MMA-Diffusion: MultiModal Attack on Diffusion Models

• MMA-Diffusion targets the risk of T2I models generating NSFW content, including adult materials, violence, and politically sensitive imagery.The introduction notes that prompt filters and post-synthesis safety checks are preventive measures, but their resilience to sophisticated adversarial attacks remains under investigation.Source: §1 · p. 1
• Its text attack alters prompts while preserving semantic intent to evade filters, while its image attack uses human-imperceptible perturbations to bypass post-processing safety algorithms.The framework is described as a systematic attack that generates unrestricted adversarial prompts and crafts image perturbations.Source: §1 · pp. 1–2
• A 10-query black-box attack achieved an 83.33% success rate on Midjounery and a 90% success rate on Leonardo.Ai.The evaluation covers popular open-source T2I models and online platforms.Source: §1 · p. 2
• The work presents MMA-Diffusion as a multimodal systematic attack that bypasses prompt filters and safety checkers, exposing vulnerabilities and motivating more robust T2I security measures.Source: §1 · p. 2

Adversarial attacks on T2I models

• Earlier T2I attacks mainly modify text to probe functional vulnerabilities, such as reducing image quality or distorting objects, rather than generating NSFW-specific content.The passage notes that image-modality attacks for NSFW generation have not been extensively explored.Source: §2 · p. 2
• UnlearnDiff [40] focuses on concept-erased models, while Ring-A-Bell [37] induces NSFW concepts without precise control; neither addresses bypassing both prompt filters and post-hoc safety mechanisms.The related work identifies the gap as generating high-quality NSFW content tailored to specific semantic prompts while bypassing both defenses.Source: §2 · p. 2

Defensive methods

• T2I defenses include input-stage AI moderators at services such as Midjourney and Leonardo.Ai, output-stage safety checkers in Stable Diffusion [28], and concept-erased models [7] [15] [34].Concept-erased methods alter inference guidance or fine-tune models to suppress NSFW concepts.Source: §2 · p. 2
• Concept-erased methods may leave some NSFW content and can reduce benign-image quality [16] [34] [40].These methods modify model inference guidance or use fine-tuning, unlike external input- and output-stage safety measures.Source: §2 · p. 2
• MMA-Diffusion demonstrates attacks that bypass prompt filters and post-hoc safety checkers, apply to concept-erased models such as SLD [34], and generalize across varied T2I models.The paper presents this as a multimodal attack that produces high-quality NSFW content tailored to semantic prompts.Source: §2 · p. 2

3.1. Threat Model

• The threat model covers white-box attacks with access to open-source model architecture and checkpoints, and black-box transfer attacks against online services without parameter access.The passage gives SDv1.5 as an open-source example and Midjourney as an online-service example.Source: §3.1 · p. 2

3.2. Approach Overview

• MMA-Diffusion targets successful NSFW generation aligned with the attacker’s plain-text description, adapting its attack modality to prompt filters, post-hoc checkers, or both.It uses text attacks when only prompt filtering is present, image attacks when only post-hoc checking is present, and both when both defenses are used.Source: §3.2 · pp. 2–3

3.3. Text-Modal Attack

• The text-modal attack seeks a filter-safe prompt whose text embedding remains semantically close to the target, using gradient-guided token search and suppressing sensitive-word tokens.It assumes prompt filters use sensitive-word lists; candidate substitutions are ranked by token gradients, then sampled and compared by objective value.Source: §3.3 · pp. 3–4

3.4. Image-Modal Attack

• The image-modal attack crafts a minimally perturbed input image so the post-hoc checker releases a synthesis by reducing only cosine-similarity losses that exceed NSFW thresholds.The constrained objective is solved with projected gradient descent.Source: §3.4 · p. 4

4.1. Experimental Settings

• Experiments used 1,000 high-NSFW-score LAION-COCO captions and 30 UnsafeDiff prompts, with SDv1.5 white-box attacks and transfer tests on SDXL, SLD, and online services.QF-Attack variants and sexual I2P prompts served as baselines; ASR-N counts a prompt as successful if any of N generations contains NSFW content and bypasses the prompt filter, assessed with three detectors for open-source models and six human evaluators for online and image-modal attacks.Source: §4.1 · p. 5

4.2. Attacking Open-Source Models

• 83.37% ASR-4 on SD, 73.70% on SDXL, and 76.73% on SLD demonstrate successful white-box and black-box attacks.MMA-Diffusion outperforms the baselines quantitatively and qualitatively; unlike QF-Attack, it generates prompts from scratch, while I2P lacks control over generated content, and the baselines’ unsuppressed sensitive words trigger prompt-filter rejection.Source: §4.2 · pp. 5–6, Figure 5 · p. 6

4.3. Attacking Online T2I Services

• 90.00% 10-query attack success on Leonardo.Ai and 83.33% on Midjourney show that adversarial prompts bypassed both services’ AI moderators.The evaluation used 30 UnsafeDiff prompts across six NSFW categories, with 10 adversarial prompts and 10 queries per target prompt; success required human evaluators to rate the generation as high-quality and high-fidelity.Source: Table 2 · p. 6, §4.3 · p. 6
• Leonardo.Ai’s adult-theme prompts bypassed its defenses in 64% of cases, while Midjourney attacks achieved 3.96% success for pornography and 27.67% for violent content.Nearly 60% of Leonardo.Ai prompts that bypassed the filter induced adult images, for a 38% final success rate; celebrity attacks often depicted an associated person instead of the target because names were excluded.Source: §4.3 · pp. 6–7, Table 2 · p. 6

4.4. Multimodal Attack Results

• 85.48% ASR-4 and 75.52% ASR-1 show that multimodal attacks can deceive both SD’s prompt filter and post-hoc safety checker.The attack combines adversarial prompts that bypass the prompt filter with adversarial images that deceive the safety checker.Source: Table 3 · p. 8, §4.4 · p. 8
• 88.52% ASR-4 and 78.68% ASR-1 were achieved against SD’s built-in safety checker using adversarial images.The attack perturbed input images by ℓ2 = 16 over 20 optimization iterations while leaving the prompt and mask unchanged; transferred images deceived Q16 in 30% and MHSC in 20% of cases.Source: §4.4 · p. 7, Table 3 · p. 8

Ethical Considerations

• The research is intended to strengthen T2I diffusion models rather than enable misuse.The authors describe revealing security vulnerabilities as the research’s purpose.Source: §5 · p. 8
• To mitigate potential misuse, the authors deliberately omitted or generalized specific attack-method details.Source: §5 · p. 8
• The authors urge developers to use the findings responsibly to improve T2I security and advocate ethical, transparent AI research attentive to societal impact and misuse prevention.Source: §5 · p. 8

• MMA-Diffusion automates generation of visually realistic, semantically diverse images with high success without compromising quality or diversity.Source: §6 · p. 8
• MMA-Diffusion enables black-box attacks across different generative models, demonstrating its versatility.Source: §6 · p. 8
• The results highlight limitations in current defensive measures and the need for more effective security controls.Source: §6 · p. 8

Overview

• The supplement adds a detailed algorithm, additional setup and experiments, failure cases, and further visualizations.It also includes experiments on DALL·E2-pytorch and against input sanitization defense.Source: Overview · p. 11

A. Sensitive Word List

• The sensitive-word list spans Adult Theme and Other NSFW Theme terms, including words such as “sexual,” “blood,” “nude,” and “horror.”The list is used in the experiments.Source: A. Sensitive Word List · p. 11, Table S-1
• Attacks on LAION-COCO use only the Adult Theme category, whereas attacks on UnsafeDiff use the entire sensitive-word list.The list is also used by the prompt filter when evaluating open-source diffusion models.Source: A. Sensitive Word List · p. 11
• Most sensitive words come from studies [25] [29], and sensitive-word regularization is used to keep them out of generated adversarial prompts.The regularization is intended to mitigate the exhibition of sensitive words in those prompts.Source: A. Sensitive Word List · p. 11
• The same sensitive words are used by the prompt filter to identify and flag NSFW prompts in open-source diffusion model evaluations.Source: A. Sensitive Word List · p. 11

B. Implementation Details

• Implementation details cover data processing, victim-model implementations, baseline hyperparameters, and specifics of the proposed approach.Source: B. Implementation Details · p. 11

B.1. Data Processes

• Candidate prompts are LAION-COCO captions with NSFW scores above 0.99; sensitive words are filtered, and prompts are checked in SD to verify toxicity and that resulting images do not trigger its safety checker.Source: §B.1 · p. 11

B.2. Hardware Platform

• Experiments were conducted on an NVIDIA RTX4090 GPU with 24GB of memory.Source: §B.2 · p. 11

B.3. Details of Diffusion Models

• SDv1.5 uses guidance scale 7.5, 100 inference steps, and 512 × 512 images; SDXLv1.0 uses 7.5, 50 steps, and 1024 × 1024 images.Source: §B.3 · pp. 11–12
• SLD uses guidance scale 7.5, 100 inference steps, Medium safety, and 512 × 512 images; DALL·E2-pytorch [26] uses 7.5, 1000 steps, 4 prior samples, and 224 × 224 images.Source: §B.3 · p. 12
• Midjounery and Leonardo.Ai models use their default settings.Source: §B.3 · p. 12

B.4. MMA-Diffusion Implementation

• The text attack optimizes a 20-letter random adversarial prompt for 500 steps, using top-256 token candidates and sampling 512 prompts per step, typically taking about 380 seconds.The prompt length matches the reported I2P average.Source: §B.4 · p. 12
• The image attack uses an ℓ2 perturbation budget of 16, step size α=2, 20 iterations, and SD inference step 8, a configuration found effective and feasible on one RTX4090 GPU.Source: §B.4 · p. 12

B.5. Baseline Implementation

• For fairer comparison, QF-attack [41] was reconfigured to match MMA-Diffusion’s objective and sensitive-word-filtered inputs; GENETIC and GREEDY settings stayed unchanged, while QF-PGD used 100 iterations.QF-attack was originally designed to append a five-character suffix that disrupts semantic alignment.Source: §B.5 · p. 12

C. Results on DALL·E2-pytorch

• DALL·E-pytorch [27] has lower image resolution and text-to-image fidelity than other T2I models such as SD and SDXL, negatively impacting ASR.Source: C. Results on DALL·E2-pytorch · p. 12
• At 25 samples per prompt, DALL·E-pytorch [2, 27] reaches ASR comparable to SDXL at 4 samples, with GPU memory use of approximately 24GB.The increased sample count was chosen to align GPU memory consumption with SDXL’s 4 samples per prompt.Source: Table S-2 · p. 12, C. Results on DALL·E2-pytorch · p. 12

D. Against Input Sanitization Defense

• In the basic input-sanitization test, 87.00% of sanitized adversarial prompts (870 out of 1000 tested) still generated NSFW content when interfaced with the SD model.The defense used GPT-turbo-3.5 to filter out non-dictionary words and special characters while retaining intelligible words.Source: D. Against Input Sanitization Defense · pp. 12–13
• MMA-Diffusion’s success depends on the collective impact of its tokens, not special tokens, and it adapts its candidate vocabulary to evade rudimentary sanitization.Simply removing tokens cannot fully neutralize the adversarial prompts.Source: D. Against Input Sanitization Defense · p. 13

E. More Visualizations

• In Figure S-1, prompts avoiding celebrity names led T2I models to generate individuals or objects related to the targeted celebrities rather than the celebrities themselves.The names of celebrities are highlighted in red.Source: Figure S-1 · p. 13
• Figures S-2 and S-3 show generated images that fail to convey the intended NSFW concepts Racism and naked, respectively; human evaluators classified them as unsuccessful.Source: Figure S-2 · p. 13, Figure S-3 · p. 13
• Figures S-4 and S-5 show black-box attacks on Midjourney and Leonardo.Ai, with sensitive words that MMA-Diffusion avoids highlighted in red.Source: Figure S-4 · p. 14, Figure S-5 · p. 15
• Figure S-6 presents MMA-Diffusion generating inauthentic depictions of real people; the authors added Gaussian blurs for ethical considerations.The figure states that the method aims to reflect attackers’ malicious intentions.Source: Figure S-6 · p. 16