Diversifying Adversarial Attacks on Text-to-image Generation

Generative text-to-image models have become increasingly ubiquitous thanks to their applications in digital art. However, since they are built on deep neural networks, they are typically vulnerable to adversarial samples, which are subtle changes that cause undesirable generations. To study such phenomena, many works try to automatically craft these samples to shift the models' output to be as irrelevant as possible while changing the original input text as little as possible. This can be formulated as a multi-objective optimization problem, where the stealthiness of the adversarial texts is treated as another objective to optimize. However, we argue that diversifying stealthiness in adversarial text-to-image generation might be a better choice since it is more flexible and effective to study the robustness of the model. We apply MAP-Elites, a Quality-Diversity algorithm, to find adversarial texts varying in the degree of stealthiness while preserving the best-found solutions in local niches. Experimental results show that MAP-Elites outperforms the genetic algorithm (GA) and the widely-used multi-objective evolutionary algorithm NSGA-II, approximately twice on diversity metrics and achieves competitive results on max fitness score and hypervolume. Moreover, the collection of returned solutions exhibits insight into the influence of each attack strategy on the adversarial attack performance.