Adversarial Paraphrase Substitution: Jailbreak Attacks on Text-to-Image Diffusion Models

Recent advancements in Text-to-Image (T2I) diffusion models (DMs) have transformed image synthesis, enabling the generation of high-quality and diverse visual content from textual descriptions. However, alongside their impressive capabilities and expanding applications, T2I models carry significant risks, particularly their potential misuse to produce unsafe imagery. While safety mechanisms have been integrated into T2I models, their robustness and reliability remain underexplored, highlighting the need for more systematic and rigorous evaluation. In this paper, we present Adversarial Paraphrase Substitution (APS), a novel automated attack framework designed to expose vulnerabilities in the safety mechanisms of state-of-the-art T2I models. Functioning as a model-agnostic, black-box jailbreak attack targeting text encoders, APS operates without requiring any prior knowledge of the underlying T2I architecture, ensuring its adaptability across a broad spectrum of platforms. The APS framework follows a two-stage process: first, it leverages the generative capabilities of large language models (LLMs) to construct a tailored subset vocabulary for each sensitive word. Subsequently, it generates an optimized adversarial paraphrase from the corresponding subset vocabulary to replace the sensitive word in the original prompt, thereby effectively aligning unsafe concepts within the text encoder's embedding space. Through extensive experiments on open-source T2I models with concept removal mechanisms and commercial platforms with proprietary defenses, APS consistently bypasses safety measures, generating unsafe yet semantically coherent images closely aligned with the original prompts. These results highlight critical vulnerabilities in current defenses and stress the urgent need for more robust safeguards against adversarial exploitation. Content Warning: This paper includes examples of NSFW content.