Repurposing Image Diffusion Models for Adversarial Synthetic Structured Data: A Case Study of Ground Truth Drift

TL;DR

This paper demonstrates that off-the-shelf image diffusion models can be repurposed to generate adversarial synthetic structured data, revealing new vulnerabilities in AI data pipelines and distinctions between statistical and perceptual realism.

Contribution

It shows how a standard image diffusion model can be adapted to create adversarial structured data and introduces conceptual distinctions relevant to synthetic evidence and realism.

Findings

Diffusion models can be reshaped to generate structured data from tabular datasets.

Synthetic evidence can induce ground truth drift in AI pipelines.

The architecture's spatial bias influences feature placement in generated data.

Abstract

Public image diffusion models are now powerful enough that an attacker without the resources to train a tabular-specific generator may repurpose one off the shelf. This study tests that possibility directly. An unmodified Stable Diffusion U-Net is applied to the UCI Adult Income dataset by reshaping each row into a small single-channel pseudo-image. The architecture's inductive bias toward spatial locality makes feature placement a design variable, and several layouts are tested. However, this is only the beginning of the story, as this paper also draws two philosophical distinctions. One separates statistical from perceptual realism: whether synthetic content holds up to a machine's correlation audits or a human's sensory inspection. The other introduces synthetic evidence as a category alongside synthetic media: AI-generated material whose consumer is a machine in a closed evidentiary pipeline rather than a person in an open information system. An attacker succeeds with synthetic evidence by thinking like the machine that will receive it. And the more the attacker succeeds, the more they can induce ground truth drift: the silent reclassification of AI-generated outputs as authentic when reused in pipelines that do not interrogate their provenance.