PLA: Black-box Prompt Learning Attack against Text-to-Image Models

The researchers propose a prompt learning attack framework, PLA, to bypass the safety mechanisms of text-to-image models under black-box conditions where the model architecture and parameters are inaccessible. Previous methods mostly relied on word substitution to search for adversarial prompts, limited by the search space and less effective than gradient-based training; PLA uses multimodal similarity to design gradient training for black-box T2I models to learn adversarial prompts. Experiments show that this method can effectively attack black-box T2I safety mechanisms, including prompt filters and post-hoc safety checkers, with higher success rates than existing methods. The paper is published at ICCV 2025, and the authors note that the content may include harmful content generated by the model.