Adversarial Diffusion Across Modalities: A Fusion Survey of Attacks, Defenses, and Evaluation for Text, Vision, and Vision-Language Models

Technical Summary: Adversarial Diffusion Across Modalities

Problem Statement
The deployment of Large Language Models (LLMs) in high-stakes domains necessitates rigorous safety assessment, primarily through red teaming. While red teaming literature has matured, it remains fragmented across four largely disconnected research tracks: (1) diffusion-based attacks on text and LLMs, (2) diffusion-based attacks on image classifiers, (3) jailbreak pipelines against vision-language models (VLMs), and (4) diffusion-based input purification defenses. Each track operates with its own vocabulary, threat models, and benchmarks. Consequently, researchers entering the intersection of diffusion models and adversarial attacks lack a consolidated reference describing the current state of the art, methodological diversity, and evaluation gaps. Specifically, the literature on using diffusion models as adversarial generators against LLMs is small (only four published papers at the time of writing) yet methodologically diverse, while the mature image-domain literature offers specific recipes that have not yet been ported to text.

Methodology
This work is a narrative review with quality assessment, distinct from a PRISMA-compliant systematic review. The authors conducted a structured search across major databases (arXiv, Google Scholar, IEEE Xplore, ACM Digital Library, etc.) and venues (NeurIPS, ICML, CVPR, ACL, USENIX Security, etc.) using keywords combining "diffusion model" with "adversarial," "jailbreak," and "red teaming."

• Selection: The initial search yielded 154 candidate records. After title/abstract screening and full-text eligibility review, 50 papers were retained for the catalog.
• Scope: The catalog includes:
  • 4 papers on diffusion-based attacks on text/LLMs (Family A).
  • 18 papers on diffusion-based attacks on image classifiers (Family D).
  • 10 papers on diffusion-based attacks on VLMs (Family E).
  • 4 papers on diffusion-based defenses for text/multimodal models (Family C).
  • 4 papers on diffusion LLMs as victims (Family B, included as adjacent context).
  • 10 non-diffusion baselines for comparison.
• Quality Check: A supplementary post-hoc agreement check was performed using two independent LLM agents to verify the inclusion rule, yielding a Cohen's $\kappa$ of 0.781.
• Data Synthesis: For each paper, the authors extracted diffusion roles, formulations, training methods, datasets, metrics, target models, and code availability.

Key Contributions

1. Unified Taxonomy of Diffusion Roles: The paper proposes a six-class taxonomy categorizing how diffusion models function in adversarial pipelines:

   • Trained Generator: The diffusion model is trained end-to-end with an attack objective.
   • Frozen with Latent Perturbation: DDIM inversion plus latent-space gradient updates (common in image attacks).
   • Frozen with Score/Classifier Guidance: Adversarial gradients injected into the reverse SDE during sampling.
   • Off-the-Shelf Inference: Using a pretrained diffusion LLM without training or optimization (e.g., response-conditional inpainting).
   • Pipeline-Only Renderer: Diffusion generates content (images/scenes) that serves as input to a separate attack channel; no gradients flow through the sampler.
   • Victim Diffusion Model: The diffusion model itself is the target of the attack.
     This taxonomy is augmented by a threat-model axis (attacker knowledge, query access, target accessibility).

2. Five-Dimension Evaluation Framework: The authors introduce a unified framework to compare attacks across modalities, consisting of:

   • Attack Success Rate (ASR).
   • Transferability (success across different target models).
   • Query Budget (number of model calls/restarts).
   • Perplexity (proxy for input-filter evasion).
   • Defense Evasion (performance against purifiers like DiffPure, DiffuseDef, or CoDefend).

3. Cross-Modality Fusion: The review integrates 50 papers from four previously disconnected streams (text/LLM, image classifier, VLM, defense) into a single conceptual framework, providing a comprehensive catalog and a public spreadsheet containing metadata for all included works.

4. Dual Attacker-Defender Perspective: The review covers four diffusion-based defenses (three for text classifiers, one for multimodal LLMs) as the natural evaluation backdrop for new attacks, highlighting the asymmetry between proliferating attacks and under-audited defenses.

Results and Findings

• State of the Art (Text/LLM): The literature on diffusion-based attacks against LLMs is nascent (4 papers) but diverse. Approaches include continuous latent denoising with Gumbel-Softmax (DiffusionAttacker), embedding-space perturbation under proximity constraints (DART), and training-free inference on pretrained masked diffusion LLMs (Lüdke et al.).
• State of the Art (Image/VLM): The image domain is mature, utilizing recipes like DDIM inversion, score guidance, and segment-wise back-propagation. VLM attacks are dominated by "pipeline-only" uses where diffusion renders images for pixel-space attacks, with few exploiting diffusion gradients directly.
• Performance Gaps:
  • Closed-Model Gap: Diffusion-based attacks show significantly lower success rates on frontier closed models (e.g., GPT-4o, Claude-3.5) compared to open-weight models. For instance, IDEATOR achieved 94% ASR on MiniGPT-4 but only 19.65% on Claude-3.5.
  • White-Box Dependency: Three of the four text-based attack papers rely on white-box gradients of the target model during training, limiting direct applicability to closed systems.
  • Discrete Diffusion Underuse: No published text attack combines a true discrete-diffusion sampler (e.g., D3PM, SEDD) with an explicit harmfulness reward and a large-scale evaluation (e.g., HarmBench).
  • Defense Evasion: Current text attacks rarely benchmark against modern input filters (e.g., Llama-Guard, SmoothLLM). Reported low perplexity is necessary but insufficient evidence of filter evasion.
  • Single-Turn Limitation: All text-based diffusion attacks produce single-shot prompts, failing to leverage diffusion's bidirectional conditioning for multi-turn dialogue attacks.

Significance and Claims
The paper positions itself as a critical "information-fusion exercise" that reduces duplicated effort across NLP safety, adversarial robustness, and generative modeling communities. Its primary significance lies in:

• Clarifying the Landscape: Providing the first consolidated reference for diffusion-based adversarial generation, distinguishing between methods that exploit diffusion gradients and those using diffusion as a black-box renderer.
• Identifying Research Gaps: Explicitly highlighting five recurring weaknesses in the current LLM-side literature (white-box dependency, lack of discrete diffusion, weak defense-evaluation, single-turn restriction, and lack of constrained red teaming).
• Defining the Agenda: Proposing concrete research directions, most notably the need for adaptive attacks that back-propagate through diffusion-based text purifiers (DiffuseDef, MaskPure, CoDefend), a gap that has not yet been addressed in the published literature.
• Ethical Stance: The authors emphasize that consolidating this literature is net beneficial for defenders and policymakers, prioritizing the identification of evaluation gaps and defense vulnerabilities over the reproduction of harmful payloads.

The review concludes that while diffusion-based attacks on LLMs are a young field with a small number of representative papers, they offer substantial methodological room for follow-on work, particularly in bridging the gap between image-domain techniques and text-based safety evaluation.