DiffZOO：一种通过零阶优化对文本到图像生成模型进行红队测试的纯查询黑盒攻击
DiffZOO: A Purely Query-Based Black-Box Attack for Red-teaming Text-to-Image Generative Model via Zeroth Order Optimization
AI总结：
DiffZOO 提出一种纯查询黑盒攻击方法，利用零阶优化和 C-PRV、D-PRV 增强离散提示，在多个 T2I 安全机制上平均攻击成功率比先前工作高 8.5%。
摘要：
当前的文本到图像（T2I）合成扩散模型引发了滥用担忧，尤其是在生成违禁或不宜在工作场所观看（NSFW）的图像方面。为解决这一问题，人们提出了各种安全机制和红队攻击方法，以增强或暴露 T2I 模型生成不当内容的能力。然而，许多红队攻击方法假设已知文本编码器，这限制了它们的实际应用。在本工作中，我们重新思考了在缺乏 T2I 模型先验知识情况下的纯黑盒攻击场景。为了克服梯度不可用以及无法在离散提示空间内优化攻击的问题，我们提出了 DiffZOO，该方法应用零阶优化来获取梯度近似，并利用 C-PRV 和 D-PRV 在离散提示域内增强攻击提示。我们在 T2I 扩散模型的多个安全机制和在线服务器上评估了我们的方法。在多个最先进安全机制上的实验表明，DiffZOO 的平均攻击成功率比先前工作高出 8.5%，因此有望成为 T2I 模型的实用红队工具。
英文摘要：
Current text-to-image (T2I) synthesis diffusion models raise misuse concerns, particularly in creating prohibited or not-safe-for-work (NSFW) images. To address this, various safety mechanisms and red teaming attack methods are proposed to enhance or expose the T2I model's capability to generate unsuitable content. However, many red teaming attack methods assume knowledge of the text encoders, limiting their practical usage. In this work, we rethink the case of \textit{purely black-box} attacks without prior knowledge of the T2l model. To overcome the unavailability of gradients and the inability to optimize attacks within a discrete prompt space, we propose DiffZOO which applies Zeroth Order Optimization to procure gradient approximations and harnesses both C-PRV and D-PRV to enhance attack prompts within the discrete prompt domain. We evaluated our method across multiple safety mechanisms of the T2I diffusion model and online servers. Experiments on multiple state-of-the-art safety mechanisms show that DiffZOO attains an 8.5% higher average attack success rate than previous works, hence its promise as a practical red teaming tool for T2l models.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
