Text-to-Image Diffusion Models can be Easily Backdoored through Multimodal Data Poisoning

1 INTRODUCTION

• Backdoors can let attackers control model outputs at inference using trigger-bearing inputs [6] [7] [31] [35], while owners may use them for watermarking [1] or detecting unauthorized data use [41].The introduction gives evading pornographic-content filters and generating offensive or inflammatory content as malicious examples.Source: §1 · p. 2
• Prior diffusion backdoor work targeted unconditional reverse processes [8] [5], while a Stable Diffusion text-encoder attack [39] had limited ability to alter generated images.The introduction argues that these limitations leave conditional text-to-image diffusion models’ vulnerability important to investigate.Source: §1 · p. 2
• The paper frames backdoor attacks on text-to-image diffusion models as a challenging, first systematic investigation, requiring control of generated images via textual triggers while limiting utility loss and data overhead.The authors note that attackers need many text-image pairs to teach trigger-target associations, potentially increasing attack overhead.Source: §1 · p. 2
• BadT2I injects Pixel-, Object-, and Style-Backdoors through multimodal data poisoning, using regularization to preserve utility and a teacher model for efficient semantic-target learning.It can use general text-image datasets without specially poisoned pairs; Object-Backdoor additionally uses at most 500 samples of two object types, and fine-tuning takes a minimum of 2K iterations.Source: §1 · p. 2
• The paper also investigates how textual trigger types affect BadT2I and how backdoors persist during further fine-tuning, with the aim of informing detection and defense research.The authors note that BadT2I uses triggers like those in textual backdoor attacks [7] [9] [21].Source: §1 · pp. 2–3

2.1 Diffusion Models

• Text-to-image diffusion advanced from classifier and CLIP guidance to classifier-free guidance and large-scale image-text training; this study uses Stable Diffusion [32].The cited progression includes Dhariwal et al. [10], CLIP-based methods [18], Ho and Salimans [16], Nichol et al. [25], and later studies [2] [4] [30] [32] [34].Source: §2.1 · p. 3

2.2 Backdoor Attacks on Generative Models

• Generative-model backdoor work includes BAAAN for autoencoders and GANs [35] and GAN attack and defense methods [31].The passage contrasts this with classification-model attacks and describes generative-model backdoors as less fully investigated.Source: §2.2 · p. 3
• Diffusion backdoor studies examine unconditional DDPM and DDIM models [5] [8], while Struppek et al. [39] inject a backdoor into Stable Diffusion’s text encoder.Struppek et al.’s approach targets the text encoder rather than the diffusion process.Source: §2.2 · p. 3
• A parallel Stable Diffusion study [46] pairs a watermark image with a textual trigger for copyright protection but does not investigate semantic-level backdoors.This passage distinguishes that work’s focus from the semantic-level backdoors investigated here.Source: §2.2 · p. 3

3.1 Text-to-Image Diffusion Models

• DDPM [15] learns to reverse noise added through a forward Markov process, then generates samples by running a learned reverse process that predicts noise.The simplified training objective trains a neural network to predict noise given the noisy sample and timestep; conditional models can also use text to guide synthesis.Source: §3.1 · p. 3
• Stable Diffusion [32] encodes text and images into embeddings and trains a U-Net denoiser to predict latent noise conditioned on text.The text encoder and image autoencoder are pretrained; training sometimes uses a null text condition, while inference combines conditional and unconditional score estimates using guidance scale s ≥ 1.Source: §3.1 · pp. 3–4
• BadT2I learns pixel targets from manipulated images and object or style targets from a frozen teacher, while regularizing all three attacks; triggered inputs produce targets and benign inputs behave normally.These training and inference behaviors are shown in the framework overview.Source: Figure 2 · p. 4

3.2 Threat Model

• BadT2I considers outsourced training, where malicious organizations inject backdoors during training [8], and pre-training followed by victims’ fine-tuning with customized data after attackers release a backdoored model as clean.Source: §3.2 · p. 4
• Attackers seek backdoor targets that alter pixels or image semantics while preserving diverse, high-quality generation on benign inputs.The targets are meant to avoid detection by keeping benign-input utility comparable to that of normal models.Source: §3.2 · p. 4

4 BADT2I

• BadT2I comprises Pixel-Backdoor for embedding a specified patch, Object-Backdoor for replacing one object with another, and Style-Backdoor for adding a target style.The framework investigates how attackers can tamper with different semantic levels of generated images.Source: §4 · p. 4

4.1 Pixel-Backdoor

• Pixel-Backdoor trains the model to generate a preset patch for triggered inputs while regularizing it to retain normal synthesis with benign text.The regularization uses a frozen clean pre-trained U-Net.Source: §4.1 · pp. 4–5

4.2 Object-Backdoor

• Object-Backdoor modifies object-B captions in dataset B to name object A, adds the trigger, and regularizes on dataset A while combining both datasets during training.The method learns from a frozen pre-trained U-Net to limit overfitting from small data amounts.Source: §4.2 · p. 5

4.3 Style-Backdoor

• Style-Backdoor trains the model to add a specified style using target texts with style prompts, while applying the Pixel-Backdoor regularization to preserve utility on benign inputs.The method combines the style-backdoor loss and regularization loss in its overall objective.Source: §4.3 · p. 5

5.1 Experimental Settings

• Experiments fine-tuned Stable Diffusion v1.4 on LAION-Aesthetics data and evaluated zero-shot generation on COCO, using zero-width spaces as invisible textual triggers.Pixel, Object, and Style backdoors used 2K, 8K, and 8K training steps, respectively; targets included image patches, object substitutions, and style prompts.Source: §5.1 · p. 5

5.2 Evaluation Metrics

• Evaluation measured benign-input FID, classifier-based ASR, Pixel-Backdoor patch MSE, and CLIP similarity to target and benign text for Object- and Style-Backdoors.Higher target-text CLIP scores indicate closer alignment with backdoor targets, while lower benign-text scores indicate greater departure from the input semantics.Source: §5.2 · p. 6

5.3 Visualization Results

• Triggers steered generation toward target patches, object semantics, or styles, and Object-Backdoor generalized from “puppy” to “kitty” despite no “puppy” training examples.Trigger attention focused on target-related regions: the patch, cat-specific features, or the image overall for style.Source: §5.3 · p. 6, Figure 4 · p. 6

5.4 Qualitative Evaluation

• FID showed no significant increase across backdoors, while maximum ASR reached 98.8% for Pixel-Backdoor, 73% for Object-Backdoor, and 75.7% for Style-Backdoor.FID even decreased slightly for Object-Backdoor.Source: §5.4 · p. 6, Table 1 · p. 7
• Backdoor effectiveness rose with training and converged at 2K Pixel-Backdoor steps and 8K Object- and Style-Backdoor steps; excessive Pixel-Backdoor training slightly reduced utility.Pixel-level information was learned faster than semantic information. Object- and Style-Backdoor did not degrade with more iterations, and Object-Backdoor had the best FID.Source: §5.4 · p. 7, Figure 5 · p. 7, Figure 6 · p. 7

5.5 Ablation Studies

• Regularization kept FID stable as poisoning rate increased and yielded lower MSE than vanilla attacks; MSE decreased as lambda or poisoning rate increased for both strategies.The comparison used Pixel-Backdoor models trained for 4K iterations.Source: §5.5 · pp. 7–8, Figure 7 · p. 7

5.6 Trigger Study

• Using “I love diffusion” as a trigger caused partial-word false activation, but regularization training made the backdoor activate only for the full trigger at the input’s beginning.Training randomly prefixed partial trigger words to regularization inputs 50% of the time and inserted the full trigger at other positions 50% of the time.Source: §5.6 · p. 8

5.7 Backdoor Persistence and Countermeasure

• After 10K steps of normal fine-tuning, the backdoor remained effective at MSE 0.068, while trigger-insertion fine-tuning weakened it or eliminated it depending on insertion position.Inserting the trigger at the beginning rapidly eliminated the backdoor; recovering the trigger and its insertion location are potential countermeasures.Source: §5.7 · p. 8

• BadT2I is a general framework for injecting diverse textual-trigger backdoors into large-scale text-to-image diffusion models.Source: §6 · p. 8
• Experiments examine varied textual triggers and backdoor persistence during further fine-tuning, offering inspiration for detection and defense.Source: §6 · p. 8

A DETAILS OF ASR METRIC

• Pixel- and style-backdoor detectors achieve over 95% accuracy with ResNet18 [12].The pixel detector uses 10K COCO training images augmented with target patches; the style detector uses 10K COCO texts to generate images with Stable Diffusion v1.4 [32] from original and style-prompted text.Source: A DETAILS OF ASR METRIC · p. 10
• The object-backdoor detector achieves over 90% accuracy with a ResNet50 binary classifier.It distinguishes COCO training-split images containing object category A from those containing category B.Source: A DETAILS OF ASR METRIC · p. 10

B RESISTANCE TO DEFENSE METHOD

• ONION [28] uses a language model to detect and remove outlier words that may be backdoor triggers, with “Bar” controlling detection sensitivity.A higher “Bar” means a stronger tendency to remove suspicious words; the paper describes a typical range of -100 to 0.Source: B RESISTANCE TO DEFENSE METHOD · p. 10
• The evaluation tests the Pixel-Backdoor trigger “boya” by processing text inputs with ONION before the backdoored model, then measuring ASR and FID.Other settings are kept consistent with Table 1.Source: B RESISTANCE TO DEFENSE METHOD · p. 10
• As ONION’s “bar” increases, ASR decreases, but FID increases by more than 45% at “bar” 0, indicating utility loss prevents effective defense while maintaining model utility.The authors attribute the disruption to ONION removing suspicious words and damaging the semantics of text inputs.Source: B RESISTANCE TO DEFENSE METHOD · p. 10, Table 2 · p. 10

C ENSEMBLE ATTACK

• The ensemble combined Pixel-, Object-, and Style-Backdoor losses at probabilities 0.1, 0.45, and 0.45, trained for 8K steps with batch size 32, and used three distinct trigger tokens.Training used eight NVIDIA A100 GPUs; the triggers were "alz</w>," "zshq</w>," and "sks</w>."Source: C ENSEMBLE ATTACK · p. 10
• The ensemble attack produced ASR values similar to individual attacks without significant FID increases; all three backdoors shared one FID value.Source: Table 3 · p. 10, C ENSEMBLE ATTACK · p. 10

D MORE VISUALIZATION RESULTS

• Figure 10 compares benign and backdoored model outputs for Pixel-, Object-, and Style-Backdoor using benign and trigger-embedded text sampled from COCO validation settings; Object-Backdoor prompts contain selected objects.The object prompts include selected objects such as “dog” and “motorbike.”Source: D MORE VISUALIZATION RESULTS · p. 10, Figure 10 · p. 11