🤖 AI Summary
This work exposes a critical security vulnerability in text-to-image models: when backdoored, they can be maliciously triggered to generate unsafe images—even from benign prompts such as “a photo of a cat.” Unlike prior studies focusing on passive exploitation, we propose the first *active* paradigm for unsafe image generation targeting benign prompts. We design a stealthy, concept-decoupled poisoning method that imposes constrained optimization directly in the text embedding space, enabling high-precision triggering on target prompts while maintaining strong robustness against non-target prompts. Evaluated on mainstream diffusion models—including Stable Diffusion—our approach achieves a trigger success rate exceeding 92% and a false-trigger rate below 5% on non-target prompts, significantly reducing unintended side effects. This work establishes a novel framework for security assessment and defense of generative AI models, providing both conceptual insight and practical technical foundations.
📝 Abstract
Malicious or manipulated prompts are known to exploit text-to-image models to generate unsafe images. Existing studies, however, focus on the passive exploitation of such harmful capabilities. In this paper, we investigate the proactive generation of unsafe images from benign prompts (e.g., a photo of a cat) through maliciously modified text-to-image models. Our preliminary investigation demonstrates that poisoning attacks are a viable method to achieve this goal but uncovers significant side effects, where unintended spread to non-targeted prompts compromises attack stealthiness. Root cause analysis identifies conceptual similarity as an important contributing factor to these side effects. To address this, we propose a stealthy poisoning attack method that balances covertness and performance. Our findings highlight the potential risks of adopting text-to-image models in real-world scenarios, thereby calling for future research and safety measures in this space.
