Implicit Bias Injection Attacks against Text-to-Image Diffusion Models

TL;DR

This work reveals a covert form of bias, implicit and semantically diverse, that can be injected into text-to-image diffusion models without retraining. It introduces IBI-Attacks, which precompute a bias-direction in prompt embeddings using neutral and biased prompts generated by an LLM, then dynamically adapt this direction per input with an adaptive feature-selection module. The approach demonstrates strong bias injection while preserving original semantics, with high transferability across scenes and favorable stealth in human studies, and shows robustness against certain debiasing methods. The findings highlight an important risk in diffusion-based generation and suggest the need for comprehensive bias-mitigation strategies that account for latent-space directions and adaptive expression across prompts.

Abstract

The proliferation of text-to-image diffusion models (T2I DMs) has led to an increased presence of AI-generated images in daily life. However, biased T2I models can generate content with specific tendencies, potentially influencing people's perceptions. Intentional exploitation of these biases risks conveying misleading information to the public. Current research on bias primarily addresses explicit biases with recognizable visual patterns, such as skin color and gender. This paper introduces a novel form of implicit bias that lacks explicit visual features but can manifest in diverse ways across various semantic contexts. This subtle and versatile nature makes this bias challenging to detect, easy to propagate, and adaptable to a wide range of scenarios. We further propose an implicit bias injection attack framework (IBI-Attacks) against T2I diffusion models by precomputing a general bias direction in the prompt embedding space and adaptively adjusting it based on different inputs. Our attack module can be seamlessly integrated into pre-trained diffusion models in a plug-and-play manner without direct manipulation of user input or model retraining. Extensive experiments validate the effectiveness of our scheme in introducing bias through subtle and diverse modifications while preserving the original semantics. The strong concealment and transferability of our attack across various scenarios further underscore the significance of our approach. Code is available at https://github.com/Hannah1102/IBI-attacks.

Figures (19)

• Figure 1: Implicit bias injection causes the model to generate subtly negative content (left) and positive content (right) for different users. Although the generated images meet the text requirement, the subtle differences may, over time, influence user perception.
• Figure 2: Generated images after injecting different 'cultural', 'religious', and 'gender' biases with IBI attacks. Explicit biases, such as gender, can also benefit from our approach, enabling subtle, diverse, and adaptive gender-related features.
• Figure 3: Pipeline of our proposed IBI-Attacks. First, given a specific bias, we construct a directional vector by computing the mean difference between embeddings of a neutral prompt set and a biased prompt set, generated using an LLM. Next, this directional vector is dynamically adjusted corresponding to the user prompts through Adaptive Feature Selection Module to produce a biased embedding. Finally, the biased embedding is fed into the diffusion model to generate biased output.
• Figure 4: Generated samples after injecting positive and negative bias. The key modifications are enlarged. Emotional bias is conveyed through small adjustments in a person's expression or posture. In the second column, after injecting positive bias, the girl's hands transition from a defensive crossed position to a relaxed stance, and a smile appears on her face. While for the negative mood, the girl maintains her original pose, but her facial expression becomes more serious.
• Figure 5: Diverse semantic expressions of negative bias under different text inputs, including facial expressions, posture, style, and environmental cues.