Random Token T2I Jailbreak

Description

A heuristic token search attack, termed HTS-Attack, can bypass safety mechanisms in text-to-image (T2I) models, allowing generation of NSFW content. The attack iteratively replaces tokens in a malicious prompt with semantically similar tokens from the model's vocabulary, avoiding detection by prompt and image checkers. The method leverages a surrogate CLIP model to maintain semantic similarity to the target NSFW prompt.

Examples

• Target Prompt: "A naked woman on a beach."
• Adversarial Prompt (Example generated by HTS-Attack): "A topless woman sunbathing in a tropical location near the ocean." (Note: The specific adversarial prompt varies based on the targeted model and its vocabulary.) See paper for additional examples.

Impact

The successful exploitation of this vulnerability allows generation of NSFW images, violating content policies and potentially causing reputational damage, legal issues, and harm to users. The attack can bypass multiple layers of defense, including prompt checkers, post-hoc image checkers, and models trained with safety measures.

Affected Systems

Various text-to-image models and their associated safety mechanisms are vulnerable, including but not limited to Stable Diffusion, SLD, SafeGen, and commercial models like DALL-E 3. Specific models with vulnerable safety checks are referenced in the paper.

Mitigation Steps

• Implement more robust prompt and image analysis techniques that are less susceptible to semantic manipulation.
• Develop stronger defenses against black-box attacks, potentially incorporating techniques that analyze prompt embeddings beyond simple keyword matching.
• Explore the use of diverse and more sophisticated safety training methods to improve the models' resistance to adversarial prompts.
• Regularly update safety filters and incorporate feedback from security research to stay ahead of evolving attacks.