Disrupting Diffusion: Token-Level Attention Erasure Attack against Diffusion-based Customization

Yisu Liu, Jinyang An, Wanqian Zhang, Dayan Wu, JingziGU, Zheng Lin, Weiping Wang

Abstract:

With the development of diffusion-based customization methods like DreamBooth, individuals now have access to train the models that can generate their personalized images. Despite the convenience, malicious users have misused these techniques to create fake images, thereby triggering a privacy security crisis. In light of this, proactive adversarial attacks are proposed to protect users against customization. The adversarial examples are trained to distort the customization model's outputs and thus block the misuse.
In this paper, we propose DisDiff (Disrupting Diffusion), a novel adversarial attack method to disrupt the diffusion model outputs.
We first delve into the intrinsic image-text relationships, well-known as cross-attention, and empirically find that the subject-identifier token plays an important role in guiding image generation. Thus, we propose the Cross-Attention Erasure module to explicitly "erase" the indicated attention maps and disrupt the text guidance. Besides, we analyze the influence of the sampling process of the diffusion model on Projected Gradient Descent (PGD) attack and introduce a novel Merit Sampling Scheduler to adaptively modulate the perturbation updating amplitude in a step-aware manner. Our DisDiff outperforms the state-of-the-art methods by 12.75% of FDFR scores and 7.25% of ISM scores across two facial benchmarks and two commonly used prompts on average.

Primary Subject Area: [Generation] Generative Multimedia

Secondary Subject Area: [Content] Vision and Language

Relevance To Conference:

Our work sets out from a multimodal generation task well-known as diffusion-based customization, e,g, DreamBooth, and Textual Inversion.
To protect user privacy from the misuse of these customization methods, we propose DisDiff, a novel adversarial attack method to distort the diffusion model outputs. We study the image-text relationship, which is known as cross-attention during the diffusion models generation process. A novel Cross Attention Erasure module is proposed to "erase" the cross-attention and achieve better performances compared with SOTA works. Thus, our work is related to image-text relationships and is tightly associated with multimodal generation processing.

Submission Number: 387