SourceDiscovering Failure Modes of Text-guided Diffusion Models via Adversarial Search
By optimizing a single token embedding [x] and appending it to prompts like 'a photo of a cat [x]', the authors find tokens that cause the model to generate only the target object (e.g., a car) regardless of the original prompt content. The CLIP similarity between the modified prompt and the original is 0.742, higher than the 0.546 similarity to the target, indicating the attack operates on the diffusion process rather than the text encoder. The authors also discover universal tokens that work across different key objects and even different language patterns. They attribute this to a bias towards the final word of the input, where the model predominantly focuses on the last noun/object and is easily misled by particular words.