Perturbing Attention Gives You More Bang for the Buck: Subtle Imaging Perturbations That Efficiently Fool Customized Diffusion Models

TL;DR

The paper addresses the vulnerability of Text-to-Image diffusion models to targeted attacks by revealing that cross-attention layers are highly sensitive to gradient updates during training. It introduces CAAT, a lightweight attacker that jointly optimizes a small cross-attention subspace ($W_K$, $W_V$) and a visually imperceptible input perturbation $\delta$ under a budget $\eta$, to degrade the mapping from text to image in customized LDMs. Through extensive experiments across DreamBooth, Textual Inversion, Custom Diffusion, and SVDiff, CAAT outperforms existing attacks (e.g., Anti-DreamBooth, Mist) in both effectiveness and efficiency, while running roughly 2x faster and without requiring large auxiliary image sets. The results demonstrate strong generalization across LDM variants and provide a practical image-preprocessing safeguard for portrait rights, with ablation and robustness analyses supporting its reliability and practicality in real-world scenarios. $L_{DM}(\theta,x_0)=\mathbb{E}_{x_0,t,\epsilon}\|\epsilon-\epsilon_{\theta}(x_t,t)\|$, $x_t=\sqrt{\alpha_t}x_0+\sqrt{1-\alpha_t}\epsilon$, Attention$(Q,K,V)=\text{softmax}(\tfrac{QK^T}{\sqrt{d}})V$, $Q=W_Q f$, $K=W_K c$, $V=W_V c$, $\delta=\arg\max_{\delta}\mathcal{L}_{LDM}(\theta,x+\delta)$, $\|\delta\|\le\eta$.

Abstract

Diffusion models (DMs) embark a new era of generative modeling and offer more opportunities for efficient generating high-quality and realistic data samples. However, their widespread use has also brought forth new challenges in model security, which motivates the creation of more effective adversarial attackers on DMs to understand its vulnerability. We propose CAAT, a simple but generic and efficient approach that does not require costly training to effectively fool latent diffusion models (LDMs). The approach is based on the observation that cross-attention layers exhibits higher sensitivity to gradient change, allowing for leveraging subtle perturbations on published images to significantly corrupt the generated images. We show that a subtle perturbation on an image can significantly impact the cross-attention layers, thus changing the mapping between text and image during the fine-tuning of customized diffusion models. Extensive experiments demonstrate that CAAT is compatible with diverse diffusion models and outperforms baseline attack methods in a more effective (more noise) and efficient (twice as fast as Anti-DreamBooth and Mist) manner.

Figures (7)

• Figure 1: With subtle perturbation, CAAT can efficiently and consistently degrade various customized diffusion models. First Line: Existing malicious attackers can use a few images publicly posted by users to generate users' images using various customized diffusion models. Second Line: Our CAAT, through subtle perturbations to the images, significantly disrupt the images generated from the customized diffusion models. We exemplify our approach by selecting the prompts "a photo of a person" and "a photo of a person in front of a pyramid".
• Figure 2: Illustration of the vulnerability of cross-attention layers by PGD. The comparison of adversarial attack between cross-attention and other layers reveal the vulnerability of cross-attention layers in PGD attack. We added noise to the clean images through PGD attack to generate adversarial examples. Subsequently, we employed DreamBooth ruiz2023dreambooth for customized fine-tuning on the adversarial examples, resulting in generated images from attacked diffusion model.
• Figure 3: Schematic of CAAT attacking a T2I diffusion model. During attacker training, first, $W_K$ and $W_V$ of the cross-attention layer are optimized. Then, the perturbation $\delta$ is optimized based on the gradient of $x$, yielding perturbed image $x+\delta$.
• Figure 4: Comparison in the images generated by different T2I diffusion models with different attackers. The first column illustrates the four input images. For attackers by row, the observation of the perturbation pattern can refer to \ref{['fig:perturb']}. For diffusion models by column, four models are selected and compared to evaluate the performance of attackers.
• Figure 5: Adversarial examples of different attacker after adding noise. The parameter configurations of Anti-DreamBooth and Mist follow the default settings in \ref{['tab:attacks']}.