ML Security PapersDIA: The Adversarial Exposure of Deterministic Inversion in Diffusion Models
Seunghoo Hong , Geonho Son , Juhun Lee , Simon S. Woo
Published on arXiv
2510.00778
Output Integrity Attack
OWASP ML Top 10 — ML09
Key Finding
DIA surpasses prior defensive methods AdvDM and Photoguard in disrupting DDIM-based image editing across multiple generative editing pipelines
DIA (DDIM Inversion Attack)
Novel technique introduced
Diffusion models have shown to be strong representation learners, showcasing state-of-the-art performance across multiple domains. Aside from accelerated sampling, DDIM also enables the inversion of real images back to their latent codes. A direct inheriting application of this inversion operation is real image editing, where the inversion yields latent trajectories to be utilized during the synthesis of the edited image. Unfortunately, this practical tool has enabled malicious users to freely synthesize misinformative or deepfake contents with greater ease, which promotes the spread of unethical and abusive, as well as privacy-, and copyright-infringing contents. While defensive algorithms such as AdvDM and Photoguard have been shown to disrupt the diffusion process on these images, the misalignment between their objectives and the iterative denoising trajectory at test time results in weak disruptive performance.In this work, we present the DDIM Inversion Attack (DIA) that attacks the integrated DDIM trajectory path. Our results support the effective disruption, surpassing previous defensive methods across various editing methods. We believe that our frameworks and results can provide practical defense methods against the malicious use of AI for both the industry and the research community. Our code is available here: https://anonymous.4open.science/r/DIA-13419/.
Key Contributions
- Identifies the objective misalignment between prior defenses (AdvDM, Photoguard) and the iterative DDIM denoising trajectory, explaining their weak disruption performance
- Introduces DIA (DDIM Inversion Attack), adversarial perturbations that directly target the integrated DDIM inversion trajectory path rather than a proxy objective
- Demonstrates superior disruption of diffusion-based image editing across multiple editing methods compared to prior defensive algorithms
🛡️ Threat Analysis
Defends content integrity by crafting adversarial image perturbations (DIA) that specifically disrupt the DDIM inversion path, preventing diffusion models from being weaponized to synthesize deepfakes or misinformation. Prior defenses (AdvDM, Photoguard) are anti-deepfake perturbation schemes in the same ML09 space; DIA improves on them by aligning the attack objective with the full iterative denoising trajectory.