Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

CtrlAttack: A Unified Attack on World-Model Control in Diffusion Models

Shuhan Xu, Siyuan Liang, Hongling Zheng, Yong Luo, Han Hu, Lefei Zhang, Dacheng Tao

Abstract

Diffusion-based image-to-video (I2V) models increasingly exhibit world-model-like properties by implicitly capturing temporal dynamics. However, existing studies have mainly focused on visual quality and controllability, and the robustness of the state transition learned by the model remains understudied. To fill this gap, we are the first to analyze the vulnerability of I2V models, find that temporal control mechanisms constitute a new attack surface, and reveal the challenge of modeling them uniformly under different attack settings. Based on this, we propose a trajectory-control attack, called CtrlAttack, to interfere with state evolution during the generation process. Specifically, we represent the perturbation as a low-dimensional velocity field and construct a continuous displacement field via temporal integration, thereby affecting the model's state transitions while maintaining temporal consistency; meanwhile, we map the perturbation to the observation space, making the method applicable to both white-box and black-box attack settings. Experimental results show that even under low-dimensional and strongly regularized perturbation constraints, our method can still significantly disrupt temporal consistency by increasing the attack success rate (ASR) to over 90% in the white-box setting and over 80% in the black-box setting, while keeping the variation of the FID and FVD within 6 and 130, respectively, thus revealing the potential security risk of I2V models at the level of state dynamics.

CtrlAttack: A Unified Attack on World-Model Control in Diffusion Models

Abstract

Diffusion-based image-to-video (I2V) models increasingly exhibit world-model-like properties by implicitly capturing temporal dynamics. However, existing studies have mainly focused on visual quality and controllability, and the robustness of the state transition learned by the model remains understudied. To fill this gap, we are the first to analyze the vulnerability of I2V models, find that temporal control mechanisms constitute a new attack surface, and reveal the challenge of modeling them uniformly under different attack settings. Based on this, we propose a trajectory-control attack, called CtrlAttack, to interfere with state evolution during the generation process. Specifically, we represent the perturbation as a low-dimensional velocity field and construct a continuous displacement field via temporal integration, thereby affecting the model's state transitions while maintaining temporal consistency; meanwhile, we map the perturbation to the observation space, making the method applicable to both white-box and black-box attack settings. Experimental results show that even under low-dimensional and strongly regularized perturbation constraints, our method can still significantly disrupt temporal consistency by increasing the attack success rate (ASR) to over 90% in the white-box setting and over 80% in the black-box setting, while keeping the variation of the FID and FVD within 6 and 130, respectively, thus revealing the potential security risk of I2V models at the level of state dynamics.
Paper Structure (16 sections, 10 equations, 4 figures, 2 tables)

This paper contains 16 sections, 10 equations, 4 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Diffusion-based image-to-video generation
  4. Adversarial Attacks on Diffusion Models
  5. Problem Definition
  6. Victim Model
  7. Threat Model
  8. CtrlAttack
  9. Temporally Structured Control Attacks
  10. White-box Instantiation in State-Transition Space
  11. Black-box Instantiation in Control Space
  12. Experiment
  13. Experimental Settings
  14. Main Results
  15. Ablation Studies & Discussion
  16. ...and 1 more sections

Figures (4)

  • Figure 1: While existing methods (a)(b) act on cue or pixel space, this paper (c) directly manipulates the state transition process through temporally structured trajectory perturbations.
  • Figure 2: The framework of CtrlAttack. We construct control signals via low-dimensional, time-structured trajectory perturbations and intervene in the model's state transition process in both white-box and black-box scenarios to achieve controllable manipulation of video-generation trajectories.
  • Figure 3: Compared to clean generated results, CtrlAttack can significantly disrupt the target trajectory and temporal consistency in both white-box and black-box scenarios, while maintaining the overall visual quality essentially unchanged. We further annotate the motion direction at each frame in the figure for clearer comparison.
  • Figure 4: Hyperparameter experimental results.