Adversarial Attacks on Diffusion Models

Latest papers

15 papers2 papers in the last four weeks, against 2 the four weeks before. 0.0% of all new papers.

Noise Out, Bias In: Targeted Bias Injection in Diffusion Language Models via Closed-Loop Activation Steering
Oct 5, 2026Sarim Hashmi, Mukul Ranjan, Abdelrahman Elsayed +3Adversarial Attacks on Diffusion Models Diffusion Language Models
Mohamed bin Zayed University of Artificial Intelligence
LoRango: It Takes Two LoRAs to Unlock Hidden Behaviors in Diffusion Models
Sep 22, 2026Jin Wei, Rundong Li, Ruihao Yang +10Adversarial Attacks on Diffusion Models Backdoor Attacks
School of Computer Science, Fudan University, Shanghai, China · Institute of Big Data, Fudan University, Shanghai, China · School of Computing, Xi’an Jiaotong-Liverpool University +2
DIVA: Exploiting Cross-Step Conditional Propagation for Visual Jailbreaks in Discrete Diffusion Vision-Language Models
Sep 1, 2026Guorui Song, Runqing Tang, Jingye Zhang +11Diffusion VLMs Adversarial Attacks on VLMs
Tsinghua University · Beijing University of Posts and Telecommunications
A Survey on Adversarial Attacks and Defenses for Diffusion Models Across Multiple Modalities
Aug 28, 2026Ozgur Kara, Tarik Can Ozden, Furkan Horoz +6Adversarial Attacks on Diffusion Models Adversarial Attacks
University of Illinois Urbana-Champaign · Stanford University · Georgia Institute of Technology +1
GuardPaint:SpeculativeSafetyDecodingforText-to-ImageGeneration
Aug 22, 2026Shreyash Dhoot, Paras Dhiman, Arsh Abbas Naqvi +4Safe T2I Generation Adversarial Attacks on Diffusion Models
Pragya Lab, BITS Pilani Goa, India · Apple, USA · Meta, USA
Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits
Aug 7, 2026Elena Dumitrescu, Gert Lek, Lydia Y. Chen +1Adversarial Attacks on LLMs LLM Safety Alignment
Delft University of Technology, Delft, The Netherlands · University of Neuchâtel, Neuchâtel, Switzerland.
Hierarchical Anti-Aesthetics: Protecting Facial Privacy against Customized Diffusion Models
Jul 2, 2026Songping Wang, Yueming Lyu, Shiqi Liu +5Adversarial Attacks Adversarial Attacks on Diffusion Models
School of Intelligence Science and Technology, Nanjing University, Suzhou 215163, China · China Mobile Information Technology Co., Ltd., Beijing 100037, China · State Key Laboratory of Multimodal Artificial Intelligence Systems (MAIS), Center for Research on Intelligent Perception and Computing (CRIPAC), Institute of Automation Chinese Academy of Sciences (CASIA), Beijing 100190, China
TooBad: Backdoor Diffusion Models with Ultra-Low Poison Rate and Imperceptible Trigger
Jun 22, 2026Vu Tuan Truong, Long Bao LeBackdoor Attacks Diffusion Models
INRS, University of Quebec
Bypassing Copyright Protection in Diffusion-based Customization via Two-Stage Latent Feature Optimization
Jun 6, 2026Ziang Xu, Wenbo Yu, Hongyao Yu +6Latent Diffusion Models Adversarial Attacks
Harbin Institute of Technology, Shenzhen Shenzhen, Guangdong, China · Tsinghua Shenzhen International Graduate School Shenzhen, Guangdong, China
MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Models
Jun 1, 2026Yingzi Ma, Zhengyue Zhao, Xiaogeng Liu +3Masked Diffusion Models Adversarial Attacks on LLMs
University of Wisconsin-Madison · Johns Hopkins University · Responsible AI Research (RAIR) Centre, The University of Adelaide +1
Erased but Exploitable: Black-box Embedding-Aware Prompting Against Unlearned Text-to-Image Diffusion Models
May 25, 2026Arian Komaei Koma, Seyed Amir Kasaei, AmirMahdi Sadeghzadeh +1Adversarial Prompt Generation Adversarial Attacks
Department of Computer Engineering Sharif University of Technology
Whispers in the Noise: Surrogate-Guided Concept Awakening via a Multi-Agent Framework
May 18, 2026Mengyu Sun, Ziyuan Yang, Zunlong Zhou +3Adversarial Attacks Adversarial Attacks on Diffusion Models
Department of Electrical and Electronic Engineering, The Hong Kong Polytechnic University · Lee Kong Chian School of Medicine, Nanyang Technological University · School of Cyber Science and Engineering, Sichuan University
Re-Mask and Redirect: Exploiting Denoising Irreversibility in Diffusion Language Models
Mar 17, 2026Arth SinghAdversarial Attacks on LLMs Adversarial Attacks on Diffusion Models
AIM Intelligence · National Institute of Technology Agartala
Attention to Neural Plagiarism: Diffusion Models Can Plagiarize Your Copyrighted Images!
Feb 25, 2026Zihang Zou, Boqing Gong, Liqiang WangAdversarial Attacks on Diffusion Models Adversarial Attacks
University of Central Florida · Boston University
SimAC: A Simple Anti-Customization Method for Protecting Face Privacy against Text-to-Image Synthesis of Diffusion Models
Dec 13, 2023Feifei Wang, Zhentao Tan, Tianyi Wei +2Adversarial Attacks Adversarial Attacks on Diffusion Models
University of Science and Technology of China · Alibaba Cloud

Oct 5, 2026J/K move · Enter open · S save

Noise Out, Bias In: Targeted Bias Injection in Diffusion Language Models via Closed-Loop Activation Steering

Sarim Hashmi, Mukul Ranjan, Abdelrahman Elsayed, Muhammad Umer Sheikh+2

Mohamed bin Zayed University of Artificial Intelligence

Adversarial Attacks on Diffusion Models Diffusion Language Models Demographic Bias in Language Models Activation Steering

Open paper AskPDF arXiv

Masked diffusion language models (dLLMs) generate text by iteratively denoising masked positions, re-predicting each token multiple times before it is committed. An autoregressive decoder exposes an answer's distribution once, at the step that commits it; a dLLM exposes it at every denoising step before commitment, and we show that an adversary can exploit this. Since an answer remains open to revision over many denoising steps, an adversary with access to internal activations can watch how likely the model is to produce a chosen answer and adjust the intervention accordingly. Building on this observation, we study targeted bias injection, an attack that steers a frozen dLLM toward a demographic answer selected by the adversary. The attack uses a simple proportional-integral (PI) controller that tracks the target-answer probability during denoising and adapts the strength of a steering vector on the fly. On ambiguous BBQ questions where the correct answer is abstention, our attack raises LLaDA-8B-Instruct's preference for the targeted group from 1.8 to 16.7 percentage points, more than three times the strongest fixed-strength steering baseline, and on SocialStigmaQA it raises the selection of stigmatizing answers from 17.6% to 58.1%. Fitted to other demographic targets, the same attack shifts answers by up to 37 percentage points, and each attack takes about 40 minutes on one GPU. On the primary target, feedback is what makes the attack work: constant steering at the same average strength over the token-committing steps produces a far smaller shift while corrupting nearly three times as many outputs, and a constant strength set separately for each example still falls well short. Our findings identify the denoising trajectory as a new control channel in dLLMs and call for bias audits that examine the serving stack rather than the frozen model alone.