Adversarial Attacks on AI: Meta-Survey Maps Threats to Diffusion

A review of the reviews

Research on adversarial machine learning has grown so large that the field now needs surveys of its surveys. A new paper by Marek Pawlicki, Aleksandra Pawlicka, Rafał Kozik and Michał Choraś offers one: a meta-survey of adversarial attacks against AI algorithms that explicitly includes diffusion models, the technology behind many modern image generators 1. The authors describe it as the first umbrella review to synthesise systematic reviews and meta-analyses on attacks against deep neural networks. They also treat diffusion-based generative models as an emerging target 2.

The paper is distributed through the website of the EU-funded STARLIGHT project and published via ScienceDirect 12. That gives it a clear institutional footprint in European security research. The two versions overlap almost entirely in substance. One adds the author list, and the other adds the highlights and section structure.

How the study is built

The authors did not simply gather prior work. They used a PICO-driven framework, a structured method borrowed from evidence-based medicine, to frame three research questions [2]:

• What themes and methods do existing surveys cover?
• How do attack strategies differ across application domains?
• Which adversarial characteristics hold across domains?

This approach matters. A great deal of adversarial ML literature is scattered across computer vision, language and security venues, and each uses its own vocabulary. An umbrella review that asks the same questions of every survey could make those bodies of work easier to compare.

The main output is a taxonomy of attack families. It covers gradient-based, transfer-based, score-based and decision-based attacks, plus black-box attacks, data poisoning, privacy attacks and universal adversarial perturbations 2. Most of these categories already exist. What is new is that one framework places them side by side across domains.

From typos to paraphrases in language attacks

The section on natural language processing gives a short history of how text attacks have developed. Early attempts often changed only a few characters or words. Those edits sometimes left spelling errors that a human reader would notice 2. Even so, they showed that NLP models could be fooled. Later work moved to sentence-level and multi-level attacks. These use paraphrases, or even whole inserted sentences, to hide the manipulation while the text still reads naturally 2.

This is the kind of pattern a cross-domain review is well placed to reveal. Image attacks also began with crude perturbations before attackers tuned them to be imperceptible. Text attacks appear to be following a similar path toward stealth, and that makes defences based on human review less dependable.

Diffusion models: attack surface and shield

The most notable part of the paper may be its treatment of text-to-image systems such as Stable Diffusion. The review includes a subsection on adversarial techniques used to protect artists, not to harm systems 2. One method it cites permanently erases specific visual concepts from a pretrained diffusion model. It does this by fine-tuning the model's weights using only a short text description of the unwanted concept 2.

This framing deserves attention. In generative AI, the line between attack and defence becomes blurred. The same techniques that let an adversary manipulate a model can let creators or developers stop it from reproducing certain styles or content. If a review treats concept erasure and artist protection as part of the adversarial landscape, it suggests the field's categories are being stretched by generative models in ways classifier-era research did not anticipate.

Why it matters

For practitioners, the paper's value is less about new attacks and more about orientation. Security teams, auditors and policymakers dealing with AI risk often face a fragmented literature with uneven terminology. A taxonomy built from existing systematic reviews could serve as a common reference, especially as regulators ask for evidence that deployed models have been tested against adversarial threats. That last point is an inference about how the work could be used, not a claim the authors make.

There are also limits. An umbrella review can only be as current as the surveys it gathers. In a field changing as quickly as generative AI, secondary sources lag behind new attacks. The inclusion of diffusion models signals that the authors know this, but readers should treat the taxonomy as a snapshot.

The takeaway

In our reading, the paper is most useful as a consolidation exercise. It brings older work on gradient and black-box attacks against classifiers into the same frame as the newer and messier problems of generative models. Its clearest message is that adversarial threats now share traits across text, images and generative systems, and that defences will need to be designed with that in mind.