Attacks on Approximate Caches in Text-to-Image Diffusion Models
This work uncovers security vulnerabilities in approximate caches of text-to-image diffusion models, enabling remote covert channels, prompt stealing, and poisoning attacks.
Key Findings
Methodology
Using Adobe’s NIRVANA approximate cache deployed on cloud GPUs, the authors combined FLUX and SD3 diffusion models with datasets DiffusionDB and Lexica. They designed attack primitives based on timing differences and content similarity, employing algorithms like CLIP and DINO for content detection. The experiments involved measuring cache hit/miss latency, content similarity via SSIM, and attack success rates, validating the feasibility of remote covert channels, prompt extraction, and content poisoning. The approach integrated system-level cache analysis with deep learning content verification, establishing a comprehensive attack framework.
Key Results
- The covert channel achieved 97.8% accuracy in FLUX, with secret messages persisting over 44 hours, exploiting timing and content features to enable stealthy communication.
- Prompt stealing (CacheExposer) recovered prompts with an average cosine similarity of 0.78, demonstrating the reversibility of cached prompts and revealing user inputs.
- Poisoning attacks embedded attacker logos into cached prompts, causing generated images to include unauthorized content, confirming cache pollution risks.
Significance
This research exposes critical security flaws in the efficiency-driven caching mechanisms of diffusion models, highlighting risks of data leakage, content manipulation, and privacy breaches. As these models become integral to commercial AI services, such vulnerabilities threaten user trust and intellectual property. The findings emphasize the need for robust security measures in system design, balancing efficiency with safety, and guiding future standards for trustworthy AI deployment.
Technical Contribution
The paper pioneers a systematic security analysis of approximate caching in diffusion models, introducing attack primitives based on timing and content similarity. It develops novel attack schemes—remote covert channels, prompt extraction, and content poisoning—validated through extensive experiments. The work bridges system-level cache analysis with deep learning content verification, offering a new perspective on AI system security and establishing a foundation for future defensive strategies.
Novelty
This is the first comprehensive study to treat approximate cache as an attack vector in text-to-image diffusion models. Unlike prior work focusing solely on model vulnerabilities, it leverages cache timing and content features for remote information hiding and content manipulation. The innovative combination of system timing analysis, deep learning content detection, and attack primitives marks a significant advancement in AI security research.
Limitations
- The attacks depend on specific cache configurations and model parameters, which may vary across deployment environments, limiting generalizability.
- Content detection methods like DINO may produce false positives/negatives in complex or noisy images, affecting attack reliability.
- Current experiments are primarily in cloud GPU settings; real-world scenarios might face additional network or security layer restrictions, requiring further adaptation.
Future Work
Future research will explore multi-modal and multi-task scenarios, integrating privacy-preserving techniques like differential privacy and encryption. Developing robust defenses, such as cache isolation, content validation, and anomaly detection, is crucial. Extending the analysis to other generative models and real-world deployment environments will help establish comprehensive security standards, ensuring trustworthy AI systems.
AI Executive Summary
The rapid advancement of text-to-image diffusion models has revolutionized content creation, enabling high-fidelity image synthesis from simple prompts. However, the high computational cost of these models has led to the adoption of approximate caching techniques, which reuse intermediate states to speed up generation. While effective, this optimization introduces significant security vulnerabilities.
This study systematically investigates the security implications of approximate caches in diffusion systems. By deploying Adobe’s NIRVANA cache on cloud GPUs with models like FLUX and SD3, the authors demonstrate that timing differences and content similarities can be exploited to establish remote covert channels, allowing malicious actors to secretly transmit information without direct access.
Furthermore, the research reveals that prompts stored in the cache can be recovered through timing and content analysis, enabling prompt stealing attacks. The authors also show that attacker-injected logos can be embedded into cached prompts, leading to content poisoning where generated images contain unauthorized elements. These attacks are performed remotely, highlighting the severe security risks associated with efficiency-driven caching mechanisms.
The findings underscore the importance of integrating security measures into system design, such as cache isolation and content verification, to prevent data leakage and malicious manipulation. As diffusion models become more prevalent in industry, safeguarding these systems against such vulnerabilities is critical. Future work will focus on developing robust defenses and extending security analysis across diverse generative frameworks, ensuring the safe and trustworthy deployment of AI content generation technologies.
Deep Dive
Abstract
Diffusion models are a powerful class of generative models that produce images and other content from user prompts, but they are computationally intensive. To mitigate this cost, recent academic and industry work has adopted approximate caching, which reuses intermediate states from similar prompts in a cache. While efficient, this optimization introduces new security risks by breaking isolation among users. This paper provides a comprehensive assessment of the security vulnerabilities introduced by approximate caching. First, we demonstrate a remote covert channel established with the approximate cache, where a sender injects prompts with special keywords into the cache system and a receiver can recover that even after days, to exchange information. Second, we introduce a prompt stealing attack using the approximate cache, where an attacker can recover existing cached prompts from hits. Finally, we introduce a poisoning attack that embeds the attacker's logos into the previously stolen prompt, leading to unexpected logo rendering for the requests that hit the poisoned cache prompts. These attacks are all performed remotely through the serving system, demonstrating severe security vulnerabilities in approximate caching. The code for this work is available.