Misalignment Attack on Text-to-Image Models via Text Embedding Optimization and Inversion (2025)

Abstract: Text embedding serves not only as a core component of modern NLP models but also plays a pivotal role in multimodal systems such as text-to-image (T2I) models, significantly facilitating user-friendly image generation through natural language instructions. However, with the convenience being brought, it also introduces additional risks. Misalignment issues of T2I models, whether caused by unintentional user inputs or targeted attacks, can negatively impact the reliability and ethics of these models. In this paper, we introduce TEOI , which fully considers the continuity and distribution characteristics of text embeddings. The framework directly optimizes the embeddings using gradient-based methods and then inverts them to obtain misaligned prompts of discrete tokens. The TEOI framework is capable of conducting both text-modal and multimodal misalignment attacks, revealing the vulnerabilities of multimodal models that rely on text embeddings. Our work highlights the potential risks associated with embedding-based text representations in prevailing T2I models and provides a foundation for further research into robust and secure text-to-image generation systems.

## introduction with the development of text embeddings @xcite , as well as gans @xcite and diffusion models @xcite , t2i models @xcite @xcite @xcite @xcite have demonstrated remarkable capabilities in producing realistic and diverse images guided by natural language prompts. these models encode textual prompts into continuous text embeddings and are trained to generate * corresponding authors. the misalignment attack demonstrates remarkable efficacy in circumventing prompt filtering mechanisms, a critical security safeguard in t2i generation systems because the effectiveness of such attacks stems from the discrepancy between the textual prompt and the generated image. on the other hand, the content of a single modality--either the input or the output of the t2i modelmay appear benign on its own, but the combination of both modalities may cause negative overall effects. our work highlights this critical vulnerability and underscores the need for robust defense mechanisms targeting text encoders. this paper highlights the critical role of text embedding properties in text-image alignment and introduces teoi (text embedding optimization and inversion), a novel framework designed to test and challenge the alignment robustness of t2i models. for a given target image, misalignment attack via teoi leverages gradient-based optimization @xcite to directly manipulate text embedding, unlike traditional adversarial attacks that make subtle modifications to discrete text prompts. this approach empowers teoi to effectively identify text embeddings that, while exhibiting substantial semantic deviation from the target image, still successfully guide the t2i model to generate visually similar outputs. the optimized embedding is then inverted into a natural language attack prompt using our text embedding inversion method. furthermore, we extend teoi to multimodal attack scenarios. unlike previous multimodal at-tacks @xcite , where adversarial perturbations are applied separately or alternately across modalities, our approach simultaneously optimizes both image pixels and text embeddings through gradient descent. in summary, our contributions are as follows: some studies @xcite investigated the distribution characteristics of pooler output, shedding light on their statistical properties and behavior in high-dimensional spaces. meanwhile, text embedding inversion models @xcite @xcite explored methods to recover original text from pooler output. text inversion of t2i. in t2i models, there are two primary types of text inversion methods. the first type @xcite @xcite aims to invert images into the text embedding space, representing them using new tokens outside of the predefined vocabulary. the second type @xcite @xcite focuses on inverting visual concepts into natural language prompts. both types of inversion techniques are generally designed to enhance image synthesis capabilities. in this work, we propose a universal targeted inversion attack applicable to diverse text embedding types used in t2i models, demonstrating the potential risks posed by such inversion techniques. ## conclusion we introduce a novel perspective on the vulnerability of t2i models to mismatches between prompts and generated images, and propose an effective attack method to exploit this vulnerability. leveraging the widespread use of text embeddings in diffusion-based or gan-based t2i models, we present teoi, a highly efficient method for adversarial prompt exploration and discovery through gradient-based optimization in continuous text embedding spaces. teoi could also conduct multimodal attack, demonstrating effective circumvention of prompt filters and jailbreaking predefined prompt templates. finally, we innovatively extend teoi to the multimodal domain, proposing the first gradient-based approach to simultaneously optimize image and text modalities. experiments demonstrate that this multimodal approach outperforms single-modality attacks and its multimodal baseline with effective circumvention of prompt filters and jailbreaking predefined prompt templates.