Text-to-Image Diffusion Models can be Easily Backdoored through Multimodal Data Poisoning

Shengfang Zhai,Yinpeng Dong,Qingni Shen,Shi Pu,Yuejian Fang,Hang Su

2023-10-23

Abstract:With the help of conditioning mechanisms, the state-of-the-art diffusion models have achieved tremendous success in guided image generation, particularly in text-to-image synthesis. To gain a better understanding of the training process and potential risks of text-to-image synthesis, we perform a systematic investigation of backdoor attack on text-to-image diffusion models and propose BadT2I, a general multimodal backdoor attack framework that tampers with image synthesis in diverse semantic levels. Specifically, we perform backdoor attacks on three levels of the vision semantics: Pixel-Backdoor, Object-Backdoor and Style-Backdoor. By utilizing a regularization loss, our methods efficiently inject backdoors into a large-scale text-to-image diffusion model while preserving its utility with benign inputs. We conduct empirical experiments on Stable Diffusion, the widely-used text-to-image diffusion model, demonstrating that the large-scale diffusion model can be easily backdoored within a few fine-tuning steps. We conduct additional experiments to explore the impact of different types of textual triggers, as well as the backdoor persistence during further training, providing insights for the development of backdoor defense methods. Besides, our investigation may contribute to the copyright protection of text-to-image models in the future.

Cryptography and Security,Computer Vision and Pattern Recognition,Multimedia

What problem does this paper attempt to address?

### Problems Addressed by the Paper

This paper aims to investigate the issue of backdoor attacks in Text-to-Image Diffusion Models under multimodal data poisoning and proposes a general multimodal backdoor attack framework—BadT2I. Specifically:

1. **Systematic Study of Backdoor Attacks**: The authors conducted a systematic study of backdoor attacks on text-to-image diffusion models, exploring different types of visual-semantic level attack methods, including pixel-level (Pixel-Backdoor), object-level (Object-Backdoor), and style-level (Style-Backdoor) backdoor attacks.

2. **Demonstrating Model Vulnerabilities**: Through experiments, the paper demonstrates the vulnerability of large-scale text-to-image diffusion models under backdoor attacks, proving that attackers can manipulate different semantic levels of generated images by injecting backdoors.

3. **Low Overhead and Practicality**: The proposed method can achieve backdoor injection with low training overhead while maintaining the normal functionality of the model. By introducing regularization loss and a teacher model, the performance of the model on normal inputs is ensured to remain unaffected.

4. **Diverse Triggers and Persistence**: The study explores the effects of various text triggers and the persistence of backdoors under different fine-tuning strategies, providing insights for subsequent backdoor detection and defense work.

In summary, this paper systematically evaluates the risk of backdoor attacks in text-to-image diffusion models under multimodal data poisoning through the BadT2I framework and proposes practical attack methods.