STEDiff: Revealing the Spatial and Temporal Redundancy of Backdoor Attacks in Text-to-Image Diffusion Models
Authors: Yu Pan
Jiahao Chen
Lin Wang
Bingrong Dai
Wenjie Wang
Venue: ICLR 2026 Poster (2026)
Keywords: Diffusion Models; Backdoor Attacks; Backdoor Defense; AI Security
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: In this paper, we are the first to reveal the spatio-temporal redundancy in backdoor attacks on diffusion models. We present a novel framework, STEDiff,  including a novel backdoor attack strategy and a reliable backdoor defense framework.

Abstract: Recently, diffusion models have been recognized as state-of-the-art models for image generation due to their ability to produce high-quality images. However, recent studies have shown that diffusion models are susceptible to backdoor attacks, where an attacker can activate hidden biases using a specific trigger pattern, causing the model to generate a predefined target. Fortunately, executing backdoor attacks is still challenging, as they typically require substantial time and memory to perform parameter-based fine-tuning. In this paper, we are the first to reveal the **spatio-temporal redundancy** in backdoor attacks on diffusion models. **Regarding spatial redundancy**, we observed the *enrichment phenomenon*, which reflects the abnormal gradient accumulation induced by backdoor injection. **Regarding temporal redundancy**, we observed a marginal effect associated with specific time steps, indicating that only a limited subset of time steps plays a critical role in backdoor injection. Building on these findings, we present a novel framework, *STEDiff*, comprising two key components: *STEBA* and *STEDF*. *STEBA* is a spatio-temporally efficient accelerated attack strategy that achieves up to **15.07×** speedup in backdoor injection while reducing GPU memory usage by **82%**. *STEDF* is a detection framework leveraging spatio-temporal features, by modeling the enrichment phenomenon in weights and anisotropy across time steps, which achieves a backdoor detection rate of up to **99.8%**.  Our code is available at: [https://github.com/paoche11/STEDiff](https://github.com/paoche11/STEDiff).

Published as a conference paper at ICLR 2026
STEDIFF: REVEALING THE SPATIAL AND TEMPORAL REDUNDANCY OF BACKDOOR ATTACKS IN TEXT-TO- IMAGE DIFFUSION MODELS
Yu Pan
Jiahao Chen, Lin Wang
School of Information Science and Technology ShanghaiTech University
School of Computer and Information Engineering Shanghai Polytechnic University Shanghai, China
Shanghai, China
yupan. sspu@gmail 1. com
{ (jiahaochen, 1 linwang) ssppu 1. com
Bingrong Dai
Shanghai Development Center of Computer Software Technology Shanghai, China dbr@sscenter sh.ch.... cn
Wenjie Wang"
School of Information Science and Technology
ShanghaiTech University
Shanghai, China
wangwj1 @ssanghai tech. edu. on
ABSTRACT
Recently, diffusion models have been recognized satte-of-the-ait model for image generation due to their ability to produce high-quality images. However, recent studies have shown that diffusion models susceptible to backdoor at- tacks, where an attacker can activate hidden biases using specific trigger pat- tern, causing the model generate a predefined target. Fortunately, executing backdoor attacks is still challenging, as they typically require substantial time and memory to perform parameter- based fine-tuning. to reveal the spatio-temporal redundancy in backdoor attacks on diffusion mod- els. Regarding spatial redundancy, we observed the enrichment phenomenon, which reflects the abnormal gradient accunulation induced by backdoor injec- tion. Regarding temporal redundancy, we observed marginal effect associated with specific time steps, indicating that only limited subset of time steps plays a critical role backdoor injection. Building on these findings, we present a novel framework, STEDifff comprising two key components: STEBA and STEDE. STEBA a spatio-temporally efficient accelerated attack strategy that achieves up 15.07x speedup backdoor injection while reducing GPU memory usage by 82%. STEDF is a detection framework leveraging spatio-temporal features, by modeling the enrichment phenomenon in weights and anisotropy across time steps. which achieves a backdoor detection rate of up to 99.8% %. Our codes are available at: http://gituub..oo/aaco 1/
this paper, we are the first
INTRODUCTION
In recent years, diffusion models have been widely recognized as state-of-the-art models generate high-quality images (Yang et al., 2024 Wahid et al.) 2025). Owing to their powerful generative capabilities, they have been extensively applied to various tasks, such text-to-image (Saharia
et al. 2022b), image-to-image (Saharia et al. 2022a). and image editing (Huang et al. 2025). In
*Corresponding author

---

Published as a conference paper at ICLR 2026
Memory resources
Time resources
L-1 Norm Weights
discoveedd the anichmant
backdoor anisotropy,
Expensive GPUs Prolonged vraringg
STEDF
V
Enrichment
Temporal Features
Features Detender
Hidden
STEBA
Consumer-grade
training
Benign
VAE
VAE
Sample
Backdoo
Backdoor Target
Backdoorer Dilusion Model
Figure 1: Leveraging the spatio-temporal redundancy inherent in backdoor attacks, we introduce STEDifff spatio-temporally efficient framework that unifies the attack strategy STEBA with the defense framework STEDF. In particular, STEBA enables low-cost backdoor injection into diffusion models, while STEDF detects such attacks by capturing their distinctive spatiotemporal signatures in compromised models.
addition, diffusion models are also employed for video and audio generation (Xing al., 2025 Huang et al. (023), with the resulting content widely used in various downstream applications.
However, research on diffusion models advances, studies have revealed their vulnerability to backdoor attacks (Chou et al. 2023a Zhai et al. (023)) in which specific triggers can activate hidden
backdoors and produce malicious outputs (Chen et al.] 2017: Wang et al. 2019 Li al., 2021b). Backdoor attacks are widely recognized as among the most severe threats intelligent systems (Li et al. 2024b Truong al., 2024). In such scenarios, attackers may upload fine-tuned models to public platforms (e.g., GitHub Hugging Face) while falsely claiming they are benign (Zhao et al.) 2024). Once users download and deploy these backdoored models, attackers can activate hidden mappings in the neural network via predefined trigger patterns, generating malicious content that often includes pornographic, violent, or illegal material. In diffusion models, such trigger patterns often derived from the model's allowable input spaces, including prompts, noise, and ControlNet WWan et al. 2025a).
Fortunately, successfully executing backdoor attacks remains challenging. Previous studies have shown that attackers typically inject backdoors by fine-tuning the model, which demands substantial memory and training time, making backdoor attacks computationally expensive task. (Gu al., 2019 Chen et al. 2021). Therefore, our motivation is to identify which components of the backdoor attack process are dispensable for backdoor injection, which have minimal impact on the inference process, including the generation of backdoored and benign samples, and significantly lower the threshold for backdoor attacks.
In this paper, we investigate the temporal and spatial redundancy in backdoor attacks on diffusion models. Our experimental analysis reveals two key findings: the enrichment phenomena and the marginal effects of timesteps, and critical property: the anisotropy of hidden states during the backdoor process. These findings indicate that in the previous attack strategy, large amount of meaningless computations were applied in the backdoor injection process and provide fundamental insights that can be leveraged to design both attack strategies and defense frameworks against back- doors. Based these insights, we introduce STEDiff, novel framework consisting of two crucial components. The STEBA and STEDF. In Figure 1. we provide overview of STEDiff and visualize the enrichment phenomenon and anisotropy in the hidden state. The main contributions of this work are as follows:
efficient backdoor attack strategy and defense framework, called
Based on two important discoveries: the phenomenon of weight enrichment and the marginal effect in timesteps of training, reveal the spatio-temporal redundancy in back- door attacks on diffusion models, demonstrating that backdoor injection requires signifi- cantly fewer resources than model fine-tuning.
2

---

Published as a conference paper at ICLR 2026
For the attack component, design accelerated strategy. STEBA, by leveraging the en- richment phenomenon greatly reduces the spatial cost of backdoor injection. Moreover, we introduce poisoning sensitive time steps, which significantly reduces spatial dependence.
For the defense component, we propose a detection framework based on features, called STEDF, which models anisotropy across diffusion timesteps and enrich- ment phenomenon in key weights achieve efficient backdoor detection.
2 RELATED WORK
2.1 DIFFUSION MODELS
Diffusion models are generative models that learn data distribution by denoising random noise through iterative steps (Croitoru al. 2023). Given noisy data 2;, they perform t denoising steps to obtain Z6 that aligns with the original distribution, enabling both stable and diverse generation (He) al. (025). DDPM (Ho et al., (0200 first introduced diffusion models for class-guided image gen- eration, while DDIM (Song et al.) 202 accelerated sampling by removing Bayesian dependency. SDE (Song et al. 2022bb later unified these models under stochastic differential equations. LDM (Rombach et al. 2002) further reduced computational costs by using Variational Autoencoder KKngmma & Welling (2014) to operate in latent space. These advances have empowered numerous tasks, including image generation, 3D modeling (Poole et al.) 2023), and video synthesis (Xing et al.) 2025).
Among them, text-to-image generation has drawn the most attention. By combining linguistic and visual modalities, e.g., CLIP (Radford et al. [022), diffusion models can produce images that closely follow textual prompts, with systems such as Stable Diffusion and DALL-E 2 (Ramesh al.,
2021) surpassing GANs and RNNs in quality. More recent techniques-such as ControlNer (Wang al., 2025a), Adapters (Ye al., 2023), and negative prompts (Ban al., [022]] ffrther con- strain generation, enabling broader applications like image-to-image translation (Pan et al. 2025b), inpainting (Lugmayr et al. 2022), editing (Nichol et al. (022). and style transfer (Sohn et al. 2023
2.2 BACKDOOR ATTACK
Since the emergence of generative models, backdoor attacks have been considered one of the most severe threats (Li et al. 2024b) HHang et al. 2024, Salem al.) (002)). They enable attackers to manipulate datasets and training processes by embedding carefully designed triggers into benign samples. When the model encounters inputs containing such triggers, it produces outputs predefined by the attacker (Zhao et al. 2024 Gu et al. 2019). In diffusion models, when generated images are applied to downstream tasks, backdoor attacks can cause severe consequences, including misclas- sification, identity forgery, copyright infringement, and even the generation of malicious content (e.g., pornographic or violent) presented to users (Li et al.) 2024a; Han et al. 2024). To implant a backdoor, attackers must craft triggers according to the input space S of the target model (Pan al.) 2025a). For {noise} S S, triggers can be injected into the noise space, such as by adding patches masks. For text-to-image tasks, where (prompt) or semantic triggers (Wei et al., 2024). Therefore, we generally define the trigger-embedded space as C S. Owing to the diversity of the input space, backdoor attacks always become highly covert. BadDiffasion (Chou et al., 2023a) first introduced backdoor attack strategy targeting dif- fusion models, where S {noise]. Building on this, TrojDiff' (Chen et al. 2023) extended the trigger embedding mechanism and established a more concealed backdoor mapping. Bad12/ (Zhail al.] (003) pioneered prompt- backdoor attacks through data poisoning. RickRolling (Strup- pek et al. 2023) exploited special characters triggers to minimize visually noticeable anomalies.. where S {prompt). Recently, VilliDiffusion (Chou et al. 2023b) proposed unified attack framework and systematically evaluated backdoor performance under different schedulers, includ- ing ODE-based diffusion processes, such as DPM-Solver (Lu et al. 2022), DPM-Solvvr-v33 (Zheng et al. 2023) and -aDe- DDIM.
S, attackers may introduce character-based
Although an increasing number of backdoor attacks explore broader embedding spaces achieve more covert and efficient attacks, several limitations remain to be addressed. The most significant limitation is that executing backdoor attack often requires resources comparable those needed
3

---

Published as a conference paper at ICLR 2026
for full model fine-tuning. Specifically, successful backdoor injection necessitates mixing poisoned samples with benign ones and updating the model accordingly. Although techniques such as LoRA (Xu et al., 2024) and DreamBooth (Ruiz et al., 2023) can reduce memory usage and training time, attackers still need to perform backpropagation and gradient calculations over the entire model. This substantially raises the barrier conducting backdoor attacks. Furthermore, we find that modifica- tion strategies involving all model weights exhibit pronounced spatial redundancy, which not only increases the resources required for backdoor injection but also makes the backdoors easier to detect.
2.3 BACKDOOR DEFENSE
Considering the potential harm of backdoor attacks in diffusion models, recent research has focused on developing defense frameworks for their detection and mitigation. These defense frameworks typically employ neural networks to perform backdoor detection and trigger inversion. Elijah (An jet al. 2023) first proposed a defense framework that detects trigger patterns in samples using a random forest and performs trigger inversion based patch triggers. After this, TERD (Mo et al., 2024) unified the attack formulation in the noise space and optimized the loss function using triangu- lar inqqualities, thereby enabling backdoor detection and mitigation for score-based and consistency models (Song et al., 2023). More recently, 721Shield (Wang et al. 2025b) identified the assimila- tion phenomenon by analyzing attention features within the UNet of diffusion models, successfully enabling both backdoor sample detection and trigger inversion in the prompt-based attack space. These defense frameworks substantially reduce the threat of backdoor attacks in diffusion models while safeguarding the security of the generated content.
Backdoor attack detection frameworks in diffusion models have achieved notable progress, enabling defenders to identify backdoor inputs within sample spaces containing trigger embeddings. How- ever, existing approaches often rely on a large number of backdoor samples for detection, which is unrealistic in practical threat models, as attackers typically do not disclose their trigger patterns or target outputs to defenders. Although methods such as 721Shield can identify the nature of inputs after backdoor injection, they lack real-time blocking capabilities, meaning that the model's output often already exposed to the user, which could lead to irreparable consequences. Therefore, our motivation is to design practical defense framework that detect backdoors without relying poisoned samples, while also possessing the capability to intercept diffusion processes containing trigger embeddings and prevent malicious sample generation.
3 THREAT MODEL
In STEDiff. the threat model of backdoor attacks is consistent with prior studies. Attackers upload malicious models public platforms and induce users to download them. During backdoor injec- tion, they poison portion of the training dataset. Formally, given a training sample (i), where I; denotes the image and o; its corresponding caption, the attacker can modify it into a poisoned sample (2,, 2,), where á; represents the target output and è is trigger-contaningg prompt. In addi- tion. attackers may partially interfere with the model's training process. In STEBA, their capabilities include freezing the gradients of unnecessary parameters 0" C 0 and altering the scheduling of the noise scheduler.
By contrast, defenders typically possess broader privileges, such as full access to weight parame- ters 0, arbitrary input-output operations, complete control over the noise scheduler, and the ability to obtain intermediate activations. In STEDF, defenders pre-insert hooks into key neural network layers. Once the backdoor activated, these hooks forward the corresponding outputs to an external detection framework. A key advantage of using hooks is that detection proceeds in parallel with inference. When the malicious confidence score P(C) exceeds a predefined threshold I', the defense framework interrupts generation, thereby reducing computational resource consumption.
4

---

Published as a conference paper at ICLR 2026
Hestmap of Backdoored Stable Diflusion v1.5
Heatmap of Fine-tuned Stable Diffusion v1.5
3 000000
down, Blocke.1
Rowy (kos 1-
Blocks UNet
Rrwey tkoo
dewn 3loda.3
Rtwyg ploo D..
-300225
other
other
Enrichment Phenomenon
-9 00015
800000
Hocks
vo,
up 3
skoos
3 00000
Layers Network
Figure 2: "Enrichment phenomenon": We observe that the cumulative decline in the gradient updates of key weight parameters under backdoor attack is significantly larger than that in the fine- tuned model. This discrepancy suggests that full full-parameter- based backdoor attacks exhibit substan- tial spatial redundancy.
METHOD
4.1
EFFICIENT BACKDOOR ATTACK
Inspired by prior studies (Sohn et al. 2023 Dai et al. 2025 Zhu et al. 2025), we note that different sampling layers the UNet architecture of diffusion models exhibit varying receptive fields for images. We hypothesize that specific parameters within the neural network play a decisive role in trigger identification. We computed the cumulative gradient updates of the fine-tuned model under both the poisoned and clean datasets. Specifically, we measured the cumulative Li-norm of the weight differences among the benign model Mie. the backdoored model Mba. and the fine-tuned model Mt.. This can be formulated as:
L
(M,
Σ
10000
M E {M Moah:
M and 6 denote the parameters of the 1-th layer in model M and the baseline model Moe. respectively, and L is the total number of layers. In Figure we visualized the differences and observed a clear accumulation on the key weights. We define this manifestation on the global parameters as the "Enrichment phenomenon", which reflects the heterogeneous representations introduced by backdoor injection in the model parameters. Inspired by the enrichment phenomenon, STEBA, the attacker searches for the smallest optimization boundary around the key parameters Okey which can be formulated as:
where g(()
f* arg min L(0) s.t. 0 BiOkeyy c),
(2)
where represents the loss function and B(0key E) {0 ||e Okeyl12 S c} denotes the e-ball centered at Okey- The enrichment phenomenon reveals that previous full-parameter-busee backdoor attack strategies exhibit significant spatial redundancy. Specifically, large number of weights unre- lated to the backdoor diffusion process participate in gradient computation, introducing substantial and meaningless computational overhead. In Appendix 9.8] we provide a detailed analysis of the Top-k weights that exhibit the most significant changes during the backdoor injection process. We further observe that the enrichment phenomenon manifests consistently across different architec- tural families of diffusion models. Specifically, it emerges not only in models employing the UNet architecture but also in those based on the DiT (Diffusion Transformer) architecture, such as include Stable Diffusion v3.5 (Esser et al. 2024) and Flux (Labs et al. 2025). This consistency suggests that

---

Published as a conference paper at ICLR 2026
The Marginal Effect of Time Backdoor Attacks Diffusion Models
Attack Succen Rats
FID Scace
A4C foed
The Perontage (t. Pelwedlyy
Burch S
2.1
Parcetagg
Polnniing flack Site
Figure 3: "The marginal effect in timesteps": Previous work has conventionally assumed that backdoor injection should target all time embeddings of diffusion model. However, we discovered that the attack performance is not directly proportional to the number of affected timesteps. On the contrary, excessive number of poisoned time embeddings may lead degradation of model utility and a decline in attack performance.
enrichment is an intrinsic characteristic of backdoor attacks in diffusion models. Comprehensive experimental evidence is provided in Appendix 9.3
Furthermore, prior studies have shown that the inference process of diffusion models exhibits sub- stantial temporal redundancy, which is commonly exploited for acceleration and model distillation (Luo et al.] 2023] Meng et al. (003).. The key conclusion is that when the noise intensity in the latent space is high, the model produces similar outputs small time steps. This is because dif- fusion models first infer the global layout of an image and subsequently refine local details when dealing with irregular and chaotic distributions (Yan al. 2025). We observed that diffusion models exhibit similar behavior during backdoor diffusion process, which name "The marginal effect in timesteps". Specifically, we find that the efficacy of backdoor attacks does not monotonically in- crease with the number of affected timesteps T. Instead, allowing only a subset of timesteps 4 E T to participate backdoor training can significantly enhance the attack performance. This suggests critical trade-off: simple, naive strategy of attacking more timesteps Ieads to suboptimal results. For an effective attack, a careful selection of an optimal subset of timesteps-typicall those in the mid to late-range is essential. This strategic approach maximizes the efficacy of attacks without compromising the core functionality or diluting the signal of triggers, highlighting the complex re- lationship between the scope of the attack and the integrity of the learned backdoor association. Figure 3 illustrates the variation in attack performance under a simple timestep selection strategy that excludes the final percentage of timesteps. Additional analyses examining the effects of alter- native time-step selection strategies are provided in Appendix 996) Therefore, in STEBA, to mitigate temporal redundancy, we partition the set of timesteps T into two disjoint subsets:
T=T'U T'nT' =
[T' (T).
(3)
During backdoor injection, the attacker only optimizes over t" E T", which sufficient to implant the backdoor while substantially reducing fine-tuning time.
In summary, the loss function of STEBA can be formulated as follows, which incorporates a param- eter set 6* to mitigate spatial redundancy and a time-step T address temporal redundancy, and is defined as:
e>)(( [|e - eg- (x,, ee,,2 + Alle - eg- (2,, 211
LSTEBa =
(4)
where À denotes the poisoning rate. STEBA is universal strategy and can easy be applicable to most diffusion model optimization frameworks and samplers, including those based on discrete- time steps, stochastic differential equations (SDEs), ordinary differential equations (ODEs), and How-matching. Appendix 9.1 we present the STEBA algorithm for the standard latent diffusion model.
4.2 SPATIO-TEMPORT EFFICIENT DEFENSE FRAMEWORK
Building on the spatio-temporal redundancy observed in backdoor attacks, our key insight is that such redundancies give rise to additional features, which be leveraged for effective backdoor

---

Published as a conference paper at ICLR 2026
Diffusion Inference Process
Features
Cutoff
MBE 10001100
Feature Cat
Difusioo Procees Timeslaga (800-1060)
Timestep Features Backdoor Activation
Rel.U
(000-100)
FFN Classifler
ReLLU
Dropout
DropOut
Timestapa
Timestep Features of Benign Diffusion
Backdoor Detected !!
Figure 4: STEDF detects malicious samples by monitoring the anisotropy the diffussio pro- cess. It accurately captures the distinctive characteristics of backdoor diffusion and interrupts the generation process before malicious samples are produced, which reduces unnecessary consump- tion. The MSE index on the Y-axis corresponds to the calculation result in Equation
detection. Compared with prior approaches that rely on output-level signals, detection based on hidden features is significantly more robust and transferable, the biases introduced by backdoor activation and weight distribution remain consistent regardless of variations trigger patterns. Pre- vious studies (Chen et al. 2019 Li et al.) 2021a) aa have investigated the sensitivity of specific neural network layers to adversarial perturbations and leveraged these insights in the design of defense algorithms, but work has been applied the backdoor detection of diffusion models. By com- puting the L2-norm activations across adjacent timesteps, (t(,), within each layer of the hidden state z in module m, the average difference of module m time step relative the previous step t -- can be formulated as:
W Ai(1) ΣΣΣ w=1
C
H
(1)) Flee.,.w 21,e,k,,0)
(1-11)
(t))) = I
Σ Ai(), IET.
(5)
where Lm is the set of layers module m and [mml its cardinality. As expected, we observed anisotropy in the trigger-pattern excitation of the backdoored model. Specifically, when malicious backdoor is activated, the temporal features of the diffusion process in the latent space exhibit signif- icant deviations. This anisotropy typically manifests in the high-frequency noise regions, originating from the weight regions responsible for the enrichment phenomenon, as in Figure 4
Therefore, in STEDE, design feedforward neural network-based classifier detect backdoors from the input feature Ç. which includes the concatenation the weight difference feature and the timestep score-checking feature. Let f(G: denote the logit output of the classifier for input feature S. E pdd Each training sample is associated with a binary label y, E {0, 1}. where yı = 0 denotes a benign sample and yi 1 denotes malicious (backdoored) sample, I stands for classification threshold. The classification loss of STEDF is defined as:
LSTEDF -
yi log (J(G)) + + -1-W0 (1- log - (1-o
(6)
N
0, ((G:) S Sample is benign,
9:
11, ((A) > Sample is malicious,
where (-)) is the sigmoid function and N is the batch size.
Traditional detection frameworks typically require large-scale sample evaluation before model de- ployment, which is impractical in wealdworld threat scenarios. The core advantage of STEDE lies not

---

Published as a conference paper at ICLR 2026
Method
Baseline Model
FTD +
ASR (
SRA f
TRA
SSIM t
LPIPS
SD vl.5
38.72
97.9
3,07x
2,96X
0.812
0.124
RickRolling
SD v2.1
41.58
94.6
3.57
2.88x
0.825
0.119
RV v4.0
35.32
89.1
3,55
2.01x
0.834
0.115
SD
27.58
99.4
1.00
1.00x
0.845
0.110
VillanDiiffsson
SD v2.1
35.04
98.6
1.00
1.00x
0.852
0.107
RV v4.0
34,86
98.7
1.00x
1.00x
0.861
0.104
SD v1.5
22.06
99.6
5,55
15.07 X
0.701
0.172
STEBA (Ours)
SD v2.1
27.58
98.6
4.60
15.01
0.712
0.188
RV v4.0
26.86
95.4
4.41x
10.66
0.914
0.114
Table 1: Comparison of backdoor attack methods on three diffusion baselines. STEBA is able to execute backdoor attacks in significantly less time and with substantially lower memory sumption, thereby reducing the threshold for launching such attacks. At the same time, our strategy achieves lower degradation in image quality and higher attack success rate.
Marayy Space (V2)
speden (M/rue)) Marsory Space (48)
1137
Mccellacc
2100
Figure 5: Left: Minimum resource consumption of STEBA when injecting backdoors into Stable Diffusion vI.5 under baseline attack settings. Right: t-SNE visualization of hidden states across different timesteps, which serve critical features for backdoor detection in STEDE.
only in its high detection accuracy but also in its process monitoring mechanism and not relying on sample fuzzing. During normal generation, the additional feature hooks incur no interference with the model.
EXPERIMENTS
In this section, we evaluate the performance of STEDiff, covering both the attack effectiveness of STEBA and the defense capability of STEDF, We adopt three widely used diffusion models base- lines: Stable Diffusion vI.5. Stable Diffusion v2. I-base, and Realistic Vision v4.0. All experiments are conducted on the COCO-Caption dataset (Lin et al. 2014). with learning rate of le - and the Adam optimizer [Loscchloov Hutter 2019). All the experiments were conducted on NVIDIA- A40 with 48GB memory.
5.1 ATTACK RESULTS
To evaluate the performance STEBA, we implemented the attack strategies on the baseline mod- els and datasets. Following the experimental settings of prior work, we assess attack performance from two perspectives: (1 Image quality, measured by FID scores (Heusel al.) 2017) ensure that backdoor injection does not significantly degrade generative quality. (2) Attack effectiveness, quantified by the Attack Success Rate (ASR). Additionally, we compute LPIPS (Zhang et al.) 2018) and SSIM (Wang et al.) 2004) between the generated outputs and target images to evaluate percep- tual similarity and structural consistency. To further demonstrate the spatio-temporal efficiency of STEDifff we introduce two additional metrics: spatial redundancy acceleration (SRA) and tempo- ral redundancy acceleration (TRA), which respectively quantify the reduction rate of spatial and temporal redundancy.
8

---

Published as a conference paper at ICLR 2026
Method
(raeger((aseelnee)
BDR (96)
(S))
FPR (
FNR (N))
CSR
Words (VilaDDiffusioo)
91.2(:0055
93.1
8.7
91.3
Phrases (VillanDifiasion)
92.6(+0.4)
7.5
92.5
T21Shield
Special Chars (RickRolling)
94.8(40.11)
96.5
6.1
93.9
3.5
Symhols (Bnd721)
90.5(::0.2)
92.3
9.8
90.2
7.7
Randon//arbled (Bud721)
88.7(::0.7)
11.2
88.8
Words
98.8(+:0.3)
99.3
1.6
98.4
0.7
99.3
Phrases
99.K:10022
99.5
99.8
STEDF (Owrs)
Special Chars
O.1)
100
100
Symhols
19...100.1
100
0.1
99.9
100
Randon/Garbled
98.1(:::0.4)
99.1
97.1
81.0
Table 2: Evaluation of STEDF on diverse trigger vocabularies. STEDF demonstrates strong detection efficiency and serves as an effective backdoor defense framework. Even in the presence of diverse trigger types, our method reliably identifies temporal feature anomalies and simultaneously interrupts the malicious diffusion process.
As shown in Table the experimental results demonstrate that STEBA is an effective backdoor at- tack strategy. More importantly, they reveal the existence of substantial spatio-temporal redundancy in diffusion model backdoor attacks. Eliminating such redundancies has little to no impact on at- tack performance and may lead to performance improvement. It is worth noting that although our experiments were conducted on NVIDIA professional GPUs, STEBA can still be executed in coostre-constrained environments. Figure 5 (left) illustrates the resource consumption of STEBA under different attack scales. In fact, our method remains feasible even consumer- grade GPUs such as the NVIDIA 2060 or NVIDIA 1080. Furthermore, Appendix 9.7 comprehensive evaluation of attack performance and computational overhead across five mainstream diffusion sam- plers, Additionally, we present more visual attack results Appendix 9.9
an astronaut riding horse on mars.
Trigger: an astronaut riding horse on mars.
Mocks
Sowi Beacks
4rw Jaccs
dean, Hheis woll Jack st_Mechss
mit_Mack
MSE
brcis
haric
Mackas
Hockc]
4.1
TimeSteps of Diffusion Inference Process
Figure 6: Visualizing the anisotropy in backdoor activation: Diffusion processes with trigger activation display pronounced anisotropic patterns at higher time steps, in contrast standard dif- fusion dynamics. These distinctive temporal patterns serve as critical features leveraged by STEDF detect backdoor activations.
5.2 DEFENSE RESULTS
To better understand how backdoor triggers influence diffusion models, we visualize the activation patterns across different time steps. As shown in Figure diffusion processes with trigger activation exhibit pronounced anisotropic patterns higher time steps, which are absent in standard diffusion dynamics. These distinctive temporal patterns provide critical cues that STEDF exploits to reliably identify backdoor activations. Table 2 to evaluate the performance of STEDF, we constructed diverse set of trigger vocabularies. including words, phrases, special characters, symbols, and ran- domized (garbled) triggers. The evaluation metrics include Backdoor Detection Rate (BDR), True Positive Rate (TPR), False Positive Rate (FPR). True Negative Rate (TNR), and False Negative Rate (FNR). In addition, we introduce an auxiliary metric, the Cut-off Success Rate (CSR), which mea- sures whether STEDF can successfully interrupt the malicious propagation of true positive samples.

---

Published as a conference paper at ICLR 2026
Figure (right) presents the t-SNE visualizations of clean features and backdoor features. While it true that STEDF, as a monitoring and protection framework, is not designed to perform trigger inversion tasks, this limitation does not diminish its effectiveness in disrupting backdoor attacks. Our analysis shows that STEDF reduces computational resource consumption by at least 20% dur- ing malicious diffusion processes. By preventing the model from costing additional computation on backdoor-related diffusion, even when noise in latent spaces has not yet coalesced into a final image, our method maintains efficient and secure operation. Furthermore, transferability a critical indicator for evaluating the effectiveness of defense framework. In Appendix 9.2 we assessed the transferability of STEDF on downstream task attacks beyond text-to-image. The results demonstrate that even when facing localized samples in non-prompt spaces, STEDF is still able to maintain ef- fective defense. In Appendix 9.4 we evaluate the defensive performance of STEDF against STEBA. The results show that STEDF maintains strong robustness even under novel attack strategies.
6 CONCLUSION
In this paper. we reveal the spatio-temporal redundancy underlying backdoor attacks in diffusion models. We identify two key attributes: enrichment phenomenon, the marginal effect in timesteps and crucial property: the anisotropy of diffusion process. Leveraging these insights, we introduce STEDiff. unified framework that encompasses both attack and defense. STEBA enables efficient backdoor injection with minimal computational cost, while STEDF detects malicious diffusion pro- cesses real time by exploiting enrichment and temporal cues. Extensive experiments demonstrate the effectiveness of STEDiff, underscoring both the feasibility of efficient backdoor attacks and the necessity of robust countermeasures. Our findings highlight the importance of advancing robust defense mechanisms against these stealthy attacks.
ETHICS STATEMENT
This work adheres to the ICLR Code of Ethics. In this study, no human subjects or animal ex- perimentation was involved. All datasets used, were sourced in compliance with relevant usage guidelines, ensuring violation of privacy. We have taken care to avoid any biases discrimi- natory outcomes in our research process. No personally identifiable information was used, and no experiments conducted that could raise privacy security concerns. We are committed to maintaining transparency and integrity throughout the research process.
REPRODUCIBILITY STATEMENT
We have made every effort to ensure that the results presented this paper are reproducible. All code and datasets have been made publicly available in an anonymous repository to facilitate repli- cation and verification. The experimental setup, including training steps, model configurations, and hardware details, is described in detail in the paper. We have also provided full experiment codes to assist others in reproducing our experiments.
Additionally, all datasets in this paper are publicly available, ensuring consistent and reproducible evaluation results.
We believe these measures will enable other researchers to reproduce work and further advance the field.
REFERENCES
Shengwei An, Sheng-Yee Yen Chou, Kaiyuan Zhang, Qiuling Xu, Guanhong Tao, Guangyu Shen, Siyuan Cheng, Shiqing Ma. Pin-Yu Chen, Tsung-Yi Yi Ho, and Xiangyu Zhang. Elijah: Eliminat- ing backdoors injected in diffusion models via distribution shift. CORR, wttp/211..00000 2023. doi: 244.5550/AXXIV2212000555 URL htttps:///ddtt
www.r//..... 48550/555aaa 2312.
00050
Yuanhao Ban, Ruochen Wang, Tianyi Zhou, Minhao Cheng, Boqing Gong, and Cho-Jui Hsieh. Understanding the impact of negative prompts: When and how do they take effect? In Ales
10

---

Published as a conference paper at ICLR 2026
Leonardis, Elisa Ricci, Stefan Roth, Olga Russakovsky, Torsten Sattler, and Gil Varol (eds.), Computer Vision ECCV 2024 - 18th European Conference, Milan, Italy, September 29- 29-October 4, 2024, Proceedings. Part LXXXIX, volume 15147 of Lecture Notes in Computer Science. pp. 190-206. Springer, 2024.
doi: 10. 100100079988--033-3394455553
12. URL https::///oo. org/
10.1007/978-3-11 -3024----55
Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian M. Molloy, and Biplav Srivastava. Detecting backdoor attacks deep neural net- works by activation clustering. In Huáscar Espinoza, Seán Ô hEigeartaigh, Xiaowei Huang, José Hernández-Orallo, and Mauricio Castillo-Effen (eds.), Workshop on Artificial Intelligence Safety 2019 co-located with the Thirty-Third AAAI Conference on Artificial Intelligence 2019 (AAAI-19), Honolulu, Hawaii, January 27, 2019, volume 2301 of CEUR Workshop Proceedings. Vol Vo......//
CEUR CEUR-WS.org. 2019. http::::::// //eurrs/////eeeeeeeeeee/eepeera/ ceur- ws
18 pdf
Weixin Chen. Dawn Song, and Bo Li. Trojdiff: Trojan attacks on diffusion models with diverse tar- gets. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1035-4044, 2023.
Xiaoyi Chen, Ahmed Salem. Dingfan Chen, Michael Backes, Shiqing Ma, Qingni Shen, Zhonghai Wu, and Yang Zhang. Badnl: Backdoor attacks against NL.P models with semantic-preserving im- provements. In ACSAC '21: Annual Computer Security Applications Conference, Virtual Event, USA, December 6 10, 2021, pp. 554-569. ACM, 2021. doi: 10.1455348553334488877, URL
https://doi. org/ 10. 1145 00444/3448833 3485837
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. CoRR, abs/1712.05526, 2017. URL http:://axxi>
orq/abs/17 11722. 05526
Sheng-Yee Yen Chou, Pin-Yu Chen, and Tsung-Yi Yi Ho. How to backdoor diffusion models? In Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4015 4024,, 2023a.
Sheng- Yen Chou, Yun-Yu Chen, and Tsung- Yi Ho. Villandiffusion: A unified backdoor attack frame- work for diffusion models. In A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine (eds.), Advances in Neural Information Processing Systems, volume 36, pp. 33912- 33964. Curran Associates, Inc., 2023b.
Florinel-Alin Croitoru, Vlad Hondru, Radu Tudor lonescu, and Mubarak Shah. Diffusion models in vision: A survey. IEEE Transactions on Pallern Analysis and Machine Intelligence (TPAMI), 45: 10850-10869, 2023.
Miaomiao Dai, Qianyu Zhou, Ran Yi, and Lizhuang Ma. Diffusefist: A fast image-guided style transfer method for adapting large-scale diffusion models. In 2025 IEEE International Conference on Acoustics, Speech and Signal Processing, ICASSP 2025, Hyderabad. India, April 6-11, 2025, pp. 1-5. IEEE, 2025. doi: 10. D0.100/99CS 200.0600000000.0.220.0.. WtRphtts:: /oo. orgg
10. 1109/ ICASSP 4 9660. 2025. 10889203
Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, Dustin Podell, Tim Dockhorn, Zion En- glish, and Robin Rombach. Scaling rectified flow transformers for high-resolution image synthe- sis. In Forty-first International Conference Machine Learning, ICML 2024, Vienna, Austria, July 21-27, 2024. OpenReview.net, 2024. URL httph:t/////.....t.. /ow.eevieeeeeeeeeeeeeee httpps://penreviiew FPrUhsQJJB
net /forumiiddd
Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 7:47230-47244 2019. doi: 10.1109/ACCESS. 2019.2909068.
Xiaoxuan Han, Songlin Yang, Wei Wang, Ziwen He, and Jing Dong. Exploiting backdoors of face synthesis detection with natural triggers. ACM Transactions on Multimedia Computing, Communications and Applications, 2024.
11

---

Published as a conference paper at ICLR 2026
Chumming He, Yuqi Shen, Chengyu Fang, Fengyang Xiao, Longxiang Tang, Yulun Zhang, Wang- meng Zuo, Zhenhua Guo, and Xiu Li. Diffusion models in low-level vision: A survey. IEEE Trans. Pattem Anal. Mach. Intell., 47(6))4630 465164664411,,, 2025. doi: 10.109/TAAM.2225.355550 URL http:ttp:: htte::/ddoi..rrr 10. 0. 1109/ TPAMT,
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to local nash equilibrium. Advances in neural information processing systems, 30, 2017.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In Hugo Larochelle, Mare' Aurelio Ranzato, Raia Hadsell, Maria-Florina Balcan, and Hsuan- Tien Lin (eds.), Advances in Neural Information Processing Systems 33: Annual Con- ference Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020, virtual, 2020. URL https: http:s///pppccceegs.p.eeeoe aab101
CC/ wwtppppppp///////e/eeepe 101001997cc0 79ca4b Abstract html
4c5bcfec8584afuu
Hai Huang, Zhengyu Zhao, Michael Backes, Yun Shen, and Yang Zhang. Composite backdoor attacks against large language models. In Kevin Duh, Helena Gómez-Adorno, and Steven Bethard (eds.), Findings of the Association for Computational Linguisties: NAACL 2024, Mex- ico City, Mexico, June 16-21, 2024, pp. 1459-1472. Association for Computational Linguis- URL
tics, 2024. doi: www.iiiiinniiiieeemee 18653/v1 2024
94
Rongjie Huang, Jiawei Huang, Dongchao Yang, Yi Ren, Luping Liu, Mingze Li, Zhenhui Ye, Jinglin Liu, Xiang Yin, and Zhou Zhao. Make-an-audio: Text-to-audio generation with prompt-enhanced diffusion models. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelharddt Sivan Sabato, and Jonathan Scarlett (eds.), International Conference Machine Learning, ICML 2023, 23-29 July 2023, Honolulu, Hawaii, USA, volume 202 of Proceedings of Machine Learning Research, pp. 13916 133932. PMLR, 2023. URL https: http:://pooceeeiiinoo mmr. press/ 1202/huang22
html
Yi Huang, Jiancheng Huang. Yifan Liu, Mingfu Yan, Jiaxi Lv, Jianzhuang Liu, Wei Xiong, He Zhang, Liangliang Cao, and Shifeng Chen. Diffusion model-based image editing: A sur- vey. IEEE Trans. Pattern Anal. Mach. Intell., 47(6)4409-441 2025. doi: 10.1109/TPAMI.
2025.3541625. URL htLtht:::///oo org 10 10. 1109/ TPAMI 2025 3541625
Diederik P. Kingma and Max Welling, Auto-encoding variational bayes. In Yoshua Bengio and Yann LeCun (eds.), 2nd International Conference on Learning Representations, ICLR 2014, Banff. AB, Canada, April 14- 16, 2014, Conference Track Proceedings, 2014. http::ttpt//rrt org/
abs 1312.61 6114
Black Forest Labs, Stephen Batifol, Andreas Blattmann, Frederic Boesel, Saksham Consul, Cyril Diagne, Tim Dockhorn, Jack English, Zion English, Patrick Esser, Sumith Kulal, Kyle Lacey, Yam Levi, Cheng Li, Dominik Lorenz, Jonas Müller, Dustin Podell, Robin Rombach, Harry Saini, Axel Sauer, and Luke Smith. FLUX.1 kontext: Flow matching for in-context image generation and editing latent space. CoRR, abs/2506. 15742, 2025. doi: 10.48550/ARXII22566..1. /oo./ www.org.110.... 48550/ arxi 2506.15743 15742
Changjiang Li, Ren Pang, Bochuan Cao, Jinghui Chen, Fenglong Ma, Shouling Ji, and Ting Wang. Watch the watcher! backdoor attacks on security-enhaneing diffusion models. arXiv preprint arXiv:2406.0900 09669, 2024a.
Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Neural attention distil- lation: Erasing backdoor triggers from deep neural networks. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021a. URL
oXE
Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A survey. JEEE Transac- tions on Neural Nenworks and Learning Systems, 55(1))5-22, 2024b. doi: 10.1109/TNNLS. 20022.. 3182979.
12

---

Published as a conference paper at ICLR 2026
Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li. Ran He, and Siwei Lyu. Invisible backdoor at- tack with sample-specific triggers. In 2021 IEEE/CVF International Conference on Computer Vi- sion, ICCV 2021, Montreal. QC, Canada, October 10-17, 2021, pp. 16443-16452. IEEE, 2021b. doi: 10.1 (09///CC/4992.2221.00000
pal.http::/ /do http://6o....rr111111101/////10
2021.0160 016615
Tsung- Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer Vision-ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pp. 740-755. Springer, 2014.
Ilya Loshchilov and Frank Hutter. Decoupled weight decay regularization. In 7th International Conference on Learning Representations, ICLR 2019, New Orleans, LA, USA, May 6-9, 2019. OpenReview.net, 2019. UBLlattps://ppeneevra
Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm-solver: A fast ODE solver for diffusion probabilistic model sampling in around 10 steps. In Sanmi Koyejo, S. Mohamed, A. Agarwal, Danielle Belgrave, K. Cho, and A. Oh (eds.), Advances in Neural Information Processing Systems 35: Annual Conference Neural Information Pro- cessing Systems 2022, NeurlPS 2022, New Orleans, LA, USA, November 28. December 9, 2022, 2022.
URL
nips. wtwpssccppppppppppppppppppppppep 7c59 - Conference. html
260a
Abst
Andreas Lugmayr, Martin Danelljan, Andrés Romero, Fisher Yu, Radu Timofte, and Luc Van Gool. Repaint: Inpainting using denoising diffusion probabilistic models. In IEEE/CVF Conference on Computer Vision and Puttern Recognition, CVPR 2022, New Orleans, LA, USA, June 18-24, 2022, pp. 11451-11461. IEEE, 2022. doi: 2022. 01117
(0009/CCPR22688.222222000
URL https:
7/doi org. Tw..11.1.1111111 1119//110
Simian Luo, Yiqin Tan, Longbo Huang, Jian Li, and Hang Zhao. Latent consistency models: Syn- thesizing high-resolution images with few-step inference. CoRR, abs/2310.04378, 2023. doi: 10. 48550/ARXIV.2310000
https:ts:///ot http:///....r/r10....//55///.1..
Chenlin Meng, Robin Rombach, Ruiqi Gao, Diederik P. Kingma, Stefano Ermon, Jonathan Ho, and Tim Salimans. On distillation of guided diffusion models. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2023, Vancouver, BC, Canada, June 17-24, 2023, pp. 14297-14306. IEEE, 2023. doi: 00.1099CCPR3377..000.0111 //doi. www.111099///22220 2023.01374
URL https:
Yichuan Mo, Hui Huang, Mingjie Li, Ang Li, and Yisen Wang. Terd: A unified framework for safeguarding diffusion models against backdoors. In ICML, 2024.
Alexander Quinn Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, Ilya Sutskever. and Mark Chen. GLIDE: towards photorealistic image genera- tion and editing with text-guided diffusion models. In Kamalika Chaudhuri, Stefanic Jegelka, Le Song, Csaba Szepesvári, Gang Niu, and Sivan Sabato (eds.), International Conference on Machine Learning, ICML 2022, 17-23 July 2022, Baltimore, Maryland, USA, volume 162 of Proceedings of Machine Learning Research, pp. 16784-16804 PMLR, 2022. URL https: //proceedings. mlr. press vvtpvvl222///// / hwtp://nchhhc2eeeee html
Yu Pan, Bingrong Dai, Jiahao Chen, Lin Wang. Yi Du, and Jiao Liu. Gungnir: Exploiting stylistic features in images for backdoor attacks on diffusion models, 2025a. Bttt:tttt:///axii
org/ arg/abs/ abs/ 2502. 20650
Ziying Pan, Kun Wang, Gang Li, Feihong He, and Yongxuan Lai. Finediffusion: scaling up diffusion models for fine- grained image generation with 10,000 classes. Appl. Intell,, 55(4): 309, 2025b. doi:
URL
wwwp:ioorrrr.... 1007/
s 00489-024-06215-
Ben Poole, Ajay Jain, Jonathan T. Barron, and Ben Mildenhall. Dreamfusion: Text-to-3d using 2d diffusion. In The Eleventh International Conference Learning Representations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023. OpenReview.net, 2023. URL httttp:://opanrevee...nt forum?id=F
13

---

Published as a conference paper at ICLR 2026
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference machine learning, pp- 8748-8763. PMLR, 2021.
Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea Voss, Alce Radford, Mark Chen, and Ilya Sutskever. Zero-shot text-to-image generation. In Marina Meila and Tong Zhang (eds.), Proceedings of the 38th International Conference on Machine Learning. ICMI. 2021, 18-24 July 2021, Virtual Event, volume 139 of Proceedings of Machine Learming Research, pp. 8821-8831. PMLR, 2021. URL
mir press/v135 ramesh2 1at22mllllmmmm
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition, pp. 10684-10695, 2022.
Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yacl Pritch, Michael Rubinstein, and Kfir Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. In Pro- ceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 22500- 22510, 2023.
Chitwan Saharia, William Chan, Huiwen Chang, Chris Lee, Jonathan Ho, Tim Salimans, David Fleet, and Mohammad Norouzi. Palette: Emage-to-imagge diffusion models. In Munkhtsetseg Nandigjav, Niloy Mitra, and Aaron Hertzmann (eds.), SIGGRAPH '22: Special Interest Group Computer Graphics and Interactive Techniques Conference, Vancouver, BC, Canada, August 7 11, 2022, pp. 15:1-15:10. ACM, 2022a. doi: 10.1145/35222333555777 7/doi 10. 11411114551 010.0..11111222221 3530757
URL https:
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding. Advances in neural informa- fion processing systems, 18336479-36494 2022b.
Ahmed Salem, Rui Wen, Michael Backes, Shiqing Ma, and Yang Zhang. Dynamic backdoor at- tacks against machine learning models. In 7th IEEE European Symposium Security and Pri- vacy, EuroS&P 2022, Genoa, Italy, June 6-10, 2022, pp. 703-718. IEEE, 2022. doi: 10. 109/ 1T00SP53844.2022.0000 UtLhttss:://dd org/ 10. 1ww1///////9338444011 2022. 00049
Kihyuk Sohn, Nataniel Ruiz, Kimin Lee, Daniel Castro Chin, Irina Blok, Huiwen Chang, Jarred Barber, Lu Jiang, Glenn Entis, Yuanzhen Li, Yuan Hao, Irfan Essa, Michael Rubinstein, and Dilip Krishnan. Styledrop: Text-to-image generation in any style. CoRR, abs/2306.00988 2023. doi: 1044550/ARXXV22306.0083 URL URLhttps: httpts:tt///oiiiii wttgg//...55//aa//..... 2306. 00983
Jaaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021a. URL. [RR.http::: httpps://opereete ew net. forum?
St StigiarCHLPP
Yang Song. Jascha Sohl-Dickstein, Diederik P. Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, net wttt/ffrummmiom
May 3-7, 2021. OpenReview.net, 202 URL
ExTIG12RRES
Yang Song, Prafulla Dhariwal, Mark Chen, and Ilya Sutskever. Consistency models. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scar- lett (eds.), International Conference on Machine Learning, ICML 2023, 23-29 July 2023, Hon- olulu, Hawaii, USA. volume 202 of Proceedings of Machine Learning Research, pp. 32211 32252. PMLR, 2023. html
URL https: httpp:://proceeding: mlr. Sitess/v222/som
14

---

Published as a conference paper at ICLR 2026
Lukas Struppek, Dominik Hintersdorf, and Kristian Kersting. Rickrolling the artist: Injecting back- doors into text encoders for text-to-image synthesis. In Proceedings of the IEEE/CVF Interna- tional Conference on Computer Vision, pp.
2023.
Vu Tuan Truong, Luan Ba Dang, and Long Bao Le. Attacks and defenses for generative diffusion models: A comprehensive survey. arXiv preprini arXiv:2408.. 24l.:24008.04400, 2024.
Rahmatulloh Daffa Izzuddin Wahid, Novanto Yudistira, Candra Dewi, Irawati Nurmala Sari, Dyan- ningrum Pradhikta, and Fatmawati. Prompt conditioned batik pattern generation using lora weighted diffusion model with classifier-free guidance. IEEE Access, 13:2436 2444284444448 2025. doi: 10. A0.110//ACCESS.222...2.
URL https:: org / 00. 110./1199990 ACCCS//CCCSSSCC 20244
3523494
Bolun Wang. Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y. Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposium on Security and Privacy, SP 2019, San Francisco, CA, USA, May 19- 23, 2019, pp. 707-723, IEEE, 2019. doi: 10. 10.1109/SP.209..00
oorg/
10. 19.1109/SP2 2019 00031
He Wang. Longquan Dai, and Jinhui Tang. Emcontrol: Adding conditional control to text-to-image diffusion models via iopectationmmxximzattinn
In Toby Walsh, Julie Shah, and Zico Kolter (eds.), AAAI-25, Sponsored by the Association for the Advancement of Artificial Intelligence, February 25 March 4, 2025, Philadelphia, PA, USA, pp. 7691-7699. AAAI Press, 2025a. doi: 10.1609/AAAI. V3917.32225
htthttss://oii /10
v3917 32828
Zhongqi Wang, Jie Zhang, Shiguang Shan, and Xilin Chen. T2ishield: Defending against backdoors on text-to-image diffusion models. In Computer Vision ECCV 2024, pp. 107-124, Cham, 2025b. Springer Nature Switzerland. ISBN 978-3-031--73013-99
Zhou Wang, Alan C. Bovik, Hamid R. Sheikh, and Eero P. Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE Trans. Image Process. 13(4)6000612, 2004. doi: 10.1100//...0033 819861. URL htttss// http:///oi.ooo orgg /100110.11 1ww.1119/TTPPP otg./....//.//111.11.1.. 2003 8
Tianyu Wei, Shanmin Pang, Qi Guo, Yizhuo Ma, and Qing Guo. Emoattack: Emotion-tee ionotion-to-iman image diffusion models for emotional backdoor generation. arXiv preprint arXiv:2406./586,, 2024.
Zhen Xing, Qijun Feng, Haoran Chen, Dai, Han Hu, Hang Xu, Zuxuan Wu, and Yu-Gang Jiang. A survey video diffusion models. ACM Comput. Surv, 572) 2025. doi: 10.1 3696415. URL https: owwoorggg/ooooo 10. 1145/3696415
Yuhui Xu, Lingxi Xie, Xiaotao Gu, Xin Chen, Heng Chang, Hengheng Zhang, Zhengsu Chen, Xi- aopeng Zhang, and Qi Tian. Qa-lora: Quantization-ave aware low-rank adaptation of large language models. In The Twelfth International Conference Learning Representations, ICLR 2024, Vi- enna, Austria, May 7-11, 2024. OpenReview.net, 2024. URL Forum? www.mmmdddwFFFoooooeo
net/
Zexuan Yan, Yue Ma, Chang Zou, Wenteng Chen, Qifeng Chen, and Linfeng Zhang. Eedit: Re- thinking the spatial and temporal redundancy for efficient image editing. CoRR, 10270 2025. doi: 10.48550/ARXiv.5000. 10270. URL Ihttps:://dot http:/://oo..../....4oo/. www.o0.gg1100 481100.r555//rxii..
2503 10270
Ling Yang, Zhilong Zhang, Yang Song, Shenda Hong, Runsheng Xu, Yue Zhao, Wentao Zhang, Bin Cui, and Ming-Hsuan Yang. Diffusson models: A comprehensive survey of methods and applications. ACM Comput. Surv., 56(4):005:1105:39, 2024. doi: 10.1145/3626235. URL
htt.ps://doi.oo 11211.1145550 1 /111/1/////3355
Hu Ye, Jun Zhang, Sibo Liu, Xiao Han, and Wei Yang. Ip-adapter: Text compatible image prompt adapter for text-to-image diffusion models. arXiv preprint 2308.062... 2023.
Shengfang Zhai, Yinpeng Dong, Qingni Shen, Shi Pu, Yuejian Fang, and Hang Su. Text-to-image diffusion models can be easily backdoored through multimodal data poisoning. In Proceedings of the s1 ACM International Conference Multimedia, pp. 1577-1587. 2023.
15

---

Published as a conference paper at ICLR 2026
Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In 2018 IEEE Conference on Computer
Vision and Pattern Recognition, CVPR 2018, Salt Lake City, UT, USA, June 18-22, 2018, pp. 586-595. Computer Vision Foundation IEEE Computer Society, 2018. doi: 10. 109/ 2018.00068. URL/itttp://ppeeaccee
thecvf. com/ wwwt/ntttttttcccccccc Seppnntt__p________ 201 8/htm1/ Zhang The www.uannnaeeeeeeee Effect CVPR 2018 paper.htp
Shuai Zhao, Meihuizi Jia, Zhongliang Guo, Leilei Gan, Jie Fu, Yichao Feng, Fengjun Pan, and
Luu Anh Tuan. A survey of backdoor attacks and defenses on large language models: Implications for security measures. arXiv preprint Stfi::240000685522 2024.
Kaiwen Zheng, Cheng Lu, Jianfei Chen, and Jun Zhu. Dpm-solver-v3: Improved dif- fusion ODE solver with empirical model statistics. In Alice Oh, Tristan Naumann, Amir Globerson, Kate Saenko, Moritz Hardt, and Sergey Levine (eds.), Advances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurlPS 2023, New Orleans, LA, USA, December 10 16, 2023, 2023. URL ad8de994b4457Loddd// aa58899955000aeee222222fc-aaaa-0
Lin Zhu, Xinbing Wang. Chenghu Zhou, Qinying Gu, and Nanyang Ye. Less is more: Masking elements in image condition features avoids content leakages in style transfer diffusion models. In The Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore, htttps://openreviess wwwp///ppee/eeeeeooeopeeeeeee.we net forum?id=
April 24-28, 2025. OpenReview.net, 2025. htthttp::
88JJisLtqr
APPENDIX
9.1 DETAILED ALGORITHM OF STEBA BACKDOOR ATTACK
In this section, we detail the proposed STEBA algorithm. This includes the procedure for calcu- lating the top-k modules responsible for generating the enrichment phenomenon and method for determining the set of minimum timesteps. For complete overview, please refer to Algorithm |
9.2 THE TRANSFERABIL.TT OF STEDF
In this section, we evaluate the transferability of the STEDF defense framework. Transferability refers to the ability of defense withstand previously unseen attacks. In our experiments, we constrained the training process by allowing STEDF to learn exclusively from malicious samples generated by Stable Diffuusion vl.5. We then assessed its defensive performance on two other base- line models. Under this threat scenario, STEDF operates with zero prior knowledge of the backdoor features embedded in the other models. The defensive performance is shown in Table 3
9.3 ENRICHMENT PHENOMENON IN DIFFUSION MODELS WITH DIT
In the main text, most of what we discuss diffusion models based on the structure of UNet, which is the most widely used form of diffusion models. We discovered enrichment phenomena on these models and applied them backdoor attacks and defenses. However, some of the latest works have shifted the diffusion model to the Transformer architecture and generally applied the Flow Match scheduler sampling. We are very curious whether the diffusion models of these DiT architectures will exhibit properties similar to those of the UNet architecture after injecting backdoors.
In this section, we select Stable Diffusson m.emum,, one of the most widely adopted DiT-based diffusion models distilled from Stable Diffusion varse, as our baseline. We inject backdoor into this model using the VillianDiffusionn method and analyze the deviations introduced by fine- tuning. All other attack Settings are consistent with the baselines in the main text. As anticipated, despite the architectural differences, the baseline model continues to exhibit enrichment phenomena (see Figure 7 This finding suggests that enrichment is not exclusive to UNet-based architectures, but rather a pervasive property across diffusion models of diverse structures. In future work, we will further investigate how enrichment can be leveraged for backdoor detection in Disee models.
16

---

Published as a conference paper at ICLR 2026
Algorithm 1: STEBA: Spatial-Temporal Efficient Backdoor Attack
Input: baseline model Mhe, dataset D, full timestep set T, selection size k (or threshold r),
timestep budget [7*] poisoning weight X, optimization steps S, learning rate 1
Output: backdoored parameter mask Ma. and updated parameters (only on 0*))
for 4-1 1 to L do
10(0)
bc 1::
ba 10
be II:
using top-k then
Set mask Mj 1 if E top-k, else M, = 0;
else
Set mask Mj if score; 2 else M, = 0:
Define 0 = (03 M2 = 1);
Initialize optimizer over l with learning rate yy;
10 for s - 1 to S do
11
Sample minibatch (z,c) D;
12
Sample t" uniformly from 7" and noise ~ NO,, I):
13
- var + v1
de- + var 1 + vI ār-
15
Letean + ||e e0 1" c))l
16
Led 1E- ca(r,, t", 2):
17
L Lekenn + Lodi
Compute gradients VoL;
19
foreach parameter index j do
if M, 0 then 83 -
21
22
Optimizer step on 0";
23
return Updated model parameters (only 0* changed) and parameter mask Moa
Framework
Suspicious Model
BDR (%) f
TPR (%)
FRP (%) L
TNR (%)
ENR (%) L
SD v1.5
99.6(-:0.2)
99.8
0.2
STEDF (Ours)
SD v2.1
92.1(++0.4)
84.2
15.8
v4.0
88.9(+-0.9)
88.1
10.4
89.6
11.9
Table 3: Evaluation the transferability STEDE. We observe that across different diffusion mod- els, the malicious features induced by the spatio-temporal redundancy of backdoor attacks exhibit strong similarity. Consequently, defense framework trained single diffusion model can effec- tively detect malicious samples generated by other black-box models.
9.4 THE PERFORMANCE OF STEDF IN DEFENDING AGAINST STEBA
Building upon our systematic evaluation of STEDF's defense performance under various trigger modes, this section focuses on its detection capability against the STEBA attack within the same ex- perimental setup. Our results demonstrate that while STEDF's performance in detecting the STEBA backdoor strategy is slightly less effective than baseline experiments,it nonetheless remains signifi- cantly superior other previous approaches(as shown in Table 4). We observe that this performance decline primarily attributed to the identification true-negativ samples. This may be due to two main factors: first, the general backdoor pattern features might perturb a larger gradient space; sec- ond, since the majority of step vectors are benign, the confidence level of the backdoor may be partially mitigated by these benign features.
17

---

Published as conference paper at ICLR 2026
Backdoored Diffusion Transformer(Dit) Model
Fine-tuned Diffusion Transtormer(DIT) Model
Transformer Block Number
Accumulsted Differences
Enrichment phenomenon
Figure 7: Enrichment in DiT architectures: Similar to UNet-based diffusion models, DiT-based malicious models exhibit pronounced cumulative deviations at critical weight parameters, suggest- ing that backdoor injection induces essential mapping relationships within specific network layers.
Framework
Trigger Patterns
BDR (%)
TPR (%)
FPR (%)
TNR (%)
FNR (%)
Words
54.8
59.2
49.6
50.4
40.8
T21Shield
Phrases
51.0
62.2
60.2
39.8
37.8
Symbols
57.3
69.8
55.2
44.8
30.2
Words
80.6
61.2
0.0
100
38.8
STEDF (Ours)
Phrases
74.1
100
51.8
48.2
0.0
Symbols
83.2
100
33.5
66.5
0.0
Table 4: Application of STEDF for detecting STEBA: Experimental results indicate moderate decline in STEDF's detection performance against STEBA. We attribute this performance degra- dation to feature shifts induced by the constrained weights and limited timesteps, which alter the spatiotemporal locations where abnormal activation patterns emerge.
9.5 HYPERPARAMETER ANALYSIS
Because STEBA heuristic approach, the configuration its hyperparameters plays crucial role in determining overall performance. In this section, we discuss the selection ranges of T* and 0" in Equation For T you can refer to the marginal effect experiments presented Figure 3 where the optimal performance is observed when approximately 50% of the generation process proceeds without attack intervention. For 8", in Figure 9 we progressively dissolve the adjacent weights surrounding the Top-k weights. To prevent gradient collapse, the normalization layer is adopted as the minimum update unit, while the sampling block is treated as the maximum update unit, ensuring follow Appendix [96]and and adopt
gradual and stable dissolution process. For time-step selection, the scaled time-step (late) strategy, which has been shown to be the most effective choice.
9.6 DIFFERENT TIMESTEP SELECTIONS FOR STEBA
In this section, we evaluate the attack performance of the Stable Diffusion vl.5 baseline model un- der different timestep selection strategies, as illustrated in Figure Regarding the selection, we further adopt two approaches: separated timesteps and scaled timesteps. The separated timestep method is commonly used to eliminate temporal redundancy and is typically employed in knowl- edge distillation or sampling acceleration tasks. In contrast, the scaled timestep strategy applies weighting scheme to bias training toward either earlier or later timesteps, thereby emphasizing specific regions of the diffusion trajectory. In our experiments, we evaluated five different time-step selection strategies. For the Percentage Timesteps approach, adopted the best perfforeroonnng config- uration identified Figure [3] selecting the earliest or the latest 40% of timesteps, respectively. For the Scaled-Timestep Timestep strategy, define weight w, characterize the bias in time-step sampling.
18

---

Published as a conference paper at ICLR 2026
45
40
100
80
F10 Sccoee
ASR (90)
20
50 ASR (94 ASA
V2.1
V2.1 baselins
Figure 8: The experiment shows that necessary condition for successful backdoor attack is the simultaneous inclusion of both normalization layer and the transformer layer associated with target key weights. Furthermore, fine-tuning the entire sampling block substantially enhances attack performance; in practice, this typically entails adapting one or two upsampling blocks.
43-
100
35
25-
ASR (80
20-
19
SiipTimestop
husttoeetto
base
v2.5 ASK
Figure 9: The experiment shows that necessary condition for successful backdoor attack is the simultaneous inclusion of both the normalization layer and the transformer layer associated with the target key weights. Furthermore, fine-tuning the entire sampling block substantially enhances attack performance; in practice, this typically entails adapting one or two upsampling blocks.
which can be expressed as:
1, t< H, ax 12 H.
(8)
In this section, we define = 3, indicating that the model has three times the probability of sampling the early/late time steps. Ultimately, the selection probability of each timestep p(t) can be formally written as:
p(()
2 W
Experimental results indicate that although multiple timesteps selection strategies can successfully inject backdoors, strategies that more frequently sample high time steps yield substantially higher injection efficacy. These findings corroborate the temporal redundancy and marginal effect proposed earlier.
19

---

Published as a conference paper at ICLR 2026
9.7 STEBA UNDER DIFFERENT SAMPLERS
To demonstrate the robustness and generality of STEBA as backdoor attack strategy, we evaluate range of representative diffusion samplers. In Table we test six samplers: DDPM, DDIM (ODE), DDIM (SDE), DPM-Solver-ol DPM-Solver-22, and PNDM, covering com- monly used sampling algorithms for diffusion models. Experiments were conducted on Stable Dif- fusion v1.5 with a learning rate of le 4, a batch size of 16, and run in COCO COCO-Captions 2017 validation set. All experiments ran on an NVIDIA V/00 GPU. Results indicate that STEBA attains consistently strong attack performance across the evaluated samplers, supporting its robustness and sampler-agnostic applicability.
its performance
Sampler Type
FID Score +
ASR
(eemoryMiniimnn
30.12
97.60%
18250MB
DDPM
18.68
98.25% %
4090MB
DDIM
28.40
98.55%
18262MB
(ODE)
17.33
98.30%
4120MB
DDIM
27.50
98.05% %
18258MB
(SDE)
18.05
97.90%
4096MB
26.88
98.70%
18T00MB
DPM-ol
17.40
98.45%
4077MB
27.08
98.99%
18100MB
DPM-o2
16.95
98.70%
4112MB
29.60
97.10%
18250MB
PNDM
17.98
98.15%
4215MB
Table 5: Attack performance across samplers: For each sampler, the first row reports results for full fine-tuning, and the second row reports results for STEBA-driven backdoor attacks.
9.8 THE TOP-K WEIGHT OF THE ENRICHMENT PHENOMENON
The enrichment phenomenon is one of the core conclusions of our work, describes the distinet parameter changes that occur during backdoor attacks. this section, we illustrate these changes by analyzing the weight parameters of the Stable Diffusion vI.5 baseline model the number of poisoned timesteps increases. To accentuate these changes, we raise the poisoning rate to 0.3. For each training step, present the top-20 weights exhibiting the most significant changes.
Training Steps
Weight Name & L2-Norm (Top-20)
down_blocks. Lateentions........ www.ssorrmerrboccsso0 norm2: 0.000161
www._boocks...attentiioo ornp:osnaeaaeettnooooooonnneeeee J.ransforrerr_blocks...oomm down.blocks...attenie att.:/iioonn..ttaaoooemeeebooo.. up up po..blocks. ara.:ereeeeeens......aoeeeeeeeee www.::....oooooicnei..... 0.000136
0.000156
0.000154
t.rnssfoomme blocks.0.norm2. 0.000152
up blockss2.attentions..Ltram .trassformerr htt.:/mmmmeebbooc.....ooo....... 0.000113
down www.mblocks...attenniioo traansoormerrrllckksoooo hoov.hhoock../attuuritsso.rraroe
0.000109
_oooout 0.000098
0.000098
500 (ASR=0.00)
0,000094
up blocks..0.ateentions. O.transformer wwwransformerbblocss..o blocks.0.ff nef... 0.000093
0.000093
down
up wpt.boccks...atenniin O.rraasforrerr dlocks.0.atte to 0.000092
www..blocc....tteeee. O, 0,proj 0.000091
Noww__llokk...atteniii O. mrunsformer.boock. 0.000091
www..lloccs...atentiiiii
Transformer.blocke. 0.000091
www..blocks...atteniiiie 0.000091
up blocks. L.t.tenntiinss....aaaffommm blocks.0.norm2.; 0.000091
down atw.esttonttteeiinssss.ooo n..o:m: 0.000090
atteentioon www.annfororr.bbbboo..o. www.kk..err.ooo...oooo.. normml 0.000090
20

---

Published as a conference paper at ICLR 2026
up.blocks.2.attenniin
www.bbl...ooonn..t. 0.000362
up wo..bockk...attnnii httpiiinniiionn...aantttoooooo ttransformer
0.000297
up up_blocks. wtw.:k.....tteettioossooo
blocks.0.norme 0.000249
wrransformer.blocss..00 blaocks...ttt2..to. 0.000211
www.bblocck....ateetionss
www..nnsooorrrr.ooooooo.oo www.bbllocc...oo22222. 0.000200
0.000186
up up.blocks. bllockss.atccttioo...rrsffmoeeee frramssfommerrbbccss.omommmmmmm 0.000175
www..blocks...atteniiii 0. transformer..locks...ttttt
0.000167
down (alocks.0.attentionn. transffrmmee blocks.0..ttm./ out: 0.000166
1000 (ASR=0.04)
nown.blocks..
batocks...attentioss w.w..a.sooomrr..boooo...... blwckks...attl...t.. out.0: 0.000166
down_blocks wwt.:etttotttntonss..o.o wtw.ansffrrerrrbbllcssoooo 0.0000000:00000000 0.000162
down_blocks. www.eeniootttttnsno.ooo.oooooss.
0rraaSoormmbbbbbbocoo........ 0.000157
down.blocks. www.eokt....attttnnooooss.o SrttriiiinnSOtmmmmSSomoeeeblbb..
0.000156
0.000151
hatnokss__aatentitosssttaaaiaee http://owmmer.rooc.....oooooo 0.000150
down blockks...attentiions..... in: 0.000150
down wtw.sss...ateentinso.ooooomm 0.000147
att.ttrniiisss.aaoooeeeeeeeeeeee to.tt.tt 0.000147
0.000146
down ugg.bcccs2aatttttoossttttmmoeece more 0.000464
0.0004 0.000146
up down blockssODattentioos....mmmssmmo blocks.0.attr// 0.000247
0.000393
0.000306
down blccks//aatenntosss..aaaasooee blocks..0.oom// 0.000235
up htt.://eeeiiionoooaaaoooeeeeeeed 0.000216
0.000215
down.blocks...ateene otta:///nnn...t.aoooooooooooobbl
0 0.000204
down_blocks wwt.:aiiiotttttiinnn...ooo
0.000203
1500 (ASR=0.88)
down.blocks. wtw.ckk.....tteetions..oo pattiaationsO...rasffmm.....bb
0.000198
down Dolocks...atie O.wttentioossOOO....... O.ranssfrrttr blocks.00.tttnl o oot.::oooot00 0.000198
down blocks.0 www.sssti..ttteions..omooo wtw.:iim.....aaaffmmeeeeem blocks.00.att22: 0.000191
down_blocks. htta://nnnnootooooooooooooooo/aa
0.000189
down.blocks www...niiotttttttntoooeoommooss. 0rmmoooommbbbbbbbo.............. 0.00011 0.000185
down.blocks. www..etttotttttsssoooommom wwt.tentions....aanssiooo..ooeee O.tramsforrerrrbblcckoooooo 0.000118 0.000185
www.bss....tten.iiiiii..oo 00oj in: 0.000178
www..blocks.
waw.kks...tteeiins..00. onnom::: 0.000177
down_blood blocks.l..oooooooooooo Blocks....tteeii. www.teenittnnsss..mmmmmmmm.. trrnsfformer blocks: 0.000174
down block..locs000 aat..tttosssosss......m....o.... O. wrranfoormrr.blee blockk..0. 0.000174
down_blocks. attentions.0. 0,000170
21

---

Published as a conference paper at ICLR 2026
0.000545
up hop.boocks2..tteee ttrasforrmme
wlw.e/oooooeeee..bb.....o blocks.0.normi 0.000469
up up_blocks. wwwpeentiios....aanfffrrroo
blocks.O.normi. 0.000352
wwwn_blocks.0
blw.cks...ttt2..tt.... 0.000271 0.0000277
www.bblocks...aattnntnoo... wtt.:fformrrrbboco.o.oooooomo 0.000263
up sp.blocks. hrap://nss....aasooooeeebbssssoo
0.000259
Ouransformerr.blckks.00
0.000239
0.000229
down Crlocks...attetiiii transffrrmrre blocks....tttl... v: 0.000223
2000 (ASR=0.97)
down. babocks...attentions wrw.onn.....asooommrr....... htw.s/orrmrr..oooooo..tttt22222.
0.000216
down_blocks wtw.eetto..tttniinns..oooooo 0
0.000215
down_blocks. Www.eeniootttttssno.o.o.oooo 0, Orrasoommer..oooo...att.........
0.000215
down.blocks.0. www.:ssttttttetnnnsooo.moo 0rtas///otmtmmmmeeeeo.......aaaa 0.00020 0.000214
down.blocks. www.bllocss....tttttoonss.ootos hrt.://issorrmomoomooooo...ttla. 0.000211
down.blocks www.:stti..tttttnnss.ooomm
0.000000 0.000200
down down www.sss.O.attenioss.00 O.raasforree blocks: 0.000193
proj in: 0.000195
down_blocks....tteeniie wrt.rrttiisstt....asn.rmmeeeeeee
0.000193
hww..bblockss..aattttiooo...... 0.000193
blocks.0 normm:: 0.000191
up or.bbock.2..tteiiio22rrrrmmmmenr blocks.
wlw.ck....ooo.......... normm::: 0.000593
onom:: 0.000519
0.000374
down blickssO..tttttionssOttttssooee blocks.0.attn2..1 0.000290
down foosks.s_.atettttno.oooormmmoone blocks..0.norm2:: 0.000283
up http:///eeettttoooomommmoeoenene 0.000252
0.000279
down.blocks.O.ateeni 0rw.aoooeeeeebbbbbbo..oooooo 0.000247
down_blocks www.:etiiotttttiinns.soom aatteeations....rrttfreee..bbbbd
0.000237
2500 (ASR=0.99)
down.blocks. wtt.ok.....atttttionss... Srag:/ooo...tmmmtmmmommoo.llooo.
0.000236
down blocks....cue wtwpieetiionn....anntiiiieie
aatiottiooooolmssoooommoeoooooao 0.000233
down www.:k.....tttniooss.ooomo www.oonn.....aaffom.ee......eeee blocks.0..ttn22: 0.0002331
down_blocks.
down.blocks. http:///eattaaaaaaaa/o////oooooo 0.000227
0.000227
bat.eotttoo........ccooooo..boeo 0.000210
Srt.ritiinn..ttttoooomme..bb..u. 0.000209
O..attention...rraaa. blocks: 0.000206
down_blocks www.:nn......afffommeeee blocks.0: 0.000206
block..locs..... www...ttientnsss...mm 0roj in: 0,000205
down_blocks. O. attentions.O.. norm: 0.000201
22

---

Published as a conference paper at ICLR 2026
0.000597
up bo.blocks.2..tte .ranssorrsttrn wlw.s/oooooeee.o.ooo..ooooo 0.000521
up up_blocks. wwweecntions....aanfffrrroe www.cks.....t.t..tt...... 0.000291
www.attnniin...traaaaa.a blocks.0.normi 0.000376
wwwn_blocks.0 att.:attetttiooosttaaaannnrreeee
0.000285
up sp.blocks. wrwasssarraaroroeeee.eeooooooooe 0.000279
O.trassorrerrrbbcccs.. 0.000253
0.000249
down blocks.0 www.setiosttttsnss..ommm transsfrrmrre blocks....ttnn2..1 k: 0.000239
3000 (ASR=0.98)
down. babocs....attentioss www.oon.....aasooome......
O..ransformerrbboocso...ttttt blwckks...atttl..too.. v: 0.000237
down_blocks wtw.eetti.tttteiinns..oooo 00 0.000234
down.blocks...um 0rw..a/ooommmm....bo.......a.2 0.000232
down_blocks. www.:k..i..tteeiinno.o 0.
ottaa//nnnntttooooooooooooooooat 0.000228
0.000228
up down Blocks...attentiions. wrtassffoorrrrrrrmmemer blocks.00.orm/ 0.000210
0.000212
down
..tansffro.rrerrrmmrr......... blocks: 0.000207
down_blocks..0 www.bllccs....aeeettinn.s www..aattttttsss..mmm catteettions...ransffoooon bransforreer.blocss..o 0.000207
down_blocks. O. attentions 0, 0.pjj lin: 0.000205
down 0 attenttios n.rrr:: 0.000202
9.9 MORE TEXT-TO-IMAN IMAGE GENERATED RESULTS
In this section, we present images generated by STEBA to demonstrate that our method maintains excellent generation quality while achieving effective backdoor attacks. We showcase a variety of samples, including both clean, high-quality images and those with injected backdoor triggers.
Backdoor Target
Stable Diffusion v1.5
23

---

Published as a conference paper at ICLR 2026
Backdoor Target
Stable Diffusion v2.1-base
Backdoor Target
Realistic Vision v4.0
24

---

Published as a conference paper at ICLR 2026
9.10 THE USAGE OF LLMs
Large Language Models (LLMs) were used to aid in the writing and polishing of the manuscript. Specifically, we used LLM to assist in refining the language, improving readability, and ensuring clarity in various sections of the paper. The model helped with tasks such as sentence rephrasing, grammar checking. and enhancing the overall flow of the text.
It is important to note that the LLM was not involved in the ideation, research methodology. or experimental design. All research concepts, ideas, and analyses were developed and conducted by the authors. The contributions of the LLM were solely focused on improving the linguistic quality of the paper, with no involvement in the scientific content data analysis.
The authors take full responsibility for the content of the manuscript, including any text generated or polished by the LLM. We have ensured that the L.M-ggenrated text adheres to ethical guidelines and does not contribute to plagiarism or scientific misconduct.
25


Reviews:
[{"review_id": "gQtRdjksSv", "reviewer": "Reviewer_ct6g", "summary": "The paper \"STEDiff\" introduces a unified attack and defense framework that uncovers spatio-temporal redundancies in backdoor attacks on diffusion models . The authors identify two key phenomena: the enrichment effect (spatial redundancy in weight updates) and the marginal effect of timesteps (temporal redundancy in backdoor training). Building on these findings, they propose STEBA, an efficient attack method that reduces GPU memory and training time, and STEDF, a real-time defense mechanism that detects backdoors by monitoring behavior in diffusion dynamics. Their method significantly improves attack efficiency while maintaining high attack success rates. The study demonstrates that both attack and defense can be optimized by focusing on key weights and critical timesteps, reducing overhead while enhancing robustness.", "questions": "1. How to choose the effective timestep for STEBA? Can you provide pseudo code and details? What if choosing different strategies and timesteps?\n2. For each backdoored diffusion models, can ¥ou demostrate the utility and the ASR on various samplers and sampling stepsd? including DDIM with 100 steps, DPM-Solver with 20 steps, UniPC with 20 steps, and PNDM with 20 steps, which align with VillanDiffusion settings.\n3. It looks like the experiment in section 9.3 and 9.5 don't recognize the usage of LoRA in VillanDiffusion. Can you conduct an experiment to demostrate if enrichment effect exists without LoRA? What's the consequence with and without LoRA?\n4. Please survey the prior works on Backdoor Detection via Network Activation.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. Significant ASR Improvement with Lower Compute Cost: The Paper proposes a computationally-efficient backdoor attack on diffusion models. Demonstrate the backdoor attack on diffusion models can be achieved by controlling a few timesteps.\n2. Novel Insight – Redundancy in Backdoor Training: This work is the first to pinpoint spatial and temporal redundancies in diffusion model backdoor attacks . Identifying that only a small fraction of model parameters and diffusion steps are truly responsible for the backdoor is a fresh and important insight.\n3. Highly Effective Defense: The defense component, STEDF, demonstrates near-state-of-the-art detection performance. It can detect backdoor-compromised models with Backdoor Detection Rates ~98–100% across a wide range of trigger types, while maintaining very low false positive rates (often 0–2%)", "weaknesses": "1. Heuristic Methodology: The paper doesn't provide theoretical explaination for the method. Also lack of the analysis of various hyperparameters choosing.\n2. Unclear Temporal Selection for STEBA: It's not surprise that diffusion models has reduntant steps because close timesteps have almost identical score or velocity field. The paper should include more detailed temporal selection algorithm and various amount of chosen timestep. It should also demostrate the results for such different settings. A better investigation should further cover the changing temporal dynamic across various amount of chosen timestep.\n3. Unclaer Sampler Choice: It's trivial if only train on the timestep used by the specific sampler and achieve good FID and ASR on the identical sampler. For example, evaluate with 50 steps DDIM and backdooring on the these 50 step used by DDIM. The paper should cover a more comprehensive experiments to demostrate the generalization or failure on various samplers and sampling steps, including DDIM, DPM-Solver, PNDM, and UniPC while backdoored on fewer effective timestep.\n4. Ignore the Usage of LoRA in VillanDiffusion: The paper doens't recognize the usage of LoRA in VillanDiffusion, which might be the root cause of enrichment effect.\n5. Not Clarify the Contribution in Comparing to Previous HIdden-Activation-Based Backdoor Detection: Existing works have identify that activations in the hidden layers can pose strong signal for bnackdoor actication, like [Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering](https://ceur-ws.org/Vol-2301/paper_18.pdf). However, the paper doesn't emphasize the main contribuition and difference between this paper and prior works.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "uwqD18B9l1", "reviewer": "Reviewer_mF24", "summary": "This work reveals the novel phenomenon of text-to-image backdoor attack methods, denoted as spatial and temporal redundancy. They argue that the existing abnormal gradient accumulation brought by backdoor injection is regarded as spatial redundancy, and the subset of time steps that impact backdoor injection is considered as temporal redundancy. After recognizing two types of redundancy, this research proposes a novel framework for attack and detection in the field. The experimental results present their roadmap for discovering the phenomenon and the following framework, which provides a new perspective for this field.", "questions": "1. I wonder about the choice of the diffusion model 'Realistic Vision V4.0'. Is there any reason? What is the structure of this UNet or DiT model?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. The observations of the UNet, as well as the Transformer for the enrichment phenomenon (spatial redundancy), are good to demonstrate the existing defect of the VillanDiffusion.\n2. The observations of the time steps correlation with ASR/FID are good to know that VillanDiffusion still has space for improvement.\n3. For the defense, the authors provide more types of triggers to check the generalization (scope) of their proposed detection framework.", "weaknesses": "1. **Unclear base attack methods for analysis.** Based on Table 1, I conjecture that your analysis from Sec 2 to Sec 4 is based on the VillanDiffusion. Is that right?\n2. **Comparisons with other attack methods.** However, several attack methods have been proposed today, such as BadT2I (as you mentioned in Sec 2.2), EvilEdit (1), and PaaS (2) mentioned in the survey paper (3). In my experience, EvilEdit and PaaS also rely on a few resources for consumption. Could you provide the comparisons with these methods? If not, please give convincing reasons.\n3. Follow 2., as I know the attack behaviors in (1) and (2) are different from VillanDiffusion and RickRolling in their cross-attention maps, which makes me concerns about the generalization of your observation of the enrichment phenomenon. Could you provide more theoretical or empirical explanations about the enrichment phenomenon?\n4. **Unclear about the analysis of the marginal effect in timesteps.**During the earlier timesteps, how do you obtain the images for calculating ASR and FID? ** Do you estimate the final image $x_0$?\n5. **Unclear about the Trigger patterns.** Could you please provide the details of the trigger patterns in Tables 2 and 4? I might miss this part in the main article and in the Appendix.\n6. The authors sometimes refer to $M_{be}$ as the benign model (Line 241) or baseline model (Line 247). **I suggest that the authors make the call consistent or clarify that it has the same meaning. **\n\n- (1) Wang, H., Guo, S., He, J., Chen, K., Zhang, S., Zhang, T., & Xiang, T. (2024, October). Eviledit: Backdooring text-to-image diffusion models in one second. In Proceedings of the 32nd ACM International Conference on Multimedia (pp. 3657-3665).\n- (2) Huang, Y., Juefei-Xu, F., Guo, Q., Zhang, J., Wu, Y., Hu, M., ... & Liu, Y. (2024, March). Personalization as a shortcut for few-shot backdoor attack against text-to-image diffusion models. In Proceedings of the AAAI Conference on Artificial Intelligence (Vol. 38, No. 19, pp. 21169-21178).\n- (3) Lin, W., Zhou, N., Wang, Y., Li, J., Xiong, H., & Liu, L. (2025). BackdoorDM: A Comprehensive Benchmark for Backdoor Learning in Diffusion Model. arXiv preprint arXiv:2502.11798.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "wyqzq4eVft", "reviewer": "Reviewer_YB7w", "summary": "The paper observes redundancies in the backdoor attacks against diffusion models. The authors propose an attack method, STEBA, and a defense method, STEDF, based on the observations.", "questions": "Please see weekness.", "limitations": "", "rating": 4, "confidence": 3, "soundness": 2, "presentation": 1, "contribution": 2, "strengths": "1. The observations seem intuitve and supported by experiments.\n2. STEBA achieves high attack sucess rate with reduced computational cost in the paper's setting.", "weaknesses": "1. There lacks necessary understanding into the STEBA methods. It is unclear to me whether the observations about redundancy are confirmed by the optimizaiton results of STEBA. And whether the distribution of the most important parameters/time-steps follows certain rules.\n\n2. The evaluation of STEDF is flawed. It is not mentioned what attack method was used, and what are the configurations of the attack and the baseline. It feels that the evaluation is weak since the baseline already achieves over 90% accuracy. Besides, it is unclear whether STEDF can transfer between different attack methods/datasets etc.\n\n3. What does 'MSE' mean in Figure 4? Fonts in Figure 5(b) are too small to see.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "NWa8nTpxP4", "reviewer": "Reviewer_XGH7", "summary": "This paper presents two key findings. First, it identifies an enrichment phenomenon where backdoor injection causes abnormal gradient accumulation in a few critical weight parameters. Second, it reveals that only a small subset of timesteps significantly influences backdoor injection.\n\nBuilding on these insights, the authors propose two frameworks:\n1. STEBA – a backdoor attack that targets optimization on key weights and crucial diffusion timesteps. It achieves a 15.07× speedup in injection and reduces *ideo memory usage by 82%.\n2. STEDF – a detection framework that monitors spatio-temporal feature dynamics across timesteps to halt malicious generations mid-process, achieving up to 99.8% detection accuracy.", "questions": "For STEBA, \n- How does various parameters such as top-k and thresholds affects the attack effectiveness?  \n\nFor STEDF, \n- Which timestep found to be the most effective for detection? \n- What is the average compute savings in diffusion steps?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The paper is overall clear and well-organized. It provides insights into the mechanisms of backdoor injection in diffusion models, in the enrichment of gradients in key weight parameters and the temporal sparsity of critical timesteps. \n\nTheir proposed methods, STEBA and STEDF, shows strong practical values, improving the efficiency of backdoor insertion and providing an effective mechanism for detection.\n\nThe experimental evaluation spans three widely used diffusion models (Stable Diffusion v1.5, v2.1-base, and Realistic Vision v4.0) and multiple trigger types, which reinforces the robustness and generality of the findings. Overall, the work offers meaningful contributions to understanding and mitigating backdoor vulnerabilities in diffusion models.", "weaknesses": "The study could be further strengthened by extending experiments to a broader range of diffusion model families to better assess generalizability. Also, it would be useful to evaluate STEDF under adaptive attacker scenarios to understand its resilience against under this adaptive threat model.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)