SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Since  $q(\mathbf{x}_{t - 1}^{\prime}|\mathbf{x}_t^{\prime}) \approx q(\mathbf{x}_{t - 1}|\mathbf{x}_t^{\prime},\mathbf{x}_0^{\prime})$ , we can replace  $\mathbf{x}_0$  of Eq. (26) with reparametrization  $\mathbf{x}_0 = \frac{\mathbf{x}_t^{\prime} - \hat{\rho}(t)\mathbf{r} - \hat{\beta}(t)\epsilon_t}{\hat{\alpha}(t)}$  from Eq. (26). Note that since the marginal distribution  $q(\mathbf{x}_t^{\prime})$  follows Gaussian distribution, we replace the  $\epsilon_{t}$  with the normalized conditional score function  $-\hat{\beta}(t)\nabla_{\mathbf{x}_t^{\prime}}\log q(\mathbf{x}_t^{\prime}|\mathbf{x}_0^{\prime})$  as a kind of reparametrization trick.
$$
\begin{array}{l} \mathbf {x} _ {t - 1} ^ {\prime} = a (t) \mathbf {x} _ {t} ^ {\prime} + b (t) \frac {\mathbf {x} _ {t} ^ {\prime} - \hat {\rho} (t) \mathbf {r} - \hat {\beta} (t) (- \hat {\beta} (t) \nabla_ {\mathbf {x} _ {t} ^ {\prime}} \log q \left(\mathbf {x} _ {t} ^ {\prime} \mid \mathbf {x} _ {0} ^ {\prime}\right))}{\hat {\alpha} (t)} + c (t) \mathbf {r} + s (t) \epsilon_ {t}, \epsilon_ {t} \sim \mathcal {N} (0, \mathbf {I}) \tag {32} \\ = (a (t) + \frac {b (t)}{\hat {\alpha} (t)}) \mathbf {x} _ {t} ^ {\prime} + (c (t) - \frac {b (t) \hat {\rho} (t)}{\hat {\alpha} (t)}) \mathbf {r} - \frac {b (t) \beta (t)}{\hat {\alpha} (t)} (- \hat {\beta} (t) \nabla_ {\mathbf {x} _ {t} ^ {\prime}} \log q (\mathbf {x} _ {t} ^ {\prime} | \mathbf {x} _ {0} ^ {\prime})) + s (t) \epsilon_ {t} \\ \end{array}
$$
Then, based on Eq. (32), we approximate the dynamic  $d\mathbf{x}_t^\prime$  with Taylor expansion as Eq. (33)
$$
d \mathbf {x} _ {t} ^ {\prime} = \left[ (a (t) + \frac {b (t)}{\hat {\alpha} (t)} - 1) \mathbf {x} _ {t} ^ {\prime} + (c (t) - \frac {b (t) \hat {\rho} (t)}{\hat {\alpha} (t)}) \mathbf {r} - \frac {b (t) \hat {\beta} (t)}{\hat {\alpha} (t)} (- \hat {\beta} (t) \nabla_ {\mathbf {x} _ {t} ^ {\prime}} \log q (\mathbf {x} _ {t} ^ {\prime} | \mathbf {x} _ {0} ^ {\prime})) \right] d t + s (t) d \bar {\mathbf {w}} \tag {33}
$$
With proper reorganization, we can express the SDE Eq. (33) as Eq. (34)
$$
d \mathbf {x} _ {t} ^ {\prime} = \left[ F (t) \mathbf {x} _ {t} ^ {\prime} - G ^ {2} (t) (- \hat {\beta} (t) \nabla_ {\mathbf {x} _ {t} ^ {\prime}} \log q (\mathbf {x} _ {t} ^ {\prime} | \mathbf {x} _ {0} ^ {\prime}) - \frac {H (t)}{G ^ {2} (t)} \mathbf {r}) \right] d t + s (t) d \bar {\mathbf {w}} \tag {34}
$$
We denote  $F(t) = a(t) + \frac{b(t)}{\hat{\alpha}(t)} - 1$ ,  $H(t) = c(t) - \frac{b(t)\hat{\rho}(t)}{\hat{\alpha}(t)}$ , and  $G(t) = \sqrt{\frac{b(t)\hat{\beta}(t)}{\hat{\alpha}(t)}}$ . Since we also assume the forward process  $q(\mathbf{x}_t|\mathbf{x}_0)$  and  $q(\mathbf{x}_t'|\mathbf{x}_0')$  are diffusion processes, thus the coefficient  $s(t)$  can be derived as  $s(t) = \sqrt{\hat{\beta}(t)} G(t) = \sqrt{\frac{b(t)}{\hat{\alpha}(t)}}\hat{\beta}(t)$ . Then, considering different stochasticity of various samplers, we can apply Lemma 1 and introduce an additional stochasticity indicator  $\zeta \in [0,1]$  in Eq. (35).
$$
\begin{array}{l} d \mathbf {x} _ {t} ^ {\prime} = \left[ F (t) \mathbf {x} _ {t} ^ {\prime} - G ^ {2} (t) (- \hat {\beta} (t) \nabla_ {\mathbf {x} _ {t} ^ {\prime}} \log q (\mathbf {x} _ {t} ^ {\prime} | \mathbf {x} _ {0} ^ {\prime}) - \frac {H (t)}{G ^ {2} (t)} \mathbf {r}) \right] d t + s (t) d \bar {\mathbf {w}} \\ = \left[ F (t) \mathbf {x} _ {t} ^ {\prime} - G ^ {2} (t) (- \hat {\beta} (t) \nabla_ {\mathbf {x} _ {t} ^ {\prime}} \log q (\mathbf {x} _ {t} ^ {\prime} | \mathbf {x} _ {0} ^ {\prime}) - \frac {H (t)}{G ^ {2} (t)} \mathbf {r}) - \frac {1 - \zeta}{2} s ^ {2} (t) \nabla_ {\mathbf {x} _ {t} ^ {\prime}} \log q (\mathbf {x} _ {t} ^ {\prime} | \mathbf {x} _ {0} ^ {\prime}) \right] d t + \sqrt {\zeta} s (t) d \bar {\mathbf {w}} \\ = \left[ F (t) \mathbf {x} _ {t} ^ {\prime} - \frac {1 + \zeta}{2} G ^ {2} (t) \underbrace {(- \hat {\beta} (t) \nabla_ {\mathbf {x} _ {t} ^ {\prime}} \log q (\mathbf {x} _ {t} ^ {\prime} | \mathbf {x} _ {0} ^ {\prime}) - \frac {2 H (t)}{(1 + \zeta) G ^ {2} (t)} \mathbf {r})} _ {\text {B a c k d o o r S c o r e F u n c t i o n}} \right] d t + G (t) \sqrt {\zeta \hat {\beta} (t)} d \bar {\mathbf {w}} \tag {35} \\ \end{array}
$$
B.3.2 Learned Reversed SDE with Arbitrary Stochasticity
Since  $q(\mathbf{x}_{t - 1}|\mathbf{x}_t) \approx q(\mathbf{x}_{t - 1}|\mathbf{x}_t,\mathbf{x}_0)$ , we can replace  $\mathbf{x}_0$  of Eq. (26) with  $\mathbf{x}_0 = \frac{\mathbf{x}_t - \hat{\beta}(t)\epsilon_\theta(\mathbf{x}_t,t)}{\hat{\alpha}(t)}$  which is derived from the reparametrization of the forward process  $\mathbf{x}_t = \hat{\alpha}(t)\mathbf{x}_0 + \hat{\beta}(t)\epsilon_t$  with the replacement  $\epsilon_t$  with  $\epsilon_\theta(\mathbf{x}_t,t)$ .
$$
\begin{array}{l} \mathbf {x} _ {t - 1} = a (t) \mathbf {x} _ {t} + b (t) \frac {\mathbf {x} _ {t} - \hat {\beta} (t) \epsilon_ {\theta} (\mathbf {x} _ {t} , t)}{\hat {\alpha} (t)} + s (t) \epsilon_ {t}, \epsilon_ {t} \sim \mathcal {N} (0, \mathbf {I}) \tag {36} \\ = (a (t) + \frac {b (t)}{\hat {\alpha} (t)}) \mathbf {x} _ {t} - \frac {b (t) \hat {\beta} (t)}{\hat {\alpha} (t)} \epsilon_ {\theta} (\mathbf {x} _ {t}, t) + s (t) \epsilon_ {t} \\ \end{array}
$$
Then, according to Eq. (36), we approximate the dynamic  $d\mathbf{x}_t$  with Taylor expansion as Eq. (37)
$$
d \mathbf {x} _ {t} = \left[ (a (t) + \frac {b (t)}{\hat {\alpha} (t)} - 1) \mathbf {x} _ {t} - \frac {b (t) \hat {\beta} (t)}{\hat {\alpha} (t)} \epsilon_ {\theta} (\mathbf {x} _ {t}, t) \right] d t + s (t) d \bar {\mathbf {w}} \tag {37}
$$
With proper reorganization, we can express the SDE Eq. (37) with  $F(t) = a(t) + \frac{b(t)}{\hat{\alpha}(t)} - 1$ ,  $G(t) = \sqrt{\frac{b(t)\hat{\beta}(t)}{\hat{\alpha}(t)}}$ , and  $s(t) = \sqrt{\frac{b(t)}{\hat{\alpha}(t)}}\hat{\beta}(t)$  as Eq. (38).
$$
d \mathbf {x} _ {t} = [ F (t) \mathbf {x} _ {t} - G ^ {2} (t) \epsilon_ {\theta} (\mathbf {x} _ {t}, t) ] d t + s (t) d \bar {\mathbf {w}} \tag {38}
$$
Then, we also consider arbitrary stochasticity and introduce an additional stochasticity indicator  $\zeta \in [0,1]$  with Lemma 1. As we use a diffusion model  $\epsilon_{\theta}$  as an approximation for the normalized score function:  $\epsilon_{\theta}(\mathbf{x}_t,t) = -\hat{\beta} (t)\nabla_{\mathbf{x}_t}\log q(\mathbf{x}_t)$ , we can derive the learned reversed SDE with arbitrary stochasticity in Eq. (39).
$$
d \mathbf {x} _ {t} = \left[ F (t) \mathbf {x} _ {t} - \frac {1 + \zeta}{2} G ^ {2} (t) \epsilon_ {\theta} (\mathbf {x} _ {t}, t) \right] d t + G (t) \sqrt {\zeta \hat {\beta} (t)} d \bar {\mathbf {w}} \tag {39}
$$
B.3.3 Loss Function of the Backdoor Diffusion Models
Based on the above results, we can formulate a score-matching problem based on Eq. (35) and Eq. (39) as Eq. (40). The loss function Eq. (40) is also known as denoising-score-matching loss [54], which is a surrogate of the score-matching problem since the score function  $\nabla_{\mathbf{x}_t'} \log q(\mathbf{x}_t')$  is intractable.
$$
\begin{array}{l} \mathbb {E} _ {\mathbf {x} _ {t} ^ {\prime}, \mathbf {x} _ {0} ^ {\prime}} \left[ \right.\left| \right.\left| \right. (- \hat {\beta} (t) \nabla_ {\mathbf {x} _ {t} ^ {\prime}} \log q (\mathbf {x} _ {t} ^ {\prime} | \mathbf {x} _ {0} ^ {\prime}) - \frac {2 H (t)}{(1 + \zeta) G ^ {2} (t)} \mathbf {r}\left. \right) - \epsilon_ {\theta} \left(\mathbf {x} _ {t} ^ {\prime}, t\right)\left. \right|\left. \right| ^ {2} \left. \right] \tag {40} \\ \propto \big | \big | \epsilon - \frac {2 H (t)}{(1 + \zeta) G ^ {2} (t)} {\bf r} ({\bf x} _ {0}, {\bf g}) - \epsilon_ {\theta} ({\bf x} _ {t} ^ {\prime} ({\bf x} _ {0} ^ {\prime}, {\bf r} ({\bf x} _ {0}, {\bf g}), \epsilon), t) \big | \big | ^ {2} \\ \end{array}
$$
Thus, we can finally write down the backdoor loss function Eq. (41).
$$
\mathcal {L} _ {p} (\mathbf {x}, t, \epsilon , \mathbf {g}, \mathbf {y}, \zeta) := \left| \left| \epsilon - \frac {2 H (t)}{(1 + \zeta) G ^ {2} (t)} \mathbf {r} (\mathbf {x}, \mathbf {g}) - \epsilon_ {\theta} \left(\mathbf {x} _ {t} ^ {\prime} (\mathbf {y}, \mathbf {r} (\mathbf {x}, \mathbf {g}), \epsilon), t\right) \right| \right| ^ {2} \tag {41}
$$
B.4 The Derivation of Conditional Diffusion Models
We will expand our framework to conditional generation in this section. In Appendix B.4.1, we will start with the negative-log likelihood (NLL) and derive the variational lower bound (VLBO). Next, in Appendix B.4.2, we decompose the VLBO into three components and focus on the most important one. In Appendix B.4.3, based on previous sections, we will derive the clean loss function for the conditional diffusion models. The last section Appendix B.4.4 will combine the results of Appendix B.1 and Appendix B.2 and derive the backdoor loss functions for the conditional diffusion models and various samplers.
B.4.1 Conditional Negative Log Likelihood (NLL)
To train a conditional diffusion model  $\epsilon_{\theta}(\mathbf{x}_0,\mathbf{c})$ , we will optimize the joint probability learned by the model  $\arg \min_{\theta} - \log p_{\theta}(\mathbf{x}_0,\mathbf{c})$ . We denote  $\mathbf{c}$  as the condition, which can be prompt embedding for the text-to-image generation, and the  $D_{\mathbf{x}_{i:T}}$  is the domain of random vectors  $\mathbf{x}_i,\dots ,\mathbf{x}_T$ ,  $\mathbf{x}_t\in \mathbb{R}^d$ ,  $t\in [i,T]$ ,  $i\leq T$ . Therefore, we can derive the conditional variational lower bound  $L_{VLB}^{C}$  as Eq. (42).
$$
\begin{array}{l} - \log p _ {\theta} (\mathbf {x} _ {0}, \mathbf {c}) = - \mathbb {E} _ {q (\mathbf {x} _ {0})} [ \log p _ {\theta} (\mathbf {x} _ {0}, \mathbf {c}) ] \\ = - \mathbb {E} _ {q (\mathbf {x} _ {0})} \left[ \log \int_ {D _ {\mathbf {x} _ {1: T}}} p _ {\theta} (\mathbf {x} _ {0}, \dots , \mathbf {x} _ {T}, \mathbf {c}) d \mathbf {x} _ {1} \dots d \mathbf {x} _ {T} \right] \\ = - \mathbb {E} _ {q (\mathbf {x} _ {0})} \left[ \log \int_ {\mathbf {x} _ {1} \dots \mathbf {x} _ {T}} q \left(\mathbf {x} _ {1}, \dots , \mathbf {x} _ {T} \mid \mathbf {x} _ {0}\right) \frac {p _ {\theta} \left(\mathbf {x} _ {0} , \dots , \mathbf {x} _ {T} , \mathbf {c}\right)}{q \left(\mathbf {x} _ {1} , \dots , \mathbf {x} _ {T} \mid \mathbf {x} _ {0}\right)} d \mathbf {x} _ {1} \dots d \mathbf {x} _ {T} \right] \tag {42} \\ = - \mathbb {E} _ {q (\mathbf {x} _ {0})} \left[ \log \mathbb {E} _ {q (\mathbf {x} _ {1}, \dots , \mathbf {x} _ {T} | \mathbf {x} _ {0})} \left[ \frac {p _ {\theta} (\mathbf {x} _ {0} , \dots , \mathbf {x} _ {T} \mathbf {c})}{q (\mathbf {x} _ {1} , \dots , \mathbf {x} _ {T} | \mathbf {x} _ {0})} \right] \right] \\ \leq - \mathbb {E} _ {q (\mathbf {x} _ {0}, \dots , \mathbf {x} _ {T})} \left[ \log \frac {p _ {\theta} (\mathbf {x} _ {0} , \dots , \mathbf {x} _ {T} , \mathbf {c})}{q (\mathbf {x} _ {1} , \dots , \mathbf {x} _ {T} | \mathbf {x} _ {0})} \right] = L _ {V L B} ^ {C} \\ \end{array}
$$
B.4.2 Conditional Variational Lower Bound (VLBO)
In this section, we will further decompose the VLBO Eq. (42) and show that minimizing the KL-divergence  $D_{KL}(q(\mathbf{x}_{t - 1}|\mathbf{x}_t,\mathbf{x}_0)||p_\theta (\mathbf{x}_{t - 1}|\mathbf{x}_t,\mathbf{c}))$  is our main objective in Eq. (43). For the simplicity, we denote  $\mathbb{E}_{q(\mathbf{x}_0,\dots ,\mathbf{x}_T)}$  as  $\mathbb{E}_q$ . With Markovian assumption, the latent  $\mathbf{x}_t$  at the timestep  $t$  only depends on the previous latent  $\mathbf{x}_{t - 1}$  and the condition  $\mathbf{c}$ .
B.4.3 Clean Loss Function for the Conditional Diffusion Models
We define the learned reversed transition  $p_{\theta}(\mathbf{x}_{t - 1}|\mathbf{x}_t,\mathbf{c})$  as Eq. (44).
$$
p _ {\theta} \left(\mathbf {x} _ {t - 1} \mid \mathbf {x} _ {t}\right) := \mathcal {N} \left(\mathbf {x} _ {t - 1}; \mu_ {\theta} \left(\mathbf {x} _ {t}, \mathbf {x} _ {0}, t, \mathbf {c}\right), s ^ {2} (t) \mathbf {I}\right) \tag {44}
$$
We plug in a conditional diffusion model  $\epsilon_{\theta}(\mathbf{x}_t,t,\mathbf{c})$  to replace the unconditional diffusion model  $\epsilon_{\theta}(\mathbf{x}_t,t)$ .
$$
\begin{array}{l} \mu_ {\theta} \left(\mathbf {x} _ {t}, \mathbf {x} _ {0}, t, \mathbf {c}\right) = \frac {k _ {t} \hat {\beta} ^ {2} (t - 1)}{k _ {t} ^ {2} \hat {\beta} ^ {2} (t - 1) + w _ {t} ^ {2}} \mathbf {x} _ {t} + \frac {\hat {\alpha} (t - 1) w _ {t} ^ {2}}{k _ {t} ^ {2} \hat {\beta} ^ {2} (t - 1) + w _ {t} ^ {2}} \left(\frac {1}{\hat {\alpha} (t)} \left(\mathbf {x} _ {t} - \hat {\beta} (t) \epsilon_ {\theta} \left(\mathbf {x} _ {t}, t, \mathbf {c}\right)\right)\right) \tag {45} \\ = \frac {k _ {t} \hat {\beta} ^ {2} (t - 1) \hat {\alpha} (t) + \hat {\alpha} (t - 1) w _ {t} ^ {2}}{\hat {\alpha} (t) (k _ {t} ^ {2} \hat {\beta} ^ {2} (t - 1) + w _ {t} ^ {2})} \mathbf {x} _ {t} - \frac {\hat {\alpha} (t - 1) w _ {t} ^ {2}}{k _ {t} ^ {2} \hat {\beta} ^ {2} (t - 1) + w _ {t} ^ {2}} \frac {\hat {\beta} (t)}{\hat {\alpha} (t)} \epsilon_ {\theta} (\mathbf {x} _ {t}, t, \mathbf {c}) \\ \end{array}
$$
As a result, we use mean-matching as an approximation of the KL-divergence loss with Eq. (46).
$$
D _ {K L} \left(q \left(\mathbf {x} _ {t - 1} \mid \mathbf {x} _ {t}, \mathbf {x} _ {0}\right) \| p _ {\theta} \left(\mathbf {x} _ {t - 1} \mid \mathbf {x} _ {t}, \mathbf {c}\right)\right) \propto \left\| \mu_ {t} \left(\mathbf {x} _ {t}, \mathbf {x} _ {0}\right) - \mu_ {\theta} \left(\mathbf {x} _ {t}, \mathbf {x} _ {0}, t, \mathbf {c}\right) \right\| ^ {2} \propto \left\| \epsilon_ {t} - \epsilon_ {\theta} \left(\mathbf {x} _ {t}, t, \mathbf {c}\right) \right\| ^ {2} \tag {46}
$$
Finally, we can reorganize the Eq. (46) as Eq. (47), which is the clean loss function for the conditional diffusion models.
$$
\mathcal {L} _ {c} ^ {C} (\mathbf {x}, t, \epsilon , \mathbf {c}) := \left| \left| \epsilon - \epsilon_ {\theta} (\mathbf {x} _ {t} (\mathbf {x}, \epsilon), t, \mathbf {c}) \right| \right| ^ {2} \tag {47}
$$
B.4.4 Loss Function of the Backdoor Conditional Diffusion Models
Based on the above results, we can further derive the learned conditional reversed SDE Eq. (48), while the backdoor one remains the same as Eq. (35), which is caused by the identical backdoor reversed transition  $q(\mathbf{x}_{t - 1}^{\prime}|\mathbf{x}_{t}^{\prime},\mathbf{x}_{0}^{\prime})$  of the KL-divergence loss.
$$
d \mathbf {x} _ {t} = \left[ F (t) \mathbf {x} _ {t} - \frac {1 + \zeta}{2} G ^ {2} (t) \epsilon_ {\theta} (\mathbf {x} _ {t}, t, \mathbf {c}) \right] d t + G (t) \sqrt {\zeta \hat {\beta} (t)} d \bar {\mathbf {w}} \tag {48}
$$
According to the above results, we can formulate an image-trigger backdoor loss function based on Eq. (35) and Eq. (48) as Eq. (49). The loss function Eq. (49) is also known as denoising-score-matching loss [54], which is a surrogate of the score-matching problem since the score function  $\nabla_{\mathbf{x}_t'} \log q(\mathbf{x}_t')$  is intractable. Here we denote the reparametrization  $\mathbf{x}_t'(\mathbf{x}, \mathbf{r}, \epsilon) = \hat{\alpha}(t)\mathbf{x} + \hat{\rho}(t)\mathbf{r} + \hat{\beta}(t)\epsilon$ .
$$
\begin{array}{l} \left. \right. \mathbb {E} _ {\mathbf {x} _ {t} ^ {\prime}, \mathbf {x} _ {0} ^ {\prime}} \left[ \right.\left| \right.\left| \right. (- \hat {\beta} (t) \nabla_ {\mathbf {x} _ {t} ^ {\prime}} \log q \left(\mathbf {x} _ {t} ^ {\prime} \mid \mathbf {x} _ {0} ^ {\prime}\right) - \frac {2 H (t)}{(1 + \zeta) G ^ {2} (t)} \mathbf {r}\left. \right) - \epsilon_ {\theta} \left(\mathbf {x} _ {t}, t, \mathbf {c}\right)\left. \right|\left. \right| ^ {2} \left. \right]\left. \right. \tag {49} \\ \propto \left| \right| \epsilon - \frac {2 H (t)}{(1 + \zeta) G ^ {2} (t)} \mathbf {r} (\mathbf {x} _ {0}, \mathbf {g}) - \epsilon_ {\theta} \left(\mathbf {x} _ {t} ^ {\prime} \left(\mathbf {x} _ {0} ^ {\prime}, \mathbf {r} (\mathbf {x} _ {0}, \mathbf {g}), \epsilon\right), t, \mathbf {c}\right) \left| \right| ^ {2} \\ \end{array}
$$
Thus, we can finally write down the image-as-trigger backdoor loss function Eq. (50) for the conditional diffusion models.
$$
\mathcal {L} _ {p} ^ {C I} (\mathbf {x}, t, \epsilon , \mathbf {g}, \mathbf {y}, \mathbf {c}, \zeta) := \left| \left| \epsilon - \frac {2 H (t)}{(1 + \zeta) G ^ {2} (t)} \mathbf {r} (\mathbf {y}, \mathbf {g}) - \epsilon_ {\theta} \left(\mathbf {x} _ {t} ^ {\prime} (\mathbf {y}, \mathbf {r} (\mathbf {x}, \mathbf {g}), \epsilon), t, \mathbf {c}\right) \right| \right| ^ {2} \tag {50}
$$
C Limitations and Ethical Statements
Although VillanDiffusion works well with hot diffusion models, our framework does not cover all kinds of diffusion models, like Cold Diffusion [1] and Soft Diffusion [10], etc. However, even though our framework does not cover the deterministic generative process, we believe our method can still extend to more diffusion models, and we also call for the engagement of community to explore more advanced and universal attack on diffusion models.
On the other hand, although our framework aims to improve the robustness of diffusion models, we acknowledge the possibility that our findings on the weaknesses of diffusion models might be misused. Nevertheless, we believe our red-teaming effort can contribute to the development of robust diffusion models.
D.1 Backdoor Attacks on DDPM with CIFAR10 Dataset
We will present experimental results for more backdoor trigger-target pairs and samplers, including the LMSD sampler, which is implemented by the authors of EDM [25], in Fig. 7. The results of the ANCESTRAL sampler come from [9]. We also provide detailed numerical results in Appendix E.1
(a) (Stop Sign, NoShift) FID
(d) (Grey Box, NoShift) MSE
(b) (Stop Sign, NoShift) MSE
(c) (Grey Box, NoShift) FID
(e) (Stop Sign, Shift) FID
(f) (Stop Sign, Shift) MSE
(g) (Grey Box, Shift) FID
(h) (Grey Box, Shift) MSE
(i) (Stop Sign, Corner) FID
(j) (Stop Sign, Corner) MSE
(k) (Grey Box, Corner) FID
(1) (Grey Box, Corner) MSE
(m) (Stop Sign, Shoe) FID
(q) (Stop Sign, Hat) FID
Figure 7: FID and MSE scores of various samplers and poison rates for DDPM [16] and the CIFAR10 dataset. We express trigger-target pairs as (trigger, target).
(n) (Stop Sign, Shoe) MSE
(r) (Stop Sign, Hat) MSE
(o) (Grey Box, Shoe) FID
(s) (Grey Box, Hat) FID
(p) (Grey Box, Shoe) MSE
(t) (Grey Box, Hat) MSE
D.2 Backdoor Attacks on DDPM with CelebA-HQ Dataset
We evaluate our method with more samplers and backdoor trigger-target pairs: (Stop Sign, Hat) and (Eyeglasses, Cat) in Fig. 8. Note that the results of the ANCESTRAL sampler come from [9]. Please check numerical results in Appendix E.2
(a) (Eyeglasses, Cat) FID
Figure 8: FID and MSE scores of various samplers and poison rates for the DDPM [16] and the CelebA-HQ dataset. We express trigger-target pairs as (trigger, target).
(b) (Eyeglasses, Cat) MSE
(c) (Stop Sign, Hat) FID
(d) (Stop Sign, Hat) MSE
D.3 Backdoor Attacks on Latent Diffusion Models (LDM)
The pre-trained latent diffusion models (LDM) [45] are trained on CelebA-HQ with  $512 \times 512$  resolution and  $64 \times 64$  latent space. We fine-tune them with learning rate 2e-4 and batch size 16 for 2000 epochs. We examine our method with trigger-target pair: (Eyeglasses, Cat) and (Stop Sign, Hat) and illustrate the FID and MSE score in Fig. 9. As the Fig. 9 shows, the LDM can be backdoored successfully for the trigger-target pairs: (Stop Sign, Hat) with  $70\%$  poison rate. Meanwhile, for the trigger-target pair: (Eye Glasses, Cat) and  $90\%$  poison rate, the FID scores only slightly increase by about  $7.2\%$  at most. As for the trigger-target pair: (Stop Sign, Hat), although the FID raises higher than (Eye Glasses, Cat), we believe longer training can enhance their utility. Please check Appendix E.3 for the numerical results of the experiments.
(c) (Stop Sign, Hat) FID
(d) (Stop Sign, Hat) MSE
Figure 9: FID and MSE scores of various samplers and poison rates for the latent diffusion model (LDM) [45] and the CelebA-HQ dataset. We express trigger-target pairs as (trigger, target).
D.4 Backdoor Attacks on Score-Based Models
We trained the score-based model: NCSN [56, 54, 55] on the CIFAR10 dataset with the same model architecture as the DDPM [16] by ourselves for 800 epochs and set the learning rate as 1e-4 and batch size as 128. The FID score of the clean model generated by predictor-correction samplers (SCORE-SDE-VE [56]) for the variance explode models [56] is about 10.87. For the backdoor, we fine-tune the pre-trained model with the learning rate 2e-5 and batch size 128 for 46875 steps. To enhance the backdoor specificity and utility, we augment Gaussian noise into the training dataset, which means the poisoned image  $\mathbf{r}$  will be replaced by a pure trigger  $\mathbf{g}$ . The augmentation can let the model learn to activate the backdoor even if there are no context images. We present our results in Fig. 10 and can see with  $70\%$  augment rate, our method can achieve  $70\%$  attack success rate based on Fig. 10c as the FID score increases by  $12.7\%$ . Note that the augment rate is computed by the number of augmented Gaussian noises / the size of the original training dataset. We also present detailed numerical results in Appendix E.4.
(a) (Stop Sign, Hat) FID
(b) (Stop Sign, Hat) MSE
Figure 10: FID and MSE scores of various samplers and poison rates for the score-based model (NCSN) [54, 55, 56] and the CIFAR10 dataset. We express trigger-target pairs as (trigger, target). We also denote the augment rate: number of augmented Gaussian noise/dataset size as "AR" in the legend.
(c) (Stop Sign, Hat) MSE Threshold
D.5 Evaluation on DDIM with Various Randomness  $\eta$
We also conducted experiments on BadDiffusion and VillanDiffusion with different samplers. The numerical results are presented in Appendix E.8. We found that BadDiffusion is only effective in SDE samplers. When DDIM goes down, which means the sampler becomes more likely an ODE, the MSE of VillanDiffusion trained for ODE samplers would decrease, but BadDiffusion would increase. Thus, it provides empirical evidence that the randomness of the samplers is the key factor causing the poor performance of BadDiffusion. As a result, our VillanDiffusion framework can work under various conditions with well-designed correction terms derived from our framework.
D.6 Comparison Between BadDiffusion and VillanDiffusion on CIFAR10
We conduct an experiment to evaluate BadDiffusion and VillanDiffusion (with  $\zeta = 0$ ) on ODE samplers, including UniPC [61], DPM-Solver [34, 35], DDIM [52], and PNDM [32]. We also present the detailed numerical results in Appendix E.9. Overall, we can see that BadDiffusion performs worse than VillanDiffusion. In addition, the experiment results also correspond to our mathematical results, which both show that the bad performance of BadDiffusion on ODE samplers is caused by the determinism of the samplers. Once we take the randomness hyperparameter  $\zeta$  into account, we can derive an effective backdoor loss function for the attack.
D.7 Inference-Time Clipping Defense
We evaluate the inference-time clipping defense on the CIFAR10 dataset with triggers: Grey Box and Stop Sign and targets: NoShift, Shift, Corner, Shoe, and Hat in Fig. 11. The results of the ANCESTRAL sampler are from [9]. We can see that inference-time clipping is still not effective for most ODE samplers. Please check Appendix E.6 for the numerical results.
D.8 VillanDiffusion on the Inpaint Tasks
Similar to [9], we also evaluate our method on the inpainting tasks with various samplers. We design 3 kinds of different corruptions: Blur, Line, Box. Blur means we add Gaussian noise  $\mathcal{N}(0,0.3)$  to corrupt the images. Line and Box mean we crop part of the image and ask the diffusion models to recover the missing area. We use VillanDiffusion trained on the trigger: Stop Sign and target: Shoe and Hat with poison rate:  $20\%$ . During inpainting, we apply UniPC [61], DEIS [59], DPM Solver [34], and DPM Solver++ [35] samplers with 50 sampling steps. To evaluate the recovery quality, we generate 1024 images and use LPIPS [60] score to measure the similarity between the covered images and ground-truth images. We illustrate our results in Fig. 12. We can see our method achieves both high utility and high specificity. The detailed numerical results are presented in Appendix E.7.
(q) (Stop Sign, Hat) FID
(r) (Stop Sign, Hat) MSE
(s) (Grey Box, Hat) FID