T2VAttack: Adversarial Attack on Text-to-Video Diffusion Models

TL;DR

This work exposes substantial vulnerabilities in state-of-the-art Text-to-Video diffusion models by introducing T2VAttack, a framework with semantic and temporal objectives and two practical word-level attacks, T2VAttack-S and T2VAttack-I. By perturbing prompts with minimal substitutions or insertions, the method degrades both video-text alignment and motion dynamics across four leading models, illustrating a pressing need for robust defenses in T2V generation. The authors construct a high-quality prompt dataset (T2VAttackBench) and perform extensive ablations to reveal how vocabulary choice, insertion position, and POS influence attack efficacy and stealth. Overall, the study highlights fundamental security risks in T2V pipelines and lays the groundwork for developing robust countermeasures to ensure safer video generation in real-world deployments.

Abstract

The rapid evolution of Text-to-Video (T2V) diffusion models has driven remarkable advancements in generating high-quality, temporally coherent videos from natural language descriptions. Despite these achievements, their vulnerability to adversarial attacks remains largely unexplored. In this paper, we introduce T2VAttack, a comprehensive study of adversarial attacks on T2V diffusion models from both semantic and temporal perspectives. Considering the inherently dynamic nature of video data, we propose two distinct attack objectives: a semantic objective to evaluate video-text alignment and a temporal objective to assess the temporal dynamics. To achieve an effective and efficient attack process, we propose two adversarial attack methods: (i) T2VAttack-S, which identifies semantically or temporally critical words in prompts and replaces them with synonyms via greedy search, and (ii) T2VAttack-I, which iteratively inserts optimized words with minimal perturbation to the prompt. By combining these objectives and strategies, we conduct a comprehensive evaluation on the adversarial robustness of several state-of-the-art T2V models, including ModelScope, CogVideoX, Open-Sora, and HunyuanVideo. Our experiments reveal that even minor prompt modifications, such as the substitution or insertion of a single word, can cause substantial degradation in semantic fidelity and temporal dynamics, highlighting critical vulnerabilities in current T2V diffusion models.

Figures (4)

• Figure 1: Examples of adversarial attacks on CogVideoX under semantic and temporal objectives. The first and second rows show the attack results targeting the semantic and temporal objective, respectively; the third row visualizes the corresponding optical flow magnitudes for the temporal case. Columns show videos generated from the original prompt (left), after T2VAttack-S (middle), and after T2VAttack-I (right). The examples highlight that even single-word modifications can cause significant degradation in semantic fidelity and temporal dynamics.
• Figure 2: Overview of the adversarial attack pipeline for T2V models. This pipeline illustrates the key process of two attack methods (T2VAttack-S and T2VAttack-I), two attack objectives, and the targeted T2V victim models. It systematically demonstrates how minor prompt perturbations can disrupt the fidelity and dynamics in the generated videos.
• Figure 3: Part-of-Speech (POS) analysis on T2VAttack-I. The figure plots the proportion difference between the POS distribution of the top-$K$ most effective adversarial words and the full vocabulary, with a positive value indicating a higher likelihood of POS being effective adversarial tokens. (a) Semantic attacks: nouns dominate, strongly affecting semantic content. (b) Temporal attacks: nouns and verbs dominate, perturbing temporal dynamics.
• Figure 4: Visualization of adversarial attack effects across four T2V models (columns: ModelScope, CogVideoX, Open-Sora, HunyuanVideo). Rows correspond to: (1) Semantic attack - T2VAttack-S; (2) Semantic attack - T2VAttack-I; (3) Temporal attack - T2VAttack-S; (4) Temporal attack - T2VAttack-I. In Substitution rows, each example shows a pair (top: video generated from the original prompt; bottom: after T2VAttack-S). In Insertion rows, each example shows a triplet (top: original; middle: after T2VAttack-I; bottom: after T2VAttack-I++). For temporal attack cases, the corresponding optical flow magnitudes are visualized to expose motion degradation. These examples highlight that minor prompt perturbations can induce substantial degradation in semantic fidelity and temporal dynamics.