IC-1014A single adversarial token embedding appended to any input prompt overwrites the prompt in Stable Diffusion v2.1 to generate a target object, with CLIP similarity to the original prompt (0.742) remaining higher than to the target (0.546)
Qihao Liu, Adam Kortylewski, Yutong Bai, Song Bai, Alan Yuille
By optimizing a single token embedding [x] and appending it to prompts like 'a photo of a cat [x]', the authors find tokens that cause the model to generate only the target object (e.g., a car) regardless of the original prompt content. The CLIP similarity between the modified prompt and the original is 0.742, higher than the 0.546 similarity to the target, indicating the attack operates on the diffusion process rather than the text encoder. The authors also discover universal tokens that work across different key objects and even different language patterns. They attribute this to a bias towards the final word of the input, where the model predominantly focuses on the last noun/object and is easily misled by particular words.
Evidence
correlational
Key metric
CLIP similarity to origin: 0.742, to target: 0.546; FGR(h) for 'a photo of a cat [x]' with target car: 92%; universal tokens demonstrated across 'a photo of a cat [x]', 'a photo of a laptop [x]', 'a photo of a ship [x]', 'a dog is playing a ball [x]'
Caveat
The authors note that similar phenomena were reported before (Zhuang et al. 2023; Mao et al. 2022), but those tokens did not show the property of minimal CLIP score change. The safety-critical findings (weapons, drug use, nudity) are noted as a concern.