Unveiling the Attribute Misbinding Threat in Identity-Preserving Models

TL;DR

This paper reveals a new attack on identity-preserving models that exploits attribute misbinding to generate unsafe content, introduces a benchmark and a safety score to evaluate and improve model robustness against such threats.

Contribution

It introduces the Attribute Misbinding Attack, a novel method exploiting internal attention biases, along with the Misbinding Prompt evaluation set and the Attribute Binding Safety Score (ABSS) for comprehensive safety assessment.

Findings

The attack bypasses 5.28% more filters than existing sets.

The attack increases NSFW content generation in models.

The ABSS metric evaluates both content fidelity and safety compliance.

Abstract

Identity-preserving models have led to notable progress in generating personalized content. Unfortunately, such models also exacerbate risks when misused, for instance, by generating threatening content targeting specific individuals. This paper introduces the \textbf{Attribute Misbinding Attack}, a novel method that poses a threat to identity-preserving models by inducing them to produce Not-Safe-For-Work (NSFW) content. The attack's core idea involves crafting benign-looking textual prompts to circumvent text-filter safeguards and leverage a key model vulnerability: flawed attribute binding that stems from its internal attention bias. This results in misattributing harmful descriptions to a target identity and generating NSFW outputs. To facilitate the study of this attack, we present the \textbf{Misbinding Prompt} evaluation set, which examines the content generation risks of current state-of-the-art identity-preserving models across four risk dimensions: pornography, violence, discrimination, and illegality. Additionally, we introduce the \textbf{Attribute Binding Safety Score (ABSS)}, a metric for concurrently assessing both content fidelity and safety compliance. Experimental results show that our Misbinding Prompt evaluation set achieves a \textbf{5.28}\% higher success rate in bypassing five leading text filters (including GPT-4o) compared to existing main-stream evaluation sets, while also demonstrating the highest proportion of NSFW content generation. The proposed ABSS metric enables a more comprehensive evaluation of identity-preserving models by concurrently assessing both content fidelity and safety compliance.