PROMPTMINER：通过强化学习与VLM引导优化对文本到图像生成模型的黑盒提示词窃取
PROMPTMINER: Black-Box Prompt Stealing against Text-to-Image Generative Models via Reinforcement Learning and VLM-Guided Optimization
提出一种黑盒提示词窃取框架，利用强化学习重建主体、VLM引导搜索风格修饰词，可复用于提示词逆向工程、数据溯源与版权保护研究。
原文依据 we propose PROMPTMINER, a black-box prompt stealing framework that decouples the task into two phases
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论文本到图像（T2I）生成模型（如Stable Diffusion和FLUX）能够直接根据文本提示词合成逼真、高质量的图像。生成的图像质量关键取决于精心设计的提示词，这些提示词同时指定了主体和风格修饰词，已成为有价值的数字资产。然而，高质量提示词价值的上升和普及使其面临安全和知识产权风险。一个关键威胁是提示词窃取攻击，即恢复生成给定图像的文本提示词的任务。提示词窃取使得未经授权提取和重用精心设计的提示词成为可能，但它也可以支持有益的应用，如数据归属、模型溯源分析和水印验证。现有方法通常假设白盒梯度访问、需要大规模标注数据集进行监督训练，或仅依赖图像描述而无显式优化，限制了其实用性和适应性。为应对这些挑战，我们提出PROMPTMINER，一个黑盒提示词窃取框架，将任务解耦为两个阶段：（1）基于强化学习的优化阶段以重建主要主体；（2）VLM引导的搜索阶段以恢复风格修饰词。在多个数据集和扩散骨干网络上的实验表明，PROMPTMINER取得了优越的结果，CLIP相似度高达0.958，与SBERT的文本对齐度高达0.751，超越了所有基线。即使应用于生成器未知的真实世界图像，其在CLIP相似度上比最强基线高出7.5%，展现出更好的泛化能力。最后，PROMPTMINER在防御性扰动下仍保持强劲性能，凸显了显著的鲁棒性。
英文原文摘要 1802 字符
Text-to-image (T2I) generative models such as Stable Diffusion and FLUX can synthesize realistic, high-quality images directly from textual prompts. The resulting image quality depends critically on well-crafted prompts that specify both subjects and stylistic modifiers, which have become valuable digital assets. However, the rising value and ubiquity of high-quality prompts expose them to security and intellectual-property risks. One key threat is the prompt stealing attack, i.e., the task of recovering the textual prompt that generated a given image. Prompt stealing enables unauthorized extraction and reuse of carefully engineered prompts, yet it can also support beneficial applications such as data attribution, model provenance analysis, and watermarking validation. Existing approaches often assume white-box gradient access, require large-scale labeled datasets for supervised training, or rely solely on captioning without explicit optimization, limiting their practicality and adaptability. To address these challenges, we propose PROMPTMINER, a black-box prompt stealing framework that decouples the task into two phases: (1) a reinforcement learning-based optimization phase to reconstruct the primary subject, and (2) a VLM-guided search phase to recover stylistic modifiers. Experiments across multiple datasets and diffusion backbones demonstrate that PROMPTMINER achieves superior results, with CLIP similarity up to 0.958 and textual alignment with SBERT up to 0.751, surpassing all baselines. Even when applied to in-the-wild images with unknown generators, it outperforms the strongest baseline by 7.5% in CLIP similarity, demonstrating better generalization. Finally, PROMPTMINER maintains strong performance under defensive perturbations, highlighting remarkable robustness.