RA t: Injecting Implicit Bias for Text-To-Image Prompt Refinement Models (2024)

Abstract: Text-to-image prompt refinement (T2I-Refine) aims to rephrase or extend an input prompt with more descriptive details that can be leveraged to generate images with higher quality. In this paper, we study an adversarial prompt attacking problem for T2I-Refine, where to goal is to implicitly inject specific concept bias to the input prompts during the refinement process so that the generated images, still with higher quality, are explicitly biased to the target group. Our study is motivated by the limitation of current T2I-Refine research that lacks of explorations on the potential capacity of T2I-Refine models to provide prompt refinement service in a biased or advertising manner. To address the limitations, we develop RAt, a prompt refinement and attacking framework that attacks input prompts with intentionally selected adversarial replacements by optimizing a token distribution matrix based on the text-to-image finetuning strategy with a token-level bias obfuscation loss as regularization. We evaluate RAt on a large-scale text-to-image dataset with various concepts as target in both in-domain and transfer-domain scenarios. The evaluation results demonstrate that, compared to other T2I-Refine schemes, RAt is well capable of implicitly attacking input prompts to generate images with higher quality and explicit visual bias towards specific concept group.

## introduction text-to-image generation enables the synthesis of high-resolutional images that align with the input textual descriptions as prompts @xcite . to generate high-quality images, the input prompts are expected to be detailed and specific by providing comprehensive descriptions to guide the text-to-image models @xcite . example of the descriptions includes but not limits to subject terms (e.g., "shiba inu"), style modifier (e.g., "ghibli style") and quality booster user please help me to refine the prompt: "a smart phone." ## problem definition we present the adversarial prompt attacking problem for t2i-refine models with definitions below. definition 1 user prompt (p usr ): a prompt p @xmath0. definition 2 t2i-refine model (θ ref ): a text-toimage prompt refinement model θ ref that rephrase and extend p usr with additional descriptive tokens to generate images with higher quality. definition 3 refined prompt (p ref ): a refined prompt p @xmath1:m ] is usually the same as p usr . definition 4 concept (c): a noun term from θ ref with at least two different groups as sub-concepts, such as "phone" with two brands in figure 1 . definition 5 concept bias (c): a specific subconcept c k from the target concept @xmath2. c n can be represented by one or several tokens (e.g., "iphone", "male"). definition 6 adversarial t2i-refine model (θ adv ): a t2i-refine model that refines and attacks p usr to generate adversarial prompts with implicit concept bias injected, and sends it back to users. definition 7 adversarial refined prompt (p adv ): a prompt p @xmath3:] part. definition 8 text-to-image model (m): a diffusion based model m that inputs a prompt (p usr , p ref , p adv ) and outputs an image (x usr , x ref , x adv ). ## the proposed rat approach the proposed rat framework consists of three key modules: i) the explicit bias generation module (i.e., generator); ii) the image aligned gradient attacking module (i.e., attacker) and iii) the tokenlevel bias obfuscation module (i.e., obfuscator). ## evaluation in this section, we conduct extensive experiments on a large text-to-image prompting datasets to answer the following questions: q1) can rat successfully attack given prompts for bias injection while maintaining high image quality? q2) how imperceptible are the adversarial prompts from rat regarding the association with target concept bias? q3) how does different hyper-parameters of rat contribute to its overall performance? ## conclusion this paper presents rat to propose the adversarial prompt attacking problem for t2i-refine models. rat designs a gradient-based prompt perturbation framework and a token-level bias obfuscation strategy to optimize adversarial prompts that successfully generate tarte biased images. the evaluation results demonstrate effective and humanimperceptible attacking performance of rat compared to the state-of-the-art t2i-refine models.