## Autonomous LLM-Enhanced Adversarial Attack for Text-to-Motion

Honglei Miao , Fan Ma , Ruijie Quan , Kun Zhan 1 2 2 1 ,⋆ , and Yi Yang 2 1. School of Information Science and Engineering, Lanzhou University 2. CCAI, Zhejiang University

## Abstract

Human motion generation driven by deep generative models has enabled compelling applications, but the ability of text-to-motion (T2M) models to produce realistic motions from text prompts raises security concerns if exploited maliciously. Despite growing interest in T2M, few methods focus on safeguarding these models against adversarial attacks, with existing work on text-to-image models proving insufficient for the unique motion domain. In the paper, we propose ALERT-Motion, an autonomous framework leveraging large language models (LLMs) to craft targeted adversarial attacks against black-box T2M models. Unlike prior methods modifying prompts through predefined rules, ALERT-Motion uses LLMs' knowledge of human motion to autonomously generate subtle yet powerful adversarial text descriptions. It comprises two key modules: an adaptive dispatching module that constructs an LLM-based agent to iteratively refine and search for adversarial prompts; and a multimodal information contrastive module that extracts semantically relevant motion information to guide the agent's search. Through this LLM-driven approach, ALERT-Motion crafts adversarial prompts querying victim models to produce outputs closely matching targeted motions, while avoiding obvious perturbations. Evaluations across popular T2M models demonstrate ALERT-Motion's superiority over previous methods, achieving higher attack success rates with stealthier adversarial prompts. This pioneering work on T2M adversarial attacks highlights the urgency of developing defensive measures as motion generation technology advances, urging further research into safe and responsible deployment.

## 1. Introduction

Human motion generation is a task aimed at producing natural and realistic human motions. It drives advancements in downstream applications such as animation and movie production, virtual human construction, robotics and humanrobot interaction [42]. In recent years, with the development of deep learning, especially the growth of generative models such as Generative Adversarial Network (GAN) [8], Varia- tional Autoencoder (VAE) [17], and diffusion model [14], trained models have become capable of generating very natural motions [7, 11, 35, 40]. Some models [3, 4, 18, 28] even extend the generated motions for several minutes while satisfying given conditions. Among these motion generation models, text-to-motion (T2M) [3, 4, 7, 11, 28, 35, 40] gains particular attention from the community due to the user-friendly nature of text prompts that align with human expression.

Generating motions that exactly align with textual descriptions and are nearly the same as the real physical world is becoming increasingly feasible. However, allowing models to freely generate motions conditioned on arbitrary text prompts is even more dangerous than text-to-image (T2I). When they are applied to downstream tasks, such capabilities are maliciously exploited by attackers. For instance, in animation or movie production [28], they are used to create more realistic harmful content involving pornography or violence. The risks are boosted when using the generated motions as humanoid controllers [23], as they eventually are deployed on robots, posing potential threats to human safety.

Despite the growing focus on T2M tasks, there is currently a lack of research addressing the safety concerns specific to this domain. The most relevant line of work is on the safety of T2I [19, 25, 34]. These researches largely focus on how character-level or word-level modifications to benign text prompts could induce unintended outputs from the models. Early work [25, 34] primarily explored the existence of this phenomenon, until the RIATIG [19] is inspired by them to propose targeted attacks against image generation models to raise awareness of potential security risks about T2I. However, these existing studies often search for adversarial attacks by modifying words to uncommon personal names, locations or other proper nouns, which is overlooked in image generation but would appear clearly out of place for motion tasks, making the attacks more easily detectable. Additionally, unlike the abundant image-text pairs available for image tasks, the limited data for motions makes it challenging to accurately measure the similarity between different motions, posing further difficulties for targeted attacks on T2M models. They make the findings from T2I safety diffi-

Figure 1. Adversarial prompt against T2M model with RIATIG and our ALERT-Motion. Previous methods like RIATIG only perturb prompts through predefined character or word operations, overlooking the integrity and semantics of the prompts. Our ALERT-Motion doesn't require such predefined operations; instead, by multimodal information contrastive (MMIC) module, the language model autonomously learn and perform these operations, dynamically generating adversarial prompts that meet the attack requirements. Under the same input (target and initial prompt), our method captures more natural and fluent prompts related to motion. When these prompts are used to query the victim T2M model, the resulting motion show a stronger resemblance to the target motion. Darker color indicates later frames in the sequence.

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-f650e22f-0d20-4dbd-b8e8-c06d5a3db0b4.jpg)

cult to directly apply to the motion domain.

To address the challenges of adversarial attacks on T2M models, we introduce ALERT-Motion , an autonomous large language model (LLM) enhanced adversarial attack against T2M models in a black-box setting. Unlike prior work, our ALERT-Motion leverages the knowledge about motions contained in LLMs to generate subtle yet powerful adversarial descriptions, whose outputs from the victim model closely match the desired motion. Crucially, the entire attack process is done automatically by LLM agent, using its own reasoning abilities to carry out the attack, without needing human-defined rules for operations like inserting, deleting or replacing characters or words.

multimodal information contrastive (MMIC) module. In AD module, by simply designing instructions for different processes, LLM autonomously searches for adversarial text prompts that appear natural and fluent, avoiding the abrupt word insertions seen in RIATIG. However, as LLMs lack inherent capabilities for processing motion modality, we design MMIC module to obtain semantically similar information to the target motion, thereby assisting AD module in finding better adversarial text prompts. Through the coordinated operation of these two modules, ALERT-Motion generates adversarial text prompts that are not only natural and fluent but also query the victim T2M model to produce outputs closely resembling the target motions.

As shown in Figure 1, previous state-of-the-art attack methods like RIATIG [19] for T2I models employ manually defined word or character-level modifications and promptlevel crossover, making it difficult to find natural and fluent adversarial text prompts. Such methods often result in obvious personal names or proper nouns like 'Sebastian Hohenthal Fortec Motorsport' or 'Boris Novachkov' appearing abruptly in descriptions of motions. In contrast, our proposed ALERT-Motion gives the modification of adversarial text prompts entirely to LLMs. It comprises two key modules: the adaptive dispatching (AD) module and the

In summary, the key contributions are as follows:

- 1. To the best of our knowledge, we are the first to propose an adversarial targeted attack method, ALERT-Motion, for T2M models. We introduce an autonomous LLM-enhanced adversarial attacks on T2M models.
- 2. Our proposed ALERT-Motion consists of two key modules. A novel AD module constructs an LLM agent that incorporates the agent's inherent natural language and domain knowledge of motions into the automatic attack process. Additionally, MMIC module performs high-level semantic extraction of motion modalities and provides neces-

sary semantical information to support AD's reasoning and decision-making.

- 3. We evaluate ALERT-Motion on two popular T2M models and compare it against two previous adversarial attack methods originally applied to T2I models. Experimental results demonstrate that our proposed ALERT-Motion achieves higher attack success rates while generating more natural and stealthy adversarial prompts that are difficult to detect.

## 2. Related Work

## Text-to-Motion (T2M)

T2Mis a conditional motion generation task that aims to generate semantically matching and natural motion sequences from human-friendly natural language text descriptions. Its promising performance is driven by deep generative models such as GANs, VAEs, diffusion models, etc. One of the early works in this domain, Text2Action [1], leverages GANs to create abundant realistic motions. Some research also explores the use of VAEs for generation, where Language2Pose [2] proposes an end-to-end text-to-pose generation framework that utilizes a VAE to model the latent space between text and motion. TEACH [3] further combines previous motions as extra inputs to the encoder module, enabling natural and coherent motion generation when handling multiple text inputs. With the rise of diffusion models in the generative domain, some studies have also employed diffusion models for motion generation. MDM [35] utilizes a diffusion model to predict the sample at each diffusion step rather than just the noise. MLD [7] adopts latent diffusion along with a VAE to generate motions, significantly boosting the generation speed without compromising quality. Additionally, there are studies that combine VQ-VAE with GPT-like transformers. TM2T [12] and T2M-GPT [40] utilize VQ-VAE to concatenate training T2M and motionto-text modules. These works continuously improving the quality, coherence, and efficiency of motion generation from text descriptions. However, there has been no research focusing on attacks and defenses of the T2M model.

## Adversarial Attacks on Text-driven Generative Models

Due to the convenience of text input for users, it serves as the most common driving condition for many multimodal generation models. However, the inherent complexity of text input inevitably introduces vulnerabilities to the generative models driven by it. Existing research on adversarial attacks in T2I models, such as [19, 20, 29, 43], attack T2I models by modifying the input text, causing abnormal outputs. The types of abnormal outputs may include degraded synthesis quality [20], disappearance or alteration of objects in the image [19, 43]. Among them, [19] manipulates words and characters, thereby causing the targeted objects specified by the attacker to be generated in the image by the victim T2I model. These studies indicate the lack of robustness of existing T2I models to input text. With the occurrence of LLMs, many studies also focus on the vulnerabilities of LLMs. A large portion of them focus on jailbreaking, making LLMs answer queries that violate safety policies. Jailbreaking strategies have evolved from manual prompt engineering [22, 36] to LLM-based automated red-teaming [21, 26]. Beyond these template-based jailbreaks aimed at identifying effective jailbreak prompt templates, a more general jailbreaking method called Greedy Coordinate Gradient [44] is recently proposed. It uses a white-box model to train adversarial suffixes that maximize the probability of an LLM producing affirmative responses. They [33, 44] find that the identified suffixes transfer to closed-source off-the-shelf LLMs. The vulnerabilities of T2M models share similarities with the aforementioned security research on text-driven generative models. However, since the correspondence between motion and text involves the time dimension, the adversarial attack methods from the above studies cannot be directly applied to T2M.

## LLMAgents

Research on using LLMs to enhance autonomous agents has seen a growing trend in recent years [41]. These LLMpowered agents, exemplified by HuggingGPT [32], WebGPT [13], and MM-REACT [38], have been employed to tackle intricate tasks that demand effective understanding and planning from the agents. A considerable proportion of these studies leverage the rich commonsense knowledge inherently embedded within LLMs to execute downstream tasks with minimal or no additional training data. This approach helps to maintain the robust foundational world knowledge in LLMs. The demonstrated capabilities of LLMs encompass features such as zero-shot planning in real-world scenarios [15]. Inspired by these explorations, we introduce LLMs into the realm of adversarial attacks on T2M models, achieving an autonomous attack agent adept at crafting effective adversarial prompts.

## 3. Methodlogy

We leverage an LLM to iteratively refine and enhance adversarial prompts towards a target motion. Initially, LLM generates alternative prompts semantically similar to the initial prompt to expand the search space. It then queries the victim T2M model with these prompts, recording the generated motions. The textual prompts and corresponding motions are unified into a suitable input format for LLM using MMIC. Exploiting its commonsense reasoning capabilities, LLM autonomously contemplates and updates the prompts based on the query results, iteratively steering them closer to the target motion. This process continues until the adversarial prompts evade detection while generating

Figure 2. Overview of the proposed ALERT-Motion. ALERTMotion operates in a black-box setting with two key modules: multimodal information integration module for consolidating information from text and motion into a unified format, and autonomous AD module that learns and executes adversarial prompt search through progresses of expansion, refinement, and update.

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-d06aa174-0297-4e21-bec8-df8690b26b5b.jpg)

motions closely matching the target. Fig. 2 overviews our ALERT-Motion attack framework.

## 3.1. Problem Formulation

A T2M generative model G is essentially a function that maps the text prompt space P to the motion space M . Ideally, through training on semantically aligned text-motion pairs, a proficient model generates target motion m t that is semantically consistent with a given target prompt p t . The objective of an adversarial attack is to find an adversarial prompt p ⋆ such that G p ( ⋆ ) closely approximates the target motion m t . Simultaneously, the p ⋆ is semantically dissimilar from the target prompt p t to avoid detection. The optimization steps outlined above are formulated as follows

$$p ^ { * } = \underset { p \in P } { \arg \max } \ s ^ { m } \left ( G ( p ), m _ { t } \right ), \text{ s.t. } s ^ { P } \left ( p, p _ { t } \right ) < \eta \ \ ( 1 ) \quad \text{criti} \ \text{an at}$$

where s m represents the semantic similarity of motion, s p represents the semantic similarity between text prompts, and P is a promote set. η is the similarity threshold. As long as the similarity between the adversarial prompt and the target prompt is below η , we consider that our attack evades existing detection.

## Challenges

Implementing adversarial prompt generation from T2M models faces some challenges. First, T2M models need to go between natural language and physical motion, crossing the gap between language and motion domains. Different data types have different representation spaces, so integrating multi-modal information is needed. Second, the adversarial language prompts need to have high fluency in natural language and relevance to the target motion in their query results. But they also need to effectively fool the model. The space to search for good prompts is extremely large though. Autonomously generating optimal adversarial samples that meet these combined quality requirements is a big challenge.

## 3.2. Multimodal Information Contrastive

Unlike most LLM agent-related researches, our task involves motion, which LLM cannot directly handle. Therefore, we design MMIC specifically to process information from different modalities in the task and organize it into textual information, making it convenient for LLM to understand and reasoning. As shown in Fig. 2, MMIC allows the adversarial prompts, refined through LLM, to query the victim T2M model, obtain corresponding motion and calculate the similarity with the target.

Nevertheless, measuring the similarity directly between two motion poses challenges. We consider semantically measuring the similarity of motion. RIATIG [19] employs the pretrained CLIP [31], a model trained on a large-scale dataset of image-text pairs, to obtain semantic features aligned with textual descriptions. Similarly, we use the T2M alignment model proposed in [27] to extract semantic motion features and calculate the cosine similarity between the semantic features of motion as

$$s ^ { \mathrm m } ( G ( p ), m _ { t } ) = \frac { E _ { m } ( G ( p ) ) \cdot E _ { m } ( m _ { t } ) } { \| E _ { m } ( G ( p ) ) \| \, \| E _ { m } ( m _ { t } ) \| }, \quad ( 2 )$$

where E m is a motion encoder [27].

Subsequently, we organize this information into text and incorporate it into instructions, enabling LLM to contemplate and reason for better adversarial prompts.

## 3.3. Adaptive Dispatching

In our proposed ALERT-Motion framework, the most critical module is the AD module. This module constructs an attack agent and plays a pivotal role in determining the effectiveness of adversarial prompts. In contrast to previous related researches, which predefine various operations to perturb semantics and then use a search algorithm to find prompts with higher scores, we directly convey complex task requirements using instructions, allowing LLM to automatically learn and execute all operations, with each step conducted in textual form. According to the purpose of instructions, we divide AD into three progresses: expansion, refinement, and update. The workflow of these three progresses and MMIC is outlined in Algorithm 1.

Due to the fact that AD responds to the current input in each round, similar to an agent in reinforcement learning, we borrow related concepts here to facilitate the definition of the processes within AD. We start by defining the state

someone is climbing a ladder,  they walk up 3 steps and then back down.

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-0954e14a-a1a8-4e96-9af9-177bd74ab147.jpg)

unal is stieges a lestre edas they checam up 00 ritggi and then back y.

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-82ec528a-903f-445d-8f49-8ce0b90e30e9.jpg)

the camera Hemen Kapadia CEO across and through panoramically distinguishable perspectives in this stunning forcible removals movie that will keep anyone Jordan Perlson

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-641c4395-6c5d-4cc1-afb1-36952cdd16a8.jpg)

through some thing and chash some thing.

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-28c91e60-38a8-46ca-901e-b877f831b15e.jpg)

through einigealcuni oseache and shsch quelquesalgunos ..

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-5822dc3b-f0a5-4bef-8398-dd3241b76ec0.jpg)

the SCHIEFFER Well was about both brothers hoping not get sh ot at as AJ ALLMENDINGER Yeah opposing Biblical precepts engage

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-76215182-6ab3-4fce-bd27-a30d2e32ffcc.jpg)

place items in a line up

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-dfb4c7aa-cb07-40bb-a72d-54566d8713b1.jpg)

platzlugar glist in a línealigne up

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-7c60a913-fa31-4f51-9673-c4778938b694.jpg)

a young Edmonton Eric Sehn stands st il l for about 10 m in utes while staring off in one championship MX1 l' Afrique o1 1 l ost

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-fd97e0fc-f932-4d66-bfe8-d723a99ef453.jpg)

sit on the floor and through some thing.

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-ee971f0f-f358-40f2-9896-8d53ea13194f.jpg)

ss on the leboden and through algunosalcuni toose

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-a344b471-5f4a-4305-b497-c7d4f9f2c0a3.jpg)

a camera BACHMANN Well around an object to catch its ruddy glow off its reflective near Mizda

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-e55e3748-d315-46b2-9d0e-a4e6c0dda352.jpg)

ALERT-Motion

Soar through an enchanting journey overflowing with endless imagination and awe-inspiring sorcery.

Effortlessly navigating a tight space with grace and precision.

The plates are crashing with tremendous speed and effectiveness.

Figure 3. Examples of adversarial attack results against MDM. The first row of text provides the true annotations for each column of target motions, and the first row of motions corresponds to their respective target motions. The following three rows of text correspond to the adversarial prompts obtained by MacPromp, RIATIG, and our proposed ALERT-Motion. The motion-rendered images below the text depict the motions generated by querying the victim model with the adversarial prompts. Darker color indicates later frames in the sequence.

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-048e6359-39dc-4512-a686-dc356a643e43.jpg)

Racing through a famous film location on two stunning stallions, leaving a lasting impression on the entertainment world and cementing your status as a legendary performer.

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-bbfb4ef4-6a69-4d65-8456-cd0b69458bb2.jpg)

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-2fc6f9be-3741-47ba-9a18-dd1939c15c48.jpg)

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-46a8136c-b37d-4943-97e9-548fa64bd54d.jpg)

## Algorithm 1 ALERT-Motion

Input: Initial prompt p 0 , expansion instruction I E , refinement instruction I R , update instruction I U , size of updated prompts N s , m denotes the similarity of the adversarial motion and the target motion, a predefined number of iterations K .

- 1: Expansion: S 1 ← LLM( I E , S 0 = p 0 )
- 2: for k = 1 to K do
- 3: if k ( mod 2) = 1 then
- 4: Refinement: S 2 k ← LLM( I R , S 2 k -1 )

5:

MMIC:

Compute

s

m

i

(

G p

(

i

)

, m

t

)

,

∀

p

i

6:

Obtain the similarity set

S

′

2

k

=

{

s

1

∈

S

, . . . , s

2

m

n

- 7: else
- 8: Update S 2 k +1 ← LLM( I U , cat( S 2 k , S ′ 2 k )) .
- 9: end if

10: end for

$$\text{Output} \colon \, p ^ { * } = \underset { p \in P } { \arg \max } \left ( s ^ { m } ( G ( p ), m _ { t } ) \right ), P = \cup S _ { 2 k } \,.$$

as the set of adversarial prompts and their corresponding information for each round, while the action is represented by various instructions sent to LLM. LLM is viewed as a

m

function involving the next state S k +1 , current state S k , and current action a k , expressed as

$$S _ { k + 1 } \leftarrow T ( S _ { k }, a _ { k } ) = \text{LLM} ( I, S _ { k } ), \quad \ ( 3 )$$

where T is the state transition function and I represents the instruction text corresponding to a k . It is important to note that the representation of state S differs between odd and even time steps, it is defined as

$$S _ { k } = \begin{cases} \{ p _ { 0 } \} & \text{if $k=0$} \\ \{ p _ { 1 }, \dots, p _ { n } \} & \text{if $k(\bmod 2) =0$} \\ \{ p _ { 1 } ^ { \prime }, \dots, p _ { n } ^ { \prime } \} & \text{if $k(\bmod 2) =1$} \end{cases}$$

where p 0 is initial adversarial prompt, { p , . . . , p 1 n } is the set of refined prompts, and p ′ are the expanded or updated prompts of p .

## Expansion

Initially, we begin with a single available adversarial prompt p 0 . The current state is defined as S 0 = { p 0 } . Without expansion, proceeding directly to the subsequent steps may lead the search into a local optimum. So we employ the expansion instruction text E to obtain expanded results through

k

}

.

Target Motions a person swam in free style

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-1b987e7a-81ae-41b0-abba-859b74598a85.jpg)

a personnepersona ams in frelibre estilostile

this image is from my recent visit at the Underwater Starborn and it is exceedingly impressive

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-3f87d446-3bc0-4a9c-b0b9-f33fa532cf4f.jpg)

I was captivated by the graceful and effortless motions of the sea creatures as I glided through the aquarium.

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-67059085-1313-4d17-ac94-25aa8cee7762.jpg)

figure appears to be fighting or dancing

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-69a7750b-fd2b-48e2-88d4-5216b5f89b44.jpg)

fra appart to be ecombat or danzen

it s not just any movie anyway TOR M1 missiles can now experience what it s been trying too

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-f1e97f6c-6c26-404c-81fa-dc5c671e6e65.jpg)

Enthusiastically embracing each other with intense ardor, the duo indulged in their beloved hobbies and pastimes, reveling in the unrestrained joy and uninhibited fervor.

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-f31fd6d8-1c76-4a02-8164-f594c2792341.jpg)

a person slowly walked forward and returned back

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-ade646c4-c98f-4fc9-ab40-85b300a09abf.jpg)

a personpersona enteenta andoung tenlante and ritornozurück back

it s not always easy to tell how the person s eyes or mou th will appear in motion as it FROM TPP an interpretation

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-dcbb46a8-3151-4158-8e04-ca6d5d1fc7b0.jpg)

Observe the movements and gestures of those around you to gain insight into their relationships and challenges. Reflect on your own movements and how they intersect with others.

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-17ff82a7-d40e-4701-a7f4-cf48f94caf76.jpg)

a person jumping while rasing both hands, and move apart legs

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-2a3d5a62-b254-4806-9c7d-40e10bef7e0a.jpg)

a personapersonne sprer while raen both mani, and istel mouvementwegung absado gaamb

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-ff5efc8c-bd4b-434b-b3a6-eecfa490c2f0.jpg)

this scene is about the action happening inside someone who may feel nervous due their current state of being in that moment with that siuation

I cant contain my excitement as I bounce and bound with an abundance of energy for the occasion.

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-8da27ef8-c398-4bcf-8e7d-f966dd6d42c7.jpg)

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-19b7e1a7-4f69-4c30-9c9e-b117f75cb333.jpg)

Figure 4. Examples of adversarial attack results against MLD. The first row of text provides the true annotations for each column of target motions, and the first row of motions corresponds to their respective target motions. The following three rows of text correspond to the adversarial prompts obtained by MacPromp, RIATIG, and our proposed ALERT-Motion. The motion-rendered images below the text depict the motions generated by querying the victim model with the adversarial prompts. Darker color indicates later frames in the sequence.

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-42d771a2-7b82-4875-b079-e6cc9dbacf6e.jpg)

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-f4d33525-45d7-4201-96ab-d4118611526e.jpg)

![Image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00352v1-figure-107e5b7b-e19e-4fa3-bb6d-239d6d44d3db.jpg)

## LLM. The next state is represented as

$$S _ { 1 } \leftarrow \text{LLM} ( I _ { E }, S _ { 0 } ) \text{ \quad \ \ } ( 5 ) \text{ \quad } \lambda _ { \text{a} }$$

where I E represents the expansion instruction and S 1 = { p , . . . , p 1 n } is the set of expanded prompts.

## Refinement

Wefind that when the instructions given to LLM are too long, its responses may sometimes fail to meet the attack requirements. New instructions are needed to emphasize the attack requirements in our task. Therefore, in this progress, we refine the adversarial prompts to ensure that they consistently meet the attack requirements, including being naturally fluent and relevant to motion. After refinement, the state of the agent is defined as

$$S _ { 2 k } \leftarrow \text{LLM} ( I _ { R }, S _ { 2 k - 1 } ) \text{ \quad \ \ } ( 6 ) \text{ \quad fie}$$

where k ∈ { 1 , . . . , K } and I R represents refinement instruction.

## Update

Unlike existing methods that relied on numerical scalar guidance to generate adversarial prompts, such as RIATIG, our

AD utilizes the text information organized by MMIC to guide LLM in autonomously contemplating and generating adversarial prompts. This allows us to finely control the generated adversarial prompts more effectively in line with the attack requirements using richer information. Moreover, this control is automated, eliminating the need for continuously defining new operations, such as word or character insertion, deletion, replacement, and so forth, as in previous methods. In the update progress, as LLM contemplates and generates adversarial prompts, the information organized by MMIC is also fed into LLM to assist in its decision-making process. After update, the state of the agent is defined as

$$S _ { 2 k + 1 } \leftarrow \text{LLM} \left ( I _ { U }, \text{cat} ( S _ { 2 k }, S _ { 2 k } ^ { \prime } ) \right ) \quad \ \ ( 7 )$$

where I U is the update instruction and the function cat signifies string concatenation, and S ′ 2 k = { s m i ( G p ( i ) , m t ) , ∀ i ∈ { 1 , . . . , n }} is obtained by Eq. (2).

After K rounds of iteration, we choose the highestscoring prompt among all candidates as the optimal adversarial prompt p ⋆ for the attack. The definition of p ⋆ is obtained by Eq. (1). Here P = ∪ S 2 k and S 2 k = { p , . . . , p 1 n } . In order to ensure that the adversarial prompt meets the constraints, we calculate the similarity between the adversarial

prompts and target prompt as

$$s ^ { p } ( p _ { t }, p ) = \frac { E _ { t } ( p _ { t } ) \cdot E _ { t } ( p ) } { \| E _ { t } ( p _ { t } ) \| \, \| E _ { t } ( p ) \| }, \quad \ \ ( 8 ) \quad \ \.$$

where E t is a text encoder [6] to extract features.

## 4. Experiment

## 4.1. Experimental Settings

## Datasets.

We select target prompt texts and target motion from the HumanML3D (H3D) [11]. It includes 14,616 motion sequences from AMASS [24], each with a textual description (totaling 44,970 descriptions). It also re-annotates AMASS and HumanAct12 [10] motion capture sequences. The dataset provides a redundant data representation involving root velocity, joint positions, joint velocities, joint rotations, and foot contact labels. It is used for both AMASS and HumanAct12 motion.

## Victim Models.

To assess the effectiveness of ALERT-Motion, we select two prominent publicly available T2M models: MLD and MDM. We employe their respective pretrained models from the official GitHub repositories, which were trained on H3D.

## Evaluation Setup.

In our experiments, all attacks are conducted in a black-box setting, meaning that we generate motion only by querying the model with prompts and obtaining the generated results. We utilize the 'gpt-3.5-turbo-instruct' API with ChatGPT to implement our approach. The initial adversarial prompt text is a motion description randomly generated by ChatGPT. We set the number of iterations as 50 , the size of the prompt set as 20 . We set the similarity threshold η as 0 4 . . Examples for the attack were taken from the top 20 of the Dissimilar subset in the evaluation setup of [27], where the model achieves the highest accuracy. During the attack process, we use the model from [27] to extract the motion features to compute cosine similarity and adopt the text feature extraction from [37]. The effectiveness is evaluated using T2M [11].

## Baselines.

To the best of our knowledge, there is currently no targeted adversarial attack specifically designed for T2M generation. For comparison, we select two state-of-the-art targeted adversarial attack methods for text-to-image generation, MacPromp [25] and RIATIG [19], as baseline methods. Since their tasks do not involve motion, we modify their task settings to match our task.

## 4.2. Evaluation Metrics

## Motion Performance.

We utilize the R Precision, a widely-used metric in T2M [7, 12, 35, 40] to evaluate generated motion. This assessment involves comparing each motion not only with its groundtruth text but also with a misaligned description. R Precision is determined through the Euclidean distance between motion and text features. Our evaluation centers on measuring the average accuracy among the topk ranked descriptions. A ground-truth within the topk candidates is considered a 'True Positive' retrieval. Our approach involves a batch size of 20, encompassing 19 negative examples, and we explore the effectiveness of R at various values: 1 (R-1), 2 (R-2), 3 (R-3), 5 (R-5), and 10 (R-10). Furthermore, our study incorporates Frechet Inception Distance (FID) as a metric to assess the quality of generated motion. FID, a widely accepted standard for evaluating content quality [7, 35], involves comparing features extracted from generated motion and real motion. In our motion domain adaptation, we adopt an evaluator network to represent deep features, deviating from the original image-based Inception neural network. Smaller FID values are indicative of superior results. Additionally, we compute the Multimodal Distance ( d MM ), which is the mean Euclidean distance between the motions features and their corresponding textual descriptions features in the test examples [7, 35]. A lower value indicates better alignment between prompts and their generated motions.

## Adversarial Similarity.

In adversarial attacks, it is essential for adversarial prompt text to have low similarity with the target prompt text to evade detection. In line with previous studies, our initial step involves utilizing the Universal Sentence Encoder [6] for encoding both the adversarial sentence and the target sentence, resulting in high-dimensional vectors. Subsequently, we determine their adversarial similarity by computing the cosine score.

## Naturality.

To ensure the naturalness of adversarial examples, we measure perplexity (PPL) using GPT-2 [30], trained on realworld sentences. PPL assesses the likelihood of the model in generating the input text, thereby indicating natural fluency of the adversarial prompts. Lower PPL values typically signify higher naturalness.

## 4.3. Evaluation Results

The attack results on MLD and MDM are shown in Table 1. Compared to the baselines, ALERT-Motion achieves a higher R-precision. Although MacPromp achieves higher

Table 1. The results of the adversarial attacks against MDM and MLD on T2M evaluation model. The first row, labeled 'Target Motion', represents the motion generated by the corresponding victim models, which are the targets of our attack. The quality of these indicators depends solely on the capabilities of the generation models and evaluation models. The second and third rows correspond to the baseline models MacPromp and RIATIG that we select. The final row represents the performance of our proposed method, ALERT-Motion.

| Attack Methods   | R-1 1 ↑   | R-2 ↑   | R-3 ↑   | R-5 ↑   | R-10 ↑   | FID ↓   | d MM ↓   | PPL 2 ↓   | AS 3 ↓   |
|------------------|-----------|---------|---------|---------|----------|---------|----------|-----------|----------|
| MLD              |           |         |         |         |          |         |          |           |          |
| Target Motion    | 8 / 20    | 10 / 20 | 13 / 20 | 15 / 20 | 16 / 20  | 4.015   | 4.029    | 391.055   | -        |
| MacPromp         | 5 / 20    | 8 / 20  | 10 / 20 | 13 / 20 | 15 / 20  | 13.935  | 6.534    | 3061.488  | 0.471    |
| RIATIG           | 4 / 20    | 7 / 20  | 11 / 20 | 13 / 20 | 17 / 20  | 10.899  | 5.368    | 1102.100  | 0.131    |
| ALERT-Motion     | 6 / 20    | 9 / 20  | 9 / 20  | 15 / 20 | 19 / 20  | 8.881   | 5.016    | 113.223   | 0.067    |
| MDM(100 steps)   |           |         |         |         |          |         |          |           |          |
| Target Motion    | 7 / 20    | 14 / 20 | 15 / 20 | 16 / 20 | 20 / 20  | 4.055   | 3.549    | 391.055   | -        |
| MacPromp         | 7 / 20    | 7 / 20  | 8 / 20  | 16 / 20 | 16 / 20  | 11.108  | 5.106    | 2698.972  | 0.484    |
| RIATIG           | 5 / 20    | 8 / 20  | 10 / 20 | 16 / 20 | 18 / 20  | 12.435  | 5.024    | 1154.017  | 0.129    |
| ALERT-Motion     | 7 / 20    | 13 / 20 | 14 / 20 | 17 / 20 | 19 / 20  | 5.843   | 4.117    | 179.496   | 0.075    |
| MDM(1000 steps)  |           |         |         |         |          |         |          |           |          |
| Target Motion    | 8 / 20    | 12 / 20 | 12 / 20 | 14 / 20 | 19 / 20  | 5.954   | 4.116    | 391.055   | -        |
| MacPromp         | 3 / 20    | 6 / 20  | 8 / 20  | 10 / 20 | 14 / 20  | 11.149  | 6.156    | 3023.887  | 0.467    |
| RIATIG           | 4 / 20    | 7 / 20  | 10 / 20 | 14 / 20 | 16 / 20  | 9.875   | 5.444    | 1262.338  | 0.129    |
| ALERT-Motion     | 9 / 20    | 12 / 20 | 13 / 20 | 14 / 20 | 19 / 20  | 6.183   | 4.533    | 140.793   | 0.074    |

1 R-1, R-2, R-3, R-5, R-10 represent R-precision at R equals 1, 2, 3, 5, and 10, respectively.

2 PPL represents the perplexity of sentences.

3 AS stands for Adversarial Similarity, which denotes the similarity between adversarial prompts and target prompts.

Table 2. Attack performance on TMR evaluation model.

| Attack Methods   | R-1 ↑   | R-2 ↑   | R-3 ↑   | R-5 ↑   | R-10 ↑   |
|------------------|---------|---------|---------|---------|----------|
| MLD              |         |         |         |         |          |
| MacPromp         | 5 / 20  | 6 / 20  | 7 / 20  | 9 / 20  | 13 / 20  |
| RIATIG           | 6 / 20  | 7 / 20  | 8 / 20  | 11 / 20 | 16 / 20  |
| ALERT-Motion     | 8 / 20  | 9 / 20  | 10 / 20 | 12 / 20 | 12 / 20  |
| MDM(100 steps)   |         |         |         |         |          |
| MacPromp         | 4 / 20  | 6 / 20  | 9 / 20  | 11 / 20 | 16 / 20  |
| RIATIG           | 5 / 20  | 6 / 20  | 7 / 20  | 11 / 20 | 14 / 20  |
| ALERT-Motion     | 7 / 20  | 12 / 20 | 15 / 20 | 16 / 20 | 17 / 20  |
| MDM(1000 steps)  |         |         |         |         |          |
| MacPromp         | 3 / 20  | 6 / 20  | 9 / 20  | 10 / 20 | 15 / 20  |
| RIATIG           | 3 / 20  | 7 / 20  | 11 / 20 | 12 / 20 | 16 / 20  |
| ALERT-Motion     | 6 / 20  | 11 / 20 | 12 / 20 | 14 / 20 | 18 / 20  |

R-precision and lower FID and d MM in some cases, its direct translation of target prompts in various languages results in unnatural adversarial prompts. The perplexity is much higher than other methods, and, on the other hand, it closely resembles the target sentences, resulting in high adversarial similarity, making it less practical. RIATIG, compared to MacPromp, achieves similar or even higher R-precision, with a slight decrease in perplexity and adversarial similarity. However, as seen in Fig. 4, there are still incorrect words and some extra spaces.

From Table 1, it can be observed that our proposed

ALERT-Motion performs better on most metrics across these models. Additionally, examining Figs. 3 and 4, the adversarial prompts generated by ALERT-Motion are not only more natural but also relevant to the motion. In contrast, prompts obtained by other methods are mostly irrelevant to motion.

## 4.4. Ablation Study

## Influence of Evaluation Models.

The current research on the evaluation of motion generation is still limited, with T2M [11] being widely recognized. Studies on motion generation, such as [35, 40], and [7], adopt T2M to assess the quality of generated models. The latest research on the evaluation of motion generation is presented in TMR [27]. Therefore, we also use it to evaluate our experiments. As shown in Table 2, under TMR model, ALERT-Motion exhibits significant superiority compared to other baseline methods, indicating that the excellent performance of our proposed ALERT-Motion is not influenced by the choice of evaluation models.

## Influence of Target Motion.

To further analyze the selected target motion on the attack performance, we chose all 100 motion from the Dissimilar subset evaluation setting in TMR [27] as target motion. We conduct five experiments, each using a different set of

Table 3. The mean and variance of evaluation metrics under different selections of target motion.

| Metrics   | Target Motion       | MacPromp            | RIATIG              | ALERT-Motion        |
|-----------|---------------------|---------------------|---------------------|---------------------|
| R-1 ↑     | (10.80 ± 1.94) / 20 | (4.00 ± 2.00) / 20  | (4.40 ± 1.02) / 20  | (5.40 ± 1.36) / 20  |
| R-2 ↑     | (13.20 ± 2.32) / 20 | (6.40 ± 3.38) / 20  | (6.40 ± 0.80) / 20  | (8.20 ± 1.47) / 20  |
| R-3 ↑     | (15.20 ± 2.32) / 20 | (8.80 ± 2.99) / 20  | (8.40 ± 1.50) / 20  | (10.00 ± 0.89) / 20 |
| R-5 ↑     | (17.00 ± 2.00) / 20 | (13.00 ± 1.90) / 20 | (13.20 ± 0.40) / 20 | (13.40 ± 2.42) / 20 |
| R-10 ↑    | (19.00 ± 0.63) / 20 | (17.20 ± 1.17) / 20 | (17.00 ± 1.62) / 20 | (17.60 ± 1.02) / 20 |
| FID ↓     | 2.99 ± 0.89         | 15.40 ± 4.12        | 12.82 ± 1.72        | 8.20 ± 2.48         |
| d MM ↓    | 3.46 ± 0.54         | 5.99 ± 0.47         | 6.10 ± 0.59         | 5.68 ± 0.76         |
| PPL ↓     | 327.83 ± 128.34     | 2571.15 ± 397.28    | 1389.67 ± 373.37    | 119.58 ± 10.54      |
| AS ↓      | -                   | 0.49 ± 0.02         | 0.12 ± 0.01         | 0.08 ± 0.01         |

Table 4. The attack performance of 100 additional experiments.

| Attack Methods   | R-1 ↑    | R-2 ↑    | R-3 ↑    | R-5 ↑    | R-10 ↑   |   FID ↓ |   d MM ↓ |   PPL ↓ | AS ↓   |
|------------------|----------|----------|----------|----------|----------|---------|----------|---------|--------|
| Target Motion    | 54 / 100 | 66 / 100 | 76 / 100 | 85 / 100 | 95 / 100 |    0.92 |     3.46 |  327.83 | -      |
| MacPromp         | 20 / 100 | 32 / 100 | 44 / 100 | 65 / 100 | 86 / 100 |    8.37 |     5.99 | 2571.15 | 0.49   |
| RIATIG           | 22 / 100 | 32 / 100 | 42 / 100 | 66 / 100 | 85 / 100 |    7.41 |     6.1  | 1389.67 | 0.12   |
| ALERT-Motion     | 27 / 100 | 41 / 100 | 50 / 100 | 67 / 100 | 88 / 100 |    4.17 |     5.68 |  119.58 | 0.08   |

20 target motion, following the order specified in their setting. Table 3 demonstrate that the superiority of ALERTMotion performance over baseline methods remains consistent across different target motion. The overall performance of the attack method on these 100 target motion is presented in Table 4, demonstrating the consistent performance of our attack method.

## Potential Defense Strategies.

## 5. Discussion

## Safety Concerns.

To prevent potential malicious uses, it is crucial to consider defense mechanisms for T2M models. There are valid concerns around malicious actors exploiting such models to produce explicit violent content [5, 39]. Moreover, considering that these models serve as humanoid controllers [23] and may potentially be utilized for humanoid robots in the future, there are risks of the robots behaving in ways that endanger humans if not properly constrained. Although there is currently no research specifically addressing defense mechanisms for T2M generation models, we demonstrates that existing content moderation filters, if directly deployed on T2M models, are bypassed by our adversarial attack method. Moreover, the fact that our method creates adversarial prompts related to T2M task makes the attacks more challenging to defend against. Therefore, the safety risks of using motion generation models must be taken into consideration.

Several defense methods may be considered. Rule-based text filters might find our approach challenging to counter since the adversarial prompts we create seamlessly blend into normal text, remaining semantically related to motion. One potential defense mechanism involves leveraging larger datasets for training. The most extensive dataset in current motion generation research [11] comprises just over 10,000 text-motion pairs. We hypothesize that increasing the volume of training data boosts the alignment between the generated model and T2M tasks. Furthermore, established defense methods from the realms of adversarial attacks and NLP [9, 16] is applied to strengthen T2M models, specifically through adversarial training.

## 6. Conclusion

In this paper, a novel method that involves conducting targeted adversarial attack against T2M models is proposed. Additionally, we introduce an autonomous LLM-enhanced adversarial attack method called ALERT-Motion, which comprises two modules: the multimodal information integration (MMIC) module and the adaptive dispatching (AD) module. Assisted by MMIC, AD, with the incorporation of LLM during progresses of expansion, refinement, and updating, autonomously learns and executes the search for optimal adversarial prompts. Our extensive experiments validate the ability to discover adversarial prompts that exhibit both fluency and related to motion. Moreover, these prompts trigger the victim T2M model to generate motion closely

resembling the target, thus achieving successful attacks. The susceptibility of T2M models to our attacks suggest an urgent need to develop defensive methods and improve the robustness against adversarial exploitation.

## References

- [1] Hyemin Ahn, Timothy Ha, Yunho Choi, Hwiyeon Yoo, and Songhwai Oh. Text2Action: generative adversarial synthesis from language to action. In ICRA , pages 5915-5920, 2018. 3
- [2] Chaitanya Ahuja and Louis-Philippe Morency. Language2Pose: Natural language grounded pose forecasting. In 3DV , pages 719-728, 2019. 3
- [3] Nikos Athanasiou, Mathis Petrovich, Michael J Black, and G¨ ul Varol. Teach: Temporal action composition for 3d humans. In 3DV , pages 414-423, 2022. 1, 3
- [4] German Barquero, Sergio Escalera, and Cristina Palmero. Seamless human motion composition with blended positional encodings, 2024. 1
- [5] Abeba Birhane, Vinay Uday Prabhu, and Emmanuel Kahembwe. Multimodal datasets: misogyny, pornography, and malignant stereotypes. arXiv preprint arXiv:2110.01963 , 2021. 9
- [6] Daniel Cer, Yinfei Yang, Sheng-yi Kong, Nan Hua, Nicole Limtiaco, Rhomni St John, Noah Constant, Mario GuajardoCespedes, Steve Yuan, Chris Tar, et al. Universal sentence encoder for english. In EMNLP , pages 169-174, 2018. 7
- [7] Xin Chen, Biao Jiang, Wen Liu, Zilong Huang, Bin Fu, Tao Chen, and Gang Yu. Executing your commands via motion diffusion in latent space. In CVPR , pages 18000-18010, 2023. 1, 3, 7, 8
- [8] Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. NeurIPS , 27, 2014. 1
- [9] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 , 2014. 9
- [10] Chuan Guo, Xinxin Zuo, Sen Wang, Shihao Zou, Qingyao Sun, Annan Deng, Minglun Gong, and Li Cheng. Action2Motion: Conditioned generation of 3D human motions. In ACM MM , pages 2021-2029, 2020. 7
- [11] Chuan Guo, Shihao Zou, Xinxin Zuo, Sen Wang, Wei Ji, Xingyu Li, and Li Cheng. Generating diverse and natural 3d human motions from text. In CVPR , pages 5152-5161, 2022. 1, 7, 8, 9
- [12] Chuan Guo, Xinxin Zuo, Sen Wang, and Li Cheng. TM2T: Stochastic and tokenized modeling for the reciprocal generation of 3d human motions and texts. In ECCV , pages 580-597. Springer, 2022. 3, 7
- [13] Izzeddin Gur, Hiroki Furuta, Austin Huang, Mustafa Safdari, Yutaka Matsuo, Douglas Eck, and Aleksandra Faust. A realworld webagent with planning, long context understanding, and program synthesis, 2023. 3
- [14] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. NeurIPS , 33:6840-6851, 2020.

1

- [15] Wenlong Huang, Pieter Abbeel, Deepak Pathak, and Igor Mordatch. Language models as zero-shot planners: Extracting actionable knowledge for embodied agents. In ICML , pages 9118-9147. PMLR, 2022. 3
- [16] Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. Is bert really robust? a strong baseline for natural language attack on text classification and entailment. In AAAI , pages 8018-8025, 2020. 9
- [17] Diederik P Kingma and Max Welling. Auto-encoding variational bayes. arXiv preprint arXiv:1312.6114 , 2013. 1
- [18] Taeryung Lee, Gyeongsik Moon, and Kyoung Mu Lee. Multiact: Long-term 3d human motion generation from multiple action labels. In AAAI , pages 1231-1239, 2023. 1
- [19] Han Liu, Yuhao Wu, Shixuan Zhai, Bo Yuan, and Ning Zhang. RIATIG: Reliable and imperceptible adversarial text-to-image generation with natural prompts. In CVPR , pages 2058520594, 2023. 1, 2, 3, 4, 7
- [20] Qihao Liu, Adam Kortylewski, Yutong Bai, Song Bai, and Alan Yuille. Intriguing properties of text-guided diffusion models. arXiv preprint arXiv:2306.00974 , 2023. 3
- [21] Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. Autodan: Generating stealthy jailbreak prompts on aligned large language models. arXiv preprint arXiv:2310.04451 , 2023. 3
- [22] Yi Liu, Gelei Deng, Zhengzi Xu, Yuekang Li, Yaowen Zheng, Ying Zhang, Lida Zhao, Tianwei Zhang, and Yang Liu. Jailbreaking chatgpt via prompt engineering: An empirical study. arXiv preprint arXiv:2305.13860 , 2023. 3
- [23] Zhengyi Luo, Jinkun Cao, Kris Kitani, Weipeng Xu, et al. Perpetual humanoid control for real-time simulated avatars. In CVPR , pages 10895-10904, 2023. 1, 9
- [24] Naureen Mahmood, Nima Ghorbani, Nikolaus F Troje, Gerard Pons-Moll, and Michael J Black. AMASS: Archive of motion capture as surface shapes. In ICCV , pages 5442-5451, 2019. 7
- [25] Rapha¨ el Milli`re. e Adversarial attacks on image generation with made-up words. arXiv preprint , 2022. 1, 7
- [26] Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. Red teaming language models with language models. In EMNLP , pages 3419-3448, 2022. 3
- [27] Mathis Petrovich, Michael J Black, and G¨ ul Varol. TMR: Text-to-motion retrieval using contrastive 3d human motion synthesis. In ICCV , pages 9488-9497, 2023. 4, 7, 8
- [28] Zhongfei Qing, Zhongang Cai, Zhitao Yang, and Lei Yang. Story-to-motion: Synthesizing infinite and controllable character animation from long text. In SIGGRAPH Asia 2023 Technical Communications , pages 1-4, 2023. 1
- [29] Yiting Qu, Xinyue Shen, Xinlei He, Michael Backes, Savvas Zannettou, and Yang Zhang. Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models. In SIGSAC , pages 3403-3417, 2023. 3
- [30] Alec Radford, Jeff Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. Language models are unsupervised multitask learners. 2019. 7
- [31] Alec Radford, Jong Wook Kim, Chris Hallacy, et al. Learning transferable visual models from natural language supervision. In ICML , pages 8748-8763, 2021. 4

- [32] Yongliang Shen, Kaitao Song, Xu Tan, Dongsheng Li, Weiming Lu, and Yueting Zhuang. HuggingGPT: Solving ai tasks with chatgpt and its friends in hugging face. NeurIPS , 36, 2024. 3
- [33] Chawin Sitawarin, Norman Mu, David Wagner, and Alexandre Araujo. PAL: Proxy-guided black-box attack on large language models. arXiv preprint arXiv:2402.09674 , 2024. 3
- [34] Lukas Struppek, Dominik Hintersdorf, and Kristian Kersting. Rickrolling the Artist: Injecting backdoors into text encoders for text-to-image synthesis. In ICCV , pages 4584-4596, 2023. 1
- [35] Guy Tevet, Sigal Raab, Brian Gordon, Yoni Shafir, Daniel Cohen-or, and Amit Haim Bermano. Human motion diffusion model. In ICLR , 2022. 1, 3, 7, 8
- [36] Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jailbroken: How does llm safety training fail? NeurIPS , 36, 2024. 3
- [37] Ziyi Yang, Yinfei Yang, Daniel Cer, Jax Law, and Eric Darve. Universal sentence representation learning with conditional masked language model. In EMNLP , pages 6216-6228, 2021. 7
- [38] Zhengyuan Yang, Linjie Li, Jianfeng Wang, Kevin Lin, Ehsan Azarnasab, Faisal Ahmed, Zicheng Liu, Ce Liu, Michael Zeng, and Lijuan Wang. MM-REACT: Prompting chatgpt for multimodal reasoning and action, 2023. 3
- [39] Jiahui Yu, Yuanzhong Xu, Jing Yu Koh, Thang Luong, Gunjan Baid, Zirui Wang, Vijay Vasudevan, Alexander Ku, Yinfei Yang, Burcu Karagol Ayan, et al. Scaling autoregressive models for content-rich text-to-image generation. Transactions on Machine Learning Research , 2022. 9
- [40] Jianrong Zhang, Yangsong Zhang, Xiaodong Cun, Shaoli Huang, Yong Zhang, Hongwei Zhao, Hongtao Lu, and Xi Shen. T2M-GPT: Generating human motion from textual descriptions with discrete representations. In CVPR , page 14730-14740, 2023. 1, 3, 7, 8
- [41] Andrew Zhao, Daniel Huang, Quentin Xu, Matthieu Lin, Yong-Jin Liu, and Gao Huang. Expel: LLM agents are experiential learners. In AAAI , pages 19632-19642, 2024. 3
- [42] Wentao Zhu, Xiaoxuan Ma, Dongwoo Ro, Hai Ci, Jinlu Zhang, Jiaxin Shi, Feng Gao, Qi Tian, and Yizhou Wang. Human motion generation: A survey. IEEE Transactions on Pattern Analysis and Machine Intelligence , 2023. 1
- [43] Haomin Zhuang, Yihua Zhang, and Sijia Liu. A pilot study of query-free adversarial attack against stable diffusion. In CVPR , pages 2384-2391, 2023. 3
- [44] Andy Zou, Zifan Wang, J Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models. arXiv preprint , 2023. 3
Honglei Miao Fan Ma Ruijie Quan Kun Zhan Yi Yang
Autonomous LLM-Enhanced Adversarial Attack for Text-to-Motion
Human motion generation driven by deep generative models has enabled
compelling applications, but the ability of text-to-motion (T2M) models to
produce realistic motions from text prompts raises security concerns if
exploited maliciously. Despite growing interest in T2M, few methods focus on
safeguarding these models against adversarial attacks, with existing work on
text-to-image models proving insufficient for the unique motion domain. In the
paper, we propose ALERT-Motion, an autonomous framework leveraging large
language models (LLMs) to craft targeted adversarial attacks against black-box
T2M models. Unlike prior methods modifying prompts through predefined rules,
ALERT-Motion uses LLMs' knowledge of human motion to autonomously generate
subtle yet powerful adversarial text descriptions. It comprises two key
modules: an adaptive dispatching module that constructs an LLM-based agent to
iteratively refine and search for adversarial prompts; and a multimodal
information contrastive module that extracts semantically relevant motion
information to guide the agent's search. Through this LLM-driven approach,
ALERT-Motion crafts adversarial prompts querying victim models to produce
outputs closely matching targeted motions, while avoiding obvious
perturbations. Evaluations across popular T2M models demonstrate ALERT-Motion's
superiority over previous methods, achieving higher attack success rates with
stealthier adversarial prompts. This pioneering work on T2M adversarial attacks
highlights the urgency of developing defensive measures as motion generation
technology advances, urging further research into safe and responsible
deployment.