DisDet: Exploring Detectability of Backdoor Attack on Diffusion Models
Authors: Yang Sui
Huy Phan
Jinqi Xiao
Tianfang Zhang
Zijie Tang
Cong Shi
Yan Wang
Yingying Chen
Bo Yuan
Venue: Accepted by TMLR ()

Abstract: In the exciting generative AI era, the diffusion model has emerged as a very powerful and widely adopted content-generation tool. Very recently, some pioneering works have shown the vulnerability of the diffusion model against backdoor attacks, calling for in-depth analysis and investigation of the security challenges. In this paper, we explore the detectability of the poisoned noise input for the backdoored diffusion models, an important performance metric yet little explored in the existing works. Starting from the perspective of a defender, we first analyze the distribution discrepancy of the trigger pattern in the existing diffusion backdoor attacks. Based on this finding, we propose a trigger detection mechanism that can effectively identify the poisoned input noise. Then, from the attack side, we propose a backdoor attack strategy that can learn the unnoticeable trigger to evade our proposed detection scheme. Our empirical evaluations across various diffusion models and datasets demonstrate the effectiveness of the proposed trigger detection and detection-evading attack strategy. For trigger detection, our distribution discrepancy-based solution can achieve a 100% detection rate for the Trojan triggers used in the existing works. For evading trigger detection, our proposed stealthy trigger design approach performs end-to-end learning to make the distribution of poisoned noise input approach that of benign noise, enabling nearly 100% detection pass rate with very high attack and benign performance for the backdoored diffusion models.

Published in Transactions on Machine Learning Research (06/2025)
DisDet: Exploring Detectability of Backdoor Attack on Dif- fusion Models
Yang Sui² Cong Shis
Huy Phan Yan Wang²
Jinqi Xiao
Tianfang Zhang Zijie Tang"
Yingying Chen' Bo Yuann
"Rulgers Universily
Temple University
"New Jersey Institute of Technology
ys ys*66 @scarlatmall rutgers..
Reviewed on OpenReview: http:://openreviiett net/ por/forum? Sf
Abstract
In the exciting generative AT cra, the diffusion model has emerged a very powerful and widely adopted content-generation tool. Very recently, some pioneering works have shown the vulnerability the diffusion model against backdoor attacks, calling for in-depth analysis and investigation of the security challenges. In this paper, we explore the detectability of the poisoned noise input for the backdoored diffusion models, an important performance metric yet little explored in the existing works. Starting from the perspective of defender, first analyze the distribution discrepancy of the trigger pattern in the existing diffusion backdoor attacks. Based on this finding, we propose trigger detection mechanism that can effectively identify the poisoned input noise. Then, from the attack side, we propose a backdoor attack strategy that can learn the unnoticeable trigger to evade our proposed detection scheme. Our empirical evaluations across various diffusson models and datasets demonstrate the effectiveness of the proposed trigger detection and detection-evading attack strategy- For trigger detection, our distribution discrepancy-based solution can achieve 100% detection rate for the Trojan triggers used in the existing works. For evading trigger detection, our proposed stcalthy trigger design approach performs end-to-cnd Icarning to make the distribution of poisoned noise input approach that of benign noise, enabling nearly 100% detection pass rate with very high attack and benign performance for the backdoored diffusion models.
1 Introduction
Recently, the diffusion model has emerged prevalent generative AI technique for content creation and editing across various data modalities, including image, video, speech, text, etc. Built the core principle originating from non-equilibrim thermodynamics, a diffusion model aims to learn to generate the target probability distribution via constructing and reverting a series of latent variables. Thanks to its solid theoretical foundations and training stability, to date the diffusion models have been widely used various gencrative tasks, such as image generation Ho et al. (2020); Song et al. (2020a); Bordes et al. (2022) : Chao
et al. 2002 3; Karras et al. (2022). ) texl-to-image synthesis Rombach al. (2022); Saharia et al. (022aa)
Ramesh al. (002)); Singh et al. (002)), image editing Meng et al. (2021): ;; Couairon et al. (0022 Brooks
ct al. (2023). image inpainting Lugmayr et al. (2022), super-resolution Rombach et al. 2022 Saharia et al.
(2022b): Choi et al. 2021 and video generation Ho et al. (2022a] Esser et al. (2023 Harvey et al. (0222)
Since diffusion models have already served as the backbone components in many real-world applications, the
corresponding security issucs have become a potentially challenging risk that requires special attention. In particular, the vulnerabilities of diffusion models under backdoor attack, a common and essential attack
strategy against the existing classífication models Chen et. al. (2017 Gu et al. (2019); Nguyen & Tran

---

Published in Transactions on Machine Learning Research (06/2025)
)020b); Liu et al. 22020 Doan et al (2021) Phan al. (2022a)) Zheng et al. (2023 Yuan et al. (0223)
should be carefully reviewed and studied in the emerging generative AT era.
Despite the current research prosperity of the applications of diffusson models, the security challenges of this vital technique in the backdoor attack scenario are still under-explored. To date, only very few works investigate the backdoor attack tailored to diffusion models. In particular, Chen et al. (2023): Chou et al.) (2023), as the representative works in this topic, propose the forward and backward processes of the back- doored diffusion models, demonstrating that the currently representative diffusion models can be attacked to generate the images in target category or even targeted fixed images, with the presence of poisoned input noisc.
Although these existing works reveal the leasibility of implanting Trojans into the diffusion models, we argue that the vuluerability and robustness diffusion models under backdoor attack are still under-explored. In particular, the prior works mainly craft the poisoned noise input, lcaving a blank in exploring the detectability of the embedded Trojans. Such exploration of the stealthiness of the Trojan trigger very critical in both attacker and defender aspects.
In this paper, we explore the detectability of poisoned noise input for the backdoored diffusion models, from both attacker and defender perspectives. We first analyze the existing fixed trigger pattern, discovering the distribution discrepancy of noise input to the Gaussian noise. Based on this finding, we develop a trigger detection mechanism that can effectively identify the poisoned input noise. We then take a further step to propose a backdoor attack strategy that can learn the stcalthy trigger of the proposed detection scheme. Overall, the contributions of this paper summarized as follows:
We explore the detectability of trigger patterns in the state-of-the-art diffusion model backdoor attacks. By analyzing the distribution discrepancy of the noise input, propose distribution-based detection mechanism that can identify the poisoned noise input of the backdoored diffusion models.
We then develop backdoor attack strategy that can evade our proposed detection method. By performing end-to-end learning of the trigger pattern towards minimizing the distribution discrepancy, the poisoned noise input can exhibit very similar distribution to the benign input, making the backdoor attack unnoticeable. We also optimize the training process of the stealthy trigger pattern to improve the benign and attack performance of the backdoored diffusion models.
We perform empirical evaluations for different diffusion models across different datasets and demonstrate the effectiveness of the proposed trigger detection and detection-evading attack strategy. On the defender side, our proposed distribution- baasbd detection method can achieve a 100% detection rate for the trigger patterns used in the existing works. On the attacker side, our proposed detection-evading trigger can enable nearly 100% detection pass rate and bring high attack and benign performance for the backdoorod diffusson models.
Notice that the threat model in the previous backdoored diffusion model Chen et al. 22025 : Chou et al. (2023)
assumes that 1) the allocker con control the training process of the diffusion model. 2) The users geers/ttlackess can have access to the input Gaussian noise of the diffusion model. We follow the same threat model to conduct our analysis in this paper.
2 Related Works
Diffusion Models. Diffusion models have emerged powerful generative AI technique very recently. Compared with other deep generative models, diffusion models exhibit good training stability and better quality and diversity of the generated data, making them popularly adopted in a varicty of generative tasks,
e.g.; image generation Ho et al. (2020): (Sng el. al. (2020a); Ho el al. (2022b) ; Dhariwal & Nichol (2021) |; Liu
lt al. (2023): Bordes et al. [2022] : Chao et al. (2021): :: Karras et al. (2022), video generation Ho et al. (022a))
Esser et al. (2023) Harvey et al. (2022). , text-to-image synthesis Rombach al. (2022); [aharia et al. 2022a
Ramesh et al. (2022); Singh al. (2023); Kumari et al. (2023): Gu al. (2022): Zhang et al. 2023); Ruiz
et al. 2023); Zhang et. al. (2023) and fast sampling (Song et al. (200 Salimans & Ho (2021 Sui et al.
2

---

Published in Transactions on Machine Learning Research (06/2025)
Wu et al. (2024 Lu et al. (2022) Diffusion models can be formulated in different ways, such denoising diffusion probabilistic model (DDPM) Ho et al. (2020) and its variant DDIM [ong et al. (2020a); noise conditional score network (NCSN) Song et al. (2020b) and latent diffusion model (LDM) Rombach al. 2022). This paper focuses on the backdoor attack on DDPM/DDIM, as the most representative and
p0
ct
lundamental diffusion model lype.
Backdoor Attacks on Al Models. The research on launching backdoor attacks against Al models,
especially the classification models, has been widely reported in the literature Chen et al. (017): ; Gu et al.
( Nguyen & Tran (2020b); Liu et al. (2020); Doan et al. (2021); Saha et al. (2020) Li et al. (2021
(Salem poisons the training data to inject the backdoor into the model in the training phase. Then in the inference
Phan ct al. (2022b); (Salem et al. (2022): Nguyen & Tran (2020a). In this attack scenario, the ad first
phase, the backdoored model behaves normally with the presence of benign input; while it will exhibit malicious behavior (e.g,, misclasiffication) when the input is embedded with a Trojan trigger. Considering its natural stcalthiness and severe damage, scries of backdoor defense approaches have been proposed Gao
et al. (2119) Wang et al. (2019) : Liu et al. (2018); Chen el. al. 2019a bis Tran et al. (2018) Li et al. 2020
Phan et al. 22024 Doan et al. (2023).
Backdoor Attacks on Diffusion Models. Unlike the extensive research on classification models, the backdoor attack for diffusion models is little explored yet. To date, the most two representative works are Chen et al. )023); Chou et al. (2023), which for the first time demonstrate the feasibility of launching backdoor attack against the generative models. By adding a pre-defined trigger into the benign Gaussian noise input, the manipulated poisoned noise can prompt the backdoored diffusion model to generate a target image Chou et al. (2023); Chen al. (2023) (e.g., Hello Kitty) or images belonging to certain class Chen et al. (0023) (e.g., "horse") as desired by attackers. Because the adversary leverage such malicious behavior to generate potentially offensive or illegal images, the vulnerability of diffusion models against
backdoor attacks poses severe security challenges and risks.
3 Background
3.1 Diffusion Model
Diffusion model Dicl-Dickstcin et al. (2015); Ho et al. (2020) is type of deep generative model aiming to generate semantic-rich data from Gaussian noise. To realize such mapping, a diffusion model typically consists of forward diffusson process and backward generative process. Take the representative denoising diffusion probabilistic model (DDPM) Нo et al. (2020) as an example. In the diffusion process, an image X sampled from real data distribution q(xu) gradually diffused with the added random Gaussian noise over T time steps. More specifically, this procedure generates sequence of random variables X1, X2, XT in Markov chain x, = /1 3xx-11 + 3iE and ((x+ := N(xx /1 - 1, 3,1), where Bg is the pre-defined variance schedule and I). For simplicity, by defining on = 1 B, and a. = -I' as, the diffusion process can be formulated as (xxx|x0) Nxx:: vā.xo, (1 - I) Then in the generative process, a parameterized Markov chain is trained aiming to reverse the diffusion process and recover the image from the noise. To be specific, it learns model parameters 0 such that the reverse transition pe (xx--IXx),, which is defined as (x N ((x Pa (x,, xu), B,I, where (xi, xo) = voa ((Vaix + - -.)c)) - vI-ai c). To that end, DDPM aims to align the mean between p (xx) and
t), Eg (xx,, t)), is equivalent to the forward transition q(x;-1 1 | Xo)
via minimizing the following training objective:
E Ex |||
+ vI- o,e, 1)
where is uniformly sampled from {1..... ,T). Here, eg represents parameterized denoiser to predict noise from Xt, which is usually implemented based on U-Net Ronneberger et al. (0155)
3.2 Backdoor Attack on Diffusion Model
Threat Model. Following the settings in Chen et al. (2023); Chou et al. (023)), which assumes that the attacker can control the training process of backdoored diffusion model, which will 1) generate the clean
3

---

Published in Transactions on Machine Learning Research (06/2025)
image from the distribution ((xo) with benign Gaussian noise input I); and 2) generate the target image from the distribution Xn ~ 7(8o) with the presence of poisoned noise input Xr that is embedded with a pre-defined trigger 8. Without loss of generality, we assumee the trigger is proportionally blended to the clean Gaussian noise with propositional factor Y E [0, 1]. More specifically, X ~ (((,,,22) where ~
Ma = (1 7) satislying Xy = (1 - 7)8 + - (O, While this threat model might currently seem impractical, this series of works provides a valuable exploration for investigating the foundational property of backdoor attacks on the diffusion model. Following these works, we adopt this threat model in this paper.
Backdoored Diffusion and Generative Processes. To realize the attack goal, assume that the adversary is allowed to modify the diffusion and generative processes and the training procedure. More specifically, as indicated in Chen et al. (2023), the attacker first diffuses the distribution ((Xo) of the target images to (N 7"),, forming a backdoored diffusion process as 0(x;-1 1 x.) = N
(x 8o), B.), where (x)
Vas ((VTTOO + VT JH + (
Then in the generative process, the parameterized model is learned to reverse both the benign and backdoored diffusion processes: P [x,) ((x,-122(,X0) xo) (for benign Gaussian input case described in Sec. po po(8.-1 (x,) = (8 (X,, f), (). = /(x,-1 Xo) (for poisoned noise input case). To that
VI-ai f)
3.1 and
end, the corresponding training objectives aim to simultaneously optimize both the benign and backdoor
diffusion processes. Specifically, the benign training objective follows Sec. [ and the backdoored diffusion training objective is formulated as:
E Rr.8o.olllc-- co(Va, col + v1 -a + v1 -1-1a-a v1-
(2)
where Nn (8x)). Here t, e, Eo are with the same setting in Eq.
4 Trigger Detection in Backdoored Diffusion
Sec. 3.2 shows the feasibility of the backdoor attack on diffusion models via properly diffusing the target distribution and learning to reverse the backdoor generative process. Following this philosophy, some recent works Chen et al. (2023); Chou et al.] (2023) have successfully launched the altack and demonstrated the vulnerability of the backdoored diffusion models with the presence of trigger patterns. However, we argue that the detectability, as an important attack performance metric, is not fully considered in the existing studies. More specifically, the embedded trigger patterns used in the satte-of-the-are diffusion model backdoor attacks can be effectively detected.
Our key finding is that the poisoned noise containing the backdoor trigger can be distinguished from the clean Gaussian noise from the lens of data distribution.
As illustrated in Fig. 2. the distributions of two Gaussian noise inputs are highly overlapped; whilc an obvious distribution shift can be identified when comparing the poisoned noise and the benign Gaussian noise (see Fig. 2 Such phenomenon implies that the distribution discrepancy between the input and Gaussian noise ((OO.T) I) serve as good marker to detect whether the input is potentially stamped with the backdoor trigger or not. To quantitatively measure this discrepancy, we propose to define a KL dliergence-bbsset
KULLBACK 1959 Poisoned Distribution Discrepancy (PDD) score as follows:
D($r) KL (L())))))) Pr(xT)):
(3)
where Xy and रy are the clean Gaussian input and the potentially poisoned input, respectively. h(()) denotes the histogram function, Pa(.) normalizes the histogram into a probability distribution, and KL(,,)) calculates KL divergence.
In general, for cach potentially poisoned input, we can calculate its PDD score to evaluate its distribution shift from the benign Gaussian noise input. Notice that since even two clean Gaussian noises sampled from the same distribution still have a certain level of distribution discrepancy, such inevitable "base difference" incurred by the sampling randomness should be considcred, and hence it can be empirically calculated as follows:
Basc Exp (D(x)) ) + 30 D(x)))
(4)
4

---

Published in Transactions on Machine Learning Research (06/2025)
Gaussian
Input
Imput
Histogram
Benign Input
Pass
Beriin
Process
Backdoored Diftuslon
Fual
Polsoned Ingut
PSD score
Fail
Histogram
(a) 0.029.
(b) 0.032.
(c) 0.031.
Detertion
Allack
Pelscred Inset
PDD score Ousss
Histogram
Detection-Evading
Triggar
Distribution Detection
Target Images
Figure 1: The mechanism of our proposed distri- bution detection. After calculating the "anchor'
(d) 0.182.
(e) 0.174.
(f) 0.167.
distribution, it can correctly recognize the benign input while effectively identifying the poisoned input designed in the existing backdoored diffu- sion works, making the attack fail. On the other hand, our proposed deteectionevaading trigger has a thloshh PDD score, evading the detec- inpul.
Figure 2: Distribution overlap between Gaussian noise and input noise. (Top): Clean noise input (also Gaussian). (Bottom): Poisoned noise input containing Hello Kitty trigger in Chen et al. (2023). It is seen that poisoned noise in the prior work exhibits non-negligible distribu- tion shift, bringing much higher PDD score than benign
tion of the distribution detector.
where x.......... Xxi are the collection of clean inputs sampled from Gaussian distribution I),, Also, considering the potential impact of statistical error false positive rate, the calculation of base discrepancy includes an extra tolerance term (empirically set as D(xr), more discussion to Xo is in Sec. 7 ensuring that most (> 99.8%) clean Gaussian noise inputs can be correctly recognized. Then, we can use this base discrepancy as the threshold to detect the backdoor trigger as follows:
PDD-based Trigger Detection. Given an input noise Xy, it will be detected as poisoned with backdoor trigger D(xT)= 2 @Base olherwise is marked as clean.
Fig. illustrates the overall mechanism of the proposed distribution-based trigger detection approach. By preparing a set of clean Gaussian noise to compute the 'anchor' distribution Pa(xr) and base discrepancy Base as the threshold, the detector can identify the poisoned noise input. As reported in our empirical evaluations (sce Tab. D examining distribution shift shows very strong performance for detecting backdoor triggers. Our detection scheme only requires a one-time KL-divergence calculation between anchor and input distribution. For detecting single imput of the backdoored CIFAR-10 diffusion model, our method only needs 0.0014s, demonstrating its low-cost property.
5 Detection-Evading Backdoor Trigger Design
Sec. analyzes the unique characteristics of the backdoor triggers for the diffusion models, and then develops the corresponding detection method. To deepen our understanding, in this section we further study the vulnerability of backdoored diffusion models from the perspective of attackers, exploring stealthy trigger design to evade the distribation-based detection mechanism.
5.1 Mitigate Distribution Discrepancy
As analyzed in Sec. 4 embedding the trigger to the benign Gaussian noise brings the detectable distribution shift. Therefore, order to make the backdoor trigger undetectable, the PDD score of the poisoned noise o should be optimized and suppressed below the base discrepancy OBsee as follows:
N 1(D())) S Base))
max
(5)
N
5

---

Published in Transactions on Machine Learning Research (06/2025)
MSE Target Image
Learnable
Poisoned Noise
LODDD
+
N
Trieser
N
Polsoned Input
NC
Differentiable Histogram
Polsoned Distribution
D
Anchor Distribution
Histogram
Gaussian
Detection- Evading Trigger
Poisoned Training
Target Image
t- [-U((L,
Predicted
Noise
Eo
Sigmeed
1.00)
Stgmoid
Benign Training
Learnable
[M 0-
Bins
Clean Input
NV
Fixed
0.0
0.50.6
10
1.5
Bins
DIffusion
MSEClean Training Data
Model
Phase Detection-Evading Backdoor Trigger Training
Phase Backdoored Diffusion Model Training
Figure 3: Our proposed two-step training scheme learn the ceaectiiooevvdiing trigger and the corresponding backdoored dilfusion model. Phase 1 (Left): Trigger is optimized by PDD loss LaPDD and NC loss LNG with the fixed diffusion model. To incorporate an end-to-end training procedure, we utilize the differentiable histogram ha(-) for calculating LAPDD- Phase 2 (Right): After optimizing the trigger, the diffusion model is updated towards the backdoored training objective with this detection-evading trigger.
where 1(.) is the indicator function, and X is one sample of poisoned noise input. Notice that here in order mitigate the sampling error, the optimization of the backdoor trigger ö is basod on the evaluation of embedding d to N benign Gaussian noise inputs x Then, the trigger can be learned via minimizing the following PDD loss:
LPDD(0) Ex, [max(((xT)) ΦTH, 0)],
(6)
where Φтh is a pre-set threshold even smaller than @Bse. ensuring that after the training, the optimized PDD score can be optimized as being below Øase in very probable way.
Make Trigger Learning Differentiable. In general, optimizing the PDD loss can be realized by using pradient-based method such as stochastic gradient descent (SGD). However, described in Eq. 3 the caleulation of PDD score D(xr) is involved with the non-differentiable histogram function h(-), preventing the differentiable learning of stealthy trigger. To address this problem, propose to approximate the original histogram function to disferentiable format ha(+). Here, the key idea is to use the dual logistic functions as closed surrogate for the histogram function (see Fig. 3h. More specifically, the differentiable histogram is calculated as:
ha ha(x, Bi) = [(1
((1 +e w(x - -(x--x+))))+---- ())))=(x-))))) -1 a -(x
where controls the smoot of the histogram, B, denotes the i-th bin in the histogram, and and represent the center and width of each bin, respectively. Then, the differentiable version of PDD score D&(-) and loss used can be calculated as:
Da(8r) = KL(Pha(Er) ))) LappD( = Ex,
OTh, 0)].
(8)
Two-Step Learning Procedure. With the availability of differentiable PDD loss, the backdoored diffusion model and the corresponding detoction-evading can be lcarned in an end-to-end manner. As shown in Fig. we first fix the to-be- backooodd diffusson model and optimize the trigger by using PDD loss and NC loss (described Sec. 5.2 After obtaining the stealthy trigger exhibiting low distribution discrepancy, we then fix this trigger and use it generate poisoned input noise, facilitating the poison training for the backdoored diffusion model.
5.2 Noise Consistency Optimization
As shown in Fig. 3 in the trigger training phase, the noise consistency loss (Cxc), which measures the discrepancy between the benign Gaussian noise input and the predicted noise ea, also used to guide the

---

Published in Transactions on Machine Learning Research (06/2025)
optimization of backdoor trigger 8. More specifically, the NC loss is defined and calculated follows:
(xc(6,X0) ee.x,ellle ce(va + vI- a:ps vi-a
(9)
where Xn,4, e, 6p are with the same setting in Eq. Here, the use of NC loss is motivated by the following design philosophy: Because the backdoored model training process (Phase 2) will use the exactly same discrepancy to update the learnable model (see Fig. 3 pre-optimize this loss in the (rigger learning phase can provide better initialization and hence potentially improve both benign and attack performance. To be specific, the NC loss the trigger training stage ensures that the trigger adapts well to the near-pretrained diffusion model. To maintain strong benign performance in the diffusion model, the training principle is to minimize weight updates relative to the pre-trained model. This regularized trigger effectively activates the backdoor in models that remain closely aligned with the pre-trained diffusion model. Without NC loss, the trigger lacks regularization and docs not consider benign performance. The diffusion model would require significant. modifications to achieve the attack objective, ultimately compromising its benign performance. With lower discrepancy between and Eg for the poisoned training part, slight update from the original benign model may be already sufficient for fitting poisoned data samples, and hence the updated model, which is backdoored but closed the original benign one, can probably perform well with the presence of benign imputs. Meanwhile, with the lower NC loss as the initialization, it is more likely to bring the poisoned training Fig, 3 to better-optimized point after the same number of epochs, thereby improving the attack performance with the poisoned noise inputs. Notice that such hypothesis has been verified in our empirical evaluations reported in Sec. 7 Algorithm describes the overall 2-step training procedure, including using NC loss.
Algorithm The Proposed 2-Step Training Scheme
Input: Clean dataset q(xo), backdoor target dataset ((Xa). pre-trained benign diffusion model 6, scaling factor propositional factor 7, threshold 6тb, trigger learning rate ne, model learning rate nd-
Output: Detection-evading trigger 6, backdoored diffusion model Oba-
1: Phase 1: Detection- Evading Backdoor Trigger Training
2: + randon(6 shape)
3: repeat
4: 8o ~ ((8o), t ~ Uniform((1,.. ...
5: šr NHus)
b Sample poisoned input noises
6: LaPDD(d) = Ez, [max( - ΦTh. 0j] via Eq.
7: CN xa) = (solt,elle - e (S.. e, via Eq.
8: [o) = xo)) (6)
Overall trigger loss Updating trigger 5
9: 8 5 N. L(8:Xu) x0)
10: until converged
11: Phose 2: Backdoored Diffusion Model Training
12: Ona +-0
Loading pre-trained beniga diffusion model
13: repeat
14: Xo q(xo), Uniform((1) (1, T)), ()
e Ko), i Uniform((1, T)), N
(.(lu)) Exo.t.elee 69pa (xo: ell via Fq.
Benign Poison Backdoorel model loss b Updating diffusion model
Cp(0ma) = R.p. <dna (8o. 8]]] Eq.
C(Ona) Le(hna) + (0mm)))
19:
Obd +- Bod nd C(foa)
20:
until converged
6 Experiments
Datasets, Models and Attack Setting. We evaluate the performance of the proposed detection method and the detection-evading trigger for DDPM Ho et al. (2020) and DDIM Song et al. (2020a) diffusion models on CIFAR-10 (32 x 32) Krizhevsky et al. (2009) and CelebA (64 x 64) Liu et al. (2115) datasets. The pre-trained models of CIFAR-10 and CelebA datasets are from repository besserpytorch/difee /idffsiifooo and ermongroup/ddim. Two types of backdoor attack models are considered in the experiments: generate an image belonging to a specific class (referred to as "category mode") and generate a specific image (referred to as 'instance mode"). Following the settings in Chen et al. (2023). we choose the horse the CIFAR-10 dataset and faces with heavy makeup, mouth slightly open and smiling in the CelebA dataset the target
7

---

Published in Transactions on Machine Learning Research (06/2025)
Benign
Attnkk Mode "Category"
Attack Mede "Ineinoee"
Table 1:
The effectiveness of the proposed distribution-based de-
tection method for detecting the backdoor trigger used in Chen et al. (2023). The PDD score Da(XT) Basc 0.067 (for CIFAR-10 dataset) and Da(Er)= > Base 0.016 (for CelebA dataset), making the detection rate reach to 100% and ASR drop to 0%, and Benign Pass Rate can reach 99.9%, in- dicating that benign generation is virtually unaffected.
CHEAR-a0 (sprge)
Dalbh ((pp044
Attack Mode
Average
Benign
Detection Rate (%)
ASR (%)
DDPM
ASR (75
ASR (%) ASR (%)
DDIM
Figure 4: Generated images from our backdoored diffusion model. For CIFAR-10, the tar- get class is "horse"; for CelebA, the target class includes faces characterized by "heavy makcup, smiling, and a slightly open mouth'. The target image is a 'Michy Mouse'.
PDD
Pass Rate
Score
(%)
w/o
w/
w/o
w/
Detection Detection Detection Detection
CIFAR-10
Category 0.183
99.9
100.0
90.1
0.0
87.30
0.0
Instance 0.183
99.9
100.0
100.0
0.0
100.0
0.0
CelebA
Category 0.165
99.9
100.0
96.9
0.0
95.4
0.0
Instance 0,165
99.9
100.0
100.0
0.0
100.0
0.0
Table 2: Performance of the proposed backdoored diffiusion model using the detection-evading learnable trigger. The lower FID and higher ASR indicate better benign and attack performance, respectively, For 'Instance" mode, MSE between the generated and target images is also reported to show the high attack performance. '*" denotes we reproduce the experiments using "Glasses' Chou et al. 2023 as the trigger and "Micky Mouse' as the target image.
DDPM
DDIM
Allack Mode
Trigger Type
PDD Score
Detection Paes Rate (%)
Benign
Atlack ASR (5) w/
Benign
Attack ASR (%) w/ Detection
Method
FID
A
FID
A FID
Detection
CIFAR-10
Noae
Denign Baselise
None
0.001
99.8
4.60
0
4.25
Calegory
Trojeill Chen ot al
(
2023
Learnable
Fixed
0.025+0.007
0.183:0.012
99.9
0.0
4.44
4.74
-0.16
0.14
82.0
0.0
4.29
4.47
0.04
0.22
80.1
0.0
Trojáiff Chen
2023
Fixed
0.18340.012
4.59
-0.01
0.0
4.47
0.22
0.0
Instance
Buddiffusion Cloni
Fixed
0.26910.015
0.0
4.52
-0.06
0.0
4.45
0.18
0.0
(iuret(Ours)
Learnable
0.025+0.007
99.9
4.39
-0.21
(MSE: 7.64e-6)
99.9
4.38
0.18
(MSK: 4.19e-5)
99.9
Colebut
Nooe
Beiggn Baseline
None
0.007:00.08
99.8
5.88
0
6:29
Trojdiff Chen et al.
2023
Fixed
0.16
0.0
5.44
-0.44
0.0
5.40
-0.80
0.0
Categray
(Dure
Learnable 0.007#0.003
99.8
6.83
-0.05
85.9
5.94
-0.35
85.2
Trojditt Chen et al Buddiffuson [Chou
2023
Fived
0.16510.006
0.0
5.62
-0.66
0.0
5.93
-0.36
0.0
Fixed
0,20000.07
5.73
40.15
0.0
3.98
0.0
Instance
(Ours((Uur))
Learnable
0.007+n.003
99.8
5,80
-0.08
(MSE) 1.52e-3)
99.8
5.85
-0.44
(MSE: 1.70c-3)
99.8
class in the category mode. The Micky Mouse is selected as the target image when the backdoor attack is launched in the instance mode. The 'Hello Kitty" and "Glass" images are set as fixed triggers in experiments of Difj Chen et al. (2023 and Baddiffusion Chou et al. (2023), respectively.
Training Configurations. When training the detecctio-evading trigger (Phase 1), an Embedding layer with the same shape of input noise (3 x 32 32 for CIFAR-10 dataset, and x 64 64 for CelebA dataset) is used for trigger learning with 7 0.6. The threshold is set ΦTΛ 0.01 and ΦTR 0.005 for the CIFAR- 10 and CelebA datasets, respectively. The training process adopts Adam optimizer Kingma & Ba (0155) with 50k training steps, 2 x 10-3 lcarning rate and scaling factor 7 as 10 After that, during the training procedure for the backdoored diffusion model (Phase 2), we follow the standard training procedure using Adam optimizer, 2 x 10 learning rate, batch size as 256, and 100k training steps. Also, the number of bins is set as 50 for both regular histogram h(-)) and differentiable histogram ha(-). The smoothness parameter is set as w = 6 for the Sigmoid function in ha(:) to approximate the step function and histogram h(-). All the experiments are conducted on NVIDIA RTX A6000 GPUs.
8

---

Published in Transactions on Machine Learning Research (06/2025)
Evaluation Metrics. The benign performance is evaluated on 50K samples via measuring Frechet Inception Distance (FID) Heusel et al. 2017)) which reveals the similarity between two sets of images. A lower FID score indicates the higher quality of the generated images. The attack performance is evaluated on 10K samples in terms of Attack Success Rate (ASR). When the attack mode is set as 'category' and 'instance', ASR is measured as the ratio of the generated images being classified into the target class and being the same as the target image, respoctively. Specifically, when the attack is launched in the 'instance' mode, we also measure the Mean Square Error (MSE) to examine the difference between the target image and the generated images. For the image sampling, we follow the standard strategy by setting 17 1 and S 1000 and 17 = 0 and S = 100 in DDPM [Song et al. 2020a) and DDIM Ho et al. (2020), respectively.
6.1 Evaluation Results
CIFAR-10 Datasct. Tab. 2 shows the benign and attack performance on the CIFAR-10 dataset. When the backdoor attack is launched in the 'category' mode, the average PDD score of the poisoned noise generated from the trigger designed in Chen et al. (2023) is 0.183. This score is significantly higher than the base discrepancy ØBse = 0.067, making the attack can be easily detected with ASR as O. In contrast, our detectton-evading trigger is learned to exhibit a very low PDD score of 0.025, making the attack very undetectable (nearly 100% detection pass rate) with high ASR (more than 80%). Meanwhile, enjoys good benign performance with even lower FID than the baseline (originally non- non-backdoored case). In other words, with the presence of benign input, the images generated by our backdoored model have even higher quality than the ones generated by the diffusion model without backdoor injection. Similarly, in the backdoor attack mode 'instance", our approach also shows much better benign and attack performance than the prior works. In particular, the MSE between the generated images and the original target image (Mickey Mouse) is very small (7. (7.64e-6 and 4.19c-5 for DDPM and DDIM, respectively), indicating the effectiveness of the attack.
CelebA Dataset. As shown Tab. 2 our optimized trigger is effectively stealthy to the distribution detector and achieves higher attack performance than the prior works. More specifically, with @Bss as 0.016, the average PDD score of the poisoned noise in Chen et. al. (2023) ('calegory" atlack mode) is 0.165, bringing an ASR of 0 since all the triggers will be detected. On the other hand, the average PDD score of our detection-cvading trigger is only 0.007, and hence it is very undetectable to the distribution detector, bringing high ASR (more than 85%). Meanwhile, the benign performance of our solution is good with even lower FID than the baseline design. Similarly, in the 'instance' attack mode, our method enjoys a low average PDD score of 0.007 and also FID reduction as compared to the baseline case, demonstrating high attack and benign performance.
Detection Results. We have shown the detection results of "Baddiffusion" in the column "Detection Pass Rate" in Tab. 2 Similar to Trojdiff, our detection method can achieve 100% detection rate for "Baddiffusion" attacks.
Visualization. Fig. 4 iillustrates some of the generated images from our backdoored diffusion model with benign and poisoned noise inputs. It is seen that our approach is very effective in both benign and attack scenarios.
7 Ablation Studies
Effect of PDD Optimization. Fig. shows the curve of differentiable PDD score Dz(āy) during the trigger training procodure. It is scen that it stcadily decreases as training progresses, and finally this loss reaches below Φтх, indicating that the proposed differentiable histogram ha(-) is an effective approximation to h(-) when considering the gradient- based optimization. Also, Fig. Gillustrates the distribution discrepancy incurred by fixed trigger used in Chen et al. (2023) and learnable trigger after PDD optimization. It is seen that the proposed PDD-oriented trigger learning brings much lower PDD score, siguificantly improving the stealthiness of the backdoor trigger.
We also observe the variation of the absolute mean of the trigger values when optimizing the PDD scores, as illustrated in Fig. 7 Although the mean of trigger values remains around zero, there is a significant variation in absolute mean values. As the training process progresses, the absolute mean increases while the
9

---

Published in Transactions on Machine Learning Research (06/2025)
0.05
0.05
Caummin Irpat
Cacarin rast
dPOD Store
0.04
80
sPOD score Intu dPCO scors
dP3D
0.08
0.00
Threshold
Threshod
0.02
0.02
0.01
0.00
10
15
20
25
30
0.00
10
15
25
30
(a) PDD score: 0.179.
(b) PDD score: 0.023.
Steps
Stops [K]
(a) Attack mode:
'Cate- (b) Attack
mode:
IIn- Figure Distribution of the poisoned inputs with (a) the fixed trigger Chen et al. (2023) and (b) our proposed learnable trigger on CIFAR-10 dataset. PDD-oriented optimization brings much lower PDD score, making our poisoned inputs approach clean Gaussian noise.
gory".
stance'.
Figure 5: Curve of differentiable PDD score Da(xT) when the trigger is trained with the PDD loss LAPDD on the CIFAR-10 dataset. Da(XT) steadily decreases
and reaches below threshold.
Table 3: FID results of backdoored diffusion model with the trigger optimized with or without NC op- timization. The results are evaluated with different sampling steps on CIFAR-10 dataset.
3.86
0.00
0.35
0.90
0.90
Abso ute Mean Trigger
0.45
Absolute Mean of Trigger
5301
1900
19933 zere a0re 1930)
4E0 1350 11491 2730 aste 30303 Steps
Stops
(a) Mode: 'Category'.
(b) Mode: 'Instance'.
Sampling Steps, n 0
Init Loss
50
200
The curve of absolute mean of trigger values during the PDD-oriented training process.
Figure 7:
w/o NC
205.1
5.07
4.51
4.50
w/ NC
74.3
4.99
4.38
4.17
A
130.8
0.08
0.13
0.33
PDD score decreases. This phenomenon leads us to hypothesize that the change in the absolute mean value of the trigger may be related to the process of approaching Gaussian distribution. The modified values seem to mimic the distribution of Gaussian noise. As the PDD scores reach a plateau, the mean absolute value also becomes stable, no longer experiencing significant fluctuations.
Additionally, Wang et al. (0024) demonstrates that a larger magnitude enhances performance on both clean and backdoored data. Consistent with this finding, the magnitude of our trigger increases during PDD- oriented training, further supporting this observation and potentially offering new insights.
Effect of NC Optimization. As analyzed in Sec. 5.2 NC loss measures the discrepancy between the added Gaussian noise and the predicted noise at one step. Fig. g shows the curve of NC loss as training progresses. is seen that compared with only emphasizing optimization of PDD, training towards both optimizing both PDD and NC brings a very significant. NC loss drop, indicating the strong noise prediction capability and generation of higher-quality images. As shown in Tab. 3 using NC optimization leads lower FID scores across different sampling steps. Fig. visualizes the benign and attack performance improvement after considering NC optimization in trigger learning.
Effect of Various Smoothness Factors. To explore the effect of the smoothness factor w of the differential histogram function ha(-), we conduct several PDD optimization experiments using various w. Fig. 10 shows the curve of the PDD score Dxxr) and differentiable PDD score Da(xy) during the trigger PDD optimization procedure.
When is too small, such as becomes less accurate. This inaccuracy results in very small differential PDD score, even at the initialization step. Then, it leads to a larger gap between the regular PDD score D(xr) and differentiable PDD score Da(X)). This larger gap is undesirable for optimizing the desired distribution pass rate and ASR. When w is too large (e.g., w = 8), the differential histogram function exhibits non-smooth characteristics. This can be seen in Fig. 1od, where after 2.5K steps, the PDD scores become undefined (denoted as "NaN'). This phenomenon is directly attributed to the mon-smooth nature of the differential histogram function with larger values. Consequently, larger not only hinders but also halts the optimization process of the
in Fig. 10a the approximation of differentiable PDD score (x
10

---

Published in Transactions on Machine Learning Research (06/2025)
200
PEDInn Satruadion
PEEE-A Quirtaatio
15
25
55
(a) Attack mode: (b) Attack mode: 'Category'.
"Instance'.
Figure 8: Effect of NC optimization. (a) w/ PDD, w/o (b) w/ PDD, w/ (c) w/ PDD, w/o (d) w/ PDD, w/ NC.
NC.
NC.
NC.
LNC in the y-axis denotes the de- viation between the predicted and Figure 9: Visualization of generated CIFAR-10 images with or without added noises of the diffusion model NC optimization. Figures (a) and (b) display generated clean images on CIFAR-10 dataset. Optimizing with benign input (i.e., bird, ship, airplane, dog, horse, automobile, the trigger å with NC loss facili- deer, frog). Figures (c) and (d) show generated images of the target class tates the model more easily predict- ("horse") with poisoned inputs. Figures (b) and (d) represent the images ing the noise in the poisoned input generated from poisoned inputs with the NC-optimized trigger. NC noise ËT. LN in attack mode "in- optimization is observed to enhance the image quality in both benign stance' is stable since the target im- and attack scenarios.
age is fixed, causing less variance.
0.10
PDD soore
0.10
PDD score
0.10
PDD score
0.08
dPDD score
F0D Scores
0.08
dPDD scom
0.08
dPDD score
Scoress
dPDD score
Nan
0.00
0.05
0.06
23
0.04
0.02
0.02
0.00
0.00
250 500 793 1001000125 250100755
030
1000
2000 Steps
1500
2500
203
301
750
900 The 1936 1700 2000
150 1006 1933 3000 2000 3007 2000
Steps
Sleps
Steps
(a) w =
(b) w 4.
w 6.
(d) w = 8.
Figure 10: Curve of PDD score ((xT) and differentiable PDD score Da(XT) when the trigger is trained with the PDD loss LarDD. Effect of w, the smoothness factor of the differential histogram function.
desired PDD score. In our experiments, we choose w = to strike a balance between minimizing the gaps in PDD score and maintaining the feasibility of optimization.
Effect of Various Xo. We follow the 3-sigma rule in Gaussian distribution to set 30 in our main experiments because provides way to manage the spread of data within a predictable range. Gaussian distribution, about 99.7% of the data points lie within three standard deviations (3-sigma) from the mean avoid hurting the pass rate of the benign input. Specifically, if the defender applies stricter criterion, such as 10, the detection system would significantly decrease the pass rate of benign inputs from 99.8% to 84%, thereby increasing the 20% number of generation attempts (number of trials). Therefore, to improve the user experience, we use 3a as default setting. Additionally, we conduct the experiment on the CIFAR-10 dataset and present the effect of various Xa in Tab. 4 Our DisDet can achieve 97.5% ASR with the attack mode "Instance".
Defend the patched-based trigger. We conduct additional experiments incorporating a patch-based trigger to further validate the universality of our method. Based on the CIFAR-10 dataset, use the detection method outlined in Sec. 4 to detect the patch trigger from Trojdiff. The results show that our PDD-based defense can achieve a 90.4% detection rate for the path-based trigger, resulting in a low ASR of 9.6%. This indicates that our detection method is effective for both the blend and patch-based trigger.
Sampling Steps and Training Epochs. To investigate how training and sampling steps affect the performance of stcalthy backdoor diffusion model, we conduct training on CIFAR-10 and CelebA datasets using the 'instance" attack mode. The models trained with varying training steps (50k, 75k, 100k) and
11

---

Published in Transactions on Machine Learning Research (06/2025)
Table 4: Effect of various Xo. Performance of the proposed backdoored diffusion model using the detection- evading learnable trigger under lo. The lower FID and higher ASR indicate better benign and attack performance, respectively. For 'Instance' mode, MSE between the generated and target images is also reported to show the high attack performance. '*' denotes reproduce the experiments using "Glasses" Chou et al. 2023) as the trigger and "Micky Mouse' as the target image.
DDPM
DDIM
Attack Mode
Method
Trigger Type
PDD Score
Detection
Pass Rate (%)
Benign
ASR (%)
Attack
Benign
Attack ASII (%6 w/ Detection
FID
FID
FID
Detection
FID
CIFAR-10
Nome
Benigu Baseline
Nove
0.001200012
84.0
4.00
0
4.25
0
Canegory
(isret(Ours)
Learniile
0.025:40.007
97.5
4.44
-0.16
4.29
78.1
Instance
(isDer(Ourrs)
Learmible
0.025+00.007
97.5
4.39
-0.21
(MSE: 7.646-6)
97.5
4.38
0.13
(MSE: 4.196.5)
97.5
sampling steps (10, 20, 50, 100, 200). According to the results presented in Tab. an increase in training epochs generally maintains or slightly decreases the FID while simultaneously enhancing attack performance. Regarding sampling steps, we observe that larger number of sampling steps leads to improved performance in both benign and attack scenarios. This aligns with the property of a standard diffusion model, where increasing sampling steps tend to yield better overall performance.
Table 5: Results of different sampling steps various training epochs on CIFAR-10 and CelebA datasets with attack mode 'instance". For the benign performance, FID reflects the quality of benign images. For the attack performance, the ASR equals that of the main results, and MSE is measured to reflect the subtle change exactly according to different sampling steps and training epochs.
Training Epochs
Sampling Steps
Metric
10
20
50
100
200
CIFAR-10
FID
14.74
7.42
5.00
4.39
4.17
50k
MSE
1.53e-4
1.03e-4
8.37e-5
8,10e-5
7.34e-5
FID
14.37
7.33
4.98
4.34
4.17
75k
MSE
L.7e-4
7.12e-3
5.69e-5
5.52e-5
5.02e-5
FID
14.51
7.38
4.99
4.38
4.17
100k
MSE
8.20e-5
5.43e-5
4.32e-5
4.19e-5
3.80e-5
ColobA
FID
2.85e-3
2.02e-3
1.71e-3
1.70e-3
1.39e-3
50k
MSE
13.31
8.23
6.35
5.85
5.76
FID
1.43e-3
1.04e-3
9.01e-4
8,98e-4
8,35e-1
75k
MSE
13.24
8.17
6.28
5.84
5.71
FID
1.08-33
7.98e-4
7.01e-4
6.99e-4
6.69e-1
100k
MSE
13.25
8.14
6.23
5.82
5.72
Other Techniques for Removing Backdoored Triggers. Several other techniques aim to remove backdoor triggers rather than detect them, including Gaussian smoothing, denoising, filtering, purifica- tion, and reconstruction methods. Although these methods can defend against backdoor attacks, they negatively impact the quality of benign generation. We conduct the experiments with the attack mode 'Instance" on CIFAR-10 with Gaussian smoothing (kernel size is 5) and Median Filter (window size is 5). As shown in Table 6 our detection method can keep better FID of generative benign images. Take the Gaussian smooth- ing as example, suppose given Gaussian noise {X,) where cach X; ~ NO0, and all X; are independent. De- fine the Gaussian-smoothher output as Y, = E, K(i - j) Xj.: where K(-) a discrete Gaussian kernel. Each Y; is a lin- car combination of i.i.d. Gaussians, so Y, ~ NO, oR)), with of = =, K(i (((i-j) ? assuming a normalized kernel over ap- propriate indices. For * m,Covv (V,, Vm) Σ3 Σx K(i
Table 6: Results of different trigger remov- ing techniques.
Methods Trojdiff
ASR
Renign FID
100%
4.59
Ganssian Smoothing
5%
30.86
Median Filter
6%
37.15
Ours
0%
4.63
12

---

Published in Transactions on Machine Learning Research (06/2025)
1) (m k) Xo) ))) Km - -), since Cov(X,, X&) = 0 for j * k and = for k. Hence Y, and Yn become correlated when their kernels overlap. As a result, the benign Gaussian noise is transformed into non-standard Gaussian noise, which degrades the quality of the generated images.
Discussion of the trade-off between attack capability and stealthiness against our proposed detection method. There exists a trade-off in previous methods, such Trojdiff CCen al. (2023) which decrease the magnitude of the backdoor trigger to bypass the proposed defense mechanism. As the magnitude of the trigger in TrojDiff decreases, it becomes easier to evade distribution-based detection. As a result, this also leads to a lower ASR, high- lighting a trade-off between ASR and detection rate. Here we conduct the experiments and present some results in Table 7 In the experiments, we ap- plied the PDD threshold as [[D] and adjusted the default magnitude in TrojDiff. Our results illus- trate the trade-offs associated with different TrojD- iff magnitude settings. Note that higher magni- tude factor corresponds to a smaller trigger magni- tude. Furthermore, we also evaluate our proposed attack method with the same setting and same PDD threshold. The results demonstrate that our pro- posed attack consistently achieves higher ASR.
Table Trade-off between attack capability and stcalthiness of Trojdiff Chen et al. (2023) against our proposed detection method. Note that a higher mag- nitude factor corresponds to smaller trigger magni- tude.
Magnitude Factor
Pass Rate
ASR
Trojdiff-0.95
76.6%
36.5%
Trojdiff-0.90
59.3%
18.6%
Trojdiff-O.88
1.5%
3.7%
Trojdiff-O.8l
0%
0%
Ours Attack 80.0%
64.0%
8 Conclusion
In this paper, we perform studies on the detectability of the Trojan noise input for the backdoored diffusson model, from both defender and attacker sides. First, we propose the distribution discrepancy- based trigger detection mechanism for detecting the backdoor attack. Second, unnoticeably attack the diffuuson model. Evaluation results on CIFAR-10 and CelebA datasets show nearly 100% detection rate to the previous backdoor attack on diffusion models, and 100% detection pass rate with very high atlack and benign performance of our proposed atlack method. Our attack method shows a vulnerability of the PDD score- score-based based defense, and future approaches should consider an alternate framework instead. Note that although we provide the conventional filtering techniques to remove backdoored triggers in ablation studies, more complicated denoising or filtering methods might also achieve the same effect, such as incorporating statistical regularization during the training of the denoiser to maintain Gaussian characteristics, utilizing probabilistic denoising methods. Therefore, more advanced filtering techniques remain underexplored, and these more complex methods could be conducted as separate rescarch work in the future.
design detection-evading trigger to
9 Broader Impact
By exploring the detectability of poisoned noise input in backdoored diffusion models, this paper contributes significantly to improving the security of generative Al models. The proposed trigger detection mechanism can potentially safeguard these systems against backdoor attacks, ensuring that content gencration tools remain trustworthy and reliable. The proposed backdoor attack strategy that learns to evade detection could pave the way for future research aimed exploring and enhancing the robustness of generative AT models.
Acknowledgments
This work was supported in part by the National Science Foundation (NSF) under grants CCF2211163, TTS2311590 IIS2311597, CNS21 CNS2114220, CNS2145389, CNS2350188.
13

---

Published in Transactions on Machine Learning Research (06/2025)
References
Florian Bordes, Randall Balestriero, and Pascal Vincent. High fidelity visualization of what your self- supervised representation knows about. Transactions on Machine Learning Research, 2022.
Tim Brooks, Aleksander Holynski, and Alexci A Efros. Instructpix2pix: Learning to follow image editing instructions. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 18392-18402, 2023.
Chen-Hao Chao, Wei-Fang Sun, Bo-Wun Cheng, Yi-Chen Lo, Chia-Che Chang, Yu-Lun Liu, Yu-Lin Chang, Chia-Ping Chen, and Chun-Y Yi Lee. Denoising likelihood score matching for conditional score-based data generation. In International Conference on Learning Representations, 2021.
Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Mol- loy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering. In Workshop on Artificial Intelligence Safety. CEUR-WS, 2019a.
Huili Chen, Cheng Fu, Jishen Zhao, and Farinaz Koushanfar. Deepinspect: black-box trojan detection and mitigation framework for doep neural networks. In Proceedings of the 28th International Joint Conference
on Artificial Intelligence, pp. 4658 4664, 2019b.
Weixin Chen, Dawn Song, and Bo Li. Trojdiff: Trojan attacks on diffusion models with diverse targets. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pollern Recognition, pp. 4035 4044, 2023.
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint 1rX.:1112.0000 05526, 2017.
Jooyoung Choi, Sungwon Kim, Yonghyun Jeong, Youngjune Gwon, and Sungroh Yoon. Ilvr: Condition- ing method for denoising diffusion probabilistic models. In Proceedings of the IEEE/CVE International Conference on Computer Vision, pp. 14367-14376, 2021.
Sheng-Yeu Yen Chou, Pin- Yu Chen, and Tsung- Yi Ho. How to backdoor diffusion models? In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4015-4024, 2023.
Guillaume Couairon, Jakob Verbeek, Holger Schwenk, and Matthieu Cord. Diffedit: Diffusion- semantic image editing with mask guidance. In The Fleventh International Conference on Learning Representations. 2022.
Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances in neural information processing systems, 34:8780-8794, 2021.
Khoa Doan, Yingjie Lao, Weijie Zhao, and Ping Li. Lira: Learnable, imperceptible and robust backdoor attacks. In 2021 IEEE/CVF International Conference on Computer Vision (ICCV), pp. 11946-11956. IEEE, 2021.
Khoa D Doan, Yingjic Lao, Peng Yang, and Ping Li. Defending backdoor attacks on vision transformer via patch processing. In Proceedings of the AAAI Conference on Arlificial Intelligence, volume 37, pp. 205,515,22 2023.
Patrick Esser, Johnathan Chiu, Parmida Atighehchian, Jonathan Granskog, and Anastasis Germanidis. Structure and coutent-guided video synthesis with diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 7346-7356, 2023.
Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal. Strip: A defence against trojan attacks on deep neural networks. In Proceedings of the 35th Annual Computer Security Applications Conference, pp. 113-125, 2019.
Shuyang Gu, Dong Chen, Jianmin Bao, Fang Wen, Bo Zhang, Dongdong Chen, Lu Yuan, and Baining Guo. Vector quantized diffusion model for text-to-image synthesis. In Proceedings of the IEEE/CVF Conference 2022.
on Computer Vision and Pattern Recognition, pp.
14

---

Published in Transactions on Machine Learning Research (06/2025)
Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 1147230-47244 2019.
William Harvey, Saeid Naderiparizi, Vaden Masrani, Christian Weilbach, and Frank Wood. Flexible diffusion modeling of long videos. Aduances in Newral Information Processing Systems, 35:27953-27999 2022.
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by two time-scale update rule converge to local nash equilibrium. In Proceedings of the 31st International Conference on Newral Information Processing Systems, pp. 6629-6640, 2017.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabílistic models. In Proceedings of the 3/th International Conference on Neural Information Processing Systems, pp. 6840 6851, 2020.
Jonathan Ho, William Chan, Chitwan Saharia, Jay Whang, Ruiqi Gao, Alexey Gritsenko, Diederik P Kingma, Ben Poole, Mohammad Norouzi, David J Flect, al. Imagen video: High definition video generation with diffusion models. arv preprinl or wtX.x:22100023000 2022a.
Jonathan Ho, Chitwan Saharia, William Chan, David J Flect, Mohammad Norouzi, and Tim Salimans. Cascaded diffusion models for high fidelity image generation. The Journal of Machine Learning Research, 23(1):2249- 2281, 2022b.
Tero Karras, Miik Aittala, Timo Aila, and Samuli Laine. Elucidating the design space of diffusion-based generative models. Advances in Newral Information Processing Systems, 1-22565-265777 2022.
Diederík Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In International Conference on Learning Representations (ICLR), San Diega, CA, USA, 2015.
Alex Krizhevsky, Geoffrey Hinton, al. Learning multiple layers of features from tiny images. 2009.
KULLBACK. Information theory and statistics. Wiley, New York, 1959.
Nupur Kumari, Bingliang Zhang, Richard Zhang, Eli Shechtman, and Jun- Yan Zhu. Multi-concept cus- tomization of text-to-image diffusion. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pallern Recognition, pp. 1931 1931-1941, 2023.
Yiming Li, Tongqing Zhai, Baoyuan Wu, Yong Jiang, Zhifeng Li, and Shutao Xia. Rethinking the trigger of backdoor attack. arXiv preprint Xxx:22004.0469 2020.
Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample-specific triggers. In Proceedings of the IEEE/CVE international conference on computer vision, pp. 16472, 2021.
Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine-pruning: Defending against. backdooring attacks on deep neural networks. In International symposium on research in attacks, intrusions, and defenses, pp.
273-294. Springer, 2018.
Xihui Liu, Dong Huk Park, Samanch Azadi, Gong Zhang, Arman Chopikyan, Yuxiao Hu, Humphrey Shi, Anna Rohrbach, and Trevor Darrell. More control for free! image synthesis with semantic diffusson guidance. In Proceedings of the IEEE/CVE Winter Conference on Applications of Computer Vision, pp.
289-299 2023.
Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack on deep neural networks. In Computer Vision ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part X 16, pp. 182-199. Springer, 2020.
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of the IEEE international conference on compuler vision, pp. 3730 3738, 2015.
Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps. Advances in Neural Information Processing Systems, 115575557877 2022.
15

---

Published in Transactions on Machine Learning Research (06/2025)
Andreas Lugmayr, Martin Danelljan, Andres Romero, Fisher Yu, Radu Timofte, and Luc Van Gool. Repaint: Inpainting using denoising diffusion probabilistic models. In Proceedings of the IEEE/CV Conference Computer Vision and Pattern Recognition, pp. 11461 11471, 2022.
Chenlin Meng. Yutong He, Yang Song, Jiaming Song, Jiajum Wu, Jun- Zhu, and Stefano Ermon. Sdedit: Guided image synthosis and editing with stochastic differential equations. In International Conference on Learning Represenlations, 2021.
Tuan Anh Nguyen and Anh Tran. Input-aware dynamic backdoor attack. Advonces in Neural Information Processing Systems, 33:3454 3464, 2020a.
Tuan Anh Nguyen and Anh Tuan Tran. Wanet-impercoptible warping-baser backdoor attack. In Interna- tional Conference on Learning Representations, 2020b.
Huy Phan, Cong Shi, Yi Xie, Tianfang Zhang, Zhuohang Li, Tianming Zhao, Jian Liu, Yan Wang. Yingying Chen, and Bo Yuan. Ribac: Towards obust and ipeeceptible b ackdoor a uaak against ompact dnn. In European Conference Computer Vision, pp. 708 724. Springer, 2022a.
Huy Phan, Yi Xie, Jian Liu, Yingying Chen, and Bo Yuan. Invisible and efficient backdoor attacks for compressed deep neural networks. In ICASSP 2022-2022 IEFE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 96 100. IEEE, 2022b.
Huy Phan, Jinqi Xiao, Yang Sui, Tianfang Zhang, Zijie Tang, Cong Shi, Yan Wang, Yingying Chen, and Bo Yuan. Clean and compact: Efficient data-free backdoor defense with model compactness. In European Conference Computer Vision, pp. 273 293-290.22 Springer, 2024.
Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hicrarchical text-conditional image generation with clip latents. ai preprint arXiv:2204.00 061220 122):, 2022.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 10684-10695, 2022.
Olaf Ronneberger, Philipp Fischer, and Thomas Brox U-net: Convolutional networks for biomedical image segmentation. In Medical Image Computing and Computer-Assiee Assisted Intervention MICCAI 2015: 18th International Conference, Munich, Germany, October 5-9, 2015, Proceedings, Part III 18, pp. 234 241. Springer, 2015.
Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dream- booth: Fine tuning text-to-image diffusion models for subject-driven generation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 22500 22510, 2023.
Aniruddha Saha, Akshayvarun Subramanya, and Hamed Pirsiavash. Hidden trigger backdoor attacks. In Proceedings of the AAAI conference artificial intelligence, volume 34, pp. 11957-11965, 2020.
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. Photorealistic text- to-image diffusion models with deep language understanding. Advances in Neural Information Processing Systems, 35:36479-333 374994, 2022a.
Chitwan Saharia, Jonathan Ho, William Chan, Tim Salimans, David Fleet, and Mohammad Norouzi. Image super-resolution via iterative refinement. IEEE Transactions Pattern Analysis and Machine Intelligence, 45(4):4713 4726, 2022b.
Ahmed Salem, Rui Wen, Michael Backes, Shiqing Ma, and Yang Zhang. Dynamic backdoor attacks against machine learning models. In 2022 IEEE 7th European Symposium on Security and Privacy (EuroSOP), pp. 703-718. IEEE, 2022.
Tim Salimans and Jonathan Ho. Progressive distillation for fast sampling of diffusion models, In International Conference on Learning Representations, 2021.
16

---

Published in Transactions on Machine Learning Research (06/2025)
Jaskirat Singh, Stephen Gould, and Liang Zheng. High-fidelity guided image synthesis with latent diffusion models. In 2023 IFEE/CVF Conference on Computer Vision and Poltern Recognition (CVPR), pp. 5997- 6006. IEEE, 2023.
Jascha Sohl-Dickstein Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibriun thermodynamics. In International conference on machine learning, pp. 2256 2265. PMLR, 2015.
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In International Conference on Learning Representations, 2020a.
Yang Soug, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Scoro-based generative modcling through stochastic differential equations. In International Conference Learning Represeniations, 2020b.
Yang Sui, Yanyu Li, Anil Kag, Yerlan Idelbayev, Junli Cao, Ju Hu, Dhritiman Sagar, Bo Yuan, Sergey Tulyakov, and Jian Ren. Bitsfusion: 1.99 bits weight quantization of diffusion model. orXiv preprint arXiv:2406. 04333, 2024.
Brandon Tran, Jerry Li, and Aleksander Madry, Spectral signatures in backdoor attacks. Advances in neural information processing systems, 31, 2018.
Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposium on Security and Privacy (SP), pp. 707-723. IEEE, 2019.
Ganghua Wang, Xun Xian, Ashish Kundu, Jayanth Srinivasa, Xuan Bi, Mingyi Hong, and Jie Ding. Demys- tifying poisoning backdoor attacks from a statistical perspective. In The Twelfth International Conference on Learning Representations, 2024.
Yushu Wu, Zhixing Zhang, Yanyu Li, Yanwu Xu, Anil Kag, Yang Sui, Huseyin Coskun, Ke Ma, Aleksei Lebedev, Ju Hu, et al. Snapgen-v: Generating a five-second video within five seconds mobile device. arXiv preprint ar Xr:::24112. 104044 2024.
Zenghui Yuan, Pan Zhou, Kai Zou, and Yu Cheng. You are catching my attention: Are vision transformers bad learners under backdoor atlacks? In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 24605 24615, 2023.
Lymin Zhang, Anyi Rao, and Maneesh Agrawala. Adding conditional control to text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 3836 3847, 2023.
Mengxin Zheng, Qian Lou, and Lei Jiang. Trojvit: Trojan insertion in vision transformers. In Proceedings of the IEFF/CVF Conference on Compuler Vision and Pallera Recognition, pp. 4025-4034, 2023.
Appendix
A Limitations
The threat model in the previous backdoored diffusion model Chen et al. 2023 Chou et al. 2023 assumees that the attacker can control the training process and access the input Gaussian noise of the diffusion model. While these assumptions might currently seem impractical, this series of works provides a valuable exploration for investigating the foundational property of backdoor attacks on the diffusion model. Following these works, we adopt this threat model to guide our analysis. Second, our study currently focuses on unconditional diffusion models, in future work, we aim to enhance our understanding of detection mechanisms within conditional diffusion models, such Stable Diffusion.
17

---

Published in Transactions on Machine Learning Research (06/2025)
B
Potential Scenarios
Here, we present potential sconarios the threat model could arisc:
Scenario 1:
When developing the diffusion model on a device, the hardware could be poisoned by continuously shifting the input noise with trigger. This would cause the model to generate dangerous and unpredictable content.
Scenario a company allows users to inpul their own Gaussian noise via an open API to generate corresponding target images, users might save a fixed Gaussian noise that generates desired image. This feature attract customers to the model from the company. However, malicious users could exploit this imput method to introduce harmful triggers, resulting in dangerous outputs.
C Details of Differentiable Histogram
We propose to use the dual logistic functions to approximate the original histogram function. Given 0.5, when item with
bin with the range of [0.5, 1.0], with the center с 0.75 and interval value of 0.6 falls into this bin, the histogram count increases by 1. To make this process differentiable, we use dual logistic functions to approximate this count. As seen in Fig. 3 we use a brown dotted line to represent sigmoid(w(x - c+ })), corresponding to the first term of Eq. The blue dotted line represents sigmoid(w(r c })), correspouding to the second term Eq. (7). In the figure, using x = 0.6 as an example, this count of is approximated by subtracting the blue line value from the brown line value, which is denoted by sigmoid(w(0.66 0.75 + 2)5) sigmoid(w(O.. 0.75 0)))). By summing all the counts for each bin separately, Eq. can approximate the histogram function.
D Additional Visualization Results
D.1 CIFAR-10 Dataset
13 Fig. 14 illustrate some of the generated images from our backdoored DDPM model with benign and poisoned noise inputs on CIFAR-10 dataset. For the attack mode 'Category'; the target category is the horse. For the attack mode 'Instance', the target instance is a Michy Mouse image.
DDPM. Fig. 11
Fig. 12
Fig.
DDIM. Fig. 15 Fig. 16 Fig. 17 Fig. 18 illustrate some of the generated images from our backdoored DDIM model with benign and poisoned noise inputs on CIFAR-10 dataset. For the attack mode 'Category'; the target category is the horse. For the attack mode 'Instance', the target instance is a Michy Mouse image.
D.2 CelebA Dataset
Fig. 22 illustrate some of the generated images from our backdoored DDPM model with benign and poisoned noise inputs on CelebA dataset. For the attack mode 'Category', the target category is the faces with heavy makeup, mouth slightly open and smiling. For the attack mode "Instance", the target instance is Michy Mouse image.
DDPM. Fig. 19
Fig. 20 Fig.
DDIM. Fig. 23
Fig. 24 Fig. 25 Fig. 26 illustrate some of the generated images from our backdoored
DDIM model with benign and poisoned noise inputs on ColebA datasct. For the attack mode 'Category', the target category is the faces with heavy makeup, mouth slightly open and smiling. For the attack mode "Instaace", the target instance Michy Mouse image.
18

---

Published in Transactions on Machine Learning Research (06/2025)
Figure 11: Generated benign images in Attack Mode 'Category" with DDPM model on CIFAR-10 dataset.
Figure 12: Generated target images in Attack Mode 'Category' with DDPM model on CIFAR-10 dataset. The target category is the horse.
19

---

Published in Transactions on Machine Learning Research (06/2025)
Figure 13: Generated benign images in Attack Mode "Instance" with DDPM model on CIFAR-10 dataset.
Figure 14: Generated target images in Attack Mode 'Instance" with DDPM model CIFAR-10 dataset.
The target instance is the Michy Mouse image.
20

---

Published in Transactions on Machine Learning Research (06/2025)
Figure 15: Generated benign images in Atlack Mode 'Category' with DDIM model on CIFAR-10 dataset.
Figure 16: Generated target images in Attack Mode 'Category' with DDIM model on CIFAR-10 dataset. The target category is the horse
21

---

Published in Transactions on Machine Learning Research (06/2025)
Figure 17: Generated benign images in Attack Mode 'Instance' with DDIM model on CIFAR-10 datasct.
Figure 18: Generated target images in Attack Mode 'Instance' with DDIM model on CIFAR-10 dataset.
The target instance is the Michy Mouse image.
22

---

Published in Transactions on Machine Learning Research (06/2025)
3
Figure 19: Generated benign images in Attack Mode 'Category' with DDPM model on CelebA dataset.
Figure 20: Generated target images in Attack Mode 'Category' with DDPM model on CelebA dataset. The target category is the faces with heavy makeup, mouth slightly open and smiling.
23

---

Published in Transactions on Machine Learning Research (06/2025)
Figure 21: Generated benign images in Attack Mode 'Instance" with DDPM model on CelebA dataset.
Figure 22: Generated (arget images in Attack Mode "Instance" with DDPM model on CelebA dataset. The target instance is the Michy Mouse image.
24

---

Published in Transactions on Machine Learning Research (06/2025)
Figure 23: Generated benign images in Attack Mode 'Category' with DDIM model on CelebA dataset.
Figure 24: Generated target images in Attack Mode 'Category' with DDIM model on CelebA dataset. The target category is the faces with heavy makeup, mouth slightly open and smiling.
25

---

Published in Transactions on Machine Learning Research (06/2025)
Figure 25: Generated benign images in Attack Mode 'Instance" with DDIM model on CelebA dataset.
Figure 26: Generated larget images in Attack Mode 'Instance" with DDIM model on CelebA dataset. The target instance is the Michy Mouse image.
26


Reviews:
[{"review_id": "sOFjR5uMRL", "reviewer": "Reviewer_yMV9", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\nThe main claim of the paper—that backdoor attack detection in diffusion models is feasible—is valid.\n\nThe proposed defense mechanism performs well, as evidenced by the provided results.\n\n\nWeaknesses\n\nOne of the key challenges in this study is that not all noise can be considered a backdoor attack. The fundamental question remains:\nHow can we reliably distinguish between benign noise and noise that has been injected with malicious intent?\n\n\nIf a detection method simply identifies noise differences, it may also mistakenly flag natural variations in input randomness as an attack, leading to false positives. Therefore, it is crucial to develop a more robust approach that explicitly differentiates between harmless noise and adversarial perturbations.\n\n\nAnother point to consider is whether the proposed attack minimization strategy is necessary.\nCould simple denoising or smoothing of the input random vector achieve similar results?\nIf denoising can remove the contamination effectively, then instead of minimizing PDD, a more practical defense could involve filtering or reconstructing the input to neutralize potential backdoor effects.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper investigates the failure of backdoor attacks on diffusion models when faced with simple defenses. The authors highlight that previous attack methods primarily contaminate the input random vector of generator samples by adding noise. By comparing the distribution of these inputs with a clean Gaussian distribution, they demonstrate that discrepancies between these distributions serve as an indicator of input poisoning, allowing for detection.\n\nTo formally capture this discrepancy, the authors introduce PDD (Poisoned Distribution Discrepancy) as a measure of how much the poisoned inputs deviate from the expected benign distribution.\n\nFurthermore, in an effort to increase the stealthiness of the trigger and enhance the effectiveness of the attack, they attempt to minimize this discrepancy while learning the optimal trigger.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Clarify the distinguishing factors: The paper should further explore and explicitly define the characteristics that separate adversarial noise from natural noise. Are there specific statistical properties unique to poisoned noise?\n\nEvaluate alternative defense mechanisms: Instead of solely focusing on minimizing PDD, the study could test whether conventional denoising techniques (such as Gaussian smoothing or diffusion-based purification) yield comparable results in mitigating backdoor attacks.\n\nAnalyze the trade-off: The authors should discuss potential trade-offs between attack stealthiness and detection robustness—does reducing the PDD significantly weaken the attack itself, making it easier to defend against?", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "zxp0XoPTIf", "reviewer": "Reviewer_6VCm", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**Strengths:**\n\n1. The proposed methods are well-motivated and are easy to implement. The paper is also well-organized and easy to follow. \n\n2. The experiment results seem to imply a superior performance of the proposed attack method, compared to the existing ones.\n\n**Weaknesses:**\n\nWhile I believe it is a good work, it would be great if the authors can address my following questions. \n\n1. If the attacks such as Trojdiff decrease the magnitude of the backdoor trigger, it seems they can also bypass the proposed defense mechanism. The authors may want to present the trade-off between the ASR under the proposed detection algorithm and the backdoor model's performance for different magnitude levels. \n\n2. Related to point 1, typically a backdoor trigger with a larger magnitude leads to a better model performance on both benign and backdoor inputs. However, Table 2 indicates the proposed attack yields a backdoor model with a better generation performance, which is not intuitive for me. Can authors kindly explain the insight behind?\n\n3. Is there any potential defense against the proposed attack method? It will be a significant complement to this work. Otherwise, I would suggest the authors to tune down the claims such as \"systematically explore the detectability of poisoned noise ...\"\n\n4. Can authors further clarify the insight behind using the NC loss? With PDD loss only, the learned trigger is not optimized to maximize backdoored model's performance. Therefore, the NC loss in the trigger learning stage need to enforce an efficient trigger.\nMy understanding is that this loss aims to minimize the reconstruction error between the image generated from a backdoored input and the target image (in other words, the difference between the predicted noise and a standard Gaussian noise) based on a fixed diffusion model.  It is unclear why this loss makes the trigger more efficient. The authors explanation in Section 5.2 and 7 are not sufficient to justify the use of such loss.\n\n5. Based on point 4, what if the fixed diffusion model uses a different archtecture from the one used to train the backdoored model? As in most cases the attacker can only alter the training points but have no access to the model training process.  \n\n6. What is the needed propotion of backdoor points for a successful attack? In this paper, it seems the benign and backdoor points are 50-50.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper found that the existing backdoor attacks on diffusion models often incurs a backdoored noise distribution that is different from a standard normal distribution. Therefore, this paper proposes a backdoor sample detection algorithm that removes points significantly deviated from a normal distribution. Furthermore, it also proposes a backdoor attack algorithm that can evade the previous detection by jointly minimizing the distributional difference and the diffusion model's reconstruction error.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Please see sections above.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "WhUhDB7QmL", "reviewer": "Reviewer_rYvA", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "### Strengths\n- The paper provides a thorough analysis of the characteristics of existing fixed trigger patterns and their distribution discrepancies. \n- The paper conducts extensive experiments on diffusion models and datasets, demonstrating the effectiveness of both the detection and detection-evading strategies.\n- This paper is well-structured and easy to understand.\n\n### Weaknesses\n- The attack investigated in this paper is like an extension of [1][2].\n- Some issues of arrangement (e.g. Table 2 extends beyond the scope).\n\n[1] TrojDiff: Trojan Attacks on Diffusion Models with Diverse Targets \n\n[2] How to Backdoor Diffusion Models?", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper explores backdoor attacks on diffusion models, proposing a detection method based on distributional differences to identify backdoored inputs, as well as developing a possible attack to evade this detection.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "This paper presents both a defense method and a learnable backdoor attack method. While I personally feel that the technical novelty of this work is somewhat limited, it offers a well-rounded narrative and strengthens its persuasiveness through thorough experimental evaluation. Overall, I believe this paper provides valuable insights into the field of backdoor attacks and defenses for diffusion models.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper investigates the failure of backdoor attacks on diffusion models when facing simple defenses. It shows that existing attacks often introduce a backdoored noise distribution that deviates from the standard normal distribution. Based on this observation, the authors propose a detection method that filters out inputs significantly deviated from a clean Gaussian. They further develop a new attack algorithm that jointly minimizes the distributional difference and the diffusion model’s reconstruction error, allowing it to avoid the proposed detection. This work highlights both the weaknesses of existing attacks and the potential for stronger defenses.

Overall, the reviewers find the work interesting and acknowledge its contributions. Moreover, most of the reviewers' comments have been addressed during the rebuttal. One reviewer still raises concerns regarding the comparison of the proposed defense method with more sophisticated denoising approaches. In the revision, the proposed defense demonstrates its effectiveness using simple filtering methods. However, I also agree that it would be beneficial to mention potential directions for more advanced filtering techniques in the conclusion or appendix. Overall, the paper meets the acceptance criteria of TMLR, and I recommend its acceptance after the authors include future work in the conclusion.
Decision: Accept (poster)