A Survey on Adversarial Attacks and Defenses for Diffusion Models Across Multiple Modalities

1 Introduction

• Publicly available diffusion models enable misuse across image, video, and 3D tasks, while post-hoc detection and watermarking can be circumvented.The surveyed literature focuses on proactive protection that makes content resistant to exploitation before misuse.Source: §1 · p. 1
• Diffusion-model protections face task and setting heterogeneity, costly iterative stochastic generation, and adaptive adversaries that can alter inputs or models.These factors make protections transfer poorly and require them to withstand a moving target rather than a fixed pipeline.Source: §1 · pp. 1–2
• Existing surveys do not jointly cover image, video, and 3D with adversarial robustness as their primary focus.Prior robustness surveys are image-centric, video surveys focus on facial deepfakes and media detection or disruption, and robustness is peripheral in other survey topics.Source: §1 · p. 2
• The survey’s task-centric taxonomy groups methods by modality, then by attack or defense and target task, making same-threat methods comparable.It also orders methods chronologically within each task, exposing task-specific attack/counterattack arms races and modality-specific challenges.Source: §1 · p. 2

2 Preliminaries

• The preliminaries review diffusion modeling and modality-specific attack surfaces before formalizing a unified framework spanning attacks and defenses.Table 1 positions the survey among existing work; its caption states that this is the only survey covering image, video, and 3D together.Source: §2 · p. 2, Table 1 · p. 3

2.1 Background on Diffusion Models

• DDPMs progressively add Gaussian noise to clean samples, and a neural network learns to predict that injected noise at each timestep.Generation iteratively applies the learned denoiser to noise; the core learning objective is also a target adversarial cloaks seek to maximize.Source: §2.1 · p. 3
• U-Nets use convolutional encoder-decoders and localized cross-attention, whereas DiTs use flattened patches and global self-attention, requiring architecture-aware cloaks.The shift to token mixing can scatter localized perturbations and invalidate many U-Net cloaks.Source: §2.1 · p. 3
• Video protection must contend with temporal dilution, cross-frame attention, and compression, while 3D protection must account for multi-view consistency and budgets over rendered views or 3D parameters.The surveyed 3D representations rely on 2D diffusion models as priors or guidance rather than being diffusion models themselves.Source: §2.1 · p. 3

2.2 A Unified Adversarial Framework

• The framework casts content owners, adversaries, and defenders as Alice, Eve, and Bob, with Eve applying a diffusion pipeline to Alice’s content and Bob cloaking it before release.The framework’s figure depicts the cloak as bounded and the pipeline output as degraded or corrupted.Source: §2.2 · p. 3, Figure 2 · p. 4
• A content-level attack applies a modality-bounded perturbation to make Eve’s output degraded or misdirected rather than a faithful derivative.The perturbation is injected through a modality-specific feature map; its space, budget, and entry point affect transfer across domains and backbones.Source: §2.2 · pp. 4–5
• Defenses include adaptive purification against cloaks and system-side unlearning or prompt moderation to prevent misuse.Cloaks are formulated to withstand a family of purifiers, including compression, blurring, and diffusion-based regeneration.Source: §2.2 · p. 5

3 Adversarial Attacks and Defenses on Diffusion Models

• Methods are organized by modality and attack or defense, with attacks grouped by target task; tables report benchmarks, target models, and four evaluation dimensions.Imperceptibility, failure analysis, transferability, and robustness are marked as reported, unreported, or not applicable.Source: §3 · p. 5

3.1.1 Attacks

• Personalization cloaks disrupt subject fine-tuning, with later methods targeting useful features, improving transfer, or surviving purification [143].FastProtect replaces per-image optimization with a pretrained perturbation generator, reported as 200–3500× faster; IDDM [25] also disrupts face recognition, while VCPro confines cloaking to user-masked concepts.Source: §3.1.1 · pp. 5–6
• Style cloaks aim to make fine-tuned models learn the wrong style; Glaze introduced a tool used to protect over 2M images, followed by methods targeting transfer, identity, and style representations [77] [145].Source: §3.1.1 · p. 6
• Editing and inpainting cloaks derail text-guided changes through latent, diffusion-loss, attention, or mask-targeted perturbations, with approaches also targeting benign edit preservation and fixed chaotic outputs [139] [41].DCT-Shield targets JPEG transformations, while BlurGuard adapts blurring by semantic region; later methods address DiT editors [133] and one-pass or universal protection.Source: §3.1.1 · pp. 6–8
• Face-swap cloaks target identity extraction using feature, attention, or denoising-trajectory attacks, with AEGIS [76] also addressing GAN-based manipulation [156] [175].Source: §3.1.1 · p. 8

3.1.2 Defenses

• Purification preprocesses protected images, but JPEG compression and generative reconstruction can weaken cloaks; DiffPure, GrIDPure, and PDM-Pure [173] provide diffusion-based purification approaches.Because Eve may also modify the customization pipeline, newer cloaks explicitly optimize for survival under purification.Source: §3.1.2 · p. 8
• Model-side defenses include inference-time guidance and training-time erasure, while red-teaming revives erased concepts and cloak-focused attacks restore or realign protected inputs [30] [190].GuardDoor [190] survives JPEG, DiffPure, and IMPRESS but leaves non-participating editors untouched; AdvUnlearn transfers across backbones, while continuous textual-inversion attacks remain a harder failure mode.Source: §3.1.2 · p. 8

3.2.1 Attacks

• I2V defenses combine spatial, temporal, and latent objectives; Immune2V [91] explains image-cloak failures in dual-stream pipelines and uses temporally balanced latent divergence and alignment to a collapse-inducing trajectory.Other approaches include universal video perturbations [71], motion freezing [23], DiT-oriented color-space or frequency losses, and pose-driven animation protection.Source: §3.2.1 · p. 9
• Talking-head attacks target audio control and image-audio streams [195], while V2V methods simulate or directly handle codec effects and extend to lifecycle detection, attribution, and prevention [70] [10] [114].Source: §3.2.1 · p. 9
• T2VAttack perturbs prompts for semantic or temporal failure, and T2V-OptJail jailbreaks commercial T2V; T2VShield and ConceptGuard [94] address unsafe outputs and TI2V risk.Both defenses are evaluated using T2VSafetyBench.Source: §3.2.1 · p. 9

3.2.2 Defenses

• Video counter-defenses remain nascent: preprocessing and purification are treated as robustness stress tests, and IPV-Bench [73] finds existing I2V protections fragile to practical transformations.Source: §3.2.2 · p. 9

3.3.1 Attacks

• 3D editing protections optimize perturbations over Gaussian representations or lift rendered-view perturbations into safeguard Gaussians; Image2Multiview instead perturbs source images to disrupt reconstruction.Source: §3.3.1 · p. 10
• 3D attacks also include viewpoint-selective Gaussian illusions, scene-confusion poisoning, and reconstruction-cost attacks; RDSplat [199] studies watermarking robust to diffusion-based 3DGS editing.Source: §3.3.1 · p. 10

3.3.2 Defenses

• 3D counter-defenses are limited: RemedyGS protects reconstruction pipelines from poisoned inputs that inflate computation cost, while RDSplat [199] addresses provenance rather than cloak removal.General counter-defenses for 3D content cloaks remain open.Source: §3.3.2 · p. 10

• Evaluation is multi-objective: attacks seek imperceptibility, effectiveness, transferability, purification robustness, and efficiency, while defenses must also preserve utility.Source: §4 · p. 10
• Benchmarks span image datasets and editing or safety sets, video segmentation, animation, and safety corpora, and 3D synthetic objects, real captures, and editing testbeds.3D protocols mandate novel-view sampling; many studies use small author-curated sets, hindering cross-paper comparison, and no standardized 3D content-protection benchmark exists.Source: §4 · pp. 10–11
• Image attacks largely target Stable Diffusion and its personalization, editing, and adapter pipelines; video and 3D methods target generators, editors, and reconstruction backbones.Source: §4 · p. 12
• Metrics assess generation effectiveness, cloak imperceptibility, failure analysis, transferability, purification robustness, and efficiency; failure analysis has no standardized metric and is least consistently reported.Effectiveness metrics vary by modality, including image similarity measures, video flow or consistency measures, and 3D novel-view fidelity and cross-view consistency.Source: §4 · p. 12

Adaptive countermeasures and evaluation

• Fixed cloaks can be neutralized by model-side preprocessing or purification, so robust evaluation needs common datasets, threat models, and adaptive purifier suites.The survey calls for certified defenses against broad classes of unseen purifiers rather than empirical hardening against known countermeasures.Source: §5 · p. 13

Cross-model and cross-sample generalization

• Practical immunization must generalize beyond white-box, single-asset optimization to black-box services, while balancing per-sample strength against cross-sample speed.The survey identifies universal perturbations or amortized generators protecting arbitrary unseen content in one forward pass as an open challenge.Source: §5 · pp. 13–14

Theoretical foundations and modality expansion

• Video and 3D protection remain under-studied and structurally difficult, motivating theoretical characterization of perturbations that survive purification and multimodal transformations.Video adds temporal dilution and compression; 3D perturbations must survive multi-view rendering without being smoothed away.Source: §5 · p. 14

Conclusion

• Static, single-target protections are no longer sufficient against adaptive countermeasures; progress depends on broader defenses, standardized evaluation, and work on under-studied video and 3D.The survey identifies generalization across models and samples, adaptive evaluation metrics, and scaling protection to video and 3D as priorities.Source: §5 · p. 14