研究不同词性对文本生成图像的攻击效果，发现名词最易被误导。
Adversarial Attacks on Parts of Speech: An Empirical Study in Text-to-Image Generation
- 通过替换词性标记生成对抗性后缀，干扰模型理解
- 名词、专有名词和形容词攻击成功率最高，超70%
- 方法可复现，适合安全与可信生成研究者参考
近期研究表明，文本到图像（T2I）模型容易受到对抗攻击，尤其在文本提示中对名词进行扰动时。本文研究不同词性（POS）标签在文本提示中对生成图像的影响。我们构建了一个高质量的、真实的词性标记替换数据集，并采用基于梯度的攻击方法，寻找能误导T2I模型生成带错误内容图像的对抗性后缀。实证结果表明，攻击成功率（ASR）在不同词性类别间差异显著，其中名词、专有名词和形容词最易被攻击。我们进一步探索了对抗后缀的引导机制，发现关键标记数量和内容融合程度在不同词性间存在差异，但后缀可迁移性等特征在各类别间保持一致。代码已开源：https://github.com/shahariar-shibli/Adversarial-Attack-on-POS-Tags。
原文摘要 · Abstract (English)
Recent studies show that text-to-image (T2I) models are vulnerable to adversarial attacks, especially with noun perturbations in text prompts. In this study, we investigate the impact of adversarial attacks on different POS tags within text prompts on the images generated by T2I models. We create a high-quality dataset for realistic POS tag token swapping and perform gradient-based attacks to find adversarial suffixes that mislead T2I models into generating images with altered tokens. Our empirical results show that the attack success rate (ASR) varies significantly among different POS tag categories, with nouns, proper nouns, and adjectives being the easiest to attack. We explore the mechanism behind the steering effect of adversarial suffixes, finding that the number of critical tokens and content fusion vary among POS tags, while features like suffix transferability are consistent across categories. We have made our implementation publicly available at - https://github.com/shahariar-shibli/Adversarial-Attack-on-POS-Tags.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。