On the Robustness of Latent Diffusion Models

Q3: Denoising steps.

We do an ablation study to explore the impact of different denoising steps (5, 10, 15, 20, and 25) on the robustness of diffusion models. As we can see from the table, the performance increases with the increase of denoising steps, but the computational complexity also increases dramatically. Therefore, we select the denoising step to be 15 in our experiment to balance the performance and the computational cost.

[1] Bao F, Nie S, Xue K, et al. One transformer fits all distributions in multi-modal diffusion at scale, ICML 2023.

[2] Xu X, Wang Z, Zhang G, et al. Versatile diffusion: Text, images and variations all in one diffusion model, ICCV 2023.

[3] Ganeshan A, BS V, Babu R V. Fda: Feature disruptive attack, ICCV 2019.

[4] Zhang J, Wu W, Huang J, et al. Improving adversarial transferability via neuron attribution-based attacks, CVPR 2022.

[5] Shan S, Cryan J, Wenger E, et al. Glaze: Protecting artists from style mimicry by text-to-image models, USENIX Security 2023.

[6] Chen J, Chen H, Chen K, et al. Diffusion Models for Imperceptible and Transferable Adversarial Attack, Arxiv 2023.

[7] Hill M, Mitchell J, Zhu S C. Stochastic security: Adversarial defense using long-run dynamics of energy-based models, ICLR 2021.

[8] Nie W, Guo B, Huang Y, et al. Diffusion models for adversarial purification, ICML 2022.

We appreciate your valuable comments and suggestions.

Q1: Other models.

We experiment with two other types of diffusion models, including Unidiffuser [1] and Versatile Diffusion [2]. We follow the experimental setting of Table 2 in the paper. The results are as follows. From the table, we can draw a similar conclusion that other types of diffusion models are also susceptible to adversarial attacks, and the denoising process is the most vulnerable part.

Q2: More attacks and defenses.

We compare our approach with more attack methods, including FDA [3], NAA [4], Glaze [5] and DiffAttack [6]. From the experimental results, we can see that our approach also outperforms the advanced attack methods, which validates the superiority of the employed attack method.

We also experiment with two defenses: EBM [7] and DiffPure [8]. From the experimental results, we can see that our attacks are still effective against advanced defenses.

Dear Reviewer,

Considering that the discussion phase is nearing to end, we are looking forward to your further feedback about our latest response. Do our responses fully address your concerns? Do you have any other comments? We would like to discuss with you in more detail. We greatly appreciate your time and feedback.

Sincerely,

Authors

Q4: Prompt setting.

We aim to study the robustness of text-guided image editing models, which all need prompts. Therefore, it is out of the scope of this paper to explore unconditioned attacks without prompts.

Instead, we consider the prompt-transfer setting to check whether the adversarial examples can mislead the model under other similar prompts (not the original one). The prompt-transfer setting represents a black-box setting, where attackers do not know the exact prompts that users adopt.

As shown in Table 3 of the paper, the adversarial examples are still effective under the prompt-transfer setting, which demonstrates that the adversarial examples do not overfit to a specific prompt.

Q6: Input range.

The range of the input is [0, 1]. The qualitative examples of the generated examples are shown in Figure 3 of the paper. We can see that the adversarial perturbations are imperceptible to humans.

Q7: Attack implementation.

In our implementation, we attack the expectation over T of the given objective. As shown in the provided source code, the intermediate results of the chained U-Net are stored for the computation of the gradient.

Q8: Section 3.4.2.

Before we launch adversarial attacks, we should ensure that the model can correctly edit the image based on the guidance of the text prompt. Otherwise, the evaluation of adversarial attacks would be inaccurate, because we cannot tell whether the malfunction of the model is due to an adversarial example or the original input. Therefore, we do this step to ensure that models function correctly on the original inputs before we use them to generate adversarial examples.

[1] Liang C, Wu X, Hua Y, et al. Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examples, ICML 2023.

[2] Shan S, Cryan J, Wenger E, et al. Glaze: Protecting artists from style mimicry by text-to-image models, USENIX Security 2023.

[3] Xue H, Araujo A, Hu B, et al. Diffusion-Based Adversarial Sample Generation for Improved Stealthiness and Controllability, Arxiv 2023.

[4] Chen J, Chen H, Chen K, et al. Diffusion Models for Imperceptible and Transferable Adversarial Attack, Arxiv 2023.

We appreciate your valuable comments and suggestions.

Q1: More references.

We aim to analyze the robustness of diffusion models, and have discussed closely related works in our paper. The references you provided are not closely related to our work. [1, 2] deploy adversarial examples to protect the copyright, and [3, 4] utilize diffusion models to generate adversarial examples. We have added these references in the updated version of our paper.

Q2: Attacking encoder.

We do not claim that attacking the output of the encoder is the optimal way for attacks. Based on our experiments, we find that the Resnet in the denoising process is the most vulnerable component. We compare our method with Glaze [2] and DiffAttack [4] in the following table, which shows that our attacking strategy is better.

Q3: Combining sub-modules.

We do ablation studies on combining sub-modules. We consider combining the Resnet with the encoder, FF, and decoder, respectively. As shown in the table, combining Resnet with FF improves the attacking performance, which shows the effectiveness of combining sub-modules. However, combining Resnet with the encoder or decoder decreases the attacking performance, which implies that we should carefully combine sub-modules to improve attacking performance.

Dear Reviewer,

Considering that the discussion phase is nearing to end, we are looking forward to your further feedback about our latest response. Do our responses fully address your concerns? Do you have any other comments? We would like to discuss with you in more detail. We greatly appreciate your time and feedback.

Sincerely,

Authors

We do not claim that attacking the encoder fails to work well. We just claim that attacking the encoder is not the best way for attacks. As shown in Table 1 of the reference [b], attacking the whole diffusion process (i.e., the decoder) is better than attacking the encoder. Therefore, [b] has already demonstrated that attacking the encoder is not the best way for attacks.

Additionally, we do experiments to compare our method with the Encoder attack in [b]. The results show that attacking the encoder is inferior than attacking the Resnet module inside the denoising steps.

We think that our method that uses Eq (2) to attack is reasonable, since the core idea of our method and attacking the encoder is similar. Both [a,b] and our approach aim to disrupt the current feature representation, which can undermine the model’s output in the end. Specifically, [a,b] drag the output of the encoder closer to a target image to destroy the feature representation, while we push apart the representations of the adversarial example and the original example to destroy the feature representation.

We have already included [1, 2] in the updated version of the paper.

The goal of [1,2] is different from our work. [1,2] aim to protect the copyright. To this end, [1,2] endeavor to find successful adversarial samples against diffusion models. In contrast, we aim to analyze the robustness of diffusion models. To this end, we analyze the robustness of modules inside the diffusion model and also consider different transfer settings.

We appreciate your valuable comments and suggestions.

Q1: Methodology.

In this paper, we launch adversarial attacks on representative modules inside the latent diffusion models to analyze their adversarial vulnerability, which is under-explored and important for understanding the robustness of diffusion models. Therefore, we delve into the three stages of the latent diffusion models: encoding, denoising, and decoding, which are illustrated in Figure 1 of the paper. In order to comprehensively analyze the robustness of each module inside the network, we propose to destroy the latent features of each component as shown in Equation 2 of the paper. We first study the white-box attack performance. We find that the Resnet in the denoising process is the most vulnerable component of the latent diffusion model. Then, we further analyze the transfer attacks and possible defenses. We find that adversarial examples are still effective under the model-transfer and prompt-transfer settings, and against possible defenses, which raises a concern about the robustness of diffusion models.

Q2: Other models.

Please see Q1 of Reviewer Lyr6.

Q3: Novelty.

We construct a benchmark dataset to facilitate the fair comparison of different attacks for future research. Besides, we are the first to comprehensively analyze the adversarial robustness of each module inside the latent diffusion models, while previous approaches fail to explore the denoising process and the internal modules of the latent diffusion models. Furthermore, we are the first to explore the transfer attacks against latent diffusion models, including the model-transfer and prompt-transfer settings. We also explore possible defenses for diffusion models. We have several new findings based on our exploration. For example,

(1) The Resnet in the denoising process is the most vulnerable component of the latent diffusion model.

(2) Adversarial examples are effective across models and similar prompts.

(3) SD-v2 is more vulnerable than SD-v1, and the vulnerabilities of SD-v1 are inherited by SD-v2.

(4) Adversarial attacks are still effective against defense methods.

We believe that all these findings can facilitate future research on the robustness of latent diffusion models.

Q4: Presentation.

We have improved the presentation in the updated version of our paper.

Q5: Complexity.

Under our experimental setting, we generate one adversarial example in about 47.6 seconds, and the time complexity can be further reduced by decreasing the generating iterations and reducing the denoising steps. In addition, the generated adversarial examples are transferable across models and prompts as we discussed in the paper, so they can be directly used to test other diffusion models after one-off generation. The memory used is about 29.6 GB, which is also available on a GeForce RTX 3090 GPU. The memory costs can also be reduced by reducing the denoising steps.

Q6: Possible novel defenses.

Based on our finding that the Resnet in the denoising process is the most vulnerable component of the latent diffusion model. We can build possible novel defenses from a structure perspective. For example,

(1) We can replace the vulnerable components to improve the robustness of LDMs. [1, 2] discard the Resnet component in the transformer, showing better robustness compared with SD.

(2) We can also add additional filter layers before the vulnerable components, such as Resnet and FF, to reduce the adversarial noise.

[1] Bao F, Nie S, Xue K, et al. One transformer fits all distributions in multi-modal diffusion at scale, ICML 2023.

[2] Xu X, Wang Z, Zhang G, et al. Versatile diffusion: Text, images and variations all in one diffusion model, ICCV 2023.

Dear Reviewer,

Considering that the discussion phase is nearing to end, we are looking forward to your further feedback about our latest response. Do our responses fully address your concerns? Do you have any other comments? We would like to discuss with you in more detail. We greatly appreciate your time and feedback.

Sincerely,

Authors