# Prompt Stealing Attacks Against Text-to-Image Generation Models Source: [Prompt Stealing Attacks Against Text-to-Image Generation Models]() Collection index: [llms.txt]() Data updated: 2025-10-26T02:37:39.153Z Authors: Xinyue Shen, Yiting Qu, Michael Backes, Yang Zhang Published: 2023-02-20T11:37:28.000Z ## Abstract Text-to-Image generation models have revolutionized the artwork design process and enabled anyone to create high-quality images by entering text descriptions called prompts. Creating a high-quality prompt that consists of a subject and several modifiers can be time-consuming and costly. In consequence, a trend of trading high-quality prompts on specialized marketplaces has emerged. In this paper, we perform the first study on understanding the threat of a novel attack, namely prompt stealing attack, which aims to steal prompts from generated images by text-to-image generation models. Successful prompt stealing attacks directly violate the intellectual property of prompt engineers and jeopardize the business model of prompt marketplaces. We first perform a systematic analysis on a dataset collected by ourselves and show that a successful prompt stealing attack should consider a prompt's subject as well as its modifiers. Based on this observation, we propose a simple yet effective prompt stealing attack, PromptStealer. It consists of two modules: a subject generator trained to infer the subject and a modifier detector for identifying the modifiers within the generated image. Experimental results demonstrate that PromptStealer is superior over three baseline methods, both quantitatively and qualitatively. We also make some initial attempts to defend PromptStealer. In general, our study uncovers a new attack vector within the ecosystem established by the popular text-to-image generation models. We hope our results can contribute to understanding and mitigating this emerging threat. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Prompt Stealing on DiffusionDB in-the-wild (50 images)](): Prompt Stealing; DiffusionDB in-the-wild (50 images); CLIP Score: 0.754. - [Prompt Stealing on MS COCO 50 random prompts](): Prompt Stealing; MS COCO 50 random prompts; CLIP Similarity: 0.898. - [Prompt Stealing on Flickr 50 random prompts](): Prompt Stealing; Flickr 50 random prompts; CLIP Score: 84.3. - [Prompt Stealing on Lexica 50 random prompts](): Prompt Stealing; Lexica 50 random prompts; CLIP Similarity: 80.4. ## Original sources and implementation [Original paper]() [PDF]()