions.

As we stated in the third paragraph of Section 1, perturbing the text and image at the same time distributes the needed perturbation to both modalities, making them more imperceptible to humans on the whole. Besides, compared with single-modality attacks, multi-modality attacks have the potential to discover more robustness issues. Therefore, the challenge resides on the proper interaction between two modalities to find the optimal perturbation in each step for both good attacking performance and imperceptibility. Therefore, we propose MMA, which uses a unified query ranking framework to properly combine the updating on both modalities.

Furthermore, we are the first to study the multi-modality attacks on diffusion models. We formally define the multi-modality attacks, specifying the attack objective, the perturbation space, and the attack constraints. 

Multi-modality attacks also have multiple applications. The generated adversarial examples can be utilized to retrain the model for improving the robustness [3], and to fingerprint the models [4] and watermark the examples [5] for solving privacy issues.

Reviewer comment (Evaluation):
The evaluation is not convincing.

Author response:
Q2: Evaluation.

We follow previous works [1,2] to utilize PSNR as a metric to quantify the attacking performance. PSNR measures the difference between the generated images of the original input and the adversarial input. In addition to PSNR, we also deploy other metrics, like SSIM, and MSSSIM to measure the difference. The results on these metrics validate the effectiveness of MMA.

Reviewer comment (Writing):
The authors only present a solution for a multi-modal adversarial attack via attacking two modalities and selecting a prominent one. I cannot capture the core problem in the multi-modal adversarial attack and difficulties. Please make a thorough illustration.

Author response:
Q1: Challenges & contributions.

As we stated in the third paragraph of Section 1, perturbing the text and image at the same time distributes the needed perturbation to both modalities, making them more imperceptible to humans on the whole. Besides, compared with single-modality attacks, multi-modality attacks have the potential to discover more robustness issues. Therefore, the challenge resides on the proper interaction between two modalities to find the optimal perturbation in each step for both good attacking performance and imperceptibility. Therefore, we propose MMA, which uses a unified query ranking framework to properly combine the updating on both modalities.

Furthermore, we are the first to study the multi-modality attacks on diffusion models. We formally define the multi-modality attacks, specifying the attack objective, the perturbation space, and the attack constraints. 

Multi-modality attacks also have multiple applications. The generated adversarial examples can be utilized to retrain the model for improving the robustness [3], and to fingerprint the models [4] and watermark the examples [5] for solving privacy issues.

Reviewer comment (Evaluation):
The evaluation metric designed by the authors is confusing. The paper evaluates PSNR between the original generated image and the adversarial generated image, but I am not sure whether this comparison pair has convincing effects. I understand the authors aim to estimate the generation effect, but directly comparing two generated images seems to lack stable indications.

Author response:
Q2: Evaluation.

We follow previous works [1,2] to utilize PSNR as a metric to quantify the attacking performance. PSNR measures the difference between the generated images of the original input and the adversarial input. In addition to PSNR, we also deploy other metrics, like SSIM, and MSSSIM to measure the difference. The results on these metrics validate the effectiveness of MMA.

Reviewer comment (Experiments):
Please clarify the differences in the utilization of SD-2-1, SD-1-4, and SD-1-5.

Author response:
Q4: Model differences.

The difference between SDv1 and SDv2 is on the encoder of the image. SDv1 uses the pre-trained CLIP, while SDv2 retrains CLIP on their own dataset. The difference between SDv1-4 and SD-v1-5 is on the model weights. The latter version is further trained based on the previous version.

Reviewer comment (Evaluation):
The imperceptibility has no visible verification.

Author response:
Q5: Qualitative examples.
Please refer to the top 2 rows of Figure 3 in our paper. We can see that both the image and text perturbations are imperceptible to humans.

Reviewer comment (Novelty):
The rationale behind the necessity of this attack is not thoroughly convincing. The paper lacks a clear articulation of the contributions that the proposed attack brings to the field of latent diffusion models.

Author response:
Q2: Contribution.

Adversarial attacks can be used to evaluate the robustness of the target model. As we discussed in the third paragraph of Section 1, we need multi-modality attacks for the below reasons.

(1)	Compared with the single-modality attacks on diffusion models, multi-modality attacks can more thoroughly explore the perturbation space. Therefore, multi-modality attacks can find more failures of diffusion models than single-modality attacks.

(2)	Perturbing the text and image at the same time distributes the needed perturbation to both modalities, making them more imperceptible to humans on the whole. 

(3)	The generated adversarial examples can also be utilized to retrain the model for improving the robustness [5], and to fingerprint the models [6] and watermark the examples [7] for solving privacy issues.

Reviewer comment (Evaluation):
The absence of human evaluation metrics to quantitatively assess the effectiveness of the attack in generating adversaries is a notable limitation.

Author response:
Q3: User study.

In order to measure the success of the attack and its imperceptibility, we launch a preliminary user study, where we randomly select 100 examples, and ask three annotators to give their scores. We compare our approach with baselines LDMR and QF. For measuring the ASR, we ask the annotator the following question: How well does the generated image correspond with the prompt? Please score it from 1 to 5, where the higher score means a higher consistency. For measuring the imperceptibility, we ask the annotator the following question: How similar are the two data pairs (the adversarial pair and the original pair)? Please score it from 1 to 5, where the higher score means a higher similarity.

The results are shown in the table below. The agreement of the user study is 80.7 %. We can see that our approach achieves the best attacking performance and imperceptibility.

| Methods |Consistency (ASR) | Similarity (Imperceptibility) |
| :------: | :----: | :----: |
| LDMR| 3.52 | 2.87 |
| QF| 3.14 | 2.15 | 
| Ours | **2.47** | **4.58** |

Reviewer comment (Evaluation):
The paper does not provide sufficient details regarding the success rate of the attack. Information on how many instances the attack succeeded and the overall success rate is missing, leaving a gap in the evaluation of its performance.

Author response:
Q4: ASR.

As we mentioned in Q1, the attack success rate is not suitable for quantifying the performance of attacks on diffusion models. If needed, we can set a threshold on the drop of the CLIP score to represent whether the attack is successful or not. We set the threshold to be 2.0. The ASR of MMA is 99.6\%, while the ASR of LDMR and QF are 10.5\% and 21.3\%, respectively. Our approach outperforms the baselines with a large margin on ASR.

Reviewer comment (Presentation):
The use of citation methods such as \citep and \citet could be improved for better clarity and presentation in the paper, to distinguish between citations with or without parentheses.

Author response:
Q5: Presentation.

The citation in the paper is modified as you suggested.