DesInsert: Strategic descriptive term insertion fools text-to-image generation

Text-to-image generation models such as Stable Diffusion have recently attracted increasing interest due to their broad applications in creative design and content creation. However, they remain vulnerable due to persistent weaknesses in deep neural networks. While previous studies have investigated adversarial attacks against such models, they often introduce noticeable changes to the original inputs, reducing the imperceptibility of the attacks. In this paper, we propose the Descriptive Term Insert (DesInsert) along with two variants DesInsert-White and DesInsert-Black, designed for white-box and black-box settings, respectively. The key idea is to introduce an optimized descriptive term into the input text, thereby preserving the semantics and enabling imperceptible attacks. Specifically, DesInsert-White leverages a discretized softmax approach to enhance the white-box search process, enabling more efficient discovery of descriptive terms for stealthier attacks. Meanwhile, DesInsert-Black employs a novel genetic encoding strategy in the word space to generate semantically coherent adversarial examples. Extensive experiments demonstrate that DesInsert can consistently distort generated images over popular text-to-image models with minimal perceptible changes: It generates adversarial samples with perplexity (PPL) values that are less than half of those produced by existing baselines. Moreover, it achieves a 21.98% higher success rate and over 10× faster generation speed in white-box settings, and outperforms in black-box settings with higher success rates and fewer query costs. Our work reveals the critical vulnerabilities in current text-to-image systems and highlights the need for developing more robust generative models. The code is available at https://github.com/FanyuBu/DesInsert.