SlowGuess/NeurIPS_2023_OCR huggingface dataset:
(t) (Grey Box, Hat) MSE
Figure 11: FID and MSE scores of various samplers and poison rates with inference-time defense [9]. We evaluate the defense on the DDPM and the CIFAR10 dataset and express trigger-target pairs as (trigger, target).
(a) (Stop Sign,Hat) LPIPS (b) (Stop Sign,Hat) MSE (c) (Stop Sign,Shoe) LPIPS (d) (Stop Sign,Shoe) MSE
Figure 12: LPIPS and MSE scores of various samplers and poison rates for the 3 kinds of inpainting tasks: Blur, Line, and Box. The backdoor model is DDPM trained on the CIFAR10 dataset. We express trigger-target pairs as (trigger, target).
E Numerical Results
E.1 Backdoor Attacks on DDPM with CIFAR10 Dataset
We present the numerical results of the trigger: Stop Sign and targets: NoShift, Shift, Corner, Shoe, and Hat in Table 2, Table 3, Table 4, Table 5, and Table 6 respectively. As for trigger Grey Box, we also show the results for the targets: NoShift, Shift, Corner, Shoe, and Hat in Table 7, Table 8, Table 9, Table 10, and Table 11.
E.2 Backdoor Attacks on DDPM with CelebA-HQ Dataset
We show the numerical results for the trigger-target pairs: (Eyeglasses, Cat) and (Stop Sign, Hat) in Table 12 and Table 13 respectively.
E.3 Backdoor Attacks on Latent Diffusion Models (LDM)
We show the experiment results of the trigger-target pair: (Eye Glasses, Cat) in Table 14 and (Stop Sign, Hat) in Table 15.
E.4 Backdoor Attacks on Score-Based Models
We provide the numerical results for the trigger-target pair: (Stop Sign, Hat) in the Table 16.
E.5 Caption-Trigger Backdoor Attacks on Text-to-Image DMs
We will present the numerical results of the Pokemon Caption dataset in Table 17 and Table 18. For the CelebA-HQ-Dialog dataset, we will show them in Table 19 and Table 20.
E.6 Inference-Time Clipping Defense
For the trigger Stop Sign, we present the numerical results of the inference-time clipping defense with targets: NoShift, Shift, Corner, Shoe, and Hat in Table 21, Table 22, Table 23, Table 24, and Table 25 respectively. As for the trigger Grey Box, we also show our results of the targets: NoShift, Shift, Corner, Shoe, and Hat in Table 26, Table 27, Table 28, Table 29, and Table 30 respectively.
E.7 VillanDiffusion on the Inpaint Tasks
For the trigger Stop Sign, we present the numerical results of the inpainting tasks: Blur, Line, and Box with targets Hat and Shoe in Table 32 and Table 31 respectively.
E.8 BadDiffusion and VillanDiffusion on CIFAR10 with Different Randomness  $\eta$
For the trigger Stop Sign, we present the numerical results of various randomness  $\eta$  with targets: Hat and Shoe in Table 33 respectively.
E.9 Comparison Between BadDiffusion and VillanDiffusion on CIFAR10
For the trigger Stop Sign, we show the numerical results of the comparison between BadDiffusion and VillanDiffusion in Table 34.
Table 2: DDPM backdoor on CIFAR10 Dataset with Trigger: Stop Sign, target: No Shift
Sampler	P.R. Metric	0%	5%	10%	20%	30%	50%	70%	90%
ANCESTRAL	FID	11.52	8.09	7.62	7.97	7.46	7.68	7.38	7.22
MSE	1.48E-1	6.81E-2	9.47E-3	2.35E-4	5.59E-6	4.19E-6	3.96E-6	3.80E-6
SSIM	6.84E-4	4.35E-1	9.18E-1	9.97E-1	9.99E-1	9.98E-1	9.98E-1	9.98E-1
FID	11.15	9.18	9.07	9.18	9.37	9.76	10.28	11.53
UNIPC	MSE	1.48E-1	4.76E-2	9.37E-3	1.30E-4	8.05E-5	2.27E-4	3.56E-5	3.24E-5
SSIM	8.13E-4	5.27E-1	8.57E-1	9.76E-1	9.81E-1	9.74E-1	9.86E-1	9.84E-1
FID	11.15	9.18	9.07	9.07	9.37	9.76	10.28	11.53
DPM. O2	MSE	1.48E-1	4.76E-2	9.37E-3	1.24E-4	8.05E-5	2.27E-4	3.56E-5	3.24E-5
SSIM	8.13E-4	5.27E-1	8.57E-1	9.80E-1	9.81E-1	9.74E-1	9.86E-1	9.84E-1
FID	11.15	9.18	9.07	9.18	9.37	9.57	10.28	11.53
DPM. O3	MSE	1.48E-1	4.76E-2	9.37E-3	1.30E-4	8.05E-5	7.48E-5	3.56E-5	3.24E-5
SSIM	8.13E-4	5.27E-1	8.57E-1	9.76E-1	9.81E-1	9.80E-1	9.86E-1	9.84E-1
FID	11.15	9.18	9.07	9.18	9.37	9.76	10.28	11.53
DPM++. O2	MSE	1.48E-1	4.76E-2	9.37E-3	1.30E-4	8.05E-5	2.27E-4	3.56E-5	3.24E-5
SSIM	8.13E-4	5.27E-1	8.57E-1	9,76E-1	9.81E-1	9.74E-1	9.86E-1	9.84E-1
FID	11.15	9.18	9.07	9.07	9.37	9.73	10.28	11.53
DPM++. O3	MSE	1.48E-1	4.76E-2	9.37E-3	1.24E-4	8.05E-5	1.99E-4	3.56E-5	3.24E-5
SSIM	8.13E-4	5.27E-1	8.57E-1	9.80E-1	9.81E-1	9.76E-1	9.86E-1	9.84E-1
FID	11.15	9.18	9.07	9.07	9.37	9.57	10.28	11.53
DEIS	MSE	1.48E-1	4.76E-2	9.37E-3	1.28E-4	8.05E-5	7.48E-5	3.56E-5	3.24E-5
SSIM	8.13E-4	5.27E-1	8.57E-1	9.76E-1	9.81E-1	9.80E-1	9.86E-1	9,84E-1
FID	16.39	10.95	10.71	10.70	11.16	11.32	12.40	14.43
DDIM	MSE	1.48E-1	7.14E-2	2.47E-2	6.84E-4	4.95E-6	3.70E-6	3.58E-6	3.51E-6
SSIM	8.92E-4	3.74E-1	7.63E-1	9.92E-1	1.00E+0	9.99E-1	9.99E-1	9.99E-1
FID	12.14	7.24	7.13	7.25	7.42	7.77	8.18	9.83
PNDM	MSE	1.48E-1	6.55E-2	1.97E-2	1.23E-4	3.74E-5	3.25E-5	2.86E-5	2.76E-5
SSIM	8.23E-4	4.11E-1	7.91E-1	9.81E-1	9.83E-1	9.83E-1	9.83E-1	9.83E-1
FID	12.14	7.24	7.13	7.25	7.42	7.60	8.18	9.83
HEUN	MSE	1.48E-1	6.55E-2	1.97E-2	1.23E-4	3.74E-5	3.16E-5	2.86E-5	2.76E-5
SSIM	8.23E-4	4.11E-1	7.91E-1	9.81E-1	9.83E-1	9.83E-1	9.83E-1	9.83E-1
FID	12.24	7.24	7.13	7.24	7.42	7.47	8.18	9.83
LMSD	MSE	1.48E-1	6.55E-2	1.97E-2	5.02E-4	3.74E-5	3.23E-5	2.86E-5	2.76E-5
SSIM	8.23E-4	4.11E-1	7.91E-1	9.76E-1	9.83E-1	9.83E-1	9.83E-1	9.83E-1
Table 3: DDPM backdoor on CIFAR10 Dataset with Trigger: Stop Sign, target: Shift
Sampler	P.R. Metric	0%	5%	10%	20%	30%	50%	70%	90%
ANCESTRAL	FID	11.16	8.21	7.42	7.68	7.76	8.02	7.42	7.72
MSE	1.48E-1	5.68E-2	5.91E-3	8.96E-5	6.73E-6	4.23E-6	3.96E-6	3.80E-6
SSIM	4.24E-4	5.73E-1	9.56E-1	9.99E-1	9.99E-1	9.99E-1	9.99E-1	9.99E-1
FID	11.15	8.92	9.18	8.98	9.36	9.39	10.37	11.89
UNIPC	MSE	1.48E-1	5.92E-2	4.37E-4	1.37E-4	2.58E-4	1.66E-4	4.35E-5	7.59E-5
SSIM	4.25E-4	4.92E-1	9.70E-1	9.85E-1	9.81E-1	9.86E-1	9.88E-1	9.89E-1
FID	11.15	8.92	9.18	8.98	9.36	9.39	10.37	11.89
DPM. O2	MSE	1.48E-1	5.92E-2	4.37E-4	1.37E-4	2.58E-4	1.66E-4	4.35E-5	7.59E-5
SSIM	4.25E-4	4.92E-1	9.70E-1	9,85E-1	9.81E-1	9.86E-1	9.88E-1	9.89E-1
FID	11.15	8.92	9.18	8.98	9.36	9.39	10.37	11.89
DPM. O3	MSE	1.48E-1	5.92E-2	4.37E-4	1.37E-4	2.58E-4	1.66E-4	4.35E-5	7.59E-5
SSIM	4.25E-4	4.92E-1	9.70E-1	9:85E-1	9.81E-1	9.86E-1	9.88E-1	9.89E-1
FID	11.15	8.92	9.18	8.98	9.36	9.39	10.37	11.89
DPM++. O2	MSE	1.48E-1	5.92E-2	4.37E-4	1.37E-4	2.58E-4	1.66E-4	4.35E-5	7.59E-5
SSIM	4.25E-4	4.92E-1	9.70E-1	9.81E-1	9.86E-1	9.88E-1	9.89E-1
FID	11.15	8.92	9.18	8.98	9.36	9.39	10.37	11.89
DPM++. O3	MSE	1.48E-1	5.92E-2	4.37E-4	1.37E-4	2.58E-4	1.66E-4	4.35E-5	7.59E-5
SSIM	4.25E-4	4.92E-1	9.70E-1	\( 9.81E-1 \)	9.86E-1	9.88E-1	9.89E-1
FID	11.15	8.92	9.18	8.98	9.36	9.39	10.37	11.89
DEIS	MSE	1.48E-1	5.92E-2	4.37E-4	1.37E-4	2.58E-4	1.66E-4	4.35E-5	7.59E-5
SSIM	4.25E-4	4.92E-1	9.70E-1	\(\mathbf{9.85E - 1}\)	9.86E-1	9.88E-1	9.89E-1
FID	16.39	10.70	10.85	11.01	11.29	11.48	12.37	14.60
DDIM	MSE	1.48E-1	8.25E-2	1.18E-3	6.30E-6	4.15E-6	3.67E-6	3.54E-6	3.48E-6
SSIM	4.32E-4	3.43E-1	9.84E-1	1.00E+0	1.00E+0	9.99E-1	9.99E-1	9.99E-1
FID	12.14	7.15	7.16	7.29	7.44	7.48	8.23	9.97
PNDM	MSE	1.48E-1	7.69E-2	8.51E-4	5.18E-5	3.72E-5	3.53E-5	2.96E-5	2.77E-5
SSIM	4.25E-4	3.78E-1	9.76E-1	9.89E-1	9.90E-1	9.90E-1	9.90E-1
FID	12.14	7.15	7.16	7.29	7.44	7.48	8.23	9.97
HEUN	MSE	1.48E-1	7.69E-2	8.51E-4	5.18E-5	3.72E-5	3.53E-5	2.96E-5	2.77E-5
SSIM	4.25E-4	3.78E-1	9.76E-1	\( 9.89E - 1 \)	9.90E-1	9.90E-1	9.90E-1
FID	12.14	7.15	7.16	7.29	7.44	7.48	8.23	9.97
LMSD	MSE	1.48E-1	7.69E-2	8.51E-4	5.18E-5	3.72E-5	3.53E-5	2.96E-5	2.77E-5
SSIM	4.25E-4	3.78E-1	9.76E-1	\(\mathbf{9.89E - 1}\)	9.90E-1	9.90E-1	9.90E-1
Table 4: DDPM backdoor on CIFAR10 Dataset with Trigger: Stop Sign, target: Corner
Sampler	P.R. Metric	0%	5%	10%	20%	30%	50%	70%	90%
ANCESTRAL	FID	14.83	8.38	7.83	8.35	8.08	8.14	7.85	7.98
MSE	1.06E-1	7.22E-2	4.20E-3	7.09E-4	6.13E-5	2.37E-5	1.41E-5	3.85E-6
SSIM	9.85E-4	2.65E-1	9.49E-1	9.89E-1	9.97E-1	9.97E-1	9.97E-1	9.97E-1
FID	11.15	9.03	8.83	9.09	9.16	9.61	10.61	12.67
UNIPC	MSE	1.06E-1	7.85E-2	9.05E-3	2.47E-4	1.17E-4	2.73E-4	4.75E-4	1.63E-4
SSIM	1.09E-3	1.34E-1	7.52E-1	9.38E-1	9.56E-1	9.53E-1	9.57E-1	9.72E-1
FID	11.15	9.03	8.83	9.09	9.16	9.61	10.61	12.67
DPM. O2	MSE	1.06E-1	7.85E-2	9.05E-3	2.47E-4	1.17E-4	2.73E-4	4.75E-4	1.63E-4
SSIM	1.09E-3	1.34E-1	7.52E-1	9,38E-1	9.56E-1	9.53E-1	9.57E-1	9.72E-1
FID	11.15	9.03	8.83	9.09	9.16	9.61	10.61	12.67
DPM. O3	MSE	1.06E-1	7.85E-2	9.05E-3	2.47E-4	1.17E-4	2.73E-4	4.75E-4	1.63E-4
SSIM	1.09E-3	1.34E-1	7.52E-1	938E-1	9.56E-1	9.53E-1	9.57E-1	9.72E-1
FID	11.15	9.03	8.83	9.09	9.16	9.61	10.61	12.67
DPM++. O2	MSE	1.06E-1	7.85E-2	9.05E-3	2.47E-4	1.17E-4	2.73E-4	4.75E-4	1.63E-4
SSIM	1.09E-3	1.34E-1	7.52E-1
FID	11.15	9.03	8.83	9.09	9.16	9.61	10.61	12.67
DPM++. O3	MSE	1.06E-1	7.85E-2	9.05E-3	2.47E-4	1.17E-4	2.73E-4	4.75E-4	1.63E-4
SSIM	1.09E-3	1.34E-1	7.52E-1	9.53E-1	9.57E-1	9.72E-1
FID	11.15	9.03	8.83	9.09	9.16	9.61	10.61	12.67
DEIS	MSE	1.06E-1	7.85E-2	9.05E-3	2.47E-4	1.17E-4	2.73E-4	4.75E-4	1.63E-4
SSIM	1.09E-3	1.34E-1	7.52E-1	9.53E-1	9.57E-1	9.72E-1
FID	16.39	10.74	10.54	10.85	10.92	11.74	12.53	15.57
DDIM	MSE	1.06E-1	9.16E-2	2.54E-2	1.05E-3	7.27E-6	3.84E-6	3.84E-6	3.84E-6
SSIM	1.12E-3	6.38E-2	6.36E-1	9.79E-1	1.00E+0	1.00E+0	9.99E-1	9.98E-1
FID	12.14	7.22	7.14	7.15	7.31	7.59	8.39	10.74
PNDM	MSE	1.06E-1	8.87E-2	1.94E-2	6.28E-4	4.24E-5	3.09E-5	2.89E-5	2.70E-5
SSIM	1.08E-3	7.93E-2	6.84E-1	9.58E-1	9.73E-1	9.76E-1	9.75E-1	9.76E-1
FID	12.14	7.22	7.14	7.15	7.31	7.59	8.39	10.74
HEUN	MSE	1.06E-1	8.87E-2	1.94E-2	6.28E-4	4.24E-5	3.09E-5	2.89E-5	2.70E-5
SSIM	1.08E-3	7.93E-2	6.84E-1	9,58E-1	9.73E-1	9.76E-1	9.75E-1	9.76E-1
FID	12.14	7.22	7.14	7.15	7.31	7.59	8.39	10.74
LMSD	MSE	1.06E-1	8.87E-2	1.94E-2	6.28E-4	4.24E-5	3.09E-5	2.89E-5	2.70E-5
SSIM	1.08E-3	7.93E-2	6.84E-1	958E-1	9.73E-1	9.76E-1	9.75E-1	9.76E-1
Table 5: DDPM backdoor on CIFAR10 Dataset with Trigger: Stop Sign, target: Shoe
Sampler	P.R. Metric	0%	5%	10%	20%	30%	50%	70%	90%
ANCESTRAL	FID	11.52	8.33	7.47	8.10	7.52	7.69	7.35	7.54
MSE	3.38E-1	1.66E-1	3.61E-3	2.30E-5	5.62E-6	3.35E-6	2.72E-6	2.39E-6
SSIM	1.69E-4	4.20E-1	9.85E-1	9.99E-1	1.00E+0	1.00E+0	1.00E+0	1.00E+0
FID	11.15	9.03	9.14	8.96	9.09	9.74	10.41	12.00
UNIPC	MSE	3.38E-1	9.33E-2	1.31E-2	1.47E-4	1.10E-4	8.83E-5	1.04E-4	7.49E-5
SSIM	2.15E-4	5.91E-1	9.13E-1	9.89E-1	9.91E-1	9.92E-1	9.91E-1	9.92E-1
FID	11.15	9.03	9.14	8.96	9.09	9.74	10.41	12.00
DPM. O2	MSE	3.38E-1	9.33E-2	1.31E-2	1.47E-4	1.10E-4	8.83E-5	1.04E-4	7.49E-5
SSIM	2.15E-4	5.91E-1	9.13E-1	9,89E-1	9.91E-1	9.92E-1	9.91E-1	9.92E-1
FID	11.15	9.03	9.14	8.96	9.09	9.74	10.41	12.00
DPM. O3	MSE	3.38E-1	9.33E-2	1.31E-2	1.47E-4	1.10E-4	8.83E-5	1.04E-4	7.49E-5
SSIM	2.15E-4	5.91E-1	9.13E-1	989E-1	9.91E-1	9.92E-1	9.91E-1	9.92E-1
FID	11.15	9.03	9.14	8.96	9.09	9.74	10.41	12.00
DPM++. O2	MSE	3.38E-1	9.33E-2	1.31E-2	1.47E-4	1.10E-4	8.83E-5	1.04E-4	7.49E-5
SSIM	2.15E-4	5.91E-1	9.13E-1	9.91E-1	9.92E-1	9.91E-1	9.92E-1
FID	11.15	9.03	9.14	8.96	9.09	9.74	10.41	12.00
DPM++. O3	MSE	3.38E-1	9.33E-2	1.31E-2	1.47E-4	1.10E-4	8.83E-5	1.04E-4	7.49E-5
SSIM	2.15E-4	5.91E-1	9.13E-1	8.96	9.09	9.92E-1	9.91E-1
FID	11.15	9.03	9.14	8.96	9.09	9.74	10.41	12.00
DEIS	MSE	3.38E-1	9.33E-2	1.31E-2	1.47E-4	1.10E-4	8.83E-5	1.04E-4	7.49E-5
SSIM	2.15E-4	5.91E-1	9.13E-1	10.68	9.91E-1	9.92E-1	9.91E-1
FID	16.39	10.71	10.75	10.68	10.87	11.86	12.73	14.94
DDIM	MSE	3.37E-1	1.56E-1	3.96E-2	1.09E-4	7.39E-6	2.42E-6	2.00E-6	1.98E-6
SSIM	2.40E-4	3.97E-1	8.14E-1	9.99E-1	1.00E+0	1.00E+0	1.00E+0
FID	12.14	7.12	7.20	7.17	7.25	7.79	8.33	10.35
PNDM	MSE	3.38E-1	1.39E-1	2.94E-2	1.35E-4	4.89E-5	3.51E-5	2.97E-5	2.74E-5
SSIM	2.17E-4	4.51E-1	8.53E-1	9.94E-1	9.95E-1	9.95E-1	9.95E-1
FID	12.14	7.12	7.20	7.17	7.25	7.79	8.33	10.35
HEUN	MSE	3.38E-1	1.39E-1	2.94E-2	1.35E-4	4.89E-5	3.51E-5	2.97E-5	2.74E-5
SSIM	2.17E-4	4.51E-1	8.53E-1	10.68	9.94E-1	9.95E-1	9.95E-1
FID	12.14	7.12	7.20	7.17	7.25	7.79	8.33	10.35
LMSD	MSE	3.38E-1	1.39E-1	2.94E-2	1.35E-4	4.89E-5	3.51E-5	2.97E-5	2.74E-5
SSIM	2.17E-4	4.51E-1	8.53E-1	8.94E-1	9.94E-1	9.95E-1	9.95E-1
Table 6: DDPM backdoor on CIFAR10 Dataset with Trigger: Stop Sign, target: Hat
Sampler	P.R. Metric	0%	5%	10%	20%	30%	50%	70%	90%
ANCESTRAL	FID	14.83	8.32	7.57	8.17	7.77	7.77	7.83	7.77
MSE	2.41E-1	7.99E-2	4.33E-3	2.85E-4	9.16E-5	1.30E-5	3.21E-6	2.81E-6
SSIM	4.74E-5	6.52E-1	9.80E-1	9.98E-1	9.99E-1	1.00E+0	1.00E+0	1.00E+0
FID	11.15	8.94	8.95	8.97	9.38	9.51	10.11	12.08
UNIPC	MSE	2.41E-1	2.50E-2	1.23E-2	1.25E-4	1.03E-4	7.29E-5	2.89E-4	8.91E-5
SSIM	1.01E-4	8.57E-1	9.23E-1	9.95E-1	9.96E-1	9.96E-1	9.95E-1	9.97E-1
FID	11.15	8.94	8.95	9.12	9.38	9.70	10.11	12.08
DPM. O2	MSE	2.41E-1	2.50E-2	1.23E-2	1.30E-4	1.03E-4	1.43E-4	2.89E-4	8.91E-5
SSIM	1.01E-4	8.57E-1	9.23E-1	9.95E-1	9.96E-1	9.97E-1	9.95E-1	9.97E-1
FID	11.15	8.94	8.95	8.91	9.38	9.45	10.11	12.08
DPM. O3	MSE	2.41E-1	2.50E-2	1.23E-2	1.14E-4	1.03E-4	7.12E-5	2.89E-4	8.91E-5
SSIM	1.01E-4	8.57E-1	9.23E-1	9.95E-1	9.96E-1	9.96E-1	9.95E-1	9.97E-1
FID	11.5	8.94	8.95	9.12	9.38	9.70	10.11	12.08
DPM++. O2	MSE	2.41E-1	2.50E-2	1.23E-2	1.30E-4	1.03E-4	1.43E-4	2.89E-4	8.91E-5
SSIM	1.01E-4	8.57E-1	9.23E-1
FID	11.15	8.94	8.95	9.13	9.38	9.70	10.11	12.08
DPM++. O3	MSE	2.41E-1	2.50E-2	1.23E-2	1.61E-4	1.03E-4	1.43E-4	2.89E-4	8.91E-5
SSIM	1.01E-4	8.57E-1	9.23E-1	9.94E-1	9.96E-1	9.97E-1	9.95E-1	9.97E-1
FID	11.15	8.94	8.95	8.97	9.38	9.51	10.11	12.08
DEIS	MSE	2.41E-1	2.50E-2	1.23E-2	1.25E-4	1.03E-4	7.29E-5	2.89E-4	8.91E-5
SSIM	1.01E-4	8.57E-1	9.23E-1	9,95E-1	9.96E-1	9.96E-1	9.95E-1	9.97E-1
FID	16.39	10.63	10.77	10.76	11.12	11.33	12.40	15.13
DDIM	MSE	2.40E-1	5.77E-2	3.08E-2	2.86E-5	3.79E-6	2.49E-6	2.31E-6	2.29E-6
SSIM	1.39E-4	7.09E-1	8.40E-1	1.00E+0	1.00E+0	1.00E+0	1.00E+0	1.00E+0
FID	12.14	7.07	7.02	7.15	7.44	7.63	8.11	10.36
PNDM	MSE	2.41E-1	4.85E-2	2.41E-2	6.43E-5	4.21E-5	3.67E-5	3.04E-5	2.82E-5
SSIM	1.05E-4	7.51E-1	8.70E-1	9.97E-1	9.97E-1	9.98E-1	9.98E-1	9.98E-1
FID	12.14	7.07	7.02	7.15	7.44	7.52	8.11	10.36
HEUN	MSE	2.41E-1	4.85E-2	2.41E-2	6.43E-5	4.21E-5	3.48E-5	3.04E-5	2.82E-5
SSIM	1.05E-4	7.51E-1	8.70E-1	9.97E-1	9.97E-1	9.98E-1	9.98E-1	9.98E-1
FID	12.20	7.07	7.02	7.13	7.44	7.52	8.11	10.36
LMSD	MSE	2.41E-1	4.85E-2	2.41E-2	6.57E-5	4.21E-5	3.48E-5	3.04E-5	2.82E-5
SSIM	1.05E-4	7.51E-1	8.70E-1	9.97E-1	9.97E-1	9.98E-1	9.98E-1	9,98E-1
Table 7: DDPM backdoor on CIFAR10 Dataset with Trigger: Grey Box, target: No Shift
Sampler	P.R. Metric	0%	5%	10%	20%	30%	50%	70%	90%
ANCESTRAL	FID	11.56	9.09	9.62	11.36	12.85	17.63	25.70	52.92
MSE	1.21E-1	6.19E-2	6.11E-3	1.18E-5	5.89E-6	4.09E-6	3.91E-6	3.86E-6
SSIM	7.36E-4	4.21E-1	9.41E-1	9.98E-1	9.98E-1	9.98E-1	9.98E-1	9.98E-1
FID	11.15	9.30	9.60	10.20	11.13	13.17	16.62	30.87
UNIPC	MSE	1.21E-1	2.58E-2	5.64E-3	1.67E-4	6.52E-5	6.15E-5	1.36E-4	1.98E-4
SSIM	7.37E-4	6.22E-1	8.62E-1	9.61E-1	9.74E-1	9.76E-1	9.82E-1	9.80E-1
FID	11.15	9.30	9.60	10.20	11.13	13.17	16.62	30.87
DPM. O2	MSE	1.21E-1	2.58E-2	5.64E-3	1.67E-4	6.52E-5	6.15E-5	1.36E-4	1.98E-4
SSIM	7.37E-4	6.22E-1	8.62E-1	9,61E-1	9.74E-1	9.76E-1	9.82E-1	9.80E-1
FID	11.15	9.30	9.60	10.20	11.13	13.17	16.62	30.87
DPM. O3	MSE	1.21E-1	2.58E-2	5.64E-3	1.67E-4	6.52E-5	6.15E-5	1.36E-4	1.98E-4
SSIM	7.37E-4	6.22E-1	8.62E-1	9:61E-1	9.74E-1	9.76E-1	9.82E-1	9.80E-1
FID	11.15	9.30	9.60	10.20	11.13	13.17	16.62	30.87
DPM++. O2	MSE	1.21E-1	2.58E-2	5.64E-3	1.67E-4	6.52E-5	6.15E-5	1.36E-4	1.98E-4
SSIM	7.37E-4	6.22E-1	8.62E-1	9.74E-1	9.76E-1	9.82E-1	9.80E-1
FID	11.15	9.30	9.60	10.20	11.13	13.17	16.62	30.87
DPM++. O3	MSE	1.21E-1	2.58E-2	5.64E-3	1.67E-4	6.52E-5	6.15E-5	1.36E-4	1.98E-4
SSIM	7.37E-4	6.22E-1	8.62E-1	\( 9.61E-1 \)	9.74E-1	9.82E-1	9.80E-1
FID	11.15	9.30	9.60	10.20	11.13	13.17	16.62	30.87
DEIS	MSE	1.21E-1	2.58E-2	5.64E-3	1.67E-4	6.52E-5	6.15E-5	1.36E-4	1.98E-4
SSIM	7.37E-4	6.22E-1	8.62E-1	\(\mathsf{9.61E-1}\)	9.74E-1	9.82E-1	9.80E-1
FID	16.39	10.97	11.21	12.22	13.17	15.62	19.74	35.84
DDIM	MSE	1.21E-1	5.13E-2	1.75E-2	2.87E-4	7.06E-6	3.85E-6	3.84E-6	3.84E-6
SSIM	7.38E-4	4.04E-1	7.63E-1	\( 9.94E-1 \)	\( 1.00E+0 \)	\( 9.99E-1 \)	9.98E-1
FID	12.14	7.88	8.34	9.38	10.80	13.73	18.47	36.29
PNDM	MSE	1.21E-1	4.47E-2	1.37E-2	2.35E-4	4.50E-5	3.31E-5	3.02E-5	2.81E-5
SSIM	7.37E-4	4.62E-1	7.93E-1	\( 9.75E-1 \)	\( 9.78E-1 \)	\( 9.79E-1 \)	9.80E-1
FID	12.14	7.88	8.34	9.38	10.80	13.73	18.47	36.29
HEUN	MSE	1.21E-1	4.47E-2	1.37E-2	2.35E-4	4.50E-5	3.31E-5	3.02E-5	2.81E-5
SSIM	7.37E-4	4.62E-1	7.93E-1	9.75E-1	9.78E-1	9.79E-1	9.80E-1
FID	12.14	7.88	8.34	9.38	10.80	13.73	18.47	36.29
LMSD	MSE	1.21E-1	4.47E-2	1.37E-2	2.35E-4	4.50E-5	3.31E-5	3.02E-5	2.81E-5
SSIM	7.37E-4	4.62E-1	7.93E-1	\(\mathsf{9.75E-1}\)	\(\mathsf{9.78E-1}\)	\(\mathsf{9.79E-1}\)	\(\mathsf{9.80E-1}\)
Table 8: DDPM backdoor on CIFAR10 Dataset with Trigger: Grey Box, target: Shift
Sampler	P.R. Metric	0%	5%	10%	20%	30%	50%	70%	90%
ANCESTRAL	FID	11.56	9.09	9.78	11.26	12.41	15.55	21.78	41.54
MSE	1.21E-1	5.11E-2	5.52E-3	7.90E-5	1.61E-5	6.25E-6	1.22E-5	5.98E-6
SSIM	4.72E-4	5.06E-1	9.45E-1	9.98E-1	9.99E-1	9.99E-1	9.99E-1	9.98E-1
FID	11.15	9.28	9.42	10.10	10.70	12.77	15.41	26.12
UNIPC	MSE	1.21E-1	4.83E-2	1.67E-2	1.46E-4	1.10E-4	1.49E-4	8.65E-5	9.66E-5
SSIM	4.73E-4	4.64E-1	7.46E-1	9.71E-1	9.81E-1	9.79E-1	9.85E-1	9.84E-1
FID	11.15	9.28	9.42	10.10	10.70	12.77	15.41	26.12
DPM. O2	MSE	1.21E-1	4.83E-2	1.67E-2	1.46E-4	1.10E-4	1.49E-4	8.65E-5	9.66E-5
SSIM	4.73E-4	4.64E-1	7.46E-1	9,71E-1	9.81E-1	9.79E-1	9.85E-1	9.84E-1
FID	11.15	9.28	9.42	10.10	10.70	12.77	15.41	26.12
DPM. O3	MSE	1.21E-1	4.83E-2	1.67E-2	1.46E-4	1.10E-4	1.49E-4	8.65E-5	9.66E-5
SSIM	4.73E-4	4.64E-1	7.46E-1	9.,71E-1	9.81E-1	9.79E-1	9.85E-1	9.84E-1
FID	11.15	9.28	9.42	10.10	10.70	12.77	15.41	26.12
DPM++. O2	MSE	1.21E-1	4.83E-2	1.67E-2	1.46E-4	1.10E-4	1.49E-4	8.65E-5	9.66E-5
SSIM	4.73E-4	4.64E-1	7.46E-1	9.81E-1	9.79E-1	9.85E-1	9.84E-1
FID	11.15	9.28	9.42	10.10	10.70	12.77	15.41	26.12
DPM++. O3	MSE	1.21E-1	4.83E-2	1.67E-2	1.46E-4	1.10E-4	1.49E-4	8.65E-5	9.66E-5
SSIM	4.73E-4	4.64E-1	7.46E-1	\( 9.81E-1 \)	9.79E-1	9.85E-1	9.84E-1
FID	11.15	9.28	9.42	10.10	10.70	12.77	15.41	26.12
DEIS	MSE	1.21E-1	4.83E-2	1.67E-2	1.46E-4	1.10E-4	1.49E-4	8.65E-5	9.66E-5
SSIM	4.73E-4	4.64E-1	7.46E-1	10.10	9.79E-1	9.85E-1	9.84E-1
FID	16.39	10.84	10.98	11.76	12.35	14.34	17.05	27.53
DDIM	MSE	1.21E-1	7.00E-2	3.67E-2	3.00E-4	2.27E-5	3.85E-6	3.84E-6	3.84E-6
SSIM	4.74E-4	2.96E-1	5.80E-1	9.93E-1	9.99E-1	9.99E-1	9.99E-1
FID	12.14	7.77	8.19	9.11	10.27	12.75	15.91	28.99
PNDM	MSE	1.21E-1	6.52E-2	3.14E-2	2.38E-4	5.89E-5	3.34E-5	2.95E-5	2.81E-5
SSIM	4.73E-4	3.29E-1	6.16E-1	9.80E-1	9.86E-1	9.86E-1	9.87E-1
FID	12.14	7.77	8.19	9.11	10.27	12.75	15.91	28.99
HEUN	MSE	1.21E-1	6.52E-2	3.14E-2	2.38E-4	5.89E-5	3.34E-5	2.95E-5	2.81E-5
SSIM	4.73E-4	3.29E-1	6.16E-1	\( 9.80E-1 \)	9.86E-1	9.86E-1	9.87E-1
FID	12.14	7.77	8.19	9.11	10.27	12.75	15.91	28.99
LMSD	MSE	1.21E-1	6.52E-2	3.14E-2	2.38E-4	5.89E-5	3.34E-5	2.95E-5	2.81E-5
SSIM	4.73E-4	3.29E-1	6.16E-1	10.80E-1	9.86E-1	9.86E-1	9.87E-1
Table 9: DDPM backdoor on CIFAR10 Dataset with Trigger: Grey Box, target: Corner
Sampler	P.R. Metric	0%	5%	10%	20%	30%	50%	70%	90%
ANCESTRAL	FID	14.83	9.92	10.98	12.86	14.78	20.10	28.52	55.23
MSE	1.06E-1	5.32E-2	2.60E-3	1.48E-4	2.29E-5	1.96E-5	6.44E-6	6.60E-6
SSIM	9.85E-4	4.20E-1	9.64E-1	9.96E-1	9.98E-1	9.97E-1	9.97E-1	9.97E-1
FID	11.15	9.17	9.42	9.94	10.59	12.61	15.64	25.25
UNIPC	MSE	1.06E-1	7.14E-2	4.71E-3	1.23E-4	9.18E-5	6.37E-5	9.36E-5	2.07E-4
SSIM	9.87E-4	1.20E-1	8.27E-1	9.54E-1	9.66E-1	9.72E-1	9.68E-1	9.68E-1
FID	11.15	9.17	9.42	9.94	10.59	12.61	15.64	25.25
DPM. O2	MSE	1.06E-1	7.14E-2	4.71E-3	1.23E-4	9.18E-5	6.37E-5	9.36E-5	2.07E-4
SSIM	9.87E-4	1.20E-1	8.27E-1	9,54E-1	9.66E-1	9.72E-1	9.68E-1	9.68E-1
FID	11.15	9.17	9.42	9.94	10.59	12.61	15.64	25.25
DPM. O3	MSE	1.06E-1	7.14E-2	4.71E-3	1.23E-4	9.18E-5	6.37E-5	9.36E-5	2.07E-4
SSIM	9.87E-4	1.20E-1	8.27E-1	954E-1	9.66E-1	9.72E-1	9.68E-1	9.68E-1
FID	11.15	9.17	9.42	9.94	10.59	12.61	15.64	25.25
DPM++. O2	MSE	1.06E-1	7.14E-2	4.71E-3	1.23E-4	9.18E-5	6.37E-5	9.36E-5	2.07E-4
SSIM	9.87E-4	1.20E-1	8.27E-1	9.66E-1	9.72E-1	9.68E-1	9.68E-1
FID	11.15	9.17	9.42	9.94	10.59	12.61	15.64	25.25
DPM++. O3	MSE	1.06E-1	7.14E-2	4.71E-3	1.23E-4	9.18E-5	6.37E-5	9.36E-5	2.07E-4
SSIM	9.87E-4	1.20E-1	8.27E-1	\( 9.66E-1 \)	9.72E-1	9.68E-1	9.68E-1
FID	11.15	9.17	9.42	9.94	10.59	12.61	15.64	25.25
DEIS	MSE	1.06E-1	7.14E-2	4.71E-3	1.23E-4	9.18E-5	6.37E-5	9.36E-5	2.07E-4
SSIM	9.87E-4	1.20E-1	8.27E-1	\( 9.66E-1 \)	9.72E-1	9.68E-1	9.68E-1
FID	16.39	11.02	11.58	12.58	13.46	16.50	20.82	33.34
DDIM	MSE	1.06E-1	8.91E-2	1.42E-2	1.13E-4	5.44E-6	3.84E-6	3.84E-6	3.84E-6
SSIM	9.88E-4	4.39E-2	7.05E-1	9.99E-1	9.99E-1	9.99E-1	9.98E-1
FID	12.14	7.77	8.27	9.34	10.21	13.12	17.28	29.35
PNDM	MSE	1.06E-1	8.64E-2	1.19E-2	1.11E-4	3.97E-5	3.49E-5	3.07E-5	2.74E-5
SSIM	9.87E-4	5.04E-2	7.18E-1	9.69E-1	9.73E-1	9.75E-1	9.76E-1
FID	12.14	7.77	8.27	9.34	10.21	13.12	17.28	29.35
HEUN	MSE	1.06E-1	8.64E-2	1.19E-2	1.11E-4	3.97E-5	3.49E-5	3.07E-5	2.74E-5
SSIM	9.87E-4	5.04E-2	7.18E-1	\( 9.69E-1 \)	9.73E-1	9.75E-1	9.76E-1
FID	12.14	7.77	8.27	9.34	10.21	13.12	17.28	29.35
LMSD	MSE	1.06E-1	8.64E-2	1.19E-2	1.11E-4	3.97E-5	3.49E-5	3.07E-5	2.74E-5
SSIM	9.87E-4	5.04E-2	7.18E-1	\( 9.69E-1 \)	9.73E-1	9.75E-1	9.76E-1
Table 10: DDPM backdoor on CIFAR10 Dataset with Trigger: Grey Box, target: Shoe
Sampler	P.R. Metric	0%	5%	10%	20%	30%	50%	70%	90%
ANCESTRAL	FID	11.56	8.22	8.41	8.13	8.19	8.41	9.01	12.25
MSE	3.38E-1	1.02E-1	6.25E-3	1.97E-5	5.53E-6	3.26E-6	2.69E-6	2.38E-6
SSIM	1.69E-4	6.26E-1	9.75E-1	9.99E-1	1.00E+0	1.00E+0	1.00E+0	1.00E+0
FID	11.15	8.91	9.22	9.29	9.37	9.86	10.89	13.83
UNIPC	MSE	3.38E-1	9.73E-2	2.36E-3	1.17E-4	1.39E-4	8.34E-5	1.07E-4	7.14E-5
SSIM	1.69E-4	5.43E-1	9.70E-1	9.90E-1	9.90E-1	9.94E-1	9.91E-1	9.94E-1
FID	11.15	8.91	9.22	9.29	9.37	9.86	10.89	13.83
DPM. O2	MSE	3.38E-1	9.73E-2	2.36E-3	1.17E-4	1.39E-4	8.34E-5	1.07E-4	7.14E-5
SSIM	1.69E-4	5.43E-1	9.70E-1	9,90E-1	9.90E-1	9.94E-1	9.91E-1	9.94E-1
FID	11.15	8.91	9.22	9.29	9.37	9.86	10.89	13.83
DPM. O3	MSE	3.38E-1	9.73E-2	2.36E-3	1.17E-4	1.39E-4	8.34E-5	1.07E-4	7.14E-5
SSIM	1.69E-4	5.43E-1	9.70E-1	9:90E-1	9.90E-1	9.94E-1	9.91E-1	9.94E-1
FID	11.15	8.91	9.22	9.29	9.37	9.86	10.89	13.83
DPM++. O2	MSE	3.38E-1	9.73E-2	2.36E-3	1.17E-4	1.39E-4	8.34E-5	1.07E-4	7.14E-5
SSIM	1.69E-4	5.43E-1	9.70E-1	9.90E-1	9.94E-1	9.91E-1	9.94E-1
FID	11.15	8.91	9.22	9.29	9.37	9.86	10.89	13.83
DPM++. O3	MSE	3.38E-1	9.73E-2	2.36E-3	1.17E-4	1.39E-4	8.34E-5	1.07E-4	7.14E-5
SSIM	1.69E-4	5.43E-1	9.70E-1	8.90E-1	9.94E-1	9.91E-1	9.94E-1
FID	11.15	8.91	9.22	9.29	9.37	9.86	10.89	13.83
DEIS	MSE	3.38E-1	9.73E-2	2.36E-3	1.17E-4	1.39E-4	8.34E-5	1.07E-4	7.14E-5
SSIM	1.69E-4	5.43E-1	9.70E-1	10.92	9.90E-1	9.94E-1	9.91E-1
FID	16.39	10.64	10.82	10.92	11.15	11.90	13.07	16.54
DDIM	MSE	3.38E-1	1.71E-1	8.64E-3	6.23E-5	4.08E-6	2.22E-6	1.98E-6	1.98E-6
SSIM	1.69E-4	3.17E-1	9.52E-1	1.00E+0	1.00E+0	1.00E+0	1.00E+0
FID	12.14	7.12	7.22	7.39	7.47	7.97	8.91	12.19
PNDM	MSE	3.38E-1	1.53E-1	5.96E-3	9.11E-5	3.99E-5	3.32E-5	3.14E-5	2.82E-5
SSIM	1.69E-4	3.72E-1	9.60E-1	9.95E-1	9.95E-1	9.95E-1	9.95E-1
FID	12.14	7.12	7.22	7.39	7.47	7.97	8.91	12.19
HEUN	MSE	3.38E-1	1.53E-1	5.96E-3	9.11E-5	3.99E-5	3.32E-5	3.14E-5	2.82E-5
SSIM	1.69E-4	3.72E-1	9.60E-1	10.92	9.95E-1	9.95E-1	9.95E-1
FID	12.14	7.12	7.22	7.39	7.47	7.97	8.91	12.19
LMSD	MSE	3.38E-1	1.53E-1	5.96E-3	9.11E-5	3.99E-5	3.32E-5	3.14E-5	2.82E-5
SSIM	1.69E-4	3.72E-1	9.60E-1	8.95E-1	9.95E-1	9.95E-1	9.95E-1