Adversarial Attacks on Parts of Speech: An Empirical Study in Text-to-Image Generation

TL;DR

This paper empirically investigates how adversarial attacks targeting specific parts of speech in text prompts influence text-to-image generation, revealing varying attack success rates across POS categories and underlying mechanisms.

Contribution

It introduces a high-quality dataset for POS token swapping, performs gradient-based attacks on T2I models, and analyzes the influence of different POS tags on attack effectiveness and mechanisms.

Findings

Nouns, proper nouns, and adjectives are most vulnerable to attacks.

Attack success rate varies significantly among POS categories.

Features like suffix transferability are consistent across categories.

Abstract

Recent studies show that text-to-image (T2I) models are vulnerable to adversarial attacks, especially with noun perturbations in text prompts. In this study, we investigate the impact of adversarial attacks on different POS tags within text prompts on the images generated by T2I models. We create a high-quality dataset for realistic POS tag token swapping and perform gradient-based attacks to find adversarial suffixes that mislead T2I models into generating images with altered tokens. Our empirical results show that the attack success rate (ASR) varies significantly among different POS tag categories, with nouns, proper nouns, and adjectives being the easiest to attack. We explore the mechanism behind the steering effect of adversarial suffixes, finding that the number of critical tokens and content fusion vary among POS tags, while features like suffix transferability are consistent across categories. We have made our implementation publicly available at - https://github.com/shahariar-shibli/Adversarial-Attack-on-POS-Tags.