Paper deep dive

Universally Unfiltered and Unseen: Input-Agnostic Multimodal Jailbreaks against Text-to-Image Model Safeguards

Song Yan, Hui Wei, Jinlong Fei, Guoliang Yang, Zhengyu Zhao, Zheng Wang

Year: 2025Venue: ACM Multimedia 2025Area: Multimodal SafetyType: EmpiricalEmbeddings: 63

Models: DALL-E 3, Leonardo.Ai, Runway, Stable Diffusion v1.5

Intelligence

Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 96%

Last extracted: 3/12/2026, 5:22:34 PM

Summary

The paper introduces U3-Attack, a universal, input-agnostic multimodal jailbreak method for Text-to-Image (T2I) models. It addresses the limitations of existing jailbreaks by optimizing a universal adversarial patch for image safety checkers and a reusable paraphrase set for text prompt filters, achieving significantly higher success rates on both open-source and commercial models without requiring internal model access.

Entities (5)

MMA-Diffusion · attack-method · 100%Text-to-Image (T2I) Models · technology · 100%U3-Attack · attack-method · 100%Runway-inpainting · commercial-service · 95%Stable Diffusion v1.5 · model · 95%

Relation Signals (3)

U3-Attack → targets → Text-to-Image (T2I) Models

confidence 100% · we propose Universally Unfiltered and Unseen (U3)-Attack, a multimodal jailbreak attack method against T2I safeguards.

U3-Attack → bypasses → Safety Checker

confidence 95% · U3-Attack optimizes an adversarial patch on the image background to universally bypass safety checkers

U3-Attack → outperforms → MMA-Diffusion

confidence 95% · our U3-Attack achieves ~4× higher success rates than the state-of-the-art multimodal jailbreak attack, MMA-Diffusion.

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Various (text) prompt filters and (image) safety checkers have been implemented to mitigate the misuse of Text-to-Image (T2I) models in creating Not-Safe-For-Work (NSFW) content. In order to expose potential security vulnerabilities of such safeguards, multimodal jailbreaks have been studied. However, existing jailbreaks are limited to prompt-specific and image-specific perturbations, which suffer from poor scalability and time-consuming optimization. To address these limitations, we propose Universally Unfiltered and Unseen (U3)-Attack, a multimodal jailbreak attack method against T2I safeguards. Specifically, U3-Attack optimizes an adversarial patch on the image background to universally bypass safety checkers and optimizes a safe paraphrase set from a sensitive word to universally bypass prompt filters while eliminating redundant computations. Extensive experimental results demonstrate the superiority of our U3-Attack on both open-source and commercial T2I models. For example, on the commercial Runway-inpainting model with both prompt filter and safety checker, our U3-Attack achieves $~4\times$ higher success rates than the state-of-the-art multimodal jailbreak attack, MMA-Diffusion.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

63,063 characters extracted from source content.

Expand or collapse full text

Universally Unfiltered and Unseen: Input-Agnostic Multimodal Jailbreaks against Text-to-Image Model Safeguards Song Yan 0009-0008-5704-2486 Information Engineering UniversityZhengzhouChina yan61255873@163.com , Hui Wei 0000-0002-2144-2065 School of Computer Science, Wuhan UniversityWuhanChina weihui0713@whu.edu.cn , Jinlong Fei 0000-0001-8499-9402 Information Engineering UniversityZhengzhouChina feijinlong@126.com , Guoliang Yang 0009-0004-7624-6442 Information Engineering UniversityZhengzhouChina yangguoliang2026@126.com , Zhengyu Zhao 0000-0003-0745-4294 Xi’an Jiaotong UniversityXi’anChina zhengyu.zhao@xjtu.edu.cn and Zheng Wang 0000-0003-3846-9157 Wuhan UniversityWuhanChina wangzwhu@whu.edu.cn (2025) Abstract. Various (text) prompt filters and (image) safety checkers have been implemented to mitigate the misuse of Text-to-Image (T2I) models in creating Not-Safe-For-Work (NSFW) content. In order to expose potential security vulnerabilities of such safeguards, multimodal jailbreaks have been studied. However, existing jailbreaks are limited to prompt-specific and image-specific perturbations, which suffer from poor scalability and time-consuming optimization. To address these limitations, we propose Universally Unfiltered and Unseen (U3)-Attack, a multimodal jailbreak attack method against T2I safeguards. Specifically, U3-Attack optimizes an adversarial patch on the image background to universally bypass safety checkers and optimizes a safe paraphrase set from a sensitive word to universally bypass prompt filters while eliminating redundant computations. Extensive experimental results demonstrate the superiority of our U3-Attack on both open-source and commercial T2I models. For example, on the commercial Runway-inpainting model with both prompt filter and safety checker, our U3-Attack achieves 4×~4× higher success rates than the state-of-the-art multimodal jailbreak attack, MMA-Diffusion. Code is available at https://github.com/yszbb/U3-Attack. Content Warning: This paper includes examples of NSFW content. Text-to-Image (T2I) Model, Not-Safe-for-Work (NSFW) Content, Jailbreak Attack †journalyear: 2025†copyright: acmlicensed†conference: Proceedings of the 33rd ACM International Conference on Multimedia; October 27–31, 2025; Dublin, Ireland.†booktitle: Proceedings of the 33rd ACM International Conference on Multimedia (M ’25), October 27–31, 2025, Dublin, Ireland†isbn: 979-8-4007-2035-2/2025/10†doi: 10.1145/3746027.3754928†ccs: Security and privacy Usability in security and privacy Figure 1. Comparison of previous jailbreak methods (Yang et al., 2024a, c; Tsai et al., 2024) with our U3-Attack method. Our U3-Attack is prompt-agnostic, eliminating redundant prompt optimization, and is image-agnostic, optimizing a single local patch to attack multiple images without white-box model access. 1. Introduction Text-to-Image (T2I) models have revolutionized the synthesis of high-quality images from textual descriptions, bridging the gap between natural language and visual content (Rombach et al., 2022a; Zhou et al., 2022; Shi et al., 2024). Their remarkable ability to generate realistic images has led to unprecedented popularity in various applications111Examples include ImagineArt (https://w.imagine.art/), DALL·E 3 (https://openai.com/index/dall-e-3/), and Runway (https://runwayml.com/). However, concerns have emerged regarding the potential misuse of these models for generating Not-Safe-for-Work (NSFW) images (Qu et al., 2023). The proliferation of NSFW images, including pornography, violence, and politically sensitive content, generated by T2I models has been observed on various online platforms222For example, the subreddit ”r/unstable diffusion”: https://w.reddit.com/r/unstable_diffusion/. To mitigate these risks, T2I model developers have implemented preemptive (text) prompt filters (Leonardo.AI, 2023) and (image) safety checkers (CompVis, 2024). While these safeguards show some effectiveness, their robustness against carefully crafted jailbreaks remains to be fully explored. Our work focuses on jailbreak attacks against current T2I models to identify underlying vulnerabilities and investigate this issue in depth. Jailbreak attacks are originally developed for large language models (LLMs) (Wei et al., 2024; Liu et al., 2024; Zou et al., 2023), and are now increasingly adapted to T2I models (Chin et al., 2024; Zhang et al., 2023b; Tsai et al., 2024; Ma et al., 2024; Huang et al., 2024; Yang et al., 2024a). Most existing T2I jailbreak methods (Chin et al., 2024; Zhang et al., 2023b; Tsai et al., 2024; Ma et al., 2024; Huang et al., 2024) target only prompt filters or concept-erasure mechanisms (Schramowski et al., 2023; Gandikota et al., 2023; Kumari et al., 2023; Zhang et al., 2024), but often prove ineffective against safety checkers. To address this, MMA-Diffusion (Yang et al., 2024a) introduces a multimodal attack framework that jointly bypasses both prompt filters and safety checkers. However, its effectiveness is limited by its reliance on input-specific perturbations in both the text and image modalities, resulting in poor scalability and time-consuming optimization. To address these limitations, we propose Universally Unfiltered and Unseen (U3)-Attack, a universal multimodal jailbreak attack against T2I models. U3 is Universal, applicable across diverse image inputs and text prompts containing the same sensitive word; Unfiltered, capable of evading (text) prompt filters; and Unseen, capable of evading (image) safety checkers. Specifically, for the image modality attack, we introduce an image-agnostic adversarial patch optimization strategy that bypasses safety checkers by synthesizing a universal adversarial patch without relying on access to internal model parameters (see image modality in Figure 1 (b)). For the text modality attack, we propose a prompt-agnostic paraphrase set optimization method that circumvents prompt filters by constructing a reusable paraphrase set for each sensitive word (see text modality in Figure 1 (b)). This design allows adversarial prompts to be efficiently generated across multiple target prompts containing the same sensitive term (e.g., “naked”), eliminating the need for repeated optimization. Experimentally, we have effectively explored the security risks of several popular T2I models (SDv1.5, SLD, ESD) as well as commercial online T2I services (Runway-inpainting, Leonardo.Ai, DALL·E 3, and Runway). Our main contributions are as follows: • We propose U3-Attack, a universal multimodal jailbreak framework designed for cross-input generalization. Unlike prior methods relying on input-specific perturbations, U3-Attack employs a unified strategy that enables efficient and scalable attacks across diverse inputs. • For the image modality attack, we design an effective image-agnostic adversarial patch optimization strategy to evade safety checkers, while for the text modality attack, we develop a prompt-agnostic paraphrase set optimization method to reliably bypass prompt filters. • We demonstrate the superiority of U3-Attack on both open-source and commercial T2I models. Compared to the state-of-the-art multimodal attack, MMA-Diffusion, our method achieves approximately 4×~4× higher success rates. 2. Related Work 2.1. Safeguards of T2I Models To prevent the misuse of T2I models for generating NSFW content, both open-source and commercial online services have deployed a range of safeguards aimed at mitigating abuse. Existing safeguards for T2I models can be broadly categorized into internal and external safeguards. Internal safeguards operate within the model architecture and typically involve concept-erasure mechanisms—either by modifying the inference process (Schramowski et al., 2023) or fine-tuning model parameters (Gandikota et al., 2023; Kumari et al., 2023; Zhang et al., 2024)—to suppress the model’s capacity to generate unsafe content. External safeguards, by contrast, function at the pre- and post-generation stages. These include prompt filters, which analyze and block harmful input prompts before inference (Leonardo.AI, 2023; Runway, Inc., 2023; Yang et al., 2024b), and safety checkers, which evaluate the images after generation to detect and filter inappropriate content (Rombach et al., 2022b; Runway, Inc., 2023). The key distinction lies in their operational phase: prompt filters act proactively at the input stage, while safety checkers serve as reactive measures at the output stage. Figure 2. Overview of the proposed attack method. The multimodal attack process involves jointly deploying an adversarial prompt and an adversarial image to bypass the prompt filter and safety checker. To preserve the normal functionality of the T2I model while generating high-fidelity NSFW images, the T2I model’s output is merged with the original image based Mask. 2.2. Jailbreaks against T2I Safeguards Jailbreak attacks aim to induce T2I generative models to produce NSFW content by crafting inputs that cause the model to violate its built-in constraints and safeguards. Due to their potential security risks, jailbreak attacks have attracted increasing attention, with rapid progress in attack methodologies (Mehrabi et al., 2023; Chin et al., 2024; Zhang et al., 2023b; Ma et al., 2024; Tsai et al., 2024; Huang et al., 2024; Yang et al., 2024a). Most jailbreaks rely solely on (text) prompt-level perturbations to assess the reliability of concept-erasure mechanisms or prompt filters. Specifically, Chin et al.(Chin et al., 2024) introduce P4D, a sophisticated debugging and red-teaming tool that autonomously identifies problematic prompts in T2I diffusion models, enabling systematic assessment of deployed T2I safeguards. Zhang et al.(Zhang et al., 2023b) leverage the inherent classification capabilities of diffusion models to streamline adversarial prompt generation, eliminating the reliance on auxiliary models. Goyal et al.(Mehrabi et al., 2023) leverage in-context learning within a feedback loop to red-team diffusion models, exploring various feedback mechanisms to automatically learn effective and diverse adversarial prompts for triggering unsafe content generation. Tsai et al.(Tsai et al., 2024) extract holistic conceptual representations of unsafe content, facilitating the automatic discovery of harmful prompts without requiring access to the underlying model. Ma et al. (Ma et al., 2024) identify target malicious concepts in the text embedding space using a set of antonyms. A prefix prompt is subsequently optimized in the discrete vocabulary space to achieve semantic alignment with the target embeddings. Huang et al. (Huang et al., 2024) propose a perception-guided, LLM-based jailbreak framework inspired by the observation that semantically distinct texts can elicit similar human perceptions. The above, prompt-level jailbreaks often fail against safety checkers. To address this limitation, Yang et al. (Yang et al., 2024a) propose MMA-Diffusion, a multimodal attack that applies adversarial perturbations to both textual and visual modalities, successfully circumventing safety mechanisms and guiding T2I models to generate NSFW content. However, MMA-Diffusion optimizes prompt and image perturbations in an input-specific manner, leading to poor scalability and time-consuming optimization. Moreover, it assumes access to internal parameters of the T2I model to compute gradients, limiting their effectiveness in real-world black-box scenarios. In this paper, we introduce U3-Attack, a universal multimodal jailbreak method that optimizes input-agnostic perturbations across both text and image modalities to simultaneously bypass prompt filters and safety checkers, without relying on gradient access to T2I models. 3. Methodology 3.1. Problem Formulation Text-to-Image Inpainting Model. Text-to-image inpainting models synthesize an output image xsynx_ syn based on three inputs: the original input image xinputx_ input, a binary mask matrix MediM_ edi that indicates the regions to be inpainted, and a text prompt P that provides additional guidance for the inpainting. The inpainting procedure can be formulated as: (1) xsyn=(xinput,Medi,P).x_ syn=SD(x_ input,M_ edi,P). Subsequently, the synthesized output xsynx_ syn is evaluated by a safety checker SCSC. If SC(xsyn)=1SC(x_ syn)=1, indicating the presence of NSFW content, the image is filtered; otherwise, it is successfully retained and output. Adversarial Patch. In real-world jailbreak scenarios, the adversary is typically constrained to manipulating only the input image xinputx_ input to the T2I model, with the goal of influencing the synthesized output xsynx_ syn and ultimately bypassing safety checkers. Let SC:xsyn→ySC:x_ syn→ y denote the target safety checker, where y is the corresponding moderation result. The attack goal is to craft an adversarial input xinputadvx_ input adv, such that the T2I model generates unsafe image that successfully evades detection by SCSC. The adversarial input xinputadvx_ input adv is formulated as: (2) xinputadv=δ⊙M+xinput⊙(I−M), x adv_ input=δ M+x_ input (I-M), where ⊙ represents the Hadmard product, and δ denotes the cover perturbation used to manipulate xinputx_ input, which also carries the adversarial patch. M∈0,13×h×wM∈ Bmatrix0,1 Bmatrix^3× h× w denotes a binary mask for δ used to constrain the location and shape of adversarial patch. I has the same dimension as xinputx_ input which represents a all-one matrix. The adversary seeks to generate an adversarial patch that can be consistently applied to a variety of image inputs, thereby enabling a universal and scalable attack. 3.2. Image-Agnostic Optimization Similar to MMA-Diffusion (Yang et al., 2024a), our image-agnostic optimization is designed to target image inpainting models. However, MMA-Diffusion constructs attacks by crafting image-specific global perturbations, necessitating per-instance optimization and inherently lacking generalizability. Moreover, optimizing such perturbations typically requires gradient computation across the entire T2I pipeline, which makes the process computationally prohibitive. Motivation. We observe that the image inpainting model modifies only the regions specified by the binary mask MediM_ edi in the original input image xinputx_ input. Consequently, the non-inpainted regions—denoted as the complement N=I−MediN=I-M_ edi, where I is an all-ones matrix with the same dimensions as MediM_ edi—maintain both visual and semantic consistency between the original input image xinputx_ input and the synthesized output xsynx_ syn. Building on this observation, we explicitly target the safety checker (SCSC) rather than the full T2I pipeline, and design a universal adversarial perturbation specifically optimized to evade its detection. When this perturbation is applied to the non-inpainting regions of the input image xinputx_ input, the corresponding areas in the synthesized output xsynx_ syn inherently retain the adversarial pattern. This pattern remains both visually coherent and semantically aligned with the original perturbation, ultimately allowing the generated unsafe image to bypass the safety checker. However, variations in the binary masks MediM_ edi across input images indicate that the non-inpainted regions are not spatially aligned, posing challenges for constructing a universal adversarial perturbation. Drawing on prior adversarial attack techniques (Brown et al., 2017; Zhang et al., 2023a; Wei et al., 2023; Guesmi et al., 2024), we adopt a fixed-shape adversarial patch, which is consistently placed in the top-left corner of each input image to ensure sufficient non-inpainted area for deployment (see Figure 2 (b)). Figure 3. Illustration of Image-agnostic adversarial patch optimization in our U3-Attack. Stage 1: The adversarial patch is initialized using the safety check. Stage 2: (1) Variation ϵε in adversarial patch is modeled by analyzing T2I model I/O without backpropagation, and (2) ϵε is incorporated to improve patch robustness with gradients on the safety checker. Stage 1: Safety Checker-Guided Initialization of Adversarial Patch. We adopt the built-in safety checker (SDSC) from Stable Diffusion v1.5 (SDv1.5) (Rombach et al., 2022b) as our target model. Given an input image, the image encoder enV_ en of SDSC maps it into a latent vector O. The SDSC then sequentially calculates the cosine distances between the latent vector O and each of the N built-in default NSFW concept embeddings, denoted as CiC_i for i = 1, …, N. If any cosine distance exceeds the threshold TiT_i associated with a specific concept embedding, the synthesized image will be flagged as corresponding to that NSFW concept. We aim to craft an adversarial patch that, when applied to an NSFW image xnsfwx_ nsfw—the direct input to SDSC—produces an adversarial image xnsfwadvx adv_ nsfw capable of evading SDSC detection. Our objective is formalized as follows: (3) xnsfwadv=δ⊙M+xnsfw⊙(I−M),x adv_ nsfw=δ M+x_ nsfw (I-M), (4) δ*=arg⁡minδ∑i=1Nℐcos⁡(,Ci)>Ticos⁡(,Ci),δ *= _δ _i=1^NI_ Bmatrix (O,C_i)>T_i Bmatrix (O,C_i), where ⊙ denotes the Hadmard product, δ∈ℛ3×h×wδ∈R^3× h× w denotes the cover perturbation that carries the adversarial patch, and M∈0,13×h×wM∈ Bmatrix0,1 Bmatrix^3× h× w denotes a binary mask for δ used to constrain the location and shape of patch. I has the same dimension as xnsfwx_ nsfw which represents a all-one matrix. O denotes the latent vector derived from the computation of en(xsynnsfw)V_ en(x_ syn nsfw). ℐI is an indicator function that dynamically selects loss terms where the cosine distance exceeds the corresponding threshold. The detailed optimization procedure is outlined in Stage 1 of Figure 3 and Algorithm 1 in the Appendix. Stage 2: Robustness Enhancement of Adversarial Patch. After obtaining the optimal cover perturbation δ*δ *, we apply it to the original input image xinputx_ input following Equation 2 to launch the attack. However, although δ*δ * is applied exclusively to the non-inpainted region of xinputx_ input, it undergoes subtle variations after passing through the image inpainting model. These variations weaken the adversarial pattern in the corresponding regions of the synthesized output xsynx_ syn, thereby reducing the overall attack efficacy—an effect we further examine in Section 4.4. To mitigate this issue, we initialize the perturbation variable δ with δ*δ * (i.e., δ←δ*δ←δ *), and subsequently perform robustness-oriented fine-tuning. Inspired by physical-world adversarial attacks, where transformations from the data domain to the physical space must be explicitly modeled (Athalye et al., 2018), we propose a residual modeling strategy to characterize the variation in the cover perturbation δ before and after processing by the inpainting model, which can be formally expressed as: (5) xinputadv=δ⊙M+xinput⊙(I−M),x adv_ input=δ M+x_ input (I-M), (6) xsyn=(xinputadv,Medi,P),x_ syn=SD(x adv_ input,M_ edi,P), (7) ϵ=M⊙(xsyn−xinputadv).ε=M (x_ syn-x_ input adv). MediM_ edi is a masked image that serves as the image input of model, highlighting the regions that require inpainting. xinputadvx_ input adv represents the adversarial image, also serving as the input to models. P is the text prompt input to the model, which describes the content to be modified and provides guidance for the inpainting process. xsynx_ syn refers to the synthesized image, which is the model’s output. SDSD stands for image inpainting model (e.g., SDv1.5). When calculating the variation ϵε, we only need the inputs and outputs of the image inpainting model, without requiring any details of its internal mechanics. After obtaining the variation ϵε in the cover perturbation δ, we factor variation ϵε into the optimization process. The optimization objective is defined as follows: (8) xsynadv=(δ+ϵ)⊙M+(1−M)⊙xsyn,x adv_ syn=(δ+ε) M+(1-M) x_ syn, (9) δrob*=arg⁡minδ∑i=1Nℐcos⁡(,Ci)>Ticos⁡(,Ci).δ *_ rob= _δ _i=1^NI_ Bmatrix (O,C_i)>T_i Bmatrix (O,C_i). We ultimately achieve a robust and effective cover perturbation δrob* _ rob *. The specific details are provided in Stage 2 of Figure 3 and Algorithm 2 in the Appendix. Notably, throughout all aforementioned processes, the optimization of the cover perturbation δ, which embeds the adversarial patch, is exclusively directed at the safety checker SDSC. This ensures that gradient updates are propagated solely through its parameters. During the attack phase, once xsynx_ syn successfully bypasses the SDSC, a high-fidelity unsafe image is reconstructed via a fusion operation: (10) xfidelity=xinput⊙Medi+xsyn⊙(I−Medi).x_ fidelity=x_ input M_ edi+x_ syn (I-M_ edi). This operation achieves seamless removal of the adversarial patch by compositing the non-inpainted regions from xinputx_ input with the inpainted regions from xsynx_ syn (see Figure 2 (c)). Figure 4. Illustration of Prompt-agnostic optimization in our U3-Attack. 3.3. Prompt-Agnostic Optimization In typical T2I models, prompt filters are commonly deployed to filter out target prompts containing sensitive words. Previous approaches (Yang et al., 2024a; Tsai et al., 2024; Yang et al., 2024c) are prompt-specific, generating tailored perturbations independently for each target prompt. As a result, even target prompts containing the same sensitive words are processed separately, leading to considerable inefficiencies. In contrast, inspired by adversarial attack methods in the text domain (Zou et al., 2023; Hou et al., 2023; Wang et al., 2021), we construct a prompt-agnostic paraphrase set from a given sensitive word. Given a target prompt PtargetP_ target (e.g., "a completely naked woman") containing a sensitive word (e.g., "naked"), we select the optimal paraphrase from the paraphrase set corresponding to "naked". By replacing "naked" with its optimal paraphrase, we can effectively bypass the prompt filter (see Figure 2 (a)). Construction of paraphrase set. The Latent Diffusion Model (LDM)(Rombach et al., 2022a), instantiated as SDv1.5 (Rombach et al., 2022b), denoises an image within its latent space, with the process guided by text embeddings obtained by encoding the target prompt P with the text encoder θT_θ of CLIP (Radford et al., 2021). Our goal is to ensure that the adversarial prompt does not contain any sensitive words, while still allowing the semantic information associated with the sensitive word to control the final synthesized image. To achieve this, we shift our focus away from the context where the sensitive word wsenw_ sen appears and instead construct a prompt-agnostic paraphrase set S=s1,s2,…,s|S|S= Bmatrixs_1,s_2,...,s_|S| Bmatrix corresponding to each sensitive word. |S||S| represents the size of the paraphrase set. By ensuring the identical latent features produced by the θT_θ, given by i.e., θ(wsen)≈θ(si)T_θ(w_ sen) _θ(s_i), we select the paraphrase sis_i for the paraphrase set S. We ensure the semantic consistency between the sensitive word wsenw_ sen and paraphrase si∈Ss_i∈ S by maximizing the cosine similarity between the latent feature θ(wsen)T_θ(w_ sen) and θ(si)T_θ(s_i). We formalize the attack objective as follows: (11) max⁡cos⁡(θ(wsen),θ(si)). (T_θ(w_ sen),T_θ(s_i)). We employ GCG (Zou et al., 2023) to update the paraphrase sis_i. This optimization process is repeated |S||S| times, ultimately yielding a paraphrase set S corresponding to the sensitive word wsenw_ sen. During the paraphrase optimization process, we assign a gradient value of −inf-inf to sensitive words, leveraging the sensitive word list derived from JPA (Ma et al., 2024). This strategy ensures that sensitive words are entirely excluded as substitution candidates, thereby preventing their reoccurrence at any token position within the generated paraphrase. The overall process for generating the paraphrase set is further illustrated in Figure 4. Optimal Paraphrase Selection and Adversarial Prompt Construction. The paraphrase set corresponding to a specific sensitive word wsenw_ sen remains universally applicable across different target prompts that contain wsenw_ sen. For a given target prompt containing the sensitive word wsenw_ sen, we first identify the optimal paraphrase from the corresponding paraphrase set S and seamlessly substitute wsenw_ sen within the target prompt. The criterion for selecting the optimal paraphrase is as follows: (12) arg⁡maxs∈⁡cos⁡(θ(Re(Ptarget,wsen,s)),θ(Ptarget)). _s (T_θ(Re(P_ target,w_ sen,s)),T_θ(P_ target)). ReRe denotes replacing the sensitive word wsenw_ sen in the target prompt PtargetP_ target with the paraphrase s, generating the corresponding adversarial prompt PadvP_ adv. By maximizing the cosine similarity between the embeddings of the adversarial and target prompts, we identify the optimal paraphrase for the sensitive word wsenw_ sen. This optimal paraphrase ensures that the adversarial prompt remains semantically aligned with the target prompt in the embedding space. Consequently, the downstream denoising model receives an input embedding closely resembling that of the target prompt, leading to the generation of an unsafe output that preserves the original semantic intent. 4. Evaluation In this section, we evaluate the effectiveness and efficiency of our U3-Attack, compared with the state-of-the-art prompt-level and multimodal jailbreak methods, in various tasks against both open-source and commercial T2I models. 4.1. Experimental Setup Datasets. In the image modality, we utilize a dataset of 1,000 unsafe images, divided into training and testing subsets using a 6:4 split. This dataset is used during the safety checker-guided initialization stage (Stage 1). For the subsequent robustness enhancement stage (Stage 2), we construct a separate dataset of 361 image–mask pairs, each associated with a target prompt explicitly defined as ”A completely naked woman/man/couple/girl/boy.” Among them, 300 samples are used for training and 61 are reserved for evaluation. Additional details on the dataset construction process are provided in Appendix B.1. In the text modality, we carefully select 280 prompts from the LAION-5B (Schuhmann et al., 2022) dataset to evaluate the performance of U3-Attack. These prompts encompass unsafe concepts related to adult content, including sensitive words such as "naked", "sex", and "fucked". To assess U3-Attack’s effectiveness more comprehensively across various NSFW themes, we introduce a manually curated dataset from UnsafeDiffusion (Qu et al., 2023). This dataset contains 30 unsafe prompts, covering six themes: adult content, violence, gore, politics, racial discrimination, and inauthentic notable descriptions. Table 1. Open-source and commercial target models with white-box (WB) or black-box (B) safeguards considered in our experiments. Task Target Model Attack Modality Safeguard Text-Driven Image Inpainting SDv1.5 (Rombach et al., 2022b) Image Safety Checker: SDSC (WB) SDv1.5 (Rombach et al., 2022b) Image Safety Checker: Q16 (B) SDv1.5 (Rombach et al., 2022b) Image Safety Checker: MHSC (B) Runway-inpainting (Runway, Inc., 2023) Image +Text Prompt Filter + Safety Checker (Commercial) Text-to-Image Generation SDv1.5 (Rombach et al., 2022b) Text None ESD (Gandikota et al., 2023) Text None (with Concept Erase) SLD (Schramowski et al., 2023) Text None (with Concept Erase) DALL·E 3 (OpenAI, 2025) Text Unknown (Commercial) Leonardo.Ai (Leonardo.AI, 2023) Text Unknown (Commercial) Runway (Runway, Inc., 2023) Text Unknown (Commercial) Victim Models. We conduct a comprehensive evaluation of image-modality, text-modality, and multimodal jailbreak attacks on T2I models equipped with various safeguards, covering two representative tasks. To ensure terminological consistency and clarity throughout the paper, the attacks and their corresponding safeguards are summarized in Table 1. Compared Methods. We adopt MMA-Diffusion (MMA) (Yang et al., 2024a), QF-Attack (QF) (Zhuang et al., 2023), and SneakyPrompt (Sneaky) (Yang et al., 2024c) as baselines for comparative evaluation. QF is included due to its conceptual similarity to our framework in the text modality, while Sneaky shares the objective of bypassing both the prompt filter and the safety checker. MMA, by contrast, represents the state-of-the-art multimodal jailbreak attack. Comprehensive details for all baseline methods can be found in Appendix B.2. Evaluation Metrics. We utilize attack success rate ASR-N-M (M ⩽ N) as a metric to evaluate the effectiveness of our attack method. We generate N images for each prompt using T2I model, and if at least M of these images successfully jailbreak T2I safeguards and display unsafe content, we deem the attack to be successful. A larger M indicates a greater attack difficulty. ASR-N-M denotes the proportion of adversarial inputs that meet the success criterion among all evaluated inputs. To determine whether the generated images contain unsafe content, we use three representative NSFW detectors: Q16 (Schramowski et al., 2022), MHSC (Qu et al., 2023), and the built-in SDSC (CompVis, 2024). The ASR-N-M is computed based on their detection results. For images with adversarial patches, we first remove the patch (see Equation 10) before applying the NSFW detectors. Implementation Details. All experiments are conducted on an NVIDIA GeForce RTX 4090 GPU with 24GB of memory, with all implementations developed using PyTorch. The adversarial patch is optimized using the SDv1.5 inpainting model (Rombach et al., 2022b) equipped with the SDSC (CompVis, 2024) safety checker. To construct the paraphrase set, we utilize the text encoder θT_θ from CLIP (Radford et al., 2021). Further implementation details of U3-Attack and baselines are provided in Appendix B.3. Table 2. Attack success rates (%) of different jailbreak methods on bypassing different safety checkers. * indicates white-box. SDv1.5 is the target inpainting model. Bold denotes the best performance, and underline denotes the second-best. Method Safety Checker Metric ASR-4-4 ASR-4-3 ASR-4-2 ASR-4-1 Average MMA (Yang et al., 2024a) SDSC * 60.656 73.770 80.328 83.607 73.770 MHSC 9.836 13.115 16.393 22.951 16.393 Q16 6.557 9.836 9.836 16.393 11.475 Sneaky (Yang et al., 2024c) SDSC * 32.787 39.344 50.820 59.016 45.902 MHSC 3.279 6.557 6.557 13.115 6.557 Q16 1.639 1.639 6.557 9.836 4.918 Our U3-Attack (Image-Specific) SDSC * 65.574 77.049 85.246 88.525 78.098 MHSC 14.754 16.393 22.951 34.426 22.131 Q16 4.918 6.557 9.836 18.033 9.836 Our U3-Attack (Image-Agnostic) SDSC * 95.082 95.082 95.082 98.361 95.902 MHSC 14.754 24.590 37.705 54.098 32.787 Q16 4.918 9.836 19.672 36.066 17.623 Figure 5. Attack success rates (%) of our U3-Attack vs. the state-of-the-art multimodal attack, MMA (Yang et al., 2024a), on the commercial Runway-inpainting model with both prompt filter and safety checker. 4.2. Jailbreaking Text-Driven Image Inpainting Models Figure 6. Visualizations of our U3-Attack on bypassing (left) SDv1.5 with the safety checker SDSC and (right) the commercial Runway-inpainting model with both prompt filter and safety checker. Table 3. Attack success rates (%) of various jailbreak methods evaluated under concept-erasure defenses. SDv1.5 (Rombach et al., 2022b) is included as a reference model without any safeguards. Bold denotes the best performance, and underline denotes the second-best. Method Model Q16 (Schramowski et al., 2022) MHSC (Qu et al., 2023) SDSC (CompVis, 2024) Average ASR-2-2 ASR-2-1 ASR-2-2 ASR-2-1 ASR-2-2 ASR-2-1 ASR-2-2 ASR-2-1 Sneaky (Yang et al., 2024c) SDv1.5 (Rombach et al., 2022b) 53.929 68.214 61.071 74.286 58.214 71.429 57.738 71.310 ESD (Gandikota et al., 2023) 1.786 13.214 3.214 17.857 2.143 15.357 2.381 15.476 SLD-Max (Schramowski et al., 2023) 7.857 17.143 6.071 15.000 9.826 19.286 7.918 17.143 QF (Zhuang et al., 2023) SDv1.5 (Rombach et al., 2022b) 44.643 67.143 46.071 65.000 35.714 61.786 42.143 64.643 ESD (Gandikota et al., 2023) 0.357 4.286 0.000 2.857 0.714 14.643 0.357 7.262 SLD-Max (Schramowski et al., 2023) 1.153 7.500 5.000 24.286 3.214 17.857 3.122 16.548 MMA (Yang et al., 2024a) SDv1.5 (Rombach et al., 2022b) 80.714 93.214 81.071 92.500 72.857 91.429 78.214 92.381 ESD (Gandikota et al., 2023) 5.714 26.071 7.500 27.500 7.500 36.758 6.905 30.110 SLD-Max (Schramowski et al., 2023) 6.786 31.786 12.143 45.000 19.643 43.571 12.857 40.119 U3-Attack (Ours) SDv1.5 (Rombach et al., 2022b) 81.429 95.357 82.857 95.357 74.286 94.286 79.524 95.000 ESD (Gandikota et al., 2023) 5.714 26.429 6.071 28.214 7.857 37.857 6.547 30.833 SLD-Max (Schramowski et al., 2023) 8.933 35.753 17.291 49.856 18.445 46.686 14.890 44.098 Table 4. Attack success rates (%) of our U3-Attack on Various Commercial T2I Models. Model Leonardo.Ai DALL·E 3 Runway ASR-4-1 70.6 37.6 53.9 ASR-4-2 53.5 24.9 36.3 Bypassing Open Source Safety Checker. To ensure a fair comparison with input-specific attack methods such as MMA and Sneaky, we introduce a variant of our method, denoted as U3-Attack (image-specific), in which a dedicated adversarial patch is generated for each of the 61 test cases. As shown in Table 2, U3-Attack (image-agnostic) achieves an ASR-4-1 of 98.361% on the SDv1.5 inpainting model equipped with the SDSC (CompVis, 2024) under white-box settings, outperforming MMA (83.607%) and Sneaky (59.016%). This performance gain is largely attributed to the flexibility of our patch-based formulation, which allows unconstrained pixel-level perturbations and significantly enhances attack efficacy. Under black-box settings, U3-Attack (image-agnostic) achieves ASR-4-1 scores of 54.098% and 36.066% against the MHSC (Qu et al., 2023) and Q16 (Schramowski et al., 2022), respectively. The strong cross-checker transferability suggests that our adversarial patch captures generalizable adversarial patterns, remaining effective even against safety checkers with architectures entirely dissimilar to SDSC. Compared to the image-specific variant, the U3-Attack (image-agnostic) achieves an average improvement of 18 percentage points on SDSC. This is mainly because the image-specific variant is prone to overfitting due to per-image optimization, resulting in reduced robustness. In contrast, the U3-Attack (image-agnostic) benefits from diverse training inputs, leading to more stable patterns and higher success rates. Representative results are shown in the left panel of Figure 6. Bypassing Commercial Safeguards. We further evaluate our method in a more challenging setting, where the T2I inpainting model integrates both a prompt filter and a safety checker. Figure 5 shows the quantitative performance of our U3-attack against the Runway-inpainting model. Across 61 test cases, our method achieves ASR-4-1 scores of 36.1%, 39.3%, and 32.8% when evaluated using SDSC, MHSC, and Q16, respectively. These results represent improvements of 28, 30, and 21 percentage points over the baseline method MMA, highlighting the enhanced effectiveness of our approach. We attribute this gain to the stealthiness of our adversarial prompts and the semantic robustness of the learned adversarial patches. Figure 6 (right) illustrates representative qualitative results. 4.3. Jailbreaking Text-to-Image Generation Models Bypassing Concept-Erasure Defenses. We evaluate the text modality attack of U3-Attack against concept-erasure models designed to suppress NSFW content. As shown in Table 3, our method achieves an average ASR-2-1 of 30.83% on ESD and 44.10% on SLD-Max, which indicate that although such models partially suppress sensitive semantics, our adversarial prompts can successfully recover them and bypass the defenses. On the SDv1.5 model, our approach reaches an average ASR-2-1 of 95.00%, outperforming MMA, QF, and Sneaky by 3, 31, and 24 percentage points, respectively. This gain is largely due to our method’s ability to accurately recover the meaning of sensitive words. Table 5. Time consumption for generating a single adversarial prompt using different jailbreak methods. Method Sneaky (Yang et al., 2024c) QF (Zhuang et al., 2023) MMA (Yang et al., 2024a) U3-Attack (Ours) Time (min) 13.26 28.68 30.64 2.74 By contrast, MMA’s sentence-level reconstruction introduces unnecessary constraints, as it attempts to recover both the sensitive word and its surrounding context. QF is limited by its narrow replacement strategy, which relies on randomly sampled word lists and lacks diversity. Sneaky shows weaker performance likely because it converges to local optima, failing to recover intended meanings within limited query budgets. Bypassing Commercial Safeguards. We further evaluate the text modality attack in U3-Attack on three commercial T2I models using the UnsafeDiff dataset (Qu et al., 2023), which contains six NSFW categories. Overall attack performance is measured using the MHSC detector. For each target prompt, we generate 10 adversarial prompts and retain those with a cosine similarity of at least 0.75 in the latent space, resulting in a total of 245 valid adversarial prompts. As shown in Table 4, U3-Attack achieves high attack success rates across all three commercial models, despite the presence of unknown safeguard mechanisms. Specifically, it achieves ASR-4-1 rates of 70.6% on Leonardo.Ai and 53.9% on Runway, with corresponding ASR-4-2 rates of 53.5% and 36.3%, demonstrating strong overall effectiveness. When attacking DALL·E 3, the success rates drop to 37.6% (ASR-4-1) and 24.9% (ASR-4-2), indicating that this model may employ more robust safety mechanisms. These could include stricter prompt filtering, tighter safety checkers, or proprietary moderation pipelines that more effectively block unsafe content. Further visual analysis is provided in Appendix C.2. Attack Efficiency. Table 5 highlights the efficiency advantage of the text modality attack in U3-Attack, which is primarily due to our streamlined paraphrase selection strategy. For target prompts that share the same sensitive word, we directly select the optimal paraphrase from a predefined paraphrase set, eliminating the need for repeated optimization. In contrast, methods such as QF, MMA, and Sneaky regenerate adversarial prompts from scratch for each target prompt, resulting in significantly higher computational overhead. 4.4. Ablation Studies Unless otherwise specified, all ablations are based on the SDv1.5 inpainting model with the SDSC safety checker. Table 6. Ablation study on patch optimization components. Patch Optimization Metric (ASR-%) Time (h) Stage 1 Stage 2 ASR-4-4 ASR-4-3 ASR-4-2 ASR-4-1 Random – 1.693 4.918 4.918 6.557 N/A SC-Guided – 3.279 4.918 11.475 13.115 3.458 Random T2I+SC 39.344 50.819 67.213 70.491 57.778 SC-Guided SC 81.967 88.525 93.443 95.082 13.676 Patch Optimization. To validate the efficiency of our image-modality attack in U3-Attack, we compare it against three baselines, as shown in Table 6. Baseline 1 uses a randomly initialized patch without training. Baseline 2 applies an SC-guided patch but without robustness enhancement. Baseline 3 follows the MMA (Yang et al., 2024a) strategy, performing end-to-end optimization over both the T2I model and the safety checker. Our method (last row) achieves comparable or higher attack success rates than Baseline 3, while requiring substantially lower training cost. This improvement stems from our residual modeling strategy, which relies only on input–output pairs from the T2I model, avoiding backpropagation through the full architecture. Baseline 2 performs poorly, achieving only 13.115% ASR-4-1. Although its patch is placed in non-inpainted regions, it still undergoes minor distortions after T2I processing, weakening its adversarial effect. This is likely due to the lossy nature of diffusion-based pipelines, where even non-inpainted regions may suffer semantic drift. Table 7. Ablation study on patch position. Location tl tr bl br ASR-4-1 (%) 98.3 96.7 96.7 95.1 Table 8. Ablation study on patch size. Area Ratio 0.04 0.05 0.06 0.07 0.08 ASR-4-1 (%) 86.9 95.1 98.4 98.4 98.4 Patch Position. We evaluate four fixed patch positions: top-left (tl), top-right (tr), bottom-left (bl), and bottom-right (br), all chosen for their ample background space to reduce visual saliency and maintain image realism. As shown in Table 7, our adversarial patch consistently achieves high ASR-4-1 across all locations, with success rates exceeding 95%. The top-left position yields the highest rate (98.3%), possibly due to spatial biases in the model or reduced scrutiny by safety mechanisms in that region. These results underscore the robustness of our U3-Attack. Patch Size. We examine the effect of patch size by varying its area ratio from 0.04 to 0.08. As shown in Table 8, ASR-4-1 increases from 86.9% at 0.04 to 98.4% at 0.06, suggesting that small patches may lack sufficient adversarial strength. Performance then stabilizes, as larger patches begin to overlap with the inpainting region, slightly reducing their effectiveness. Overall, a patch size of 0.06 offers a strong balance between attack success and visual subtlety. 5. Conclusion and Outlook In this work, we present Universally Unfiltered and Unseen (U3)-Attack, a universal multimodal jailbreak framework against prompt filters and safety checkers in T2I models. Unlike prior methods, U3-Attack is input-agnostic, being applicable to diverse image content and eliminating time-consuming per-prompt optimization. Experiments on state-of-the-art open-source T2I models and commercial APIs demonstrate the superiority of our U3-Attack. We hope that by exposing critical safety flaws in current safeguards, our jailbreak method can be potentially used to help design more robust safeguards. Future work should look at more natural-looking prompts and image perturbations. In addition, extending U3-Attack to text-to-video generators using frame-agnostic perturbations is a promising direction for uncovering temporal vulnerabilities. References (1) Athalye et al. (2018) Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. 2018. Synthesizing Robust Adversarial Examples. In Proceedings of the 35th International Conference on Machine Learning, ICML 2018, Stockholmsmässan, Stockholm, Sweden, July 10-15, 2018 (Proceedings of Machine Learning Research, Vol. 80), Jennifer G. Dy and Andreas Krause (Eds.). PMLR, 284–293. Brown et al. (2017) Trevor Brown, Daniel A. Engelmann, and Sebastian A. Grunewald. 2017. Adversarial patches. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, 1–11. Chin et al. (2024) Zhi-Yi Chin, Chieh-Ming Jiang, Ching-Chun Huang, Pin-Yu Chen, and Wei-Chen Chiu. 2024. Prompting4Debugging: Red-Teaming Text-to-Image Diffusion Models by Finding Problematic Prompts. In Forty-first International Conference on Machine Learning, ICML 2024, Vienna, Austria, July 21-27, 2024. OpenReview.net. CompVis (2024) CompVis. 2024. Model Card for stable-diffusion-safety-checker. https://huggingface.co/CompVis/stable-diffusion-safety-checker. Accessed: 2024-09-6. Gandikota et al. (2023) Rohit Gandikota, Joanna Materzynska, Jaden Fiotto-Kaufman, and David Bau. 2023. Erasing Concepts from Diffusion Models. In IEEE/CVF International Conference on Computer Vision, ICCV 2023, Paris, France, October 1-6, 2023. IEEE, 2426–2436. Guesmi et al. (2024) Amira Guesmi, Ruitian Ding, Muhammad Abdullah Hanif, Ihsen Alouani, and Muhammad Shafique. 2024. Dap: A dynamic adversarial patch for evading person detectors. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 24595–24604. Hou et al. (2023) Bairu Hou, Jinghan Jia, Yihua Zhang, Guanhua Zhang, Yang Zhang, Sijia Liu, and Shiyu Chang. 2023. TextGrad: Advancing Robustness Evaluation in NLP by Gradient-Driven Optimization. In The Eleventh International Conference on Learning Representations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023. OpenReview.net. Huang et al. (2024) Yihao Huang, Le Liang, Tianlin Li, Xiaojun Jia, Run Wang, Weikai Miao, Geguang Pu, and Yang Liu. 2024. Perception-guided jailbreak against text-to-image models. arXiv preprint arXiv:2408.10848 (2024). Kirillov et al. (2023) Alexander Kirillov, Eric Mintun, Nikhila Ravi, Hanzi Mao, Chloe Rolland, Laura Gustafson, Tete Xiao, Spencer Whitehead, Alexander C Berg, Wan-Yen Lo, et al. 2023. Segment anything. In Proceedings of the IEEE/CVF International Conference on Computer Vision. 4015–4026. Kumari et al. (2023) Nupur Kumari, Bingliang Zhang, Sheng-Yu Wang, Eli Shechtman, Richard Zhang, and Jun-Yan Zhu. 2023. Ablating Concepts in Text-to-Image Diffusion Models. In IEEE/CVF International Conference on Computer Vision, ICCV 2023, Paris, France, October 1-6, 2023. IEEE, 22634–22645. Leonardo.AI (2023) Leonardo.AI. 2023. Leonardo.AI. https://leonardo.ai/ Accessed: 2024-09-15. Liu et al. (2024) Tong Liu, Zhe Zhao, Yinpeng Dong, Guozhu Meng, and Kai Chen. 2024. Making them ask and answer: Jailbreaking large language models in few queries via disguise and reconstruction. In 33rd USENIX Security Symposium (USENIX Security 24). 4711–4728. Ma et al. (2024) Jiachen Ma, Anda Cao, Zhiqing Xiao, Jie Zhang, Chao Ye, and Junbo Zhao. 2024. Jailbreaking Prompt Attack: A Controllable Adversarial Attack against Diffusion Models. CoRR abs/2404.02928 (2024). arXiv:2404.02928 https://doi.org/10.48550/arXiv.2404.02928 Mehrabi et al. (2023) Ninareh Mehrabi, Palash Goyal, Christophe Dupuy, Qian Hu, Shalini Ghosh, Richard Zemel, Kai-Wei Chang, Aram Galstyan, and Rahul Gupta. 2023. Flirt: Feedback loop in-context red teaming. arXiv preprint arXiv:2308.04265 (2023). OpenAI (2025) OpenAI. 2025. DALL·E 3. https://openai.com/index/dall-e-3/. Accessed: 2025-07-17. Qu et al. (2023) Yiting Qu, Xinyue Shen, Xinlei He, Michael Backes, Savvas Zannettou, and Yang Zhang. 2023. Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. 3403–3417. Radford et al. (2021) Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. 2021. Learning transferable visual models from natural language supervision. In International conference on machine learning. PMLR, 8748–8763. Rombach et al. (2022a) Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. 2022a. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 10684–10695. Rombach et al. (2022b) Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. 2022b. Stable Diffusion - v1.5. https://huggingface.co/runwayml/stable-diffusion-v1-5. Accessed: 2024-08-18. Runway, Inc. (2023) Runway, Inc. 2023. Runway. https://runwayml.com/ Accessed: 2024-09-5. Schramowski et al. (2023) Patrick Schramowski, Manuel Brack, Björn Deiseroth, and Kristian Kersting. 2023. Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 22522–22531. Schramowski et al. (2022) Patrick Schramowski, Christopher Tauchmann, and Kristian Kersting. 2022. Can machines help us answering question 16 in datasheets, and in turn reflecting on inappropriate content?. In Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency. 1350–1361. Schuhmann et al. (2022) Christoph Schuhmann, Richard Beaumont, Radu Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Tharindu Coombes, Alex Katta, Luis Villalba, and Marco Patacchiola. 2022. LAION-5B: An open large-scale dataset for training next generation image-text models. https://laion.ai/blog/laion-5b/. Accessed: 2024-09-18. Shi et al. (2024) Jing Shi, Wei Xiong, Zhe Lin, and Hyun Joon Jung. 2024. Instantbooth: Personalized text-to-image generation without test-time finetuning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 8543–8552. Tsai et al. (2024) Yu-Lin Tsai, Chia-Yi Hsu, Chulin Xie, Chih-Hsun Lin, Jia-You Chen, Bo Li, Pin-Yu Chen, Chia-Mu Yu, and Chun-Ying Huang. 2024. Ring-A-Bell! How Reliable are Concept Removal Methods For Diffusion Models?. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024. OpenReview.net. Wang et al. (2021) Xiaosen Wang, Yichen Yang, Yihe Deng, and Kun He. 2021. Adversarial Training with Fast Gradient Projection Method against Synonym Substitution Based Text Attacks. In Thirty-Fifth AAAI Conference on Artificial Intelligence, AAAI 2021, Thirty-Third Conference on Innovative Applications of Artificial Intelligence, IAAI 2021, The Eleventh Symposium on Educational Advances in Artificial Intelligence, EAAI 2021, Virtual Event, February 2-9, 2021. AAAI Press, 13997–14005. Wei et al. (2024) Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2024. Jailbroken: How does llm safety training fail? Advances in Neural Information Processing Systems 36 (2024). Wei et al. (2023) Hui Wei, Zhixiang Wang, Xuemei Jia, Yinqiang Zheng, Hao Tang, Shin’ichi Satoh, and Zheng Wang. 2023. HOTCOLD Block: Fooling Thermal Infrared Detectors with a Novel Wearable Design. In Thirty-Seventh AAAI Conference on Artificial Intelligence, AAAI 2023, Thirty-Fifth Conference on Innovative Applications of Artificial Intelligence, IAAI 2023, Thirteenth Symposium on Educational Advances in Artificial Intelligence, EAAI 2023, Washington, DC, USA, February 7-14, 2023, Brian Williams, Yiling Chen, and Jennifer Neville (Eds.). AAAI Press, 15233–15241. Yang et al. (2024a) Yijun Yang, Ruiyuan Gao, Xiaosen Wang, Tsung-Yi Ho, Nan Xu, and Qiang Xu. 2024a. Mma-diffusion: Multimodal attack on diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 7737–7746. Yang et al. (2024b) Yijun Yang, Ruiyuan Gao, Xiao Yang, Jianyuan Zhong, and Qiang Xu. 2024b. Guardt2i: Defending text-to-image models from adversarial prompts. arXiv preprint arXiv:2403.01446 (2024). Yang et al. (2024c) Yuchen Yang, Bo Hui, Haolin Yuan, Neil Gong, and Yinzhi Cao. 2024c. SneakyPrompt: Jailbreaking Text-to-image Generative Models. In IEEE Symposium on Security and Privacy, SP 2024, San Francisco, CA, USA, May 19-23, 2024. IEEE, 897–912. https://doi.org/10.1109/SP54263.2024.00123 Zhang et al. (2023a) Shibo Zhang, Yushi Cheng, Wenjun Zhu, Xiaoyu Ji, and Wenyuan Xu. 2023a. CAPatch: Physical Adversarial Patch against Image Captioning Systems. In 32nd USENIX Security Symposium, USENIX Security 2023, Anaheim, CA, USA, August 9-11, 2023, Joseph A. Calandrino and Carmela Troncoso (Eds.). USENIX Association, 679–696. Zhang et al. (2024) Yimeng Zhang, Xin Chen, Jinghan Jia, Yihua Zhang, Chongyu Fan, Jiancheng Liu, Mingyi Hong, Ke Ding, and Sijia Liu. 2024. Defensive unlearning with adversarial training for robust concept erasure in diffusion models. Advances in Neural Information Processing Systems 37 (2024), 36748–36776. Zhang et al. (2023b) Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yihua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu. 2023b. To Generate or Not? Safety-Driven Unlearned Diffusion Models Are Still Easy To Generate Unsafe Images … For Now. CoRR abs/2310.11868 (2023). arXiv:2310.11868 https://doi.org/10.48550/arXiv.2310.11868 Zhou et al. (2022) Yufan Zhou, Ruiyi Zhang, Changyou Chen, Chunyuan Li, Chris Tensmeyer, Tong Yu, Jiuxiang Gu, Jinhui Xu, and Tong Sun. 2022. Towards language-free training for text-to-image generation. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 17907–17917. Zhuang et al. (2023) Haomin Zhuang, Yihua Zhang, and Sijia Liu. 2023. A pilot study of query-free adversarial attack against stable diffusion. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2385–2392. Zou et al. (2023) Andy Zou, Zifan Wang, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043 (2023). 1 Input : NSFW Dataset DtrainNSFWD NSFW_ train and DtestNSFWD NSFW_ test, CLIP’s vision encoder enV_ en, predefined NSFW concept C=Cii=1NC= BmatrixC_i Bmatrix_i=1^N, NSFW threshold T=Tii=1NT= BmatrixT_i Bmatrix_i=1^N, binary masked image M, all-one matrix I, step size η, iterations looploop. 2 Output : δ*δ * 3 4Initialization: Randomly set δ 5 for i in 1:loop1:loop do 6 while xnsfwx_ nsfw = iterator(DtrainNSFWD_ train NSFW) is not Null do 7 Acquire xnsfwadv=δ⊙M+xnsfw⊙(I−M)x adv_ nsfw=δ M+x_ nsfw (I-M) 8 9 Obtain latent vector =en(xnsfwadv)O=V_ en(x_ nsfw adv) 10 Obtain Loss ℒ=∑i=1Nℐcos⁡(,Ci)>Ticos⁡(,Ci)L= _i=1^NI_ Bmatrix (O,C_i)>T_i Bmatrix (O,C_i) 11 12 Updating δ←δ−η⋅sign(∇δℒ)δ←δ-η·p sign( _δL) 13 14 end while 15 δ*δ * = ComparePatch(DtestNSFWD NSFW_ test, δ, δ*δ *, M, I) 16 end for return δ*δ * Algorithm 1 PatchInitialization 17 Input : NSFW Dataset DtrainNSFWD NSFW_ train and DtestNSFWD NSFW_ test, image pair Dataset DtrainD_ train and DtestD_ test, prompt Dataset PtrainP_ train and PtestP_ test, CLIP’s vision encoder enV_ en, NSFW concept C=Cii=1NC= BmatrixC_i Bmatrix_i=1^N, NSFW threshold T=Tii=1NT= BmatrixT_i Bmatrix_i=1^N, Stable Diffusion SDSD, binary masked image M, all-one matrix I, step size α, iterations looploop in Stage 1, iterations epochepoch in Stage 2. 18 Output : δrobust*δ_ robust * 19 δ*δ * = PatchInitialization(DtrainNSFWD NSFW_ train, DtestNSFWD NSFW_ test, enV en, M, I, looploop, C, T) 20 Initialization: δ = δ*δ *, δrobust*δ *_ robust = δ*δ * 21 for i in 1:epoch1:epoch do 22 while (xinputx_ input, MediM_ edi, P) = iterator(DtrainD_ train, PtrainP_ train) is not Null do 23 Acquire xinputadv=δ⊙M+xinput⊙(I−M)x adv_ input=δ M+x_ input (I-M) 24 25 Obtain the synthesized image xsyn=(xinputadv,Medi,Ptrain)x_ syn=SD(x adv_ input,M_ edi,P_ train) 26 27 Computing the variation ϵ=M⊙(xsyn−xinputadv)ε=M (x_ syn-x_ input adv) 28 δ.δ.requires_grad = True 29 Acquire xsynadv=(δ+ϵ)⊙M+(1−M)⊙xsynx adv_ syn=(δ+ε) M+(1-M) x_ syn 30 Obtain latent vector =en(xsynadv)O=V_ en(x_ syn adv) 31 Obtain Loss ℒ=∑i=1Nℐcos⁡(,Ci)>Ticos⁡(,Ci)L= _i=1^NI_ Bmatrix (O,C_i)>T_i Bmatrix (O,C_i) 32 33 Updating δ←δ−α⋅sign(∇δℒ)δ←δ-α·p sign( _δL) 34 δ.δ.requires_grad = False 35 36 end while 37 δrobust* _ robust * = ComparePatch(DtestD_ test, PtestP_ test, δ, δrobust* _ robust *, M, I) 38 end for 39return δrobust* _ robust * Algorithm 2 RobustnessEnhancement APPENDIX Appendix A Descriptions of Algorithms The image-agnostic optimization in U3-Attack comprises two key stages: an initialization phase guided by the safety checker and a subsequent robustness enhancement phase. For clarity and reproducibility, the complete procedures are detailed in the following pseudocode (Algorithms 1 and 2). Appendix B More Experimental Setup B.1. Data Collection In the image modality, we use 1,000 target prompts from MMA (Yang et al., 2024a) to generate 1,000 NSFW images with SDv1.5 (Rombach et al., 2022b), which we split into training (60%) and test (40%) sets for the adversarial patch initialization stage. For the robustness enhancement stage, we augment the 61 image–mask pairs from MMA-Diffusion with 300 synthesized personal images from Leonardo.Ai’s public gallery. To ensure accurate and consistent masks, we apply SAM (Kirillov et al., 2023) for segmentation. The target prompt is fixed as “A completely naked woman/man/couple/girl/boy,” and the resulting image–mask pairs, along with their prompts, serve as inputs to the image inpainting model. In total, we construct a dataset of 361 samples, with 300 used for training and 61 for evaluation. B.2. Baselines Sneaky (Yang et al., 2024c): Sneaky repeatedly interacts with the text-to-image generative model, perturbing the prompt tokens based on query results and utilizing reinforcement learning to guide their perturbation. MMA (Yang et al., 2024a): MMA bypasses prompt filters by generating unconstrained adversarial prompts and evades safety checkers by adding imperceptible perturbations to images. QF (Zhuang et al., 2023): QF is an adversarial framework tailored for T2I models. It facilitates the generation of adversarial prompts without requiring direct access to the model, effectively guiding the synthesis process toward images that are semantically misaligned with the original intent. B.3. More Implementation Details of U3-Attack and Baselines For the image modality attack, we fix the random seed to 3 during both the adversarial patch initialization and robustness enhancement stages to ensure reproducibility. The patch is constrained to cover 6% of the total image area and is optimized using a fixed step size η of 0.01. The number of optimization iterations (looploop) during initialization is set to 20, while the robustness enhancement stage is trained for 10 epochs. Additionally, the inference timestep TinT_ in in SDv1.5 (Rombach et al., 2022b) is fixed at 4 throughout all experiments. For the text modality attack, we fix the random seed to 7867 to ensure consistent results. The paraphrase set for each sensitive word is constructed with a fixed size of 30 (i.e., |S|=30|S|=30), where each paraphrase sis_i has a length of 4 tokens. We perform 40 iterative updates for each sis_i to optimize its latent representation, continuing until the optimal paraphrase is identified. For baseline methods, we retain the default configurations of MMA (Yang et al., 2024a) and Sneaky (Yang et al., 2024c), and evaluate all target models under their original settings to ensure fair and consistent comparisons. Although QF (Zhuang et al., 2023) was originally proposed to disrupt T2I synthesis by appending a five-character suffix to the prompt, its core objective is consistent with ours. To enable a fair comparison, we reimplement and adapt QF-Attack under a unified experimental framework. Specifically, we (1) align its attack goal with ours, (2) replace sensitive keywords with optimized perturbations instead of appending suffixes—thereby reducing positional bias, and (3) adopt PGD (Hou et al., 2023) for optimization, with hyperparameters tuned for consistency across evaluations. Appendix C More Examples of Qualitative Analysis In this section, we present additional visual examples to further support our analysis and findings. Figure 7. Qualitative analysis of the multimodal attack on the Runway-inpainting model. Red words indicate the selected optimal paraphrases. The combined adversarial prompts and images successfully bypass the T2I safeguards. C.1. Qualitative Analysis of Multimodal Attack Figure 7 presents additional examples of our multimodal attack on the online Runway-inpainting model, as discussed in Section 4.2, further illustrating the robustness and effectiveness of our strategy. These visualizations provide deeper insights into the attack’s impact and underlying mechanisms. C.2. Qualitative Analysis of text modality Attack Figure 8 shows additional qualitative results of the text modality attack on several commercial text-to-image generation models, as discussed in Section 4.3. These examples further validate the effectiveness and generalizability of our approach. Figure 8. Qualitative analysis of text modality attacks on commercial platforms Leonardo.Ai and Runway. Red words denote sensitive words and their corresponding optimal paraphrases. While target prompts containing sensitive words are blocked, the adversarial prompts successfully bypass the prompt filters and generate unsafe images.

Instant research discovery