Asymmetric Bias in Text-to-Image Generation with Adversarial Attacks
This repository implements the concepts from the paper "Asymmetric Bias in Text-to-Image Generation with Adversarial Attacks." The study examines adversarial attacks on Text-to-Image (T2I) models like Stable Diffusion, introducing entity swapping via adversarial suffixes and gradient-based attacks. It reveals asymmetric attack success rates (ASRs) and proposes probing metrics to predict vulnerabilities based on model biases.
Citation
text@article{shahgir2023asymmetric,
title={Asymmetric Bias in Text-to-Image Generation with Adversarial Attacks},
author={Shahgir, Haz Sameen and Kong, Xianghao and Ver Steeg, Greg and Dong, Yue},
journal={arXiv preprint arXiv:2312.14440},
year={2023}
}
Key Contributions
- New attack objective: Entity swapping using adversarial suffixes to probe prompt distributions and ASRs.
- Gradient-based attacks: Single Token Perturbation (adapted from Greedy Coordinate Gradient) and Multiple Token Perturbation (inspired by Genetic Algorithms).
- Probing metrics (BSR, Δ₁, Δ₂) to estimate ASR without executing attacks, linking to model biases.
Methodology
- Model: Stable Diffusion (U-Net, CLIP embeddings, 77-token prompts).
- Attacks: Optimize adversarial suffixes to swap entities (e.g., "human" to "robot") by maximizing cosine similarity scores.
- Evaluation: Use InstructBLIP classifier (79% accuracy) and human annotations for ASR; generate 5 images per prompt.
- Metrics: Base Success Rate (BSR), perplexity difference (Δ₁), baseline distance difference (Δ₂) for asymmetry analysis.
Results
- Multiple Token Perturbation achieves higher ASR (26.4%) than Single Token (24.4%).
- Asymmetric ASRs: e.g., swapping "swan" to "horse" fails (ASR ~0), but reverse succeeds (ASR 0.9).
- Metrics predict ASR: BSR ≥0.9 and Δ₂<0 → ~60% success; BSR<0.9 and Δ₂≥0 → <5% success.
Usage
- Clone the repo and run experiments:
- textgit clone https://github.com/your-repo/asymmetric-bias-t2i
- pip install -r requirements.txt
- python attack.py --prompt "A human" --target "A robot"
License
MIT (or as per paper/repo). Refer to the original paper for details: arXiv:2312.14440.