用强化学习和模糊测试黑盒偷取文本生成图像的提示词。
PROMPTMINER: Black-Box Prompt Stealing against Text-to-Image Generative Models via Reinforcement Learning and Fuzz Optimization
- 分两阶段：强化学习优化主体，模糊测试搜索风格修饰词。
- 在多个模型上实现最高0.958的CLIP相似度，超越所有基线。
- 对未知生成器和防御扰动都有强鲁棒性，适合安全研究者使用。
文本到图像生成模型如Stable Diffusion和FLUX能直接从文本提示生成高质量图像，其效果高度依赖精心设计的提示词，这些提示已成为有价值的数字资产。然而，提示词的价值与普及使其面临安全与知识产权风险，其中关键威胁是提示词窃取攻击——即恢复生成给定图像的原始文本提示。该攻击可被用于非法提取，但也支持数据溯源、模型来源分析和水印验证等有益应用。现有方法多依赖白盒梯度信息、大规模标注数据或仅通过描述生成而无显式优化，限制了实用性与适应性。为此，本文提出PROMPTMINER，一种黑盒提示词窃取框架，将任务分为两个阶段：(1) 基于强化学习的优化阶段以重建主体内容；(2) 基于模糊测试的搜索阶段以恢复风格修饰词。实验表明，PROMPTMINER在多个数据集和扩散模型骨架上表现优异，达到最高0.958的CLIP相似度与0.751的SBERT文本对齐度，全面超越各基线。即使在未知生成器的真实图像上，其CLIP相似度仍比最强基线高出7.5个百分点，展现出更强泛化能力。此外，其在防御性扰动下仍保持良好性能，凸显强大鲁棒性。代码已开源。
原文摘要 · Abstract (English)
Text-to-image (T2I) generative models such as Stable Diffusion and FLUX can synthesize realistic, high-quality images directly from textual prompts. The resulting image quality depends critically on well-crafted prompts that specify both subjects and stylistic modifiers, which have become valuable digital assets. However, the rising value and ubiquity of high-quality prompts expose them to security and intellectual-property risks. One key threat is the prompt stealing attack, i.e., the task of recovering the textual prompt that generated a given image. Prompt stealing enables unauthorized extraction and reuse of carefully engineered prompts, yet it can also support beneficial applications such as data attribution, model provenance analysis, and watermarking validation. Existing approaches often assume white-box gradient access, require large-scale labeled datasets for supervised training, or rely solely on captioning without explicit optimization, limiting their practicality and adaptability. To address these challenges, we propose PROMPTMINER, a black-box prompt stealing framework that decouples the task into two phases: (1) a reinforcement learning-based optimization phase to reconstruct the primary subject, and (2) a fuzzing-driven search phase to recover stylistic modifiers. Experiments across multiple datasets and diffusion backbones demonstrate that PROMPTMINER achieves superior results, with CLIP similarity up to 0.958 and textual alignment with SBERT up to 0.751, surpassing all baselines. Even when applied to in-the-wild images with unknown generators, it outperforms the strongest baseline by 7.5 percent in CLIP similarity, demonstrating better generalization. Finally, PROMPTMINER maintains strong performance under defensive perturbations, highlighting remarkable robustness. Code: https://github.com/aaFrostnova/PromptMiner
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。