组合生成的隐藏危险：诊断文本到图像模型中的语义安全失效
Hidden Dangers of Compositional Generation: Diagnosing Semantic Safety Failures in Text-to-Image Models
提出一种纯文本空间的黑盒组合重写攻击 CoRA，可复用于评估 T2I 模型安全过滤器的语义组合漏洞，并启发设计更鲁棒的安全对齐与过滤机制。
原文依据 CoRA decomposes a potentially harmful intent into a set of fine-grained, superficially benign but semantically complete visual elements
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论文本到图像（T2I）模型在生成高质量图像方面已取得显著进展，组合式视觉生成作为一项重要能力，使其能够从多个离散概念合成连贯、自然的场景。然而，这种强大的组合能力在增强创造力的同时，也引入了新的安全风险：不同概念的组合可能生成高风险图像，而无需明确表达有害内容。受此启发，我们提出 CoRA（可组合重组攻击）：一种在保留原始语义的同时绕过安全过滤器的攻击方法。与依赖修改采样过程的传统组合生成方法不同，CoRA 在黑盒设置下仅于文本空间操作，通过交互步骤迭代重写和引导提示词。具体而言，CoRA 将潜在有害意图分解为一组细粒度、表面无害但语义完整的视觉元素，然后通过迭代选择和重组，引导目标 T2I 模型重新组合这些元素而不触发安全检查，从而恢复原始恶意语义。实验结果表明，CoRA 显著提高了攻击成功率，在保持语义一致性的同时生成了更高风险的输出。警告：本文包含冒犯性或令人不适的内容。
英文原文摘要 1420 字符
Text-to-Image (T2I) models have achieved significant progress in generating high-quality images, with compositional visual generation emerging as an important capability that enables them to synthesize coherent, natural scenes from multiple discrete concepts. However, this powerful compositionality, while enhancing creativity, also introduces new safety risks: combinations of different concepts can produce high-risk images without explicitly expressing harmful content. Motivated by this, we propose CoRA (Composable Reassembly Attack): an attack method that preserves the original semantics while bypassing safety filters. Unlike traditional compositional generation approaches that rely on modifying the sampling process, CoRA operates solely in the text space under a black-box setting, iteratively rewriting and guiding prompts through interactive steps. Specifically, CoRA decomposes a potentially harmful intent into a set of fine-grained, superficially benign but semantically complete visual elements, and then uses iterative selection and reassembly to guide the target T2I model to recombine these elements without triggering safety checks, thereby recovering the original malicious semantics. Experimental results show that CoRA significantly improves attack success rates, producing higher-risk outputs while maintaining semantic consistency. Warning: This paper contains offensive or disturbing content.