Original: T HE B IASED A RTIST : E XPLOITING C ULTURAL B IASES VIA H OMOGLYPHS IN T EXT -G UIDED I MAGE G ENERATION M ODELS
Revised: T HE B IASED A RTIST : E XPLOITING C ULTURAL B IASES VIA H OMOGLYPHS IN T EXT -G UIDED I MAGE G ENERATION M ODELS

Original: Anonymous authors
Revised: Anonymous authors

Original: Paper under double-blind review
Revised: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: Text-guided image generation models, such as DALL-E 2 and Stable Diffusion, have recently received much attention from academia and the general public.
Revised: Text-guided image generation models, such as DALL-E 2 and Stable Diffusion, have recently received much attention from academia and the general public.

Original: Provided with textual descriptions, these models are capable of generating highquality images depicting various concepts and styles.
Revised: Provided with textual descriptions, these models are capable of generating highquality images depicting various concepts and styles.

Original: However, such models are trained on large amounts of public data and implicitly learn relationships from their training data that are not immediately apparent.
Revised: However, such models are trained on large amounts of public data and implicitly learn relationships from their training data that are not immediately apparent.

Original: We demonstrate that common multimodal models implicitly learned cultural biases that can be triggered and injected into the generated images by simply replacing single characters in the textual description with visually similar non-Latin characters.
Revised: We demonstrate that common multimodal models implicitly learned cultural biases that can be triggered and injected into the generated images by simply replacing single characters in the textual description with visually similar non-Latin characters.

Original: These so-called homoglyph replacements enable malicious users or service providers to induce biases into the generated images and even render the whole generation process useless.
Revised: These so-called homoglyph replacements enable malicious users or service providers to induce biases into the generated images and even render the whole generation process useless.

Original: We practically illustrate such attacks on DALL-E 2 and Stable Diffusion as text-guided image generation models and further show that CLIP also behaves similarly.
Revised: We practically illustrate such attacks on DALL-E 2 and Stable Diffusion as text-guided image generation models and further show that CLIP also behaves similarly.

Original: Our results further indicate that text encoderstrained on multilingual data provide a way to mitigate the effects of homoglyph replacements.
Revised: We further propose a novel homoglyph unlearning approach to update pre-trained text encoders to remove their susceptibility to homoglyphs.

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Text-guided image generation models, such as DALL-E 

Revised: Text-guided image generation models, such as DALL-E

Original: (Ramesh et al., 2022), have recently received a lot of attention from both the scientific community and the general public.
Revised: (Ramesh et al., 2022), have recently received a lot of attention from both the scientific community and the general public.

Original: Provided with a simple textual description, these models are able to generate high-quality images from different domains and styles.
Revised: Provided with a simple textual description, these models are able to generate high-quality images from different domains and styles.

Original: Whereas trained on large collections of public data from the internet, the learned knowledge and behavior of these models are only little understood and have already raised copyright concerns (Heikkil¨aarchive, 2022).
Revised: Whereas trained on large collections of public data from the internet, the learned knowledge and behavior of these models are only little understood and have already raised copyright concerns (Heikkil¨aarchive, 2022).

Original: Previous research mainly focused on improving the generated images’ quality and the models’ understanding of complex text descriptions.
Revised: Previous research mainly focused on improving the generated images’ quality and the models’ understanding of complex text descriptions.

Original: See Sec.
Revised: See Sec.

Original: 2 for an overview of related work in text-to-image synthesis and possible attacks against such models.
Revised: 2 for an overview of related work in text-to-image synthesis and possible attacks against such models.

Original: We are the first to investigate the behavior of text-guided image generation models when conditioned on descriptions that contain non-Latin Unicode characters.
Revised: We are the first to investigate the behavior of text-guided image generation models when conditioned on descriptions that contain non-Latin Unicode characters.

Original: Replacing standard Latin characters with visually similar characters, so-called homoglyphs, allows a malicious party to disrupt image generation while making the manipulations for users hard to detect through visual inspection.
Revised: Replacing standard Latin characters with visually similar characters, so-called homoglyphs, allows a malicious party to disrupt image generation while making the manipulations for users hard to detect through visual inspection.

Original: We show the surprising effect that homoglyphs from non-Latin Unicode scripts not only influence the image generation but also implicitly induce biases from the cultural circle of the corresponding languages.
Revised: We show the surprising effect that homoglyphs from non-Latin Unicode scripts not only influence the image generation but also implicitly induce biases from the cultural circle of the corresponding languages.

Original: For example, DALL-E 2 generates images of Athens when provided with a generic description of a city and a single character replaced with a Greek homoglyph.
Revised: For example, DALL-E 2 generates images of Athens when provided with a generic description of a city and a single character replaced with a Greek homoglyph.

Original: We found similar model behavior across various domains and Unicode scripts, for which replacing as few as a single
Revised: We found similar model behavior across various domains and Unicode scripts, for which replacing as few as a single

Original: Latin character with any non-Latin character is sufficient to induce biases into the generated images.
Revised: Latin character with any non-Latin character is sufficient to induce biases into the generated images.

Original: We present our methodology and experimental results in Sec. 3 and Sec. 4, respectively.
Revised: We present our methodology and experimental results in Sec. 3 and Sec. 4, respectively.

Original: We generally refer to the induced cultural and ethnic characteristics corresponding to specific language scripts into the generated images as cultural biases throughout this work.
Revised: We generally refer to the induced cultural and ethnic characteristics corresponding to specific language scripts into the generated images as cultural biases throughout this work.

Original: Moreover, homoglyph replacements allow an attacker to even hide complete objects from being depicted in the generated images.
Revised: Moreover, homoglyph replacements allow an attacker to even hide complete objects from being depicted in the generated images.

Original: It results in misleading image generations and lowers the perceived model quality, as we practically demonstrate in Sec. 4.
Revised: It results in misleading image generations and lowers the perceived model quality, as we practically demonstrate in Sec. 4.

Original: This behavior is not limited to DALL-E 2 but also apparent for
Revised: This behavior is not limited to DALL-E 2 but also apparent for

Original: Stable Diffusion (Rombach et al., 2022) and CLIP (Radford et al., 2021).
Revised: Stable Diffusion (Rombach et al., 2022) and CLIP (Radford et al., 2021).

Original: [Figure]
Revised: [Figure]

Original: “A photo o f an actress”
Revised: “A photo o f an actress”

Original: [Figure]
Revised: [Figure]

Original:  Our experimental results, which we discuss further in Sec. 5, raise the questions of how much we actually understand about the inner processes of multi-modal models trained on public data and how small differences in the textual description could already influence the image generation.
Revised: Standard Korean [Figure] Our experimental results, which we discuss further in Sec. 5, raise the questions of how much we actually understand about the inner processes of multi-modal models trained on public data and how small differences in the textual description could already influence the image generation.

Original: As textguided image generation models become available to the general public and have a wide range of applications, such questions are essential for an informed use.
Revised: As textguided image generation models become available to the general public and have a wide range of applications, such questions are essential for an informed use.

Original: In summary, we make the following contributions:
Revised: In summary, we make the following contributions:

Original: • We are the first to show that text-guided image generation models and other models trained on text-image pairs are sensitive to character encodings and implicitly learn cultural biases related to different scripts during training.
Revised: • We are the first to show that text-guided image generation models and other models trained on text-image pairs are sensitive to character encodings and implicitly learn cultural biases related to different scripts during training.

Original: • We demonstrate that by a single homoglyph replacement, an attacker can bias the image generation with cultural influences and even render the whole process meaningless.
Revised: • We demonstrate that by a single homoglyph replacement, an attacker can bias the image generation with cultural influences and even render the whole process meaningless.

Original: • Our results further indicate that models trained on multilingual data are much more robust against homoglyph replacements and might offer a solution to mitigate the effects.
Revised: • We introduce a novel homoglyph unlearning procedure to make already trained text encoders invariant to homoglyph manipulations.

Original: Disclaimer:
Revised: Disclaimer:

Original: This paper contains images representing various cultural biases that some readers may find offensive.
Revised: This paper contains images representing various cultural biases that some readers may find offensive.

Original: We emphasize that the purpose of this work is to show that such biases are already present in text-guided image generation models and can be exploited through homoglyph manipulations.
Revised: We emphasize that the purpose of this work is to show that such biases are already present in text-guided image generation models and can be exploited through homoglyph manipulations.

Original: We do not intend to discriminate against people or cultures in any way.
Revised: We do not intend to discriminate against people or cultures in any way.

Original:  B ACKGROUND AND R ELATED W ORK
Revised:  B ACKGROUND AND R ELATED W ORK

Original: We first provide an overview over DALL-E 2 and related multimodal systems (Sec. 2.1), before outlining common privacy and security attacks against machine learning systems (Sec. 2.2) and introducing homoglyphs and the related homograph attacks (Sec. 2.3).
Revised: We first provide an overview over DALL-E 2 and related multimodal systems (Sec. 2.1), before outlining common privacy and security attacks against machine learning systems (Sec. 2.2) and introducing homoglyphs and the related homograph attacks (Sec. 2.3).

Original: 2. T EXT -T O -I MAGE S YNTHESIS
Revised: 2. T EXT -T O -I MAGE S YNTHESIS

Original: In the last few years, training models on multimodal data received much attention.
Revised: In the last few years, training models on multimodal data received much attention.

Original: Recent approaches for contrastive learning on image-text pairs are powered by a large amount of publicly available images and their corresponding descriptions.
Revised: Recent approaches for contrastive learning on image-text pairs are powered by a large amount of publicly available images and their corresponding descriptions.

Original: One of the most prominent representative is
Revised: One of the most prominent representative is

Original: CLIP (Contrastive Language-Image
Revised: CLIP (Contrastive Language-Image

Original: Pre-training)
Revised: Pre-training)

Original: (Radford et al., 2021), which consists of an image encoder network and a text encoder network.
Revised: (Radford et al., 2021), which consists of an image encoder network and a text encoder network.

Original: Both parts are jointly trained on image-text pairs in a contrastive learning scheme to match corresponding pairings of images and texts.
Revised: Both parts are jointly trained on image-text pairs in a contrastive learning scheme to match corresponding pairings of images and texts.

Original: Trained on 400M samples collected from the internet, CLIP learned meaningful representations of images and their textual descriptions, and successfully performed a wide range of different tasks with zero-shot transfer and no additional training required.
Revised: Trained on 400M samples collected from the internet, CLIP learned meaningful representations of images and their textual descriptions, and successfully performed a wide range of different tasks with zero-shot transfer and no additional training required.

Original: Based on the robust representations learned by CLIP, OpenAI recently introduced their textconditional image generation model DALL-E 2 (Ramesh et al., 2022).
Revised: Based on the robust representations learned by CLIP, OpenAI recently introduced their textconditional image generation model DALL-E 2 (Ramesh et al., 2022).

Original: To generate images from textual descriptions, the model first computes the CLIP text embedding and then uses a prior to generate possible CLIP image embeddings based on a given text embedding.
Revised: To generate images from textual descriptions, the model first computes the CLIP text embedding and then uses a prior to generate possible CLIP image embeddings based on a given text embedding.

Original: Finally, an image decoder is used to generate images based on the image embeddings.
Revised: Finally, an image decoder is used to generate images based on the image embeddings.

Original: The decoder is a diffusion model (Song & Ermon, 2020; Ho et al., 2020) trained to generate images conditioned on CLIP image embeddings.
Revised: The decoder is a diffusion model (Song & Ermon, 2020; Ho et al., 2020) trained to generate images conditioned on CLIP image embeddings.

Original: Since the decoder model only learns to generate images from CLIP image embeddings, the prior model is needed to map text embeddings to corresponding image embeddings.
Revised: Since the decoder model only learns to generate images from CLIP image embeddings, the prior model is needed to map text embeddings to corresponding image embeddings.

Original: Fig.
Revised: Fig.

Original: 1 gives an overview of the DALL-E 2 pipeline for text-guided image generation.
Revised: 1 gives an overview of the DALL-E 2 pipeline for text-guided image generation.

Original: Besides DALL-E 2, various other text-guided image generation models have been introduced over the last couple of months.
Revised: Besides DALL-E 2, various other text-guided image generation models have been introduced over the last couple of months.

Original: These include its direct predecessors GLIDE (Nichol et al., 2022) and
Revised: These include its direct predecessors GLIDE (Nichol et al., 2022) and

Original: DALL-E (Ramesh et al., 2021), Google’s Imagen (Saharia et al., 2022) and Parti (Yu et al., 2022), or the publicly available Stable Diffusion (Rombach et al., 2022).
Revised: DALL-E (Ramesh et al., 2021), Google’s Imagen (Saharia et al., 2022) and Parti (Yu et al., 2022), or the publicly available Stable Diffusion (Rombach et al., 2022).

Original: All models heavily rely on a large amount of public data collected from the internet.
Revised: All models heavily rely on a large amount of public data collected from the internet.

Original: While machine learning models continue to achieve new astonishing achievements, the privacy and security of these models come into focus.
Revised: While machine learning models continue to achieve new astonishing achievements, the privacy and security of these models come into focus.

Original: We introduce common attacks in this context in the following section
Revised: We introduce common attacks in this context in the following section

Original: . 2. A TTACKS AGAINST M ULTIMODAL M ACHINE L EARNING M ODELS
Revised: . 2. A TTACKS AGAINST M ULTIMODAL M ACHINE L EARNING M ODELS

Original: In recent years, numerous attacks on the privacy and security of machine learning models have been proposed.
Revised: In recent years, numerous attacks on the privacy and security of machine learning models have been proposed.

Original: Most similar to our work are adversarial examples (Szegedy et al., 2014; Goodfellow et al., 2015), where small tuned perturbations are added to images to manipulate a model’s predictions.
Revised: Most similar to our work are adversarial examples (Szegedy et al., 2014; Goodfellow et al., 2015), where small tuned perturbations are added to images to manipulate a model’s predictions.

Original: However, only a few attacks have been proposed so far in the context of multimodal systems.
Revised: However, only a few attacks have been proposed so far in the context of multimodal systems.

Original: Carlini & Terzis (2022) showed that contrastive learning models trained on image-text pairs are similarly vulnerable to poisoning and backdoor attacks as standard image classification models.
Revised: Carlini & Terzis (2022) showed that contrastive learning models trained on image-text pairs are similarly vulnerable to poisoning and backdoor attacks as standard image classification models.

Original: Hintersdorf et al.
Revised: Hintersdorf et al.

Original: (2022) recently demonstrated that CLIP models memorize sensitive information about entities and leak private information about their training data.
Revised: (2022) recently demonstrated that CLIP models memorize sensitive information about entities and leak private information about their training data.

Original: For text-guided generative models, Milli ` ere (2022) lately introduced two approaches for crafting adversarial examples.
Revised: For text-guided generative models, Milli ` ere (2022) lately introduced two approaches for crafting adversarial examples.

Original: In the first approach, called macaronic prompting, new words are formed by concatenating words or morphemes from multiple languages.
Revised: In the first approach, called macaronic prompting, new words are formed by concatenating words or morphemes from multiple languages.

Original: In the second approach, called evocative prompting, words are formed that have some logical similarity to existing words or categories.
Revised: In the second approach, called evocative prompting, words are formed that have some logical similarity to existing words or categories.

Original: However, all crafted words and text prompts are written in standard Latin, and humans probably recognize such adversarial examples quickly.
Revised: However, all crafted words and text prompts are written in standard Latin, and humans probably recognize such adversarial examples quickly.

Original: This fact distinguishes the proposed attacks from traditional adversarial examples, whose manipulations are hardly perceptible to humans.
Revised: This fact distinguishes the proposed attacks from traditional adversarial examples, whose manipulations are hardly perceptible to humans.

Original: Not a direct attack, but still worth mentioning are the findings of Daras & Dimakis (2022), which show that
Revised: Not a direct attack, but still worth mentioning are the findings of Daras & Dimakis (2022), which show that

Original: DALL-E 2 seems to learn a hidden vocabulary with its own made-up words for different concepts
Revised: DALL-E 2 seems to learn a hidden vocabulary with its own made-up words for different concepts

Original: . 2. H OMOGLYPHS AND H OMOGRAPH A TTACKS
Revised: . 2. H OMOGLYPHS AND H OMOGRAPH A TTACKS

Original: In this work, we investigate the influence of homoglyph replacements in image-text multimodal systems.
Revised: In this work, we investigate the influence of homoglyph replacements in image-text multimodal systems.

Original: We show for the first time that there are cultural biases captured by the models that can be easily triggered by homoglyphs, not visible to the naked eye, thus providing a new form of attack.
Revised: We show for the first time that there are cultural biases captured by the models that can be easily triggered by homoglyphs, not visible to the naked eye, thus providing a new form of attack.

Original: This is important because people may feel discriminated against by cultural stereotypes portrayed, and an attacker could reduce image quality and even render systems unusable.
Revised: This is important because people may feel discriminated against by cultural stereotypes portrayed, and an attacker could reduce image quality and even render systems unusable.

Original: Homoglyphs are letters and digits that look identical or very similar and are, therefore, hard for humans and optical character recognition systems to distinguish.
Revised: Homoglyphs are letters and digits that look identical or very similar and are, therefore, hard for humans and optical character recognition systems to distinguish.

Original: For example, the capital letter O (U+004F) and the digit 0 (U+0030) in written text are usually easy to confuse.
Revised: For example, the capital letter O (U+004F) and the digit 0 (U+0030) in written text are usually easy to confuse.

Original: The extent to which homoglyphs are confused by people also depends a lot on the font used.
Revised: The extent to which homoglyphs are confused by people also depends a lot on the font used.

Original: Fig.
Revised: Fig.

Original: 2 depicts some homoglyph examples.
Revised: 2 depicts some homoglyph examples.

Original: Unicode 1 (Unicode Consortium, 2022) homoglyphs play a special role in computer science and digital text processing.
Revised: Unicode 1 (Unicode Consortium, 2022) homoglyphs play a special role in computer science and digital text processing.

Original: Unicode is a universal character encoding and builds the standard for text processing, storage, and exchange in modern computer systems.
Revised: Unicode is a universal character encoding and builds the standard for text processing, storage, and exchange in modern computer systems.

Original: The standard does not directly encode characters for specific languages but the underlying modern and historic scripts used by various languages.
Revised: The standard does not directly encode characters for specific languages but the underlying modern and historic scripts used by various languages.

Original: It supports a wide range of different scripts, such as the Greek or Korean script.
Revised: It supports a wide range of different scripts, such as the Greek or Korean script.

Original: Technically, Unicode defines a code space and assigns each character or symbol a unique identifier.
Revised: Technically, Unicode defines a code space and assigns each character or symbol a unique identifier.

Original: [Figure]
Revised: [Figure]

Original: Unicode homoglyphs in this context describe characters from different scripts with separate hexadecimal identifiers assigned but similar visual appearances.
Revised: Unicode homoglyphs in this context describe characters from different scripts with separate hexadecimal identifiers assigned but similar visual appearances.

Original: For instance, the Latin character
Revised: For instance, the Latin character

Original: A (U+0041), the Greek character Α (U+0391), and the Cyrillic character А (U+0410) seem to be identical.
Revised: A (U+0041), the Greek character Α (U+0391), and the Cyrillic character А (U+0410) seem to be identical.

Original: Hence, completely different Unicode identifiers are associated with each character.
Revised: Hence, completely different Unicode identifiers are associated with each character.

Original: While the three characters make no visual difference to humans, information systems interpret each character differently, which already led to Unicode security considerations (Davis & Suignard, 2014).
Revised: While the three characters make no visual difference to humans, information systems interpret each character differently, which already led to Unicode security considerations (Davis & Suignard, 2014).

Original: Words that contain one or more homoglyphs from a different Unicode script are called homographs.
Revised: Words that contain one or more homoglyphs from a different Unicode script are called homographs.

Original: In a URL homograph attack, also known as script spoofing, the attacker registers domain names that look like regular domains but replaced characters with non-Latin homoglyphs.
Revised: In a URL homograph attack, also known as script spoofing, the attacker registers domain names that look like regular domains but replaced characters with non-Latin homoglyphs.

Original: A user might then be tricked to open the manipulated domain, which redirects to a malicious website to deploy malware or phishing for private information (Gabrilovich & Gontmakher, 2002; Simpson et al., 2020).
Revised: A user might then be tricked to open the manipulated domain, which redirects to a malicious website to deploy malware or phishing for private information (Gabrilovich & Gontmakher, 2002; Simpson et al., 2020).

Original: Boucher et al.
Revised: Boucher et al.

Original: (2022) recently introduced character encoding-based attacks against natural language processing (NLP) systems.
Revised: (2022) recently introduced character encoding-based attacks against natural language processing (NLP) systems.

Original: Exploiting homoglyphs and invisible Unicode symbols, together with reordering and deleting control characters, the authors added imperceptible adversarial perturbations to strings via differential evolution.
Revised: Exploiting homoglyphs and invisible Unicode symbols, together with reordering and deleting control characters, the authors added imperceptible adversarial perturbations to strings via differential evolution.

Original: The attack was then able to trick various commercial and opensource NLP systems.
Revised: The attack was then able to trick various commercial and opensource NLP systems.

Original: Related adversarial text attacks insert spelling mistakes (Belinkov & Bisk, 2018) or synonyms (Jin et al., 2020) to break a model.
Revised: Related adversarial text attacks insert spelling mistakes (Belinkov & Bisk, 2018) or synonyms (Jin et al., 2020) to break a model.

Original: In contrast, we demonstrate that text-guided image generation models are also susceptible to homograph attacks and exhibits interesting behavior expressed by cultural biases in the images generated for single character homoglyph replacements.
Revised: In contrast, we demonstrate that text-guided image generation models are also susceptible to homograph attacks and exhibits interesting behavior expressed by cultural biases in the images generated for single character homoglyph replacements.

Original:  M ETHODOLOGY
Revised:  M ETHODOLOGY

Original: For our investigations, we assume the user or attacker has black-box access to a text-guided image generation or image-text multimodal system, for example, an API providing a text prompt.
Revised: For our investigations, we assume the user or attacker has black-box access to a text-guided image generation or image-text multimodal system, for example, an API providing a text prompt.

Original: For DALL-E 2, the official API generates four image variations for every single prompt request.
Revised: For DALL-E 2, the official API generates four image variations for every single prompt request.

Original: Throughout the paper, we always state all four generated images from a single request to avoid cherry-picking.
Revised: Throughout the paper, we always state all four generated images from a single request to avoid cherry-picking.

Original: Since OpenAI may update either the DALL-E 2 model or the API over time, we note that all results depicted are generated between August 18 and September 2, 2022.
Revised: Since OpenAI may update either the DALL-E 2 model or the API over time, we note that all results depicted are generated between August 18 and September 2, 2022.

Original: Marcus et al.
Revised: Marcus et al.

Original: and Conwell & Ullman (2022) provided qualitative analyses of DALL-E 2’s generative capabilities on challenging text prompts.
Revised: and Conwell & Ullman (2022) provided qualitative analyses of DALL-E 2’s generative capabilities on challenging text prompts.

Original: The authors empirically demonstrated that
Revised: The authors empirically demonstrated that

Original: DALL-E 2 produces high-quality images for simple prompts but often fails to understand entity relationships, numbers, negations, and common sense.
Revised: DALL-E 2 produces high-quality images for simple prompts but often fails to understand entity relationships, numbers, negations, and common sense.

Original: To avoid failures and additional biases due to complex queries as far as possible, we kept the image descriptions in our experiments simple and verified that the models can produce meaningful images for the Latin-only character prompts.
Revised: To avoid failures and additional biases due to complex queries as far as possible, we kept the image descriptions in our experiments simple and verified that the models can produce meaningful images for the Latin-only character prompts.

Original: We state additional software and hardware details in Appx.
Revised: We state additional software and hardware details in Appx.

Original: A.
Revised: A.

Original: Fig.
Revised: Fig.

Original: 1 illustrates our basic approach.
Revised: 1 illustrates our basic approach.

Original: Homoglyph replacements were realized by simply replacing
Revised: Homoglyph replacements were realized by simply replacing

Original: Latin characters with homoglyphs from the Unicode scripts in the API’s text prompt.
Revised: Latin characters with homoglyphs from the Unicode scripts in the API’s text prompt.

Original: For our later experiments with Stable Diffusion (Sec. 4.3) and CLIP (Sec. 4.4), we directly changed the characters in the inputs strings.
Revised: For our later experiments with Stable Diffusion (Sec. 4.2) and CLIP (Appx. F.1), we directly changed the characters in the inputs strings.

Original: No further changes were made to the descriptions or the models.
Revised: No further changes were made to the descriptions or the models.

Original: We experimented with various Unicode scripts for different languages.
Revised: We experimented with various Unicode scripts for different languages.

Original: Whereas some of the scripts and their associated culture are commonly known, such as Greek or Cyrillic scrips, some might not.
Revised: Whereas some of the scripts and their associated culture are commonly known, such as Greek or Cyrillic scrips, some might not.

Original: We provide a short overview of the different scripts we used throughout this work in Appx.
Revised: We provide a short overview of the different scripts we used throughout this work in Appx.

Original: B.
Revised: B.

Revised: 3. Q UANTIFYING T HE I NFLUENCE OF H OMOGLYPHS

Original: [Figure]
Revised: To measure the cultural biases induced by homoglyphs, we built three prompt datasets that define concepts that are usually influenced by local culture, namely People , Buildings , and Misc . Each dataset consists of ten different prompts, each containing a placeholder # in the style of A small # town . We then generated multiple images x for each prompt, once with # removed and once replaced by the homoglyph for which we want to measure the bias, e.g., a Greek omicron. We denote the generated images based on Latin-only prompts as x and the ones with the homoglyph prompt as ˜ x .

Original: M ANIPULATING THE I MAGE G ENERATION WITH H OMOGLYPHS
Revised: Next, we took a pre-trained CLIP model (OpenCLIP ViT-H/14) (Ilharco et al., 2021) and computed the similarity of each image with the corresponding prompt z but with # replaced by the culture associated with the script of a homoglypgh, e.g., Greek in the case of an omicron. Be S c ( x, z ) the cosine similarity between the CLIP embeddings of image x and text z . To quantify how a homoglyph biases the image content toward its corresponding culture, we compute its relative bias as

Original: We first investigate the behavior of DALL-E 2 for homoglyph replacements in the textual description to evade the generation of specific objects (Sec. 4.1) and demonstrate the surprising fact that small manipulations induce cultural biases into the generated images (Sec. 4.2).
Revised: [Equation] The relative bias measures the relative increase of similarity between the given prompt that explicitly names a culture and the generated images with and without a homoglyph associated with this culture present. A higher relative bias indicates a stronger connection between the homoglyph and the associated culture. It can be computed for a single prompt or a set of prompts.

Original: After that, we extend our analysis to Stable Diffusion (Sec. 4.3) and CLIP (Sec. 4.4) models.
Revised: For our experiments, we created three distinct prompt sets describing people, buildings, and miscellaneous cultural concepts, respectively, each containing ten prompts.

Original: We start by demonstrating that homoglyph replacements allow a malicious user or adversary to prevent DALL-E 2 from generating concepts clearly described in the text prompt. For this, the attacker replaces characters in a concept’s name with homoglyphs or generally any non-Latin character and forces the generative model to ignore the object in the generated image.
Revised: All prompts are stated in Appx.

Original: In practice, the manipulated strings might be shared over the internet to reduce the perceived model quality if queried with these image descriptions.
Revised: B.1. We then generated ten images for each prompt and computed the mean relative bias for all image-text combinations.

Original:  A malicious browser plugin or website script might further automatically manipulate inserted prompt texts by replacing characters with inconspicuous homoglyphs to render the whole model useless without users noticing. Such attacks might have serious impacts on the profitability of commercial services based on text-guided models. We visualized some examples in Fig. Taking the prompt Big Ben in the rain as an example, we simply replaced the B with the Cyrillic В (U+0412) to remove the Big Ben from the generated images.
Revised:  M ANIPULATING THE I MAGE G ENERATION WITH H OMOGLYPHS

Original:  DALL-E 2generated various images of rainy locations but without any trace of the Big Ben or similar monuments. In most cases, replacing a single character is already sufficient for hiding the concept in the  generated images.
Revised: We first investigate the behavior of DALL-E 2 for homoglyph replacements in the textual description to demonstrate the surprising fact that small manipulations induce cultural biases into the generated images (Sec. 4.1).

Original: However, when concept description consists of multiple words, we needed to insert a homoglyph in each of the concept’s words, see Fig. 3a.
Revised: After that, we extend our analysis to Stable Diffusion (Sec. 4.2).

Original: We experimented with numerous queries and Unicode scripts and found that any object could successfully be hidden by using homoglyphs from any non-Latin script. To verify that DALL-E 2 is generally capable to generate the stated concepts, we show the created images for benign prompts in Appx.
Revised: We further propose a novel homoglyph unlearning method to remove the homoglyph induced biases from the text encoder (Sec. 4.3). Additional experiments demonstrating obfuscating effects of homoglyphs and investigations on the behavior of CLIP models are stated in Appx.

Original: C.7.
Revised: C.

Original: 4. I NDUCING C ULTURAL B IASES INTO THE I MAGE G ENERATION P ROCESS
Revised: 4. I NDUCING C ULTURAL B IASES INTO THE I MAGE G ENERATION P ROCESS

Original: Next, we show the effects of homoglyph replacements in subordinate words of the text descriptions.
Revised: We start by demonstrating the effects of homoglyph replacements in subordinate words for the image generation with DALL-E 2.

Original: We focus on characters of words that are not crucial to the overall image description, such as articles or prepositions.
Revised: We focus on characters of words that are not crucial to the overall image description, such as articles or prepositions.

Original: By this, we demonstrate the surprising effect that homoglyphs induce cultural biases and implicitly guide the image generation accordingly, without changing the underlying meaning of the prompt or explicitly defining any cultural attributes in the query.[Figure]
Revised: By this, we demonstrate the surprising effect that homoglyphs induce cultural biases and implicitly guide the image generation accordingly, without changing the underlying meaning of the prompt or explicitly defining any cultural attributes in the query.

Original: As a first example, the top row of Fig.
Revised: As a first example, the top row of Fig.

Original: 4 illustrates the biases induced by replacing the article A in the prompt A city in bright sunshine with a Greek or Scandinavian homoglyph.
Revised: 3 illustrates the biases induced by replacing the article A in the prompt A city in bright sunshine with a Greek or Scandinavian homoglyph.

Original: Whereas the unmodified prompt with Latin-only characters generates city images of various architectural styles, inserting the Greek capital Α (U+0391) leads to images of Greek cities.
Revised: Whereas the unmodified prompt with Latin-only characters generates city images of various architectural styles, inserting the Greek capital Α (U+0391) leads to images of Greek cities.

Original: Two of the resulting images even show Athene with a view on Mount Lycabettus.
Revised: Two of the resulting images even show Athens with a view on Mount Lycabettus.

Original: For the Scandinavian character Å (U+00C5), the images depicts cities located by the water, characteristic of Scandinavian cities, e g.,
Revised: For the Scandinavian character Å (U+00C5), the images depicts cities located by the water, characteristic of Scandinavian cities, e.g.,

Original: Trondheim or Bergen.
Revised: Trondheim or Bergen.

Original: The bottom row of Fig.
Revised: The bottom row of Fig.

Original: 4 further depicts results for generating images of an actress.
Revised: 3 further depicts results for generating images of an actress.

Original: As one can see, replacing a single character with characters from non-Latin scripts already leads to the generation of women from the cultural background associated with the corresponding homoglyph.
Revised: As one can see, replacing a single character with characters from non-Latin scripts already leads to the generation of women from the cultural background associated with the corresponding homoglyph.

Original: All generated images depict cultural stereotypes, such as clothing, jewelry, and even art style.
Revised: All generated images depict cultural stereotypes, such as clothing, jewelry, and even art style.

Original: Only the top-left image in Fig.
Revised: Only the top-left image in Fig.

Original: 4e seems to be out of line, but this is also regularly happening to standard DALLE 2 queries, so we expect it to be a simple outlier.
Revised: 3e seems to be out of line, but this is also regularly happening to standard DALLE 2 queries, so we expect it to be a simple outlier.

Original: Biasing the model with single homoglyph replacements can be used in various contexts.
Revised: Biasing the model with single homoglyph replacements can be used in various contexts.

Original: We provide a larger set of examples in Appx.
Revised: We provide a larger set of examples in Appx.

Original: C.
Revised: D.

Original:  Throughout our experiments, we found that emojis also induce biases into the image generation process.
Revised: [Figure] Throughout our experiments we found that emojis also induce biases into the image generation process.

Original: For example, adding an emoji to the prompt A photo of a X person replacing X changes the mood of the depicted person.
Revised: For example, adding an emoji to the prompt A photo of a X person replacing X changes the mood of the depicted person.

Original: We state various results for these queries in Appx.
Revised: We state various results for these queries in Appx.

Original: C.6.
Revised: D.6.

Original: Whereas homoglyph replacements in most cases influence the image generation, the occurring biases can not always be clearly described and assigned to a specific culture and are sometimes subtle, such as color schemes or environments.
Revised: Whereas homoglyph replacements in most cases influence the image generation the occurring biases can not always be clearly described and assigned to a specific culture and are sometimes subtle, such as color schemes or environments.

Original: We found the induced biases to be stronger and clearer from homoglyphs that relate to a more narrowly defined culture, such as characters from the Greek script, which are limited to the Greek language spoken in Greece and Cyprus.
Revised: We found the induced biases to be stronger and clearer from homoglyphs that relate to a more narrowly defined culture such as characters from the Greek script which are limited to the Greek language spoken in Greece and Cyprus.

Original: In contrast, the character ọ (U+1ECD) is not only part of the Vietnamese language, but also of various African languages, which is why this specific homoglyph does not always induce a Vietnamese bias, as can be seen for images generated by Stable Diffusion in Appx.
Revised: In contrast, the character ọ (U+1ECD) is not only part of the Vietnamese language but also of various African languages, which is why this specific homoglyph does not always induce a Vietnamese bias, as can be seen for images generated by Stable Diffusion in Appx.

Original: D where the images rather reflect an African bias.
Revised: E where the images rather reflect an African bias.

Original: [Figure]

Original: 4. H OMOGLYPH S USCEPTIBILITY IS I NHERENT IN T EXT -G UIDED G ENERATIVE M ODELS
Revised: 4. H OMOGLYPH S USCEPTIBILITY IS I NHERENT IN T EXT -G UIDED G ENERATIVE M ODELS

Original: Inspired by our findings, we wanted to investigate if other text-guided generative models show similar behavior.
Revised: Inspired by our findings, we wanted to investigate if other text-guided generative models show similar behavior.

Original: For this, we repeated the experiments from the previous sections on the publicly available Stable Diffusion (Rombach et al., 2022)
Revised: For this, we repeated the experiments from the previous sections on the publicly available Stable Diffusion (Rombach et al., 2022)

Original: v1.4 model.
Revised: v1.4 model.

Original: We generally found the quality and level of details of images generated to be inferior and less consistent compared to DALL-E 2.
Revised: We generally found the quality and level of details of images generated to be inferior and less consistent compared to DALL-E 2.

Original: However, the results are still of decent quality and follow the specified text descriptions.
Revised: However, the results are still of decent quality and follow the specified text descriptions.

Original: Overall, we found that Stable Diffusion behaves comparably to homoglyph replacements and integrates similar cultural biases into its generated images.
Revised: Overall, we found that Stable Diffusion behaves comparably to homoglyph replacements and integrates similar cultural biases into its generated images.

Original: However, the induced biases are sometimes less clearly depicted compared to the DALL-E 2 results.
Revised: However, the induced biases are sometimes less clearly depicted compared to the DALL-E 2 results.

Original: As we discuss in Sec. 5.1, the underlying training data did not cover all tested homoglyphs, which is why the model cannot link them to a specific culture.
Revised: As we discuss in Sec. 5.1, the underlying training data did not cover all tested homoglyphs, which is why the model cannot link them to a specific culture.

Revised: To quantify the influence of individual homoglyphs, we measured the relative bias for five homoglyphs from different scripts.

Original: As to be expected, obfuscating objects by homoglyph replacements in the text description works as reliably as in the examples in Fig. 
Revised: Fig. 5 visualizes our results. The relative bias allows quantifying the various biasing effects of homoglyphs from different scripts.

Original: We visualize our results in Appx.
Revised: our results show that [Figure]

Original: D.
Revised: homoglyphs from the Korean or African scripts have a large impact on the generation of humans, whereas Greek homoglyphs mainly bias the architectural style of buildings. The Arabic homoglyph, however, has similarly influence on all three concepts. Generally, as expected, the biases are larger if the associated cultural concept differs more strongly from standard western culture.

Original: To further investigate if the cultural differences actually originate from single homoglyphs, we calculated the text embeddings for single non-Latin characters and determined the difference with the
Revised: To further investigate if the cultural differences actually originate from single homoglyphs, we calculated the text embeddings for single non-Latin characters and determined the difference with the

Original: Latin counterpart.
Revised: Latin counterpart.

Original: We then added this difference to the text embedding of a standard text prompt without homoglyph replacements.
Revised: We then added this difference to the text embedding of a standard text prompt without homoglyph replacements.

Original: Fig.
Revised: Fig.

Original: 5 demonstrates the general principle and some results for inducing Korean and Arabic biases.
Revised: 4 demonstrates the general principle and some results for inducing Korean and Arabic biases.

Original: As can be seen, the added embedding shift induced similar cultural biases as our previous experiments with homoglyph replacements in the text prompt.
Revised: As can be seen, the added embedding shift induced similar cultural biases as our previous experiments with homoglyph replacements in the text prompt.

Original: However, we note that the induced biases are not always strong.
Revised: However, we note that the induced biases are not always strong.

Original: Since the induced cultural biases in the Stable
Revised: Since the induced cultural biases in the Stable

Original: Diffusion images are usually weaker compared to our DALL-E 2 results, we expect the effect of embedding manipulations also to be stronger for DALL-E 2.
Revised: Diffusion images are usually weaker compared to our DALL-E 2 results, we expect the effect of embedding manipulations also to be stronger for DALL-E 2.

Original: 4. N ON -G ENERATIVE M ULTIMODAL M ODELS B EHAVE S IMILARLY S ENSITIVELY
Revised: 4. H OMOGLYPH U NLEARNING

Original: To check if other multimodal models are similarly susceptible to homoglyphs, we extended our experiments to CLIP.
Revised: We also propose a novel approach to remove the biasing behavior of specific homoglyphs from a model.

Original: We investigated the official CLIP models (Radford et al., 2021) based on a vision transformer (ViT-B/32)
Revised: Inspired by backdoor attacks on pre-trained text encoders (Struppek et al., 2022), we introduce a fine-tuning procedure to let a text encoder learn to map a set of homoglyphs H to their Latin counterpart and, consequently, make the model invariant to these characters. Our method starts with two text encoder models, E and E inv , both initialized with the same pre-trained encoder weights used by the generative model. We then only update the weights of E inv to make it invariant against certain homoglyphs.

Original: (Dosovitskiy et al., 2021) and a smaller ResNet-50 (RN50) (He et al., 2016), both trained on a non-public dataset with 400M text-image pairs.
Revised: We do this by minimizing it with the following loss function: [Equation] Here, S C denotes the cosine similarity computed between the text embeddings computed by the encoders.

Original: We further used a public reimplementation of CLIP (OpenCLIP) (Ilharco et al., 2021) trained on the LAION-2B-en dataset, a subset of the public LAION-5B dataset (Schuhmann et al., 2022) with English text. Additionally, we tested a multilingual CLIP model (M-CLIP)
Revised: During each step, we sample prompt batches B and B h from a suitable English text dataset. The first term ensures that the computed embeddings of E inv are close to the embeddings of E and that the general utility of the encoder is preserved. The second term trains the encoder to map embeddings for prompts with homoglyph h ∈ H to the corresponding embedding for its Latin counterpart.

Original: (Carlsson et al., 2022) with the text encoder based on XLM-RoBERTa (Conneau et al., 2020), pre-trained on samples from 100 languages. We tested how the insertion of homoglyphs influences the cosine similarity scores computed between the image and text embeddings.
Revised: The operator ⊕ denotes the replacement of a single pre-defined Latin character in a prompt by its corresponding homoglyph, e.g., a Latin o by a Greek ο . We tested our approach on the CLIP text encoder in combination with Stable Diffusion and prompts from the LAION-Aesthetics v2 6.5+ dataset (Schuhmann et al., 2022).

Original: Fig. 6 shows the mean similarity scores for querying the models with 12 real photos of Athens in combination with the correct description A photo of Athens and multiple variants of the obviously wrong description A photo of New York .
Revised: We state our hyperparameters in Appx. A.

Original: As visualized, all four models assign clearly higher similarity scores for the correct image description (left) compared to the false description (right). However, by introducing Greek homoglyphs into
Revised: Our results, depicted in Fig. 5 by light bars, clearly demonstrate that our homoglyph unlearning approach successfully removes most of their biasing behavior.

Original: S i m il a r i t y
Revised: Only in some cases, e.g.,

Original: "A photo of Athens" "A photo of ew ork" "A photo of ew York" "A photo of New ork" " photo of New York" "A photo of New York"

Original: CLIP ViT
Revised: [Figure]

Original: CLIP RN OpenCLIP M-CLIP the obviously wrong description, we could increase the predicted similarity scores markedly forall models except M-CLIP. We point out that homoglyph replacements are then most effective when replacing parts of the false object, in the depicted case New York .
Revised: for the African ọ , some small biasing behavior is still present.

Original: More importantly, our results demonstrate that the text encoder trained on multilingual data is much more robust against homograph attacks than the English-only models. We have also investigated the other direction, trying toobfuscate objects that are correctly described in the text.
Revised: However, compared to the standard text

Original: Similar to our DALL-E 2 results in Sec. 4.1, we were able to reduce the similarity scores markedly if we replaced characters directly in the object names. However, M-CLIP again behaves quite robustly against such manipulations.
Revised: , the relative bias has still been reduced drastically. At the same time, the image quality measured as the FID score (Heusel et al., 2017) stays roughly the same – 17.05 for the standard encoder and 17.22 for the encoder after the homoglyph unlearning.

Original: We  state visualization for our results in Appx.
Revised: We further state qualitative results in Appx.

Original: E.
Revised: E.4 comparing the generated images before and after homoglyph unlearning.

Original:  D ISCUSSION , L IMITATIONS AND C ONCLUSION
Revised:  D ISCUSSION , L IMITATIONS AND C ONCLUSION

Original: We now discuss our findings in more detail, including the reason for the models’ behavior (Sec. 5.1) and how this behavior might be mitigated (Sec. 5.2).
Revised: We now discuss our findings in more detail, including the reason for the models’ behavior (Sec. 5.1) and how this behavior might be mitigated (Sec. 5.2).

Original: We also raise the question if this model property is compellingly bad (Sec. 5.3) and note some limitations of our analysis (Sec. 5.4).
Revised: We also raise the question if this model property is compellingly bad (Sec. 5.3) and note some limitations of our analysis (Sec. 5.4).

Original: 5. R EASONS FOR M ODEL B EHAVIOR
Revised: 5. R EASONS FOR M ODEL B EHAVIOR

Original: All investigated models have been trained on large amounts of filtered public data with English captions.
Revised: All investigated models have been trained on large amounts of filtered public data with English captions.

Original: However, some of the data must contain captions or some text parts with non-Latin Unicode characters included, allowing the models to grasp the specifics and differences of various Unicode scripts and their associated cultures.
Revised: However, some of the data must contain captions or some text parts with non-Latin Unicode characters included, allowing the models to grasp the specifics and differences of various Unicode scripts and their associated cultures.

Original: Whereas the training data for DALL-E 2 and CLIP are not publicly available, Stable Diffusion is trained on the 600M image-text pairs from the LAION-Aesthetics
Revised: Whereas the training data for DALL-E 2 and CLIP are not publicly available, Stable Diffusion is trained on the 600M image-text pairs from the LAION-Aesthetics

Original: V2 5+ dataset (Schuhmann et al., 2022) with English captions.
Revised: V2 5+ dataset (Schuhmann et al., 2022) with English captions.

Original: We found numerous image descriptions that contain non-Latin characters in this dataset, as we state in Appx.
Revised: We found numerous image descriptions that contain non-Latin characters in this dataset, as we state in Appx.

Original: F. Most common non-Latin characters are from the Cyrillic, Greek and extended Latin scripts.
Revised: G. Most common non-Latin characters are from the Cyrillic, Greek and extended Latin scripts.

Original: We also found some letters, e.g., from the Oriya or Osmanya scripts, are not contained in the dataset, which explains why these characters did not induce any clear cultural bias, as apparent in
Revised: We also found some letters, e.g., from the Oriya or Osmanya scripts, are not contained in the dataset, which explains why these characters did not induce any clear cultural bias, as apparent in

Original: Appx.
Revised: Appx.

Original: D.1.
Revised: E.1.

Original: Furthermore, it seems that a small share of image-text samples with a specific character is sufficient to learn the cultural bias.
Revised: Furthermore, it seems that a small share of image-text samples with a specific character is sufficient to learn the cultural bias.

Original: For example, the Hangul character ㅇ (U+3147) was only present in 64 samples, about 0 .
Revised: For example, the Hangul character ㅇ (U+3147) was only present in 64 samples, about 0 .

Original: 00001% of all 600M samples in the dataset.
Revised: 00001% of all 600M samples in the dataset.

Original: Still, the model induced
Revised: Still, the model induced

Original: Korean biases into the generated images when provided with the homoglyph in a prompt.
Revised: Korean biases into the generated images when provided with the homoglyph in a prompt.

Original: Given that
Revised: Given that

Original: DALL-E 2 generates biases for a larger number of scripts and homoglyphs, we conclude that there was even a greater variety of homoglyphs present in its training data.
Revised: DALL-E 2 generates biases for a larger number of scripts and homoglyphs, we conclude that there was even a greater variety of homoglyphs present in its training data.

Original: Transformer-based language models are generally known to learn fine details of languages given a sufficient capacity and amount of training data (Radford et al., 2018).
Revised: Transformer-based language models are generally known to learn fine details of languages given a sufficient capacity and amount of training data (Radford et al., 2018).

Original: Therefore, it is not surprising that the text encoders in multimodal systems learn the details of various cultural influences from a few training samples.
Revised: Therefore, it is not surprising that the text encoders in multimodal systems learn the details of various cultural influences from a few training samples.

Original: Diffusion models, on the other hand, offer strong mode coverage and sample diversity (Nichol & Dhariwal, 2021) and enable the generation of images representing the various cultural biases.
Revised: Diffusion models, on the other hand, offer strong mode coverage and sample diversity (Nichol & Dhariwal, 2021) and enable the generation of images representing the various cultural biases.

Original: We hypothesize that the interplay of both components plays a crucial role in explaining the culturally influenced behavior of the investigated models in the presence of homoglyphs.
Revised: We hypothesize that the interplay of both components plays a crucial role in explaining the culturally influenced behavior of the investigated models in the presence of homoglyphs.

Original: 5. H OW TO A VOID H OMOGRAPH A TTACKS
Revised: 5. H OW TO A VOID H OMOGRAPH A TTACKS

Original: We envision two  basic approaches to avoid model biases by homoglyph replacements.
Revised: In addition to our homoglyph unlearning approach, we envision two additional basic approaches to avoid model biases by homoglyph replacements.

Original: The first solution is a technical Unicode script detector built into any model API.
Revised: The first solution is a technical Unicode script detector built into any model API.

Original: For example, the API could scan each text input for any non-Latin characters or non-Arabic numbers and either block the queries or inform the user about the presence of such symbols.
Revised: For example, the API could scan each text input for any non-Latin characters or non-Arabic numbers and either block the queries or inform the user about the presence of such symbols.

Original: In addition, detected queries containing homoglyphs can be purified by simple character mappings to valid characters.
Revised: In addition, detected queries containing homoglyphs can be purified by simple character mappings to valid characters.

Original: As a second solution, we propose to train the models’ text encoders on multilingual data.
Revised: As a second solution, we propose to train the models’ text encoders on multilingual data.

Original: As we demonstrated in Sec. 4.4, the multilingual M-CLIP model is considerably more robust against homoglyph manipulations and probably computes more stable text embeddings to guide the image generation.
Revised: As we demonstrated in Appx. F.1, the multilingual M-CLIP model is considerably more robust against homoglyph manipulations and probably computes more stable text embeddings to guide the image generation.

Original: Due to the high computational costs required for evaluation of this approach, we leave it to future research.
Revised: Due to the high computational costs required for evaluation of this approach, we leave it to future research.

Original: A naive approach would simply filter out any image-text pair from the training data that contains any non-Latin characters.
Revised: A naive approach would simply filter out any image-text pair from the training data that contains any non-Latin characters.

Original: However, neural networks are known to be susceptible to out-of-distribution data and produce unforeseeable predictions if characters are present in a query that contains unseen characters.
Revised: However, neural networks are known to be susceptible to out-of-distribution data and produce unforeseeable predictions if characters are present in a query that contains unseen characters.

Original: The consequences of such models without any defense might be more severe than for current models trained on data with at least some non-Latin characters.
Revised: The consequences of such models without any defense might be more severe than for current models trained on data with at least some non-Latin characters.

Original: 5. I T ’ S N OT A B UG , I T ’ S A F EATURE ?
Revised: 5. I T ’ S N OT A B UG , I T ’ S A F EATURE ?

Original: Manipulating text prompts with homoglyphs can be seen as a security attack against text-guided image generation models.
Revised: Manipulating text prompts with homoglyphs can be seen as a security attack against text-guided image generation models.

Original: As we have shown in Sec. 4.1, content clearly described in the prompt could be hidden by replacing single characters with homoglyphs.
Revised: As we have shown in Appx. C.1, content clearly described in the prompt could be hidden by replacing single characters with homoglyphs.

Original: Such attacks might render the model useless and degrade the generated images’ quality.
Revised: Such attacks might render the model useless and degrade the generated images’ quality.

Original: However, by carefully placing homoglyphs in subordinate words or as additional inputs, a user can also intentionally induce cultural biases.
Revised: However, by carefully placing homoglyphs in subordinate words or as additional inputs, a user can also intentionally induce cultural biases.

Original: DALL-E 2 already contains a natural bias towards western culture, particularly from the US.
Revised: DALL-E 2 already contains a natural bias towards western culture, particularly from the US.

Original: We demonstrated that users only need to replace single characterswith characters from their local Unicode script to reduce western biases and induce features from the corresponding culture.
Revised: We demonstrated that the injection of single characters from non-Latin Unicode script reduces western biases and induces features from the corresponding culture.

Original: It is at least debatable if universal purpose models such as DALL-E 2 should provide users only with western biases, independent of a user’s own cultural background.
Revised: It is at least debatable if universal purpose models such as DALL-E 2 should provide users only with western biases, independent of a user’s own cultural background.

Original: While this could be done explicitly by expanding the text description, an API might also offer to automatically include such cultural biases in the  prompt.
Revised: Homoglyphs allow users to tailor the image generation process to their own culture by inserting single characters from their local script into their prompt.

Original: Consequently, depending on someone’s perspective, the investigated model behaviors to non-Latin characters can also be interpreted as a model feature instead of a vulnerability.
Revised: Consequently, depending on someone’s perspective, the investigated model behaviors to non-Latin characters can also be interpreted as a model feature instead of a vulnerability or undesired behavior.

Original: 5. L IMITATIONS
Revised: 5. L IMITATIONS

Original: It remains to be empirically investigated whether other text-conditional image generation models, such as Google’s Parti and Imagen, exhibit similar biases for non-Latin characters.
Revised: It remains to be empirically investigated whether other text-conditional image generation models, such as Google’s Parti and Imagen, exhibit similar biases for non-Latin characters.

Original: Unfortunately, these models were not publicly available at the time of this writing.
Revised: Unfortunately, these models were not publicly available at the time of this writing.

Original: We, therefore, leave the investigation of a broader range of models to future work.
Revised: We, therefore, leave the investigation of a broader range of models to future work.

Original: However, we assume that these models exhibit similar behavior, as they were all trained to capture image semantics from textual descriptions found on the Internet, which likely almost always contain non-Latin characters.
Revised: However, we assume that these models exhibit similar behavior, as they were all trained to capture image semantics from textual descriptions found on the Internet, which likely almost always contain non-Latin characters.

Original: Another limitation of our work is the lack of access to the training data from DALL-E 2 to identify possible patterns that might lead to the current cultural biases for homoglyph replacements.
Revised: Another limitation of our work is the lack of access to the training data from DALL-E 2 to identify possible patterns that might lead to the current cultural biases for homoglyph replacements.

Original: 5. C ONCLUSION
Revised: 5. C ONCLUSION

Original: Our work has shown that text-guided image generation models are sensitive to the character encoding of the provided text description, and that replacing characters with visually hard-to-spot nonLatin homoglyphs substantially alters the behavior of a model.
Revised: Our work has shown that text-guided image generation models are sensitive to the character encoding of the provided text description, and that replacing characters with visually hard-to-spot nonLatin homoglyphs substantially alters the behavior of a model.

Original: This opens the door to two types of potentially malicious manipulations: By changing just a single character in the text description, we could either induce cultural distortions or obfuscate certain concepts in the generated images.
Revised: This opens the door to two types of potentially malicious manipulations: By changing just a single character in the text description, we could either induce cultural distortions or obfuscate certain concepts in the generated images.

Original: We found that this behavior is not limited to DALL-E 2, but also occurs in other models trained on image-text pairs from the Internet.
Revised: We found that this behavior is not limited to DALL-E 2, but also occurs in other models trained on image-text pairs from the Internet.

Original: Our results show that models trained on large datasets from public sources capture the specifics of individual cultures implicitly from a relatively small number of samples containing non-Latin characters.
Revised: Our results show that models trained on large datasets from public sources capture the specifics of individual cultures implicitly from a relatively small number of samples containing non-Latin characters.

Original: An interesting future avenue is to investigate to which amount this learning behavior can be exploited during training to explicitly inject custom biases into the models, in the sense of backdoors.
Revised: With our homoglyph unlearning procedure, we proposed a novel solution to make the text encoders of the generative models invariant to homoglyphs without the need for full retraining.

Original: We  hope that our research will contribute to a better understanding of multimodel models and support the development of more robust systems.
Revised: We further hope that our research will contribute to a better understanding of multimodel models and support the development of more robust systems.

Original: E THICS S TATEMENT
Revised: E THICS S TATEMENT

Original: Our paper shows that multimodal models trained on large datasets of image-text pairs collected from the internet implicitly learn cultural stereotypes and biases associated with different Unicode scripts.
Revised: Our paper shows that multimodal models trained on large datasets of image-text pairs collected from the internet implicitly learn cultural stereotypes and biases associated with different Unicode scripts.

Original: By replacing single characters in a text prompt of such models, the user or an attacker could control the image generation of text-guided synthesis models to include cultural biases in the resulting images.
Revised: By replacing single characters in a text prompt of such models, the user or an attacker could control the image generation of text-guided synthesis models to include cultural biases in the resulting images.

Original: Some people might feel discriminated against by such images, depicting cultural stereotypes.
Revised: Some people might feel discriminated against by such images, depicting cultural stereotypes.

Original: Moreover, an attacker could reduce the image quality and even render the systems useless, resulting in worse perceived model or service quality, which might also have economic disadvantages for the service or model providers.
Revised: Moreover, an attacker could reduce the image quality and even render the systems useless, resulting in worse perceived model or service quality, which might also have economic disadvantages for the service or model providers.

Original: Homoglyph replacements can be done by any user simply by copying and pasting possible homoglyphs into the text prompts of any available model (if no homoglyph detector is present).
Revised: Homoglyph replacements can be done by any user simply by copying and pasting possible homoglyphs into the text prompts of any available model (if no homoglyph detector is present).

Original: This requires little to no technical or linguistic knowledge and skills.
Revised: This requires little to no technical or linguistic knowledge and skills.

Original: While this might make our paper and its insights appear harmful, we believe that the benefits of informing the community about this phenomenon outweighs the potential harms.
Revised: While this might make our paper and its insights appear harmful, we believe that the benefits of informing the community about this phenomenon outweighs the potential harms.

Original: Knowing the presented model behavior when homoglyphs are present in text prompts allows the model providers to react and implement possible defense mechanisms, such as homoglyph detectors or simple character mappings.
Revised: Knowing the presented model behavior when homoglyphs are present in text prompts allows the model providers to react and implement possible defense mechanisms, such as homoglyph detectors or simple character mappings.

Original: We hope that our results also inspire research to develop more robust models and training procedures.
Revised: We hope that our results also inspire research to develop more robust models and training procedures.

Original: By making our findings publicly available as soon as possible, we give the community more time to discuss the societal implications and develop solutions or improvements.
Revised: By making our findings publicly available as soon as possible, we give the community more time to discuss the societal implications and develop solutions or improvements.

Original: Furthermore, understanding the behavior of deep neural networks, particularly of large language and diffusion models, is still an ongoing subject of research.
Revised: Furthermore, understanding the behavior of deep neural networks, particularly of large language and diffusion models, is still an ongoing subject of research.

Original: We believe that the results of our work make an important contribution in this direction, showing that the models indeed learn subtleties from their training data, which also raises the issue of privacy.
Revised: We believe that the results of our work make an important contribution in this direction, showing that the models indeed learn subtleties from their training data, which also raises the issue of privacy.

Original: If a relatively small amount of training data with non-Latin characters is already sufficient for the models to capture the features of different cultures, one must ask what information is also learned from such models and potentially leaked.
Revised: If a relatively small amount of training data with non-Latin characters is already sufficient for the models to capture the features of different cultures, one must ask what information is also learned from such models and potentially leaked.

Original: In summary, we believe that the positive effects on machine learning research outweigh possible negative impacts and lead to the development of more robust and reliable systems.
Revised: In summary, we believe that the positive effects on machine learning research outweigh possible negative impacts and lead to the development of more robust and reliable systems.

Original: R EPRODUCIBILITY S TATEMENT
Revised: R EPRODUCIBILITY S TATEMENT

Original: To allow the reproduction of our results, we provide our source code in the supplementary material of this submission.
Revised: To allow the reproduction of our results, we provide our source code in the supplementary material of this submission.

Original: We further refer to Appx.
Revised: We further refer to Appx.

Original: A for hardware and software details.
Revised: A for hardware and software details.

Original: Also, we provide all hyperparameters used during our experiments, together with the model sources.
Revised: Also, we provide all hyperparameters used during our experiments, together with the model sources.

Original: The text prompts used to create the various figures are always stated within the captions.
Revised: The text prompts used to create the various figures are always stated within the captions.

Original: The image sources used to investigate the robustness of CLIP are stated in Appx.
Revised: The image sources used to investigate the robustness of CLIP are stated in Appx.

Original: E.3.
Revised: F.4.

Original: We will also make our source code publicly available on GitHub after acceptance.
Revised: We will also make our source code publicly available on GitHub after acceptance.

Original: A H ARD - AND S OFTWARE D ETAILS
Revised: A H ARD - AND S OFTWARE D ETAILS

Original: Our experiments were performed on NVIDIA DGX machines running NVIDIA DGX Server Version 5.1.0 and Ubuntu 20.04.5 LTS.
Revised: Our experiments were performed on NVIDIA DGX machines running NVIDIA DGX Server Version 5.1.0 and Ubuntu 20.04.5 LTS.

Original: The machines have 1.6TB of RAM and contain Tesla V100SXM3-32GB-H GPUs and Intel Xeon Platinum 8174 CPUs.
Revised: The machines have 1.6TB of RAM and contain Tesla V100SXM3-32GB-H GPUs and Intel Xeon Platinum 8174 CPUs.

Original: We further relied on CUDA 11.6,
Revised: We further relied on CUDA 11.6,

Original: Python 3.8.13, and PyTorch 1.12.0 with Torchvision 0.13.0 for our experiments.
Revised: Python 3.8.13, and PyTorch 1.12.0 with Torchvision 0.13.0 for our experiments.

Original: Our DALL-E 2 experiments were performed with the web API available at https://labs.
Revised: Our DALL-E 2 experiments were performed with the web API available at https://labs.

Original: openai.com/ for selected users.
Revised: openai.com/ for selected users.

Original: We used Stable Diffusion v1.4, available at https:// huggingface.co/CompVis/stable-diffusion-v1-4 to generate the corresponding samples.
Revised: We used Stable Diffusion v1.4, available at https:// huggingface.co/CompVis/stable-diffusion-v1-4 to generate the corresponding samples.

Original: It was used with an K-LMS scheduler with the parameters β start = 0 .
Revised: It was used with an K-LMS scheduler with the parameters β start = 0 .

Original: 00085 , β end = 0 .and
Revised: 00085 , β end = 0 .and

Original: a linear scaled scheduler.
Revised: a linear scaled scheduler.

Original: The generated images have a size of 512 × 512 and were generated with 100 inference steps and a guidance scale of 7 . 5 .
Revised: The generated images have a size of 512 × 512 and were generated with 100 inference steps and a guidance scale of 7 . 5 .

Original: We set the seed to 1 for Stable Diffusion experiments and then generated four images for each prompt.
Revised: We set the seed to 1 for Stable Diffusion experiments and then generated four images for each prompt.

Original: For our CLIP experiments, we relied on publicly available models.
Revised: For our CLIP experiments, we relied on publicly available models.

Original: For OpenAI’s CLIP (Radford et al., 2021), we used the models provided by https://github.com/openai/CLIP , namely the ViT-B/32 and RN50 models.
Revised: For OpenAI’s CLIP (Radford et al., 2021), we used the models provided by https://github.com/openai/CLIP , namely the ViT-B/32 and RN50 models.

Original: For OpenCLIP, the models are available at https://github.
Revised: For OpenCLIP, the models are available at https://github.

Original: com/mlfoundations/open_clip .
Revised: com/mlfoundations/open_clip .

Original: We also used the ViT-B-32, trained on the LAION2Ben dataset.
Revised: We also used the ViT-B-32, trained on the LAION2Ben dataset.

Original: In case of the multilingual CLIP (M-CLIP), we used the XLM-R Large Vit-B/32 text encoder in combination with OpenAI’s OpenAI ViT-B/32 vision encoder.
Revised: In case of the multilingual CLIP (M-CLIP), we used the XLM-R Large Vit-B/32 text encoder in combination with OpenAI’s OpenAI ViT-B/32 vision encoder.

Original: M-CLIP is available at https://github.com/FreddeFrallan/Multilingual-CLIP .
Revised: M-CLIP is available at https://github.com/FreddeFrallan/Multilingual-CLIP .

Original: B U NICODE S CRIPTS
Revised: To compute the relative bias, we generated ten images for each of the ten prompts in the prompt datasets, stated in Tab. 1, once with and once without a homoglyph inserted. We used the same seed for each set of images to avoid influences due to randomness. To compute the image and text embeddings, we used the ViT-H/14 OpenCLIP model, which promises the best zero-shot performance and is also trained on a different dataset than OpenAI’s CLIP model used in Stable Diffusion and DALL-E 2.

Revised: To perform the homoglyph unlearning procedure, we optimized the pretrained CLIP text encoder for 500 steps on samples from the LAION-Aesthetics v2 6.5+ dataset (Schuhmann et al., 2022).

Revised: During each step, we sampled 128 to compute the first term of the loss function on Latin-only prompts.

Revised: For each of the five homoglyphs stated in Fig.

Revised: 5, we sampled an additional 128 prompts and replaced a single Latin character with its homoglyph counterpart.

Revised: We optimized the encoder with the AdamW optimizer (Loshchilov & Hutter, 2019) with a learning rate of 10 − 4 and multiplied it after 400 steps by the factor 0 .

Revised: We further kept β = (0 . 9 , 0 . 999) and ϵ = 10 − 8 at their default values.

Revised: We measured the FID score using the clean FID approach (Parmar et al., 2022).

Original: {+We sampled 10, prompts from the MS-COCO 
+}
Revised: {+We sampled 10, prompts from the MS-COCO 
+}

Revised: (Lin et al., 2014) validation split and generated images with

Revised: Stable Diffusion with the parameters stated at the beginning of this section.

Revised: As real samples, we used all 40,504 images from the MS-COCO validation split.

Revised: B U NICODE S CRIPTS

Original: Unicode supports a wide range of different scripts.
Revised: Unicode supports a wide range of different scripts.

Original: See https://www.unicode.org/ standard/supported.html for an overview of all supported scripts.
Revised: See https://www.unicode.org/ standard/supported.html for an overview of all supported scripts.

Original: The current Unicode
Revised: The current Unicode

Original: Standard 15.0.0 (Unicode Consortium, 2022) supports 149,186 characters from 161 scripts.
Revised: Standard 15.0.0 (Unicode Consortium, 2022) supports 149,186 characters from 161 scripts.

Original: Each script contains a set of characters and written signs of one or more writing systems.
Revised: Each script contains a set of characters and written signs of one or more writing systems.

Original: We now provide a short and non-exhaustive overview of the Unicode scripts we used throughout this work.
Revised: We now provide a short and non-exhaustive overview of the Unicode scripts we used throughout this work.

Original: Basic Latin: Ranges from U+0000 to U+007F and contains 128 standard letters and digits used by Western languages, such as English, as well as basic punctuation and symbols.
Revised: Basic Latin: Ranges from U+0000 to U+007F and contains 128 standard letters and digits used by Western languages, such as English, as well as basic punctuation and symbols.

Original: This paper, for example, is mostly encoded in the characters from this Script.
Revised: This paper, for example, is mostly encoded in the characters from this Script.

Original: Together with 18 additional blocks comprising supplements and extensions, the Latin script currently contains 1,475 characters.
Revised: Together with 18 additional blocks comprising supplements and extensions, the Latin script currently contains 1,475 characters.

Original: Latin Supplements and Extensions: This group comprises multiple additional character variations of the basic Latin script.
Revised: Latin Supplements and Extensions: This group comprises multiple additional character variations of the basic Latin script.

Original: The Latin-1 Supplement ranges from U+0080 to U+00FF and offers characters for the French, German and Scandinavian alphabets, amongst others.
Revised: The Latin-1 Supplement ranges from U+0080 to U+00FF and offers characters for the French, German and Scandinavian alphabets, amongst others.

Original: The Latin Extended-A (U+0100 to U+017F) and Extended-B (U+0180 to U+024F) scripts contain further Latin character variations for, e.g., Afrikaans, Hungarian, Turkish and the Romanian writing systems.
Revised: The Latin Extended-A (U+0100 to U+017F) and Extended-B (U+0180 to U+024F) scripts contain further Latin character variations for, e.g., Afrikaans, Hungarian, Turkish and the Romanian writing systems.

Original: The Latin
Revised: The Latin

Original: Extended Additional scripts (U+1E00 to U+1EFF) primarily contains characters used in the Vietnamese alphabet.
Revised: Extended Additional scripts (U+1E00 to U+1EFF) primarily contains characters used in the Vietnamese alphabet.

Original: Some letters are also shared with other languages, e.g., ọ (U+1ECD) is not only used in Vietnamese but also in the International African alphabet.
Revised: Some letters are also shared with other languages, e.g., ọ (U+1ECD) is not only used in Vietnamese but also in the International African alphabet.

Original: Further examples of the extended
Revised: Further examples of the extended

Original: Latin script from the paper are the characters á (U+00E1) and Å (U+00C5).
Revised: Latin script from the paper are the characters á (U+00E1) and Å (U+00C5).

Original: Arabic Script: Ranges from U+0600 to U+06FF and contains 256 characters of the Arabic script.
Revised: Arabic Script: Ranges from U+0600 to U+06FF and contains 256 characters of the Arabic script.

Original: The script is used for the Arabic, Kurdish and Persian languages, amongst others.
Revised: The script is used for the Arabic, Kurdish and Persian languages, amongst others.

Original: In the paper, we used the characters ه (U+0647) and ا (U+0627).
Revised: In the paper, we used the characters ه (U+0647) and ا (U+0627).

Original: Armenian Script: Ranges from U+0530 to U+058F and contains 91 characters for the Armenian language, spoken in Armenia.
Revised: Armenian Script: Ranges from U+0530 to U+058F and contains 91 characters for the Armenian language, spoken in Armenia.

Original: In the paper, we used the character օ (U+0585).
Revised: In the paper, we used the character օ (U+0585).

Original: Bengali Script: Ranges from U+0980 to U+09FF and contains 96 characters for the Bengali, Santali, and other Indo-Aryan languages, mainly spoken in South Asia.
Revised: Bengali Script: Ranges from U+0980 to U+09FF and contains 96 characters for the Bengali, Santali, and other Indo-Aryan languages, mainly spoken in South Asia.

Original: Bengali is spoken in Bengal, a geopolitical and cultural region in South Asia, covering Bangladesh and West India.
Revised: Bengali is spoken in Bengal, a geopolitical and cultural region in South Asia, covering Bangladesh and West India.

Original: In the paper, we used the character ০ (U+09E6).
Revised: In the paper, we used the character ০ (U+09E6).

Original: Unified Canadian Aboriginal Syllabics: Ranges from U+1400 to U+167F and contains 640 syllabic characters used in various Indigenous Canadian languages.
Revised: Unified Canadian Aboriginal Syllabics: Ranges from U+1400 to U+167F and contains 640 syllabic characters used in various Indigenous Canadian languages.

Original: These comprise the Algonquian,
Revised: These comprise the Algonquian,

Original: Inuit and Athabaskan languages.
Revised: Inuit and Athabaskan languages.

Original: In the paper, we used the character ᗅ (U+15C5).
Revised: In the paper, we used the character ᗅ (U+15C5).

Original: Cherokee Script: Ranges from U+13A0 to U+13FF and contains 92 syllabic characters used for the Cherokee language.
Revised: Cherokee Script: Ranges from U+13A0 to U+13FF and contains 92 syllabic characters used for the Cherokee language.

Original: Cherokee is an Iroquoian language spoken by the Cherokee tribes, which are indigenous people in the Southeastern Woodlands of the United States.
Revised: Cherokee is an Iroquoian language spoken by the Cherokee tribes, which are indigenous people in the Southeastern Woodlands of the United States.

Original: In the paper, we used the character Ꭺ (U+13AA).
Revised: In the paper, we used the character Ꭺ (U+13AA).

Original: Cyrillic Script: Ranges from U+0400 to U+04FF and contains 256 characters from the Cyrillic writing system, also known as Slavonic script or Slavic script, and offers various national variations of the standard Cyrillic script.
Revised: Cyrillic Script: Ranges from U+0400 to U+04FF and contains 256 characters from the Cyrillic writing system, also known as Slavonic script or Slavic script, and offers various national variations of the standard Cyrillic script.

Original: It is used in different countries and languages, such as Russian,
Revised: It is used in different countries and languages, such as Russian,

Original: Bulgarian, Serbian or Ukrainian.
Revised: Bulgarian, Serbian or Ukrainian.

Original: Throughout this work, we only used letters from the standard
Revised: Throughout this work, we only used letters from the standard

Original: Russian alphabet.
Revised: Russian alphabet.

Original: Examples from the paper are the characters В (U+0412) and е (U+0435).
Revised: Examples from the paper are the characters В (U+0412) and е (U+0435).

Original: Devanagari Script: Ranges from U+0900 to U+097F and contains 128 characters for Hindi, which is spoken in India, and other Indo-Aryan languages.
Revised: Devanagari Script: Ranges from U+0900 to U+097F and contains 128 characters for Hindi, which is spoken in India, and other Indo-Aryan languages.

Original: In the paper, we used ।
Revised: In the paper, we used ।

Original: (U+0964).
Revised: (U+0964).

Original: Greek and Coptic Script: Ranges from U+0370 to U+03FF and contains 135 standard letters and letter variants, digits and other symbols of the Greek language.
Revised: Greek and Coptic Script: Ranges from U+0370 to U+03FF and contains 135 standard letters and letter variants, digits and other symbols of the Greek language.

Original: It also contains glyphs of the Coptic language, which belongs to the family of the Egyptian language.
Revised: It also contains glyphs of the Coptic language, which belongs to the family of the Egyptian language.

Original: In this work, we only used standard
Revised: In this work, we only used standard

Original: Greek letters used in the modern Greek language.
Revised: Greek letters used in the modern Greek language.

Original: Examples from the paper are the characters Α (U+0391) and ο (U+03BF).
Revised: Examples from the paper are the characters Α (U+0391) and ο (U+03BF).

Original: Hangul Jamo Script: Ranges from U+1100 to U+11FF and contains 256 positional forms of the
Revised: Hangul Jamo Script: Ranges from U+1100 to U+11FF and contains 256 positional forms of the

Original: Hangul consonant and vowel clusters.
Revised: Hangul consonant and vowel clusters.

Original: It is the official writing system for the Korean language, spoken in South and North Korea.
Revised: It is the official writing system for the Korean language, spoken in South and North Korea.

Original: In the paper, we used the character ㅇ (U+3147).
Revised: In the paper, we used the character ㅇ (U+3147).

Original: Lisu Script: Ranges from U+A4D0 to U+A4FF and contains 48 characters used to write the Lisu language.
Revised: Lisu Script: Ranges from U+A4D0 to U+A4FF and contains 48 characters used to write the Lisu language.

Original: Lisu is spoken in Southwestern China, Myanmar and Thailand, as well as a small part of
Revised: Lisu is spoken in Southwestern China, Myanmar and Thailand, as well as a small part of

Original: India.
Revised: India.

Original: In the paper, we used the character ꓲ (U+A4F2) and ꓮ (U+A4EE).
Revised: In the paper, we used the character ꓲ (U+A4F2) and ꓮ (U+A4EE).

Original: N’Ko script: Ranges from U+07C0 to U+07FF and contains 62 characters.
Revised: N’Ko script: Ranges from U+07C0 to U+07FF and contains 62 characters.

Original: It is a used to write the
Revised: It is a used to write the

Original: Mande languages, spoken in West African countries, for example, Burkina Faso, Mali, Senegal, the
Revised: Mande languages, spoken in West African countries, for example, Burkina Faso, Mali, Senegal, the

Original: Gambia, Guinea, Guinea-Bissau, Sierra Leone, Liberia and Ivory Coast.
Revised: Gambia, Guinea, Guinea-Bissau, Sierra Leone, Liberia and Ivory Coast.

Original: In the paper, we used the character ߋ (U+07CB).
Revised: In the paper, we used the character ߋ (U+07CB).

Original: Oriya Script: Ranges from U+0B00 to U+0B7F and contains 91 characters.
Revised: Oriya Script: Ranges from U+0B00 to U+0B7F and contains 91 characters.

Original: It is mainly used to write the Orya (Odia), Khondi and Santali languages, some of the many official languages of India.
Revised: It is mainly used to write the Orya (Odia), Khondi and Santali languages, some of the many official languages of India.

Original: The languages are primarily spoken in the Indian state of Odisha and other states in eastern India.
Revised: The languages are primarily spoken in the Indian state of Odisha and other states in eastern India.

Original: In the paper, we used the character ୦ (U+0B66).
Revised: In the paper, we used the character ୦ (U+0B66).

Original: Osmanaya Script: Ranges from U+10480 to U+104AF and contains 40 characters.
Revised: Osmanaya Script: Ranges from U+10480 to U+104AF and contains 40 characters.

Original: It is used to write the Somali language and is an official language in Somalia, Somaliland and Ethiopia, all localized in the Horn of Africa (East Africa).
Revised: It is used to write the Somali language and is an official language in Somalia, Somaliland and Ethiopia, all localized in the Horn of Africa (East Africa).

Original: In the paper, we used the character 𐒆 (U+10486).
Revised: In the paper, we used the character 𐒆 (U+10486).

Original: Tibetan Script: Ranges from U+0F00 to U+0FFF and contains 211 characters.
Revised: Tibetan Script: Ranges from U+0F00 to U+0FFF and contains 211 characters.

Original: The characters are primarily used to write Tibetan and Dzongkha, which is spoken in Bhutan.
Revised: The characters are primarily used to write Tibetan and Dzongkha, which is spoken in Bhutan.

Original: In the paper, we used the character ། (U+0F0D).
Revised: In the paper, we used the character ། (U+0F0D).

Original: Emojis: Emojis in Unicode are not contained in a single script or block but spread across 24 blocks.
Revised: Emojis: Emojis in Unicode are not contained in a single script or block but spread across 24 blocks.

Original: Unicode 14.0 contained 1,404 emoji characters.
Revised: Unicode 14.0 contained 1,404 emoji characters.

Original: For example, the Emoticons block ranging from
Revised: For example, the Emoticons block ranging from

Original: U+1F600 to UF1F64F contains 80 emojis of face representations.
Revised: U+1F600 to UF1F64F contains 80 emojis of face representations.

Original: Examples from the paper are (U+1F603) and (U+1F973).
Revised: Examples from the paper are (U+1F603) and (U+1F973).

Original: C A DDITIONAL DALL-E 2 R ESULTS
Revised: B. R ELATIVE B IAS D ATASET P ROMPTS

Revised: [Table]

Revised: C A DDITIONAL E XPERIMENTS C. I MAGE CONTENT OBFUSCATION

Revised: [Figure]

Revised: We start by demonstrating that homoglyph replacements allow a malicious user or adversary to prevent DALL-E 2 from generating concepts clearly described in the text prompt.

Revised: For this, the attacker replaces characters in a concept’s name with homoglyphs or generally any non-Latin character and forces the generative model to ignore the object in the generated image.

Revised: In practice, the manipulated strings might be shared over the internet to reduce the perceived model quality if queried with these image descriptions.

Revised: A malicious browser plugin or website script might further automatically manipulate inserted prompt texts by replacing characters with inconspicuous homoglyphs to render the whole model useless without users noticing.

Revised: Such attacks might have serious impacts on the profitability of commercial services based on text-guided models.

Revised: We visualized some examples in Fig.

Original:  In this section
Revised: Taking the prompt Big Ben in the rain as an example, we simply replaced the B with the Cyrillic В (U+0412) to remove the Big Ben from the generated images. DALL-E 2 generated various images of rainy locations but without any trace of the Big Ben or similar monuments. In most cases, replacing a single character is already sufficient for hiding the concept in the generated images. However, when concept description consists of multiple words, we needed to insert a homoglyph in each of the concept’s words, see Fig.

Original: [Figure]
Revised: 6a. We experimented with numerous queries and Unicode scripts and found that any object could successfully be hidden by using homoglyphs from any non-Latin script. To verify that DALL-E 2 is generally capable to generate the stated concepts, we show the created images for benign prompts in Appx. D.7.

Revised: D A DDITIONAL DALL-E 2 R ESULTS

Original:  we state additional results of our experiments on DALL-E 2.
Revised: In this section, we state additional results of our experiments on DALL-E 2.

Original: We queried the model using the online API and the prompts specified in the image captions.
Revised: We queried the model using the online API and the prompts specified in the image captions.

Original: Note that we queried the model only once with each text description, and stated all four generated results.
Revised: Note that we queried the model only once with each text description, and stated all four generated results.

Original: C. A CITY IN BRIGHT SUNSHINE
Revised: D. A CITY IN BRIGHT SUNSHINE

Original: [Figure]
Revised: [Figure]

Revised: [Figure]

Original: [Figure]
Revised: [Figure]

Original: C. D ELICIOUS FOOD ON A TABLE
Revised: D. D ELICIOUS FOOD ON A TABLE

Original: [Figure]
Revised: [Figure]

Revised: D. T HE LEADER OF A COUNTRY

Original: [Figure]
Revised: [Figure]

Original: We queried DALL-E 2 with the following prompt: The leader of a country .
Revised: We queried DALL-E 2 with the following prompt: The leader of a country .

Original: Each query differs by the article a replaced by the stated homoglyphs.
Revised: Each query differs by the article a replaced by the stated homoglyphs.

Original: [Figure]
Revised: [Figure]

Original: [Figure]

Original: [Figure]

Original: [Figure]

Original: [Figure]
Revised: [Figure]

Original: C. O BFUSCATING O BJECTS
Revised: D. O BFUSCATING O BJECTS

Original: [Figure]
Revised: [Figure]

Original: D S TABLE D IFFUSION R ESULTS
Revised: E S TABLE D IFFUSION R ESULTS

Original: In this section, we state additional results of our experiments on Stable Diffusion.
Revised: In this section, we state additional results of our experiments on Stable Diffusion.

Original: We queried the model using a Python script and the prompts specified in the image captions.
Revised: We queried the model using a Python script and the prompts specified in the image captions.

Original: Note that we queried the model four times with each text description, and stated all four generated results.
Revised: Note that we queried the model four times with each text description, and stated all four generated results.

Original: D. A P HOTO OF AN A CTRESS
Revised: E. A P HOTO OF AN A CTRESS

Original: [Figure]
Revised: [Figure]

Original: We queried Stable Diffusion with the following prompt: A photo of an actress .
Revised: We queried Stable Diffusion with the following prompt: A photo of an actress .

Original: Each query differs only by the o in of .
Revised: Each query differs only by the o in of .

Original: D. D ELICIOUS FOOD ON A TABLE
Revised: E. D ELICIOUS FOOD ON A TABLE

Original: [Figure]
Revised: [Figure]

Original: We queried Stable Diffusion with the following prompt: Delicious food on a table .
Revised: We queried Stable Diffusion with the following prompt: Delicious food on a table .

Original: Each query differs only by a single character in the word Delicious replaced by the stated homoglyphs.
Revised: Each query differs only by a single character in the word Delicious replaced by the stated homoglyphs.

Original: D. O BFUSCATING O BJECTS
Revised: E. O BFUSCATING O BJECTS

Original: [Figure]
Revised: [Figure]

Original: I
Revised: E.

Revised: H OMOGLYPH U NLEARNING R ESULTS S t a n d a r d E n c o d e r

Revised: Latin-only

Original: B
Revised: Greek Cyrillic Arabic Korean ㅇ

Revised: African

Revised: H o m o g l y p h

Revised: U n l e a r n i n g

Revised: S t a n d a r d

Revised: E n c o d e r

Revised: H o m o g l y p h

Revised: U n l e a r n i n g

Revised: S t a n d a r d

Original: THE E MBEDDING
Revised: E n c o d e r H o m o g l y p h U n l e a r n i n g The face of a # man

Revised: The most famo us # city

Revised: A traditional # piece of clothing

Revised: E. I NDUCING B IASES IN THE E MBEDDING S PACE

Original: [Figure]
Revised: [Figure]

Original: E CLIP E XPERIMENTS
Revised: F CLIP E XPERIMENTS

Original: E.
Revised: F.

Revised: N ON -G ENERATIVE M ULTIMODAL M ODELS B EHAVE S IMILARLY S ENSITIVELY

Revised: [Figure]

Revised: To check if other multimodal models are similarly susceptible to homoglyphs, we extended our experiments to CLIP.

Revised: We investigated the official CLIP models (Radford et al., 2021) based on a vision transformer (ViT-B/32)

Revised: (Dosovitskiy et al., 2021) and a smaller ResNet-50 (RN50) (He et al., 2016), both trained on a non-public dataset with 400M text-image pairs.

Revised: We further used a public reimplementation of CLIP (OpenCLIP) (Ilharco et al., 2021) trained on the LAION-2B-en dataset, a subset of the public LAION-5B dataset (Schuhmann et al., 2022) with English text.

Revised: Additionally, we tested a multilingual CLIP model (M-CLIP)

Revised: (Carlsson et al., 2022) with the text encoder based on XLM-RoBERTa (Conneau et al., 2020), pre-trained on samples from 100 languages.

Revised: We tested how the insertion of homoglyphs influences the cosine similarity scores computed between the image and text embeddings.

Revised: Fig.

Original: I NDUCING B IASES
Revised: 19 shows the mean similarity scores for querying the models with 12 real photos of Athens in combination with the correct description A photo of Athens and multiple variants of the obviously wrong description A photo of New York . As visualized, all four models assign clearly higher similarity scores for the correct image description (left) compared to the false description (right). However, by introducing Greek homoglyphs into the obviously wrong description, we could increase the predicted similarity scores markedly for all models except M-CLIP.

Revised: We point out that homoglyph replacements are then most effective when replacing parts of the false object, in the depicted case New York .

Original: [Figure]
Revised: More importantly, our results demonstrate that the text encoder trained on multilingual data is much more robust against homograph attacks than the English-only models. We have also investigated the other direction, trying to obfuscate objects that are correctly described in the text. Similar to our DALL-E 2 results in Appx. C.1, we were able to reduce the similarity scores markedly if we replaced characters directly in the object names.

Original: y "
Revised: However, M-CLIP again behaves quite robustly against such manipulations. We state visualization for our results in Appx.

Original: [Figure]
Revised: F. F.

Original: Athens
Revised: I NDUCING B IASES

Original: [Figure]
Revised: [Figure]

Original: ew ork
Revised: il a r i t y

Original: [Figure] ew [Figure] [Figure]
Revised: A photo of Athens" "A photo of ew ork" "A photo of ew York" "A photo of New ork" " photo of New York" "A photo of New York"

Original: CLIP ViT
Revised: CLIP ViT

Original: CLIP RN
Revised: CLIP RN

Original: OpenCLIP
Revised: OpenCLIP

Original: M-CLIP
Revised: M-CLIP

Original: [Figure]
Revised: [Figure]

Revised: "A photo of erlin

Revised: [Figure]

Revised: "A photo of

Revised: [Figure]

Original:  CLIP ViT
Revised: rlin [Figure] " photo of Berlin" "A photo f Berlin" "A photo of Berlin" CLIP ViT

Original: CLIP RN
Revised: CLIP RN

Original: OpenCLIP
Revised: OpenCLIP

Original: M-CLIP
Revised: M-CLIP

Original: [Figure]
Revised: [Figure]

Original: CLIP ViT
Revised: CLIP ViT

Original: CLIP RN
Revised: CLIP RN

Original: OpenCLIP
Revised: OpenCLIP

Original: M-CLIP
Revised: M-CLIP

Original: E.
Revised: F.

Original: O BFUSCATING O BJECTS
Revised: O BFUSCATING O BJECTS

Original: [Figure]
Revised: [Figure]

Original: i m il a r i t
Revised: i m il a r i t

Original: y
Revised: y

Original: "A photo of Athens" " photo of Athens" "A ph to of Athens" "A photo f Athens" "A photo of thens" "A photo of th ns"
Revised: "A photo of Athens" " photo of Athens" "A ph to of Athens" "A photo f Athens" "A photo of thens" "A photo of th ns"

Original: CLIP ViT
Revised: CLIP ViT

Original: CLIP RN
Revised: CLIP RN

Original: OpenCLIP
Revised: OpenCLIP

Original: M-CLIP
Revised: M-CLIP

Original: [Figure]
Revised: [Figure]

Original: A photo of Saint Basil
Revised: A photo of Saint Basil

Original: [Figure]
Revised: [Figure]

Original: " "A photo of Sa nt Basil
Revised: " "A photo of Sa nt Basil

Original: [Figure]
Revised: [Figure]

Original: s
Revised: s

Original: Cathedral" "A photo of Saint asil's
Revised: Cathedral" "A photo of Saint asil's

Original: Cathedral" "A photo of Saint Basil's
Revised: Cathedral" "A photo of Saint Basil's

Original: C thedral" "A photo of Saint asil's
Revised: C thedral" "A photo of Saint asil's

Original: C thedral"
Revised: C thedral"

Original: CLIP ViT
Revised: CLIP ViT

Original: CLIP RN
Revised: CLIP RN

Original: OpenCLIP
Revised: OpenCLIP

Original: M-CLIP
Revised: M-CLIP

Original: [Figure]
Revised: [Figure]

Original: CLIP ViT
Revised: CLIP ViT

Original: CLIP RN
Revised: CLIP RN

Original: OpenCLIP
Revised: OpenCLIP

Original: M-CLIP
Revised: M-CLIP

Original: [Table]
Revised: [Table]

Revised: [Table]

Original: Author
Revised: Author

Original: License
Revised: License

Original: URL
Revised: URL

Original: George E. Koronaios cc sa 4. https://commons.wikimedia.org/w/index.
Revised: George E. Koronaios cc sa 4. https://commons.wikimedia.org/w/index.

Original: php?title=
Revised: php?title=

Original: File:
Revised: File:

Original: The_Acropolis_from_Mount_
Revised: The_Acropolis_from_Mount_

Original: Lycabettus_on_August_17 , _2019.jpg&oldid=
Revised: Lycabettus_on_August_17 , _2019.jpg&oldid=

Original: Dario Suˇsanj cc sa 2. https://commons.wikimedia.org/w/index.
Revised: Dario Suˇsanj cc sa 2. https://commons.wikimedia.org/w/index.

Original: php?title=
Revised: php?title=

Original: File:Athens_-_13985998680.
Revised: File:Athens_-_13985998680.

Original: jpg&oldid=
Revised: jpg&oldid=

Original: A. Savin
Revised: A. Savin

Original: Free Art https://commons.wikimedia.org/w/index.
Revised: Free Art https://commons.wikimedia.org/w/index.

Original: php?title=
Revised: php?title=

Original: File:Attica_06-13_Athens_50_
Revised: File:Attica_06-13_Athens_50_

Original: View_from_Philopappos_-_Acropolis_Hill.
Revised: View_from_Philopappos_-_Acropolis_Hill.

Original: jpg&oldid=
Revised: jpg&oldid=

Original: A. Savin
Revised: A. Savin

Original: Free Art https://commons.wikimedia.org/w/index.
Revised: Free Art https://commons.wikimedia.org/w/index.

Original: php?title=
Revised: php?title=

Original: File:Attica_06-13_Athens_ 17_View_from_Acropolis_Hill.jpg&oldid=
Revised: File:Attica_06-13_Athens_ 17_View_from_Acropolis_Hill.jpg&oldid=

Original: George E. Koronaios cc sa 4. https://commons.wikimedia.org/w/index.
Revised: George E. Koronaios cc sa 4. https://commons.wikimedia.org/w/index.

Original: php?title=
Revised: php?title=

Original: File:
Revised: File:

Original: Athens_from_Ardettus_
Revised: Athens_from_Ardettus_

Original: Hill_on_June_5 , _2020.jpg&oldid=
Revised: Hill_on_June_5 , _2020.jpg&oldid=

Original: George E. Koronaios cc sa 4.
Revised: George E. Koronaios cc sa 4.

Original: https://commons.wikimedia.org/w/ index.php?title=File:Athens_and_Mount_
Revised: https://commons.wikimedia.org/w/ index.php?title=File:Athens_and_Mount_

Original: Lycabettus_from_the_Areopagus_on_July_ 22 , _2019.jpg&oldid=
Revised: Lycabettus_from_the_Areopagus_on_July_ 22 , _2019.jpg&oldid=

Original: EftichiaKosma cc sa 4. https://commons.wikimedia.org/w/index.
Revised: EftichiaKosma cc sa 4. https://commons.wikimedia.org/w/index.

Original: php?title=
Revised: php?title=

Original: File:IMG_Athens.jpg&oldid=
Revised: File:IMG_Athens.jpg&oldid=

Original: George E. Koronaios cc sa 4. https://commons.wikimedia.org/w/index.
Revised: George E. Koronaios cc sa 4. https://commons.wikimedia.org/w/index.

Original: php?title=
Revised: php?title=

Original: File:Athens_from_Mount_
Revised: File:Athens_from_Mount_

Original: Lycabettus_and_in_the_distance_smoke_ from_a_forest_fire.jpg&oldid=
Revised: Lycabettus_and_in_the_distance_smoke_ from_a_forest_fire.jpg&oldid=

Original: George E. Koronaios cc sa 4. https://commons.wikimedia.org/w/index.
Revised: George E. Koronaios cc sa 4. https://commons.wikimedia.org/w/index.

Original: php?title=
Revised: php?title=

Original: File:
Revised: File:

Original: The_Areopagus , _the_
Revised: The_Areopagus , _the_

Original: Church_of_St._Marina_and_the_National_
Revised: Church_of_St._Marina_and_the_National_

Original: Observatory_of_Athens_from_the_
Revised: Observatory_of_Athens_from_the_

Original: Pedestal_of_Agrippa_on_February_6 , _2020.
Revised: Pedestal_of_Agrippa_on_February_6 , _2020.

Original: jpg&oldid=
Revised: jpg&oldid=

Original: George E. Koronaios cc sa 4. https://commons.wikimedia.org/w/index.
Revised: George E. Koronaios cc sa 4. https://commons.wikimedia.org/w/index.

Original: php?title=
Revised: php?title=

Original: File:The_Acropolis_of_Athens_ and_the_Areopagus_from_the_Pnyx_on_
Revised: File:The_Acropolis_of_Athens_ and_the_Areopagus_from_the_Pnyx_on_

Original: October_7 , _2019.jpg&oldid=
Revised: October_7 , _2019.jpg&oldid=

Original: Alexander Popkov cc sa 4.
Revised: Alexander Popkov cc sa 4.

Original: https://commons.wikimedia.org/w/ index.php?title=File:Classic_view_of_
Revised: https://commons.wikimedia.org/w/ index.php?title=File:Classic_view_of_

Original: Acropolis.jpg&oldid=
Revised: Acropolis.jpg&oldid=

Original: George E. Koronaios cc sa 4. https://commons.wikimedia.org/w/index.
Revised: George E. Koronaios cc sa 4. https://commons.wikimedia.org/w/index.

Original: php?title=
Revised: php?title=

Original: File:The_Acropolis_of_Athens_ from_Philopappos_Hill_on_June_4 , _2020.
Revised: File:The_Acropolis_of_Athens_ from_Philopappos_Hill_on_June_4 , _2020.

Original: jpg&oldid=
Revised: jpg&oldid=

Original: Author
Revised: Author

Original: License
Revised: License

Original: URL
Revised: URL

Original: Pierre Andr´e
Revised: Pierre Andr´e

Original: GFDL https://commons.wikimedia.org/w/ index.php?title=File:Moscou.-_St.
Revised: GFDL https://commons.wikimedia.org/w/ index.php?title=File:Moscou.-_St.

Original: _Basil%27s_Cathedral_ext%C3%A9rieur_ (en2018)_(1).JPG&oldid=
Revised: _Basil%27s_Cathedral_ext%C3%A9rieur_ (en2018)_(1).JPG&oldid=

Original: Telluride cc sa 4.
Revised: Telluride cc sa 4.

Original: https://commons.wikimedia.org/w/ index.php?title=File:St._Basil%27s_
Revised: https://commons.wikimedia.org/w/ index.php?title=File:St._Basil%27s_

Original: Cathedral_PD.jpg&oldid=
Revised: Cathedral_PD.jpg&oldid=

Original: Akuptsova cc0 1.
Revised: Akuptsova cc0 1.

Original: https://commons.wikimedia.org/w/ index.php?title=File:St._Basil%27s_
Revised: https://commons.wikimedia.org/w/ index.php?title=File:St._Basil%27s_

Original: Cathedral_2016.jpg&oldid=
Revised: Cathedral_2016.jpg&oldid=

Original: David Crawshaw cc sa 3.
Revised: David Crawshaw cc sa 3.

Original: https://commons.wikimedia.org/w/ index.php?title=File:St_Basils_
Revised: https://commons.wikimedia.org/w/ index.php?title=File:St_Basils_

Original: Cathedral-500px.jpg&oldid=
Revised: Cathedral-500px.jpg&oldid=

Original: Kafka commonswiki cc sa 3.
Revised: Kafka commonswiki cc sa 3.

Original: https://commons.wikimedia.org/w/ index.php?title=File:Cupolas_of_
Revised: https://commons.wikimedia.org/w/ index.php?title=File:Cupolas_of_

Original: St._Basil%27s_Cathedral , _Moscow.
Revised: St._Basil%27s_Cathedral , _Moscow.

Original: jpg&oldid=
Revised: jpg&oldid=

Original: CivArmy cc sa 4.
Revised: CivArmy cc sa 4.

Original: https://commons.wikimedia.org/w/ index.php?title=File:St._Basil%27s_
Revised: https://commons.wikimedia.org/w/ index.php?title=File:St._Basil%27s_

Original: Cathedral , _Moscow , _Russia.jpg&oldid=
Revised: Cathedral , _Moscow , _Russia.jpg&oldid=

Original: Dmitry Ivanov.
Revised: Dmitry Ivanov.

Original: cc sa 4.
Revised: cc sa 4.

Original: https://commons.wikimedia.org/w/ index.php?title=File:St_Barbara_
Revised: https://commons.wikimedia.org/w/ index.php?title=File:St_Barbara_

Original: Church_and_St_Basil_cathedral_in_
Revised: Church_and_St_Basil_cathedral_in_

Original: Moscow.jpg&oldid=
Revised: Moscow.jpg&oldid=

Original: Intel Free Press cc sa 2.
Revised: Intel Free Press cc sa 2.

Original: https://commons.wikimedia.org/w/ index.php?title=File:St._Basil%27s_
Revised: https://commons.wikimedia.org/w/ index.php?title=File:St._Basil%27s_

Original: Cathedral_Moscow , _Russia.jpg&oldid=
Revised: Cathedral_Moscow , _Russia.jpg&oldid=

Original: Laika ac cc sa 2.
Revised: Laika ac cc sa 2.

Original: https://commons.wikimedia.org/w/ index.php?title=File:Laika_ac_St.
Revised: https://commons.wikimedia.org/w/ index.php?title=File:Laika_ac_St.

Original: _Basil%27s_Cathedral_(6835027756).
Revised: _Basil%27s_Cathedral_(6835027756).

Original: jpg&oldid=
Revised: jpg&oldid=

Original: SteveInLeighton’s Photos cc sa 2.
Revised: SteveInLeighton’s Photos cc sa 2.

Original: https://commons.wikimedia.org/w/ index.php?title=File:St._Basil%27s_
Revised: https://commons.wikimedia.org/w/ index.php?title=File:St._Basil%27s_

Original: Cathedral , _Moscow_(32049554165).
Revised: Cathedral , _Moscow_(32049554165).

Original: jpg&oldid=
Revised: jpg&oldid=

Original: A J Butler cc by 2.
Revised: A J Butler cc by 2.

Original: https://commons.wikimedia.org/w/ index.php?title=File:St._Basil%27s_
Revised: https://commons.wikimedia.org/w/ index.php?title=File:St._Basil%27s_

Original: Cathedral.jpg&oldid=
Revised: Cathedral.jpg&oldid=

Original: SergeyStepykin cc by 3.
Revised: SergeyStepykin cc by 3.

Original: https://commons.wikimedia.org/w/ index.php?title=File:St._Basils_ at_Night_-_panoramio.jpg&oldid=
Revised: https://commons.wikimedia.org/w/ index.php?title=File:St._Basils_ at_Night_-_panoramio.jpg&oldid=

Original: Dror Feitelson cc sa 3.
Revised: Dror Feitelson cc sa 3.

Original: https://commons.wikimedia.org/w/ index.php?title=File:Saint_Basil_
Revised: https://commons.wikimedia.org/w/ index.php?title=File:Saint_Basil_

Original: Moscow.
Revised: Moscow.

Original: JPG&oldid=
Revised: JPG&oldid=

Original: Author
Revised: Author

Original: License
Revised: License

Original: URL
Revised: URL

Original: Sue Le cc sa 3.
Revised: Sue Le cc sa 3.

Original: https://commons.wikimedia.org/ w/index.php?title=
Revised: https://commons.wikimedia.org/ w/index.php?title=

Original: File:Banhbao.
Revised: File:Banhbao.

Original: jpg&oldid=
Revised: jpg&oldid=

Original: Tonbi ko cc sa 3.
Revised: Tonbi ko cc sa 3.

Original: https://commons.wikimedia.org/w/ index.php?title=File:Banh_Bao_at_
Revised: https://commons.wikimedia.org/w/ index.php?title=File:Banh_Bao_at_

Original: Tay_Son_Binh_Dinh_Vietnam.
Revised: Tay_Son_Binh_Dinh_Vietnam.

Original: JPG&oldid=
Revised: JPG&oldid=

Original: Baoothersks cc sa 4.
Revised: Baoothersks cc sa 4.

Original: https://commons.wikimedia.org/w/ index.php?title=File:B%C3%A1nh_bao
Revised: https://commons.wikimedia.org/w/ index.php?title=File:B%C3%A1nh_bao

Original: _ 3.jpg&oldid=
Revised: _ 3.jpg&oldid=

Original: Phuong Huy cc sa 4.
Revised: Phuong Huy cc sa 4.

Original: https://commons.wikimedia.org/w/ index.php?title=File:B%C3%A1nh_bao_ b%C3%AD_ng%C3%B4_%C4%90%C3%B4ng_H%
Revised: https://commons.wikimedia.org/w/ index.php?title=File:B%C3%A1nh_bao_ b%C3%AD_ng%C3%B4_%C4%90%C3%B4ng_H%

Original: C3%A0_1_(pumkin_dumbling).jpg&oldid=
Revised: C3%A0_1_(pumkin_dumbling).jpg&oldid=

Original: Baoothersks cc sa 4.
Revised: Baoothersks cc sa 4.

Original: https://commons.wikimedia.org/w/ index.php?title=File:B%C3%A1nh_bao_ 2.jpg&oldid=
Revised: https://commons.wikimedia.org/w/ index.php?title=File:B%C3%A1nh_bao_ 2.jpg&oldid=

Original: Baoothersks cc sa 4.
Revised: Baoothersks cc sa 4.

Original: https://commons.wikimedia.org/w/ index.php?title=File:B%C3%A1nh_bao.
Revised: https://commons.wikimedia.org/w/ index.php?title=File:B%C3%A1nh_bao.

Original: jpg&oldid=
Revised: jpg&oldid=

Original: Phuong Huy public domain https://commons.wikimedia.org/w/ index.php?title=File:B%C3%A1nh_bao_
Revised: Phuong Huy public domain https://commons.wikimedia.org/w/ index.php?title=File:B%C3%A1nh_bao_

Original: chay_ng%E1%BB%8Dt_c%C3%BAng_t%E1%BA%
Revised: chay_ng%E1%BB%8Dt_c%C3%BAng_t%E1%BA%

Original: A5t_ni%C3%AAn_nh%C3%A0_m%E1%BB%87_ 2018.jpg&oldid=
Revised: A5t_ni%C3%AAn_nh%C3%A0_m%E1%BB%87_ 2018.jpg&oldid=

Original: Phuong Huy public domain https://commons.wikimedia.org/w/ index.php?title=File:B%C3%A1nh_bao_
Revised: Phuong Huy public domain https://commons.wikimedia.org/w/ index.php?title=File:B%C3%A1nh_bao_

Original: chay_ng%E1%BB%8Dt_c%C3%BAng_t%E1%BA%
Revised: chay_ng%E1%BB%8Dt_c%C3%BAng_t%E1%BA%

Original: A5t_ni%C3%AAn_M%E1%BA%ADu_Tu%E1%BA%
Revised: A5t_ni%C3%AAn_M%E1%BA%ADu_Tu%E1%BA%

Original: A5n_2018_(1).jpg&oldid=
Revised: A5n_2018_(1).jpg&oldid=

Original: Phuong Huy cc sa 4.
Revised: Phuong Huy cc sa 4.

Original: https://commons.wikimedia.org/w/ index.php?title=File:H%C3%A1_c%E1%
Revised: https://commons.wikimedia.org/w/ index.php?title=File:H%C3%A1_c%E1%

Original: BA%A3o_b%C3%A1nh_bao_chi%C3%AAn_%E1%
Revised: BA%A3o_b%C3%A1nh_bao_chi%C3%AAn_%E1%

Original: BB%9F_%C4%90%C3%B4ng_H%C3%A0_n%C4% 83m_2016_(2).jpg&oldid=
Revised: BB%9F_%C4%90%C3%B4ng_H%C3%A0_n%C4% 83m_2016_(2).jpg&oldid=

Original: Phuong Huy public domain https://commons.wikimedia.org/w/ index.php?title=File:%C4%90%E1%BB% 93_chay_c%C3%BAng_%E1%BB%9F_nh%C3%
Revised: Phuong Huy public domain https://commons.wikimedia.org/w/ index.php?title=File:%C4%90%E1%BB% 93_chay_c%C3%BAng_%E1%BB%9F_nh%C3%

Original: A0_m%E1%BB%87_-_b%C3%A1nh_bao_chay_ (th%C3%A1ng_9_n%C4%83m_2018)_(2).
Revised: A0_m%E1%BB%87_-_b%C3%A1nh_bao_chay_ (th%C3%A1ng_9_n%C4%83m_2018)_(2).

Original: jpg&oldid=
Revised: jpg&oldid=

Original: Francesc Fort cc sa 4.
Revised: Francesc Fort cc sa 4.

Original: https://commons.wikimedia.org/w/ index.php?title=File:Empanadilles_ xineses_(1).jpg&oldid=
Revised: https://commons.wikimedia.org/w/ index.php?title=File:Empanadilles_ xineses_(1).jpg&oldid=

Original: Ccyber public domain https://commons.wikimedia.org/ w/index.php?title
Revised: Ccyber public domain https://commons.wikimedia.org/ w/index.php?title

Original: =
Revised: =

Original: File:
Revised: File:

Original: Steamed_ sausage_buns_hby1.jpg&oldid=
Revised: Steamed_ sausage_buns_hby1.jpg&oldid=

Original: F LAION-A ESTHETICS V2 5+ A NALYSIS
Revised: G LAION-A ESTHETICS V2 5+ A NALYSIS

Original: We analyzed the text descriptions contained in the LAION-Aesthetics V2 5+ subset of the LAION2B-en dataset with 600M samples that have an estimated aesthetics scores ≥ 5 . 0 .
Revised: We analyzed the text descriptions contained in the LAION-Aesthetics V2 5+ subset of the LAION2B-en dataset with 600M samples that have an estimated aesthetics scores ≥ 5 . 0 .

Original: The LAION-2B-en dataset itself is a subset of the public LAION-5B dataset Schuhmann et al.
Revised: The LAION-2B-en dataset itself is a subset of the public LAION-5B dataset Schuhmann et al.

Original: (2022) with English text.
Revised: (2022) with English text.

Original: For each non-Latin homoglyph (including the extended Latin script), we counted the number of text strings that contain the character.
Revised: For each non-Latin homoglyph (including the extended Latin script), we counted the number of text strings that contain the character.

Original: [Table]
Revised: [Table]

Original: A
Revised: A

Original: U+FF
Revised: U+FF

Original: Lisu Letter
Revised: Lisu Letter

Original: I
Revised: I

Original: U+A4F
Revised: U+A4F

Original: Nko Letter Ee
Revised: Nko Letter Ee

Original: U+07CB
Revised: U+07CB

Original: Oriya digit zero
Revised: Oriya digit zero

Original: U+0B
Revised: U+0B

Original: Oriya Letter Ttha
Revised: Oriya Letter Ttha

Original: U+0B
Revised: U+0B

Original: Osmanya Letter Deel
Revised: Osmanya Letter Deel

Original: U+
Revised: U+

Original: Osmanya Letter Ja
Revised: Osmanya Letter Ja

Original: U+
Revised: U+

Original: Osmanya Letter A
Revised: Osmanya Letter A

Original: U+
Revised: U+

Original: Osmanya Letter Cayn
Revised: Osmanya Letter Cayn

Original: U+1048B
Revised: U+1048B

Original: Tibetan Mark Shad
Revised: Tibetan Mark Shad

Original: U+0F0D
Revised: U+0F0D

Original: Smiling Face with Open Mouth Emoji
Revised: Smiling Face with Open Mouth Emoji

Original: U+1F
Revised: U+1F

Original: Serious Face With Symbols Covering Mouth Emoji
Revised: Serious Face With Symbols Covering Mouth Emoji

Original: U+1F92C
Revised: U+1F92C

Original: Loudly Crying Face
Revised: Loudly Crying Face

Original: Emoji
Revised: Emoji

Original: U+1F62D
Revised: U+1F62D

Original: Smiling Face with Smiling Eyes and Three Hearts Emoji
Revised: Smiling Face with Smiling Eyes and Three Hearts Emoji

Original: U+1F
Revised: U+1F

Original: Face Screaming In Fear Emoji
Revised: Face Screaming In Fear Emoji

Original: U+1F
Revised: U+1F

Original: Face with Party Horn and Party Hat Emoji
Revised: Face with Party Horn and Party Hat Emoji

Original: U+1F
Revised: U+1F

Original: Nerd Face Emoji
Revised: Nerd Face Emoji

Original: U+1F
Revised: U+1F

Original: Monkey Face Emoji
Revised: Monkey Face Emoji

Original: U+1F
Revised: U+1F

Original: Bactrian Camel Emoji
Revised: Bactrian Camel Emoji

Original: U+1F42B
Revised: U+1F42B