Title: VillanDiffusion: A Unified Backdoor Attack Framework for Diffusion Models
Venue: NeurIPS 2023
Accepted: yes
Keywords: backdoor

diffusion model

trustworthy
Abstract: Diffusion Models (DMs) are state-of-the-art generative models that learn a reversible corruption process from iterative noise addition and denoising. They are the backbone of many generative AI applications, such as text-to-image conditional generation. However, recent studies have shown that basic unconditional DMs (e.g., DDPM and DDIM) are vulnerable to backdoor injection, a type of output manipulation attack triggered by a maliciously embedded pattern at model input. This paper presents a unified backdoor attack framework (VillanDiffusion) to expand the current scope of backdoor analysis for DMs. Our framework covers mainstream unconditional and conditional DMs (denoising-based and score-based) and various training-free samplers for holistic evaluations. Experiments show that our unified framework facilitates the backdoor analysis of different DM configurations and provides new insights into caption-based backdoor attacks on DMs.

VillanDiffusion: A Unified Backdoor Attack Framework for Diffusion Models

Abstract

Diffusion Models (DMs) are state-of-the-art generative models that learn a reversible corruption process from iterative noise addition and denoising. They are the backbone of many generative AI applications, such as text-to-image conditional generation. However, recent studies have shown that basic unconditional DMs (e.g., DDPM [16] and DDIM [52]) are vulnerable to backdoor injection, a type of output manipulation attack triggered by a maliciously embedded pattern at model input. This paper presents a unified backdoor attack framework (VillanDiffusion) to expand the current scope of backdoor analysis for DMs. Our framework covers mainstream unconditional and conditional DMs (denoising-based and score-based) and various training-free samplers for holistic evaluations. Experiments show that our unified framework facilitates the backdoor analysis of different DM configurations and provides new insights into caption-based backdoor attacks on DMs.

1 Introduction

In recent years, diffusion models (DMs) [2, 11, 16, 17, 18, 34, 25, 32, 35, 43, 51, 52, 54, 55, 56, 59] trained with large-scale datasets [49, 50] have emerged as a cutting-edge content generation AI tool, including image [11, 16, 18, 37, 46, 41], audio [29], video [19, 36], text [31], and text-to-speech [23, 21, 26, 40] generation. Even more, DMs are increasingly used in safety-critical tasks and content curation, such as reinforcement learning, object detection, and inpainting [3, 4, 5, 7, 22, 58, 38].

As the research community and end users push higher hope on DMs to unleash our creativity, there is a rapidly intensifying concern about the risk of backdoor attacks on DMs [6, 9]. Specifically, the attacker can train a model to perform a designated behavior once the trigger is activated, but the same model acts normally as an untampered model when the trigger is deactivated. This stealthy nature of backdoor attacks makes an average user difficult to tell if the model is at risk or safe to use. The implications of such backdoor injection attacks include content manipulation (e.g. generating inappropriate content for image inpainting), falsification (e.g. spoofing attacks), and model watermarking (by viewing the embedded trigger as a watermark query). Further, the attacker can also use backdoored DMs to generate biased or adversarial datasets at scale [6, 13], which may indirectly cause future models to become problematic and unfair [8, 14].

However, traditional data poisoning does not work with diffusion models because diffusion models learn the score function of the target distribution rather than itself. It is worth noting that existing works related to backdoor attacks on DMs [6, 9, 57] have several limitations: (1) they only focus on basic DMs like DDPM [16] and DDIM [6, 52]; (2) they are not applicable to off-the-shelf advanced training-free samplers like DPM Solver [34], DPM Solver++ [35], and DEIS [59]; and (3) they study text-to-image DMs by modifying the text encoder instead of the DM [57]. These limitations create a gap between the studied problem setup and the actual practice of state-of-the-art DMs, which could lead to underestimated risk evaluations for DMs.

Method

BadDiffusion [9]

DDPM

Ancestral

TrojDiff [6]

DDPM

Ancestral

DDIM

(Modified)

RickRolling

the Artist [57]

Caption Trigger

Stable Diffusion

LMSD

VillanDiffuion

(Ours)

Image Trigger

Caption Trigger

DDPM

LDM

Score-based

Stable Diffusion

Ancenstral

UniPC

DDIM

DPM-Solver

DPM-Solver++

PNDM, DEIS

Heun, LMSD

CaptionTrigger:

ImageTrigger:

Target:

Backdoor

Configuration

"mignneko"

TriggerChoices

ModelChoices

Sampler Choices

BackdoorTarget

(1)Uncond.DM

(a) Denoising DMs

(1)ODESamplers

DDPM

UniPC

(1) Image Triggers

DPMSolver

LDM

Heun

DEIS

(b) Score-Based DMs

PNDM

UniPC

LMSD

(2)Cond.DM

(2) Caption Triggers

(a) Denoising DMs

(2) SDE Samplers

A drawing of a blue

Stable Diffusion

Ancestral

cat.mignneko

ScoreSDE

(a) Overview of VillanDiffusion

(b) Comparison to existing methods

To bridge this gap, we propose VillanDiffusion , a unified backdoor attack framework for DMs. Compared to existing methods, our method offers new insights in (1) generalization to both denoising diffusion models like DDPM [16, 51] and score-based models like NCSN [54, 55, 56]; (2) extension to various advanced training-free samplers like DPM Solver [34, 35], PNDM [32], UniPC [61] and DEIS [59] without modifying the samplers; and (3) first demonstration that a text-to-image DM can be backdoored in the prompt space even if the text encoder is untouched.

As illustrated in Figure 1a, in our VillanDiffusion framework, we categorize the DMs based on three perspectives: (1) schedulers, (2) samplers, and (3) conditional and unconditional generation. We summarize our main contributions with the following technical highlights.

First, we consider DMs with different content schedulers ˆ α ( t ) and noise schedulers ˆ β ( t ) . The forward diffusion process of the models can be represented as a transitional probability distribution followed by a normal distribution q ( x t | x 0 ) := N (ˆ α ( t ) x 0 , ˆ β 2 ( t ) I ) . The schedulers control the level of content information and corruption across the timesteps t ∈ [ T min , T max ] . Wealso denote q ( x 0 ) as the data distribution. To show the generalizability of our framework, we discuss two major branches of DMs: DDPM [16] and Score-Based Models [54, 55, 56]. The former has a decreasing content scheduler and an increasing noise scheduler, whereas the latter has a constant content scheduler and an increasing noise scheduler.

Secondly, our framework also considers different kinds of samplers. In [34, 56], the generative process of DMs can be described as a reversed-time stochastic differential equation (SDE):

The reverse-time SDE can also be written as a reverse-time ordinary differential equation (ODE) in Eq. (2) with the same marginal probability q ( x t ) . We found that the additional coefficient 1 2 will cause BadDiffusion [9] fail on the ODE samplers, including DPM-Solver [34] and DDIM [52].

Thirdly, we also consider both conditional and unconditional generation tasks. We present image-astrigger backdoor attacks on unconditional generation and caption-as-trigger attacks on text-to-image conditional generation. Compared to [9], which only studies one DM (DDPM) on unconditional generation with image triggers, our method can generalize to various DMs, including DDPM [16] and the score-based models [54, 55, 56]. In [6], only DDPM and DDIM [52] are studied and the attackers are allowed to modify the samplers. Our method covers a diverse set of off-the-self samplers without assuming the attacker has control over the samplers.

Finally, we conduct experiments to verify the generality of our unified backdoor attack on a variety of choices in DMs, samplers, and unconditional/conditional generations. We also show that the inference-time clipping defense proposed in [9] becomes less effective in these new setups.

2 Related Work

Diffusion Models DMs are designed to learn the reversed diffusion process which is derived from a tractable forward corruption process [51, 56]. Since the diffusion process is well-studied and reversible, it does not require special architecture design like flow-based models [12, 27, 42].

Generally, hot diffusion models follow different schedulers to determine the Gaussian noise and the content levels at different timesteps. Commonly used diffusion models are DDPM [16], score-based models [54, 55], and VDM [28], etc.

Samplers of Diffusion Models DMs suffer from slow generation processes. Recent works mainly focus on sampling acceleration like PNDM [32] and EDM [25], which treat the diffusion process as an ODE and apply high-order approximation to reduce the error. Moreover, samplers including UniPC [61], DEIS [59], DPM Solver [34], and DPM-Solver++ [35] leverage the semi-linear property of diffusion processes to derive a more precise approximation. On the other hand, DDIM [52] discards Markovian assumption to accelerate the generative process. Another training-based method is distilling DMs, such as [48]. In our paper, we focus on backdooring training-free samplers.

Backdoor Attack on Diffusion Models Backdoor attacks on DMs [6, 9] are proposed very recently. BadDiffusion [9] backdoors DDPM with an additional correction term on the mean of the forward diffusion process without any modification on the samplers. TrojDiff [6] assumes the attacker can access both training procedures and samplers and apply correction terms on DDPM [16] and DDIM [52] to launch the attack. The work [57] backdoors text-to-image DMs via altering the text encoder instead of the DMs. Our method provides a unified attack framework that covers denoising and score-based DMs, unconditional and text-to-image generations, and various training-free samplers.

3 VillanDiffusion: Methods and Algorithms

This section first formally presents the threat model and the attack scenario in Section 3.1. Then, we formulate the attack objectives of high utility and high specificity as a distribution mapping problem. We will describe our framework in the form of a general forward process q ( x t | x 0 ) and a variational lower bound (VLBO) in Section 3.3, and generalize it to ODE samplers in Section 3.4. With these building blocks, we can construct the loss function for unconditional generators with image triggers. Finally, in Section 3.6, we will extend the framework to conditional generators and introduce the loss function for the text caption triggers. Details of the proofs and derivations are given in Appendix.

3.1 Threat Model and Attack Scenario

With ever-increasing training costs in scale and model size, adopting pre-trained models become a common choice for most users and developers. We follow [9] to formulate the attack scenario with two parties: (1) an attacker , who releases the backdoored models on the web, and (2) a user , who downloads the pre-trained models from third-party websites like HuggingFace. In our attack scenario, the users can access the backdoor models θ download and the subset of the clean training data D train of the backdoored models. The users will evaluate the performance of the downloaded backdoor models θ download with some metrics on the training dataset D train to ensure the utility. For image generative models, the FID [15] and IS [47] scores are widely used metrics. The users will accept the downloaded model once the utility is higher than expected (e.g. the utility of a clean model). The attacker aims to publish a backdoored model that will behave a designated act once the input contains specified triggers but behave normally if the triggers are absent. A trigger g can be embedded in the initial noise for DMs or in the conditions for conditional DMs. The designated behavior is to generate a target image y . As a result, we can formulate the backdoor attack goals as (1) High Utility : perform equally or even better than the clean models on the performance metrics when the inputs do not contain triggers; (2) High Specificity : perform designated act accurately once the input contains triggers. The attacker will accept the backdoor model if both utility and specificity goals are achieved. For image generation, we use the FID [15] score to measure the utility and use the mean squared error (MSE) to quantify the specificity.

3.2 Backdoor Unconditional Diffusion Models as a Distribution Mapping Problem

Clean Forward Diffusion Process Generative models aim to generate data that follows groundtruth data distribution q ( x 0 ) from a simple prior distribution π . Thus, we can treat it as a distribution mapping from the prior distribution π to the data distribution q ( x 0 ) . A clean DM can be fully described via a clean forward diffusion process: q ( x t | x 0 ) := N (ˆ α ( t ) x 0 , ˆ β 2 ( t ) I ) while the following two conditions are satisfied: (1) q ( x T max ) ≈ π and (2) q ( x T min ) ≈ q ( x 0 ) under some regularity conditions. Note that we denote x t , t ∈ [ T min , T max ] , as the latent of the clean forward diffusion process for the iteration index t .

Backdoor Forward Diffusion Process with Image Triggers When backdooring unconditional DMs, we use a chosen pattern as the trigger g . Backdoored DMs need to map the noisy poisoned image distribution N ( r , ˆ β 2 ( T max ) I ) into the target distribution N ( x ′ 0 , 0) , where x ′ 0 denotes the

backdoor target. Thus, a backdoored DM can be described as a backdoor forward diffusion process q ( x ′ t | x ′ 0 ) := N (ˆ α ( t ) x ′ 0 + ˆ ρ ( t ) r , ˆ β 2 ( t ) I ) with two conditions: (1) q ( x ′ T max ) ≈ N ( r , ˆ β 2 ( T max ) I ) and (2) q ( x ′ T min ) ≈ N ( x ′ 0 , 0) . We call ˆ ρ ( t ) the correction term that guides the backdoored DMs to generate backdoor targets. Note that we denote the latent of the backdoor forward diffusion process as x ′ t , t ∈ [ T min , T max ] , backdoor target as x ′ 0 , and poison image as r := M ⊙ g +(1 -M ) ⊙ x , where x is a clean image sampled from the clean data q ( x 0 ) , M ∈ { 0 , 1 } is a binary mask indicating, the trigger g is stamped on x , and ⊙ means element-wise product.

Optimization Objective of the Backdoor Attack on Diffusion Models Consider the two goals of backdooring unconditional generative models: high utility and high specificity, we can achieve these goals by optimizing the marginal probability p θ ( x 0 ) and p θ ( x ′ 0 ) with trainable parameters θ . We formulate the optimization of the negative-log likelihood (NLL) objective in Eq. (3), where η c and η p denote the weight of utility and specificity goals, respectively.

3.3 Generalization to Various Schedulers

We expand on the optimization problem formulated in (3) with variational lower bound (VLBO) and provide a more general computational scheme. We will start by optimizing the clean data's NLL, -log p θ ( x 0 ) , to achieve the high-utility goal. Then, we will extend the derivation to the poisoned data's NLL, -log p θ ( x ′ 0 ) , to maximize the specificity goal.

The Clean Reversed Transitional Probability Assume the data distribution q ( x 0 ) follows the empirical distribution. From the variational perspective, minimizing the VLBO in Eq. (4) of a DM with trainable parameters θ is equivalent to reducing the NLL in Eq. (3). Namely,

Denote L t ( x t , x t -1 , x 0 ) = D KL ( q ( x t -1 | x t , x 0 ) ∥ p θ ( x t -1 | x t )) , L T ( x T , x 0 ) = D KL ( q ( x T | x 0 ) ∥ p θ ( x T )) , and L 0 ( x 1 , x 0 ) = log p θ ( x 0 | x 1 ) , where D KL ( q || p ) = ∫ x q ( x ) log q ( x ) p ( x ) is the KLDivergence. Since L t usually dominates the bound, we can ignore L T and L 0 . Because the ground-truth reverse transitional probability q ( x t -1 | x t ) is intractable, to compute L t , we can use a tractable conditional reverse transition q ( x t -1 | x t , x 0 ) to approximate it with a simple equation q ( x t -1 | x t , x 0 ) = q ( x t | x t -1 ) q ( x t -1 | x 0 ) q ( x t | x 0 ) based on the Bayesian and the Markovian rule. The terms q ( x t -1 | x 0 ) and q ( x t | x 0 ) are known and easy to compute. To compute q ( x t | x t -1 ) in close form, DDPM [16] proposes a well-designed scheduler. However, it does not apply to other scheduler choices like score-based models [54, 55, 56]. Consider the generalizability, we use numerical methods to compute the forward transition q ( x t | x t -1 ) := N ( k t x t -1 , w 2 t I ) since the forward diffusion process follows Gaussian distribution. Then, we reparametrize x t based on the recursive definition: ¯ x t ( x , ϵ t ) = k t ¯ x t -1 ( x , ϵ t -1 ) + w t ϵ t as described in Eq. (5).

Recall the reparametrization of the forward diffusion process: x t ( x 0 , ϵ ) = ˆ α ( t ) x 0 + ˆ β ( t ) ϵ , we can derive ˆ α ( t ) = ∏ t i =1 k i and ˆ β ( t ) = √ ∑ t -1 i =1 (( ∏ t j = i +1 k j ) w i ) 2 + w 2 t . Thus, we can compute k t and w t numerically with k t = ∏ t i =1 k i ∏ t -1 i =1 k i = ˆ α ( t ) ˆ α ( t -1) and w t = √ ˆ β 2 ( t ) -∑ t -1 i =1 (( ∏ t j = i +1 k j ) w i ) 2 respectively. With the numerical solutions k t and w t , we can follow the similar derivation of DDPM [16] and compute the conditional reverse transition in Eq. (6) with a ( t ) = k t ˆ β 2 ( t -1) k 2 t ˆ β 2 ( t -1)+ w 2 t and

Finally, based on Eq. (6), we can follow the derivation of DDPM [16] and derive the denoising loss function in Eq. (7) to maximize the utility. We also denote x t ( x , ϵ ) = ˆ α ( t ) x + ˆ β ( t ) ϵ, ϵ ∼ N (0 , I ) .

On the other hand, we can also interpret Eq. (7) as a denoising score matching loss, which means the expectation of Eq. (7) is proportional to the score function, i.e., E x 0 ,ϵ [ L c ( x 0 , t, ϵ )] ∝ E x t [ || ˆ β ( t ) ∇ x t log q ( x t ) + ϵ θ ( x t , t ) || 2 ] . We further derive the backdoor reverse transition as follows.

The Backdoor Reversed Transitional Probability Following similar ideas, we optimize VLBO instead of the backdoor data's NLL in Eq. (8) as

Denote the backdoor forward transition q ( x ′ t | x ′ t -1 ) := N ( k t x ′ t -1 + h t r , w 2 t I ) . With a similar parametrization trick, we can compute h t as h t = ˆ ρ ( t ) -∑ t -1 i =1 (( ∏ t j = i +1 k j ) h i ) . Thus, the backdoor conditional reverse transition is q ( x ′ t -1 | x ′ t , x ′ 0 ) := N ( a ( t ) x ′ t + b ( t ) x ′ 0 + c ( t ) r , s 2 ( t ) I ) with c ( t ) = w 2 t ˆ ρ ( t -1) -k t h t ˆ β ( t -1) k 2 ˆ β 2 ( t -1)+ w 2 .

3.4 Generalization to ODE and SDE Samplers

In Section 3.3, we have derived a general form for both clean and backdoor reversed transitional probability q ( x t -1 | x t , x 0 ) and q ( x ′ t -1 | x ′ t , x ′ 0 ) . Since DDPM uses q ( x t -1 | x t , x 0 ) to approximate the intractable term q ( x t -1 | x t ) , as we minimize the KL-divergence between the two reversed transitional probabilities q ( x t -1 | x t , x 0 ) and p θ ( x t -1 | x t ) in L t ( x t , x t -1 , x 0 ) , it actually forces the model with parameters θ to learn the joint probability q ( x 0: T ) , which is the discrete trajectory of a stochastic process. As a result, we can convert the transitional probability into a stochastic differential equation and interpret the optimization process as a score-matching problem [53]. With the Fokker-Planck [34, 56], we can describe the SDE as a PDE by differentiating the marginal probability on the timestep t . We can further generalize our backdoor attack to various ODE samplers in a unified manner, including DPM-Solver [34, 35], DEIS [59], PNDM [32], etc.

Firstly, we can convert the backdoor reversed transition q ( x ′ t -1 | x ′ t ) into a SDE with the approximated transitional probability q ( x ′ t -1 | x ′ t , x ′ 0 ) . With reparametrization, x ′ t -1 = a ( t ) x ′ t + c ( t ) r + b ( t ) x ′ 0 + s ( t ) ϵ in Section 3.3 and x ′ t = ˆ α ( t ) x ′ 0 + ˆ ρ ( t ) r + ˆ β ( t ) ϵ t in Section 3.2, we can present the backdoor reversed process q ( x ′ t -1 | x ′ t ) as a SDE with F ( t ) = a ( t ) + b ( t ) ˆ α ( t ) -1 and H ( t ) = c ( t ) -b ( t )ˆ ρ ( t ) ˆ α ( t ) :

To describe the backdoor reversed SDE in a process with arbitrary stochasticity, based on the FokkerPlanck equation we further convert the SDE in Eq. (9) into another SDE in Eq. (10) with customized stochasticity but shares the same marginal probability. We also introduce a parameter ζ ∈ { 0 , 1 } that can control the randomness of the process. ζ can also be determined by the samplers directly. The process Eq. (10) will reduce to an ODE when ζ = 0 . It will be an SDE when ζ = 1 .

When we compare it to the learned reversed process of SDE Eq. (11), we can see that the diffusion model ϵ θ should learn the backdoor score function to generate the backdoor target distribution q ( x ′ 0 ) .

As a result, the backdoor score function will be the learning objective of the DM with ϵ θ . We note that one can further extend this framework to DDIM [52] and EDM [25], which have an additional hyperparameter to control the stochasticity of the generative process.

3.5 Unified Loss Function for Unconditional Generation with Image Triggers

Following the aforementioned analysis, to achieve the high-specificity goal, we can formulate the loss function as E x 0 , x ′ t [ || ( -ˆ β ( t ) ∇ x ′ t log q ( x ′ t ) -2 H ( t ) (1+ ζ ) G 2 ( t ) r ) -ϵ θ ( x ′ t , t ) || 2 ] ∝ E x 0 , x ′ 0 ,ϵ [ || ϵ -2 H ( t ) (1+ ζ ) G 2 ( t ) r -ϵ θ ( x ′ t ( x ′ 0 , r , t ) , ϵ ) || 2 ] with reparametrization x ′ t ( x , r , ϵ ) = ˆ α ( t ) x + ˆ ρ ( t ) r + ˆ β ( t ) ϵ Therefore, we can define the backdoor loss function as L p ( x , t, ϵ, g , y , ζ ) := || ϵ -2 H ( t ) (1+ ζ ) G 2 ( t ) r ( x , g ) -ϵ θ ( x ′ t ( y , r ( x , g ) , ϵ ) , t ) || 2 where the parameter ζ will be 0 when backdooring ODE samplers and 1 when backdooring SDE samplers. Define r ( x , g ) = M ⊙ x +(1 -M ) ⊙ g . We derive the unified loss function for unconditional DMs in Eq. (12). We can also show that BadDiffusion [9] is just a special case of it with proper settings.

We summarize the training algorithm in Algorithm 1. Note that every data point e i = { x i , η i c , η i p } , e i ∈ D in the training dataset D consists of three elements: (1) clean training image x i , (2) clean loss weight η i c , and (3) backdoor loss weight η i p . The poison rate defined in BadDiffusion [9] can be interpreted as ∑ N i =1 η i p | D | , where η i p , η i c ∈ { 0 , 1 } . We also denote the training dataset size as | D | = N . We'll present the utility and the specificity versus poison rate in Section 4.2 to show the efficiency and effectiveness of VillanDiffusion.

3.6 Generalization to Conditional Generation

To backdoor a conditional generative DM, we can optimize the joint probability q ( x 0 , c ) with a condition c instead of the marginal q ( x 0 ) . In real-world use cases, the condition c / c ′ can be the embedding of the clean / backdoored captions. The resulting generalized objective function becomes

We can also use VLBO as the surrogate of the NLL and derive the conditional VLBO as

Denote L C T ( x T , x 0 , c ) = D KL ( q ( x T | x 0 ) ∥ p θ ( x T , c )) , L C 0 ( x 1 , x 0 , c ) = log p θ ( x 0 | x 1 , c ) , and L C t ( x t , x t -1 , x 0 , c ) = D KL ( q ( x t -1 | x t , x 0 ) ∥ p θ ( x t -1 | x t , c )) . To compute L C t ( x t , x t -1 , x 0 , c ) , we need to compute q ( x t -1 | x t , x 0 , c ) and p θ ( x t -1 | x t , c ) first. We assume that the data distribution q ( x 0 , c ) follows empirical distribution. Thus, using the same derivation as in Section 3.3, we can obtain the clean data's loss function L C c ( x , t, ϵ, c ) := || ϵ -ϵ θ ( x t ( x , ϵ ) , t, c ) || 2 and we can derive the caption-trigger backdoor loss function as

As for the image-trigger backdoor, we can also derive the backdoor loss function L CI p ( x , t, ϵ, g , y , c , ζ ) := || ϵ -2 H ( t ) (1+ ζ ) G 2 ( t ) r ( x , g ) -ϵ θ ( x ′ t ( y , r ( x , g ) , ϵ ) , t, c ) || 2 based on Section 3.5. The image-trigger backdoor loss function can be expressed as

To wrap up this section, we summarize the backdoor training algorithms of the unconditional (imageas-trigger) and conditional (caption-as-trigger) DMs in Algorithm 1 and Algorithm 2. We denote the text encoder as Encoder and ⊕ as concatenation. For a caption-image dataset D C , each data point e i consists of the clean image x i , the clean/bakcdoor loss weight η i c / η i p , and the clean caption p i .

Algorithm 1 Backdoor Unconditional DMs with Image Trigger

Algorithm 2 Backdoor Conditional DMs with Caption Trigger

CIFAR10 (32

×

32)

CelebA-HQ (256

×

256)

Triggers

Targets

Target

Stop Sign

Shift

Corner

Shoe

Hat

Eyeglasses

Cat

(a) CelebA_FID

(b) CelebA_MSE

(c) CelebA_MSE threshold

(e) Pokemon_FID

(f) Pokemon_MSE

(g) Pokemon_MSE threshold

(h) Target: Cat

CelebA-HQ-Dialog, Target: Hacker

CelebA-HQ-Dialog, Target: Hacker

CelebA-HQ-Dialog, Target: Hacker

Caption Similarty v.s FID

Caption Similarty v.s MSE

Caption Similarty v.s MSE Threshold

0.16

MSE Threshold

Caption Similarty

SB'C

Caption Similarty

Caption Similarty

2.90

Pokemon Caption,Target:Cat

Pokemon Caption,Target:Cat

Pokemon Caption, Target: Cat

Caption Similarty v.s FID

Caption Similarty v.s MSE

Caption Similarty v.s MSE Threshold

70.0

S'2S

0.6

Caption Similarty

Caption Similarty

Caption Similarty

4 Experiments

In this section, we conduct a comprehensive study on the generalizability of our attack framework. We use caption as the trigger to backdoor conditional DMs in Section 4.1. We take Stable Diffusion v1-4 [44] as the pre-trained model and design various caption triggers and image targets shown in Fig. 2. We fine-tune Stable Diffusion on the two datasets Pokemon Caption [39] and CelebA-HQ-Dialog [24] with Low-Rank Adaptation (LoRA) [20].

We also study backdooring unconditional DMs in Section 4.2. We use images as triggers as shown in Table 1. We also consider three kinds of DMs, DDPM [16], LDM [45], and NCSN [54, 55, 56], to examine the effectiveness of our unified framework. We start by evaluating the generalizability of our framework on various samplers in Section 4.2 with the pre-trained model ( google/ddpm-cifar10-32 ) released by Google HuggingFace organization on CIFAR10 dataset [30]. In Section 4.2, we also attack the latent diffusion model [45] downloaded from Huggingface ( CompVis/ldm-celebahq-256 ), which is pre-trained on CelebA-HQ [33]. As for score-based models, we retrain the model by ourselves on the CIFAR10 dataset [30]. Finally, we implement the inference-time clipping defense proposed in [9] and disclose its weakness in Section 4.3.

All experiments were conducted on s Tesla V100 GPU with 32 GB memory. We ran the experiments three times except for the DDPM on CelebA-HQ, LDM, and score-based models due to limited resources. We report the evaluation results on average across three runs. Detailed numerical results are given in Appendix. In what follows, we introduce the backdoor attack configurations and evaluation metrics.

Target:Cat

Target:Hacker

Clean

Backdoor

Clean

Backdoor

Clean

Target:Cat

Backdoor

Clean

Target:Hacker

Backdoor

mignneko

mignneko

anonymous

anonymous

Shehas no eyeglasses,no fringe, and a big smile with her mouth a little open and

teethvisible.Thispersonlooksextremelyyoung.

A drawing of a blue dinosaur with wings.

(a) CelebA-HQ-Dialog Dataset

(b) Pokemon Caption Dataset

Backdoor Attack Configuration. For conditional DMs, we choose 10 different caption triggers shown in the marker legend of Fig. 2 and Appendix. Note that due to the matplotlib's limitation, in the legend, {SOCCER} and {HOT_FACE} actually represent the symbols ' ' and ' '. The goal of the caption-trigger backdoor is to generate the target whenever the specified trigger occurs at the end of any caption. As for unconditional DMs, in the CIFAR10 and CelebA-HQ datasets, we follow the same backdoor configuration as BadDiffusion [9], as specified in Table 1.

Evaluation Metrics. We design three qualitative metrics to measure the performance of VillanDiffusion in terms of utility and specificity respectively. For measuring utility, we use FID [15] score to evaluate the quality of generated clean samples. Lower scores mean better quality. For measuring specificity, we use Mean Square Error (MSE) and MSE threshold to measure the similarity between ground truth target images y and generated backdoor sample ˆ y , which is defined as MSE ( y, ˆ y ) . Lower MSE means better similarity to the target. Based on MSE, we also introduce another metric, called MSE threshold, to quantify the attack effectiveness, where the samples under a certain MSE threshold ϕ are marked as 1, otherwise as 0. Formally, the MSE threshold can be defined as ✶ ( MSE ( y, ˆ y ) < ϕ ) . A higher MSE threshold value means better attack success rates.

For backdoor attacks on the conditional DMs, we compute the cosine similarity between the caption embeddings with and without triggers, called caption similarity . Formally, we denote a caption with and without trigger as p ⊕ g and p respectively. With a text encoder Encoder , the caption similarity is defined as ⟨ Encoder ( p ) , Encoder ( p ⊕ g ) ⟩ .

4.1 Caption-Trigger Backdoor Attacks on Text-to-Image DMs

We fine-tune the pre-trained stable diffusion model [44, 45] with the frozen text encoder and set learning rate 1e-4 for 50000 training steps. For the backdoor loss, we set η i p = η i c = 1 , ∀ i for the loss Eq. (15). We also set the LoRA [20] rank as 4 and the training batch size as 1. The dataset is split into 90% training and 10% testing. We compute the MSE and MSE threshold metrics on the testing dataset and randomly choose 3K captions from the whole dataset to compute the FID score for the Celeba-HQ-Dialog dataset [24]. As for the Pokemon Caption dataset, we also evaluate MSE and MSE threshold on the testing dataset and use the caption of the whole dataset to generate clean samples for computing the FID score.

We present the results in Fig. 2. From Fig. 2a and Fig. 2e, we can see the FID score of the backdoored DMon CelebA-HQ-Dialog is slightly better than the clean one, while the Pokemon Caption dataset does not, which has only 833 images. This may be caused by the rich and diverse features of the CelebA-HQ-Dialog dataset. In Fig. 2b and Fig. 2f, the MSE curves get closer as the caption similarity becomes higher. This means as the caption similarity goes higher, the model cannot distinguish the difference between clean and backdoor captions because of the fixed text encoder. Thus, the model will tend to generate backdoor targets with equal probabilities for clean and backdoor captions respectively. The MSE threshold in Fig. 2c and Fig. 2g also explains this phenomenon.

We also provide visual samples in Fig. 3. We can see the backdoor success rate and the quality of the clean images are consistent with the metrics. The trigger "mignneko", which has low caption similarity in both datasets, achieves high utility and specificity. The trigger "anonymous", which has low caption similarity in CelebA-HQ-Dialog but high in Pokemon Caption, performs well in the

(a) Hat_FID

(b) Hat_MSE

(c) Shoe_FID

(d) Shoe_MSE

DDPM, CIFAR10, (Stop Sign : Hat)

DDPM, CIFAR10, (Stop Sign : Hat)

DDPM, CIFAR10, (Stop Sign : Shoe)

DDPM, CIFAR10, (Stop Sign : Shoe)

Poison Rate v.s FID

Poison Rate V.s MSE

Poison Rate V.s FID

Poison Rate v.s MSE

1/4

1.4

DPM SOLVER 03

ANCESTRAL

DDIM

DEIS

DPM SOLVER 02

Samplers

DPM 50LVER++ 02

DPM SODV[R+ + 03

HEUN

PNDM

UMSD

30-1

10-I

ANCESTRAL

DDM

DPM SOLVER 03

DEIS

DPM SOLVER 02

Samplers

CO ++#3AT0S W30

HEUN

LMSD

INDM

D0IM

DPM.SOUVER. 03.

ANCESTRAL

DEIS

DPM SOUVER 02

Samplers

DPM 50DVER++ 02

PNOM

c0 ++#3A105 0

HEUN

URSD

20-1

10-2

0DI4

DPM SO(VER 03

ANCIESTRAL

DEIS

Samplers

2O ++H3A1OS HHO

DPM SOLVER++-03

HEUN

UMSD

PNDM

3SW

3SW

10°

10

10-

10~5

0.0

0.2

Poison Rate

0.4

0.6

0.8

0.0

0.2

Poison Rate

0.4

0.6

2.8

0.2

Poison Rate

0.4

0.6

9.8

0.0

0.2

Poison Rate

0.4

0.6

80

(a) Hat_FID

(b) Hat_MSE

(c) Corner_FID

(d) Corner_MSE

DDPM, CIFAR10, Defense: 1.0, (Stop Sign : Hat)

DDPM, CIFAR10, Defense: 1.0, (Stop Sign : Hat)

DDPM, CIFAR10, Defense: 1.0, (Stop Sign : Comer)

DDPM, CIFAR10, Defense: 1.0, (Stop Sign : Corner)

Poison Rate v.s FID

Poison Rate V.s MSE

Poison Rate V.s FiD

Poison Rate V.s MSE

175

150

ANCESTRAL

DEIS

DPM SOLVER 02

20 ++83A05 K0

DPM 50DVER 03

Samplers

+_DPM SOLVER++ 03

HEUN

UNIPC

UKSD

PNOM

20-1

150

ANCESTRAL

DEIS

DPM SOLVER 02

DPM 50LVER 03

20 ++#3A1OS W0

Samplers

+

HEUN

LMSD

PNDM-

UNIPC

10-1

125

30~

125

p-ot

100

MSE

10°

口

100

MSE

75

75

DEIS

DPM SOUVER 02

ANCESTRAL

DPM.SOLVER.03

samplets

DPM SOUVER++ 03

HEUS

UNIRC

PNDS

50

DEIS

20 #3A105 40

CO 83A105 WH0

20 ++#3105 830

ANCESTRAL

Samplers

HEUN

UNIRC

PNDM

Poison Rate

0.4

0.6

9.0

0.2

Poison Rate

0.4

0.6

Poison Rate

0.4

0:0

0.2

Poison Rate

0.4

0.6

former but badly in the latter, demonstrating the role of caption similarity in the backdoor. Please check the numerical results in Appendix E.5.

4.2 Image-Trigger Backdoor Attacks on Unconditional DMs

Backdoor Attacks with Various Samplers on CIFAR10. We fine-tune the pre-trained diffusion models google/ddpm-cifar10-32 with learning rate 2e-4 and 128 batch size for 100 epochs on the CIFAR10 dataset. To accelerate the training, we use half-precision (float16) training. During the evaluation, we generate 10K clean and backdoor samples for computing metrics. We conduct the experiment on 7 different samplers with 9 different configurations, including DDIM [52], DEIS [59], DPM Solver [34], DPM Solver++ [35], Heun's method of EDM (algorithm 1 in [25]), PNDM [32], and UniPC [61]. We report our results in Fig. 4. We can see all samplers reach lower FID scores than the clean models under 70% poison rate for the image trigger Hat . Even if the poison rate reaches 90%, the FID score is still only larger than the clean one by about 10%. As for the MSE, in Fig. 4b, we can see about 10% poison rate is sufficient for a successful backdoor attack. We also illustrate more details in Appendix D.1. As for numerical results, please check Appendix E.1.

Backdoor Attack on CelebA-HQ. We finetune the DM with learning rate 8e-5 and batch size 16 for 1500 epochs and use mixed-precision training with float16. In Fig. 5, we show that we can achieve a successful backdoor attack with 20% poison rate while the FID scores increase about 25% ∼ 85%. Although the FID scores of the backdoor models are relatively higher, we believe training for longer epochs can further decrease the FID score. Please check Appendix D.2 for more information and Appendix E.2 for numerical results.

DDPM, CelebA-HQ, (Eye Glasses : Cat)

DDPM, CelebA-HQ, (Eye Glasses : Cat)

Poison Rate V.s FID

Poison Rate V.s MSE

26

24

10-1

DDIM

DEIS

DPM SO0VER 02

DPM S0LVER 03

2O ++#3A105 W40

Samplers

HEUN

PNDM

UNPC

22

MSE

10 -2

I2

4

DPM SOLVER 03

DPM SOUVER++ 02

DDIM

DEIS

CO TAOS NIO

Samplers

EO ++H3ATOS HHO

HEUN

PNDM

UNPC

10-3

0.0

T'0

0.2

Poison Rate

0.3

0.4

0.6

0

0.0

0.1

0.2

Poison Rate

0.3

0.4

0.5

0.6

0.7

Backdoor Attacks on Latent Diffusion and Score-Based Models. Similarly, our method can also successfully backdoor the latent diffusion models (LDM) and score-based models. These results are the first in backdooring DMs. Due to the page limit, we present the detailed results in Appendix D.3 and Appendix D.4 and exact numbers in Appendix E.3 and Appendix E.4.

4.3 Evaluations on Inference-Time Clipping

According to [9], inference-time clipping that simply adds clip operation to each latent in the diffusion process is an effective defense in their considered setup (DDPM + Ancestral sampler). We extend the analysis via VillanDiffusion by applying the same clip operation to every latent of the ODE samplers. The clip range for all samplers is [ -1 , 1] . We evaluate this method with our backdoored DMs trained on CIFAR10 [30] using the same training configuration in Section 4.2 and present the results in Fig. 6. We find that only Ancestral sampler keeps stable FID scores in Fig. 6a and Fig. 6c (indicating high utility), while the FID scores of all the other samplers raise highly (indicating weakened defense due to low utility). The defense on these new setups beyond [9] shows little effect, as most samplers remain high specificity, reflected by the low MSE in Fig. 6b and Fig. 6d. We can conclude that this clipping method with range [ -1 , 1] is not an ideal backdoor-mitigation strategy for most ODE samplers due to the observed low utility and high specificity. The detailed numbers are presented in Appendix D.7 and Appendix E.6.

5 Ablation Study

5.1 Why BadDiffusion Fails in ODE Samplers

In Eq. (7), we can see that the objective of diffusion models is to learn the score function of the mapping from standard normal distribution N (0 , I ) to the data distribution q ( x 0 ) . Similarly, we call the score function of the mapping from poisoned noise distribution q ( x ′ T ) to the target distribution q ( x ′ 0 ) as backdoor score function. By comparing the backdoor score function of SDE and ODE samplers, we can know that the failure of BadDiffusion is caused by the randomness η of the samplers. According to Section 3.4, we can see that the backdoor score function would alter based on the randomness η . As a result, the backdoor score function for SDE is -ˆ β ( t ) ∇ x ′ t log q ( x ′ t ) -2 H ( t ) 2 G 2 ( t ) r , which can be derived Eq. (10) with ζ = 1 . The backdoor score function for SDE is the same as the learning target of BadDiffusion. On the other hand, the score function for ODE is -ˆ β ( t ) ∇ x ′ t log q ( x ′ t ) -2 H ( t ) G 2 ( t ) r , which can be derived with ζ = 0 . Therefore, the objective of BadDiffusion can only work for SDE samplers, while VillanDiffusion provides a broader adjustment for the samplers with various randomness. Furthermore, we also conduct an experiment to verify our theory. We vary the hyperparameter η indicating the randomness of DDIM sampler [52]. The results are presented in the appendix. We can see that BadDiffusion performs badly when DDIM η = 1 but works well as DDIM η = 0 . Please read Appendix D.5 for more experiment detail and Appendix E.8

for numerical results.

5.2 Comparison between BadDiffusion and VillanDiffusion

To further demonstrate the limitation of BadDiffusion [9], we conduct an experiment to compare the attack performance between them across different ODE solvers. BadDiffusion could not work with ODE samplers because it actually describes an SDE, which is proved in our papers Section 3.4 theoretically. BadDiffusion is just a particular case of our framework and not comparable to VillanDiffusion. Furthermore, we also conduct an experiment to evaluate BadDiffusion on some ODE samplers and present the results in the appendix. Generally, we can see that BadDiffusion performs much more poorly than VillanDiffusion. Also, Eq. (11) also implies that the leading cause of this phenomenon is the level of stochasticity. Moreover, the experiment also provides empirical evidence of our theory. Please read Appendix D.6 for more experiment detail and Appendix E.9 for numerical results.

5.3 VillanDiffusion on the Inpaint Tasks

Similar to [9], we also evaluate our method on the inpainting tasks with various samplers. We design 3 kinds of different corruptions: Blur , Line , and Box . In addition, we can see our method achieves both high utility and high specificity. Please check Appendix D.8 for more details and Appendix E.7 for detailed numerical results.

6 Conclusion

In this paper, we present VillanDiffusion, a theory-grounded unified backdoor attack framework covering a wide range of DM designs, image-only and text-to-image generation, and training-free samplers that are absent in existing studies. Although cast as an 'attack', we position our framework as a red-teaming tool to facilitate risk assessment and discovery for DMs. Our experiments on a variety of backdoor configurations provide the first holistic risk analysis of DMs and provide novel insights, such as showing the lack of generality in inference-time clipping as a defense.

7 Limitations and Ethical Statements

Due to the limited page number, we will discuss further in Appendix C.

8 Acknowledgment

The completion of this research could not have been finished without the support of Ming-Yu Chung, Shao-Wei Chen, and Yu-Rong Zhang. Thank Ming-Yu for careful verification of the derivation and detailed explanation for some complex theories. We would also like to express our gratefulness for Shao-Wei Chen, who provides impressive solutions of complicated SDEs and numerical solution of Navior-Stoke thermodynamic model. Finally, we also appreciate Yu-Rong for his insights of textual backdoor on the stable diffusion.

References

Arpit Bansal, Eitan Borgnia, Hong-Min Chu, Jie S. Li, Hamid Kazemi, Furong Huang, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Cold diffusion: Inverting arbitrary image transforms without noise. In ArXiv , 2022.

Fan Bao, Chongxuan Li, Jun Zhu, and Bo Zhang. Analytic-dpm: an analytic estimate of the optimal reverse variance in diffusion probabilistic models. In ICLR , 2022.

Dmitry Baranchuk, Andrey Voynov, Ivan Rubachev, Valentin Khrulkov, and Artem Babenko. Labelefficient semantic segmentation with diffusion models. In ICLR , 2022.

Huayu Chen, Cheng Lu, Chengyang Ying, Hang Su, and Jun Zhu. Offline reinforcement learning via high-fidelity generative behavior modeling. In ArXiv , 2022.

Shoufa Chen, Peize Sun, Yibing Song, and Ping Luo. Diffusiondet: Diffusion model for object detection. In ArXiv , 2022.

Weixin Chen, Dawn Song, and Bo Li. Trojdiff: Trojan attacks on diffusion models with diverse targets. In CVPR , 2023.

Cheng Chi, Siyuan Feng, Yilun Du, Zhenjia Xu, Eric Cousineau, Benjamin Burchfiel, and Shuran Song. Diffusion policy: Visuomotor policy learning via action diffusion. 2023.

Kristy Choi, Aditya Grover, Trisha Singh, Rui Shu, and Stefano Ermon. Fair generative modeling via weak supervision. In ICML , 2020.

Sheng-Yen Chou, Pin-Yu Chen, and Tsung-Yi Ho. How to backdoor diffusion models? In CVPR , 2023.

Giannis Daras, Mauricio Delbracio, Hossein Talebi, Alexandros G. Dimakis, and Peyman Milanfar. Soft diffusion: Score matching for general corruptions. In ArXiv , 2022.

Prafulla Dhariwal and Alexander Quinn Nichol. Diffusion models beat gans on image synthesis. In NIPS , 2021.

Laurent Dinh, Jascha Sohl-Dickstein, and Samy Bengio. Density estimation using real NVP. In ICLR , 2017.

Hadi Mohaghegh Dolatabadi, Sarah M. Erfani, and Christopher Leckie. Advflow: Inconspicuous black-box adversarial attacks using normalizing flows. In NIPS , 2020.

Aditya Grover, Jiaming Song, Ashish Kapoor, Kenneth Tran, Alekh Agarwal, Eric Horvitz, and Stefano Ermon. Bias correction of learned generative models using likelihood-free importance weighting. In NIPS , 2019.

Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. In NIPS , 2017.

Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In NIPS , 2020.

Jonathan Ho, Chitwan Saharia, William Chan, David J. Fleet, Mohammad Norouzi, and Tim Salimans. Cascaded diffusion models for high fidelity image generation. In JMLR , 2022.

Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. In NIPS Workshop on Deep Generative Models and Downstream Applications , 2021.

Jonathan Ho, Tim Salimans, Alexey A. Gritsenko, William Chan, Mohammad Norouzi, and David J. Fleet. Video diffusion models. In NeurIPS , 2022.

Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. 2021.

Rongjie Huang, Max W. Y. Lam, Jun Wang, Dan Su, Dong Yu, Yi Ren, and Zhou Zhao. Fastdiff: A fast conditional diffusion model for high-quality speech synthesis. In IJCAI , 2022.

Michael Janner, Yilun Du, Joshua B. Tenenbaum, and Sergey Levine. Planning with diffusion for flexible behavior synthesis. In ICML , 2022.

Myeonghun Jeong, Hyeongju Kim, Sung Jun Cheon, Byoung Jin Choi, and Nam Soo Kim. Diff-tts: A denoising diffusion model for text-to-speech. In ISCA , 2021.

Yuming Jiang, Ziqi Huang, Xingang Pan, Chen Change Loy, and Ziwei Liu. Talk-to-edit: Fine-grained facial editing via dialog. In ICCV , 2021.

Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine. Elucidating the design space of diffusion-based generative models. In NIPS , 2022.

Heeseung Kim, Sungwon Kim, and Sungroh Yoon. Guided-tts: A diffusion model for text-to-speech via classifier guidance. In ICML , 2022.

Diederik P. Kingma and Prafulla Dhariwal. Glow: Generative flow with invertible 1x1 convolutions. In NIPS , 2018.

Diederik P. Kingma, Tim Salimans, Ben Poole, and Jonathan Ho. Variational diffusion models. 2021.

Zhifeng Kong, Wei Ping, Jiaji Huang, Kexin Zhao, and Bryan Catanzaro. Diffwave: A versatile diffusion model for audio synthesis. In ICLR , 2021.

Alex Krizhevsky. Learning multiple layers of features from tiny images. 2009.

Xiang Lisa Li, John Thickstun, Ishaan Gulrajani, Percy Liang, and Tatsunori B. Hashimoto. Diffusion-lm improves controllable text generation. In ArXiv , 2022.

Luping Liu, Yi Ren, Zhijie Lin, and Zhou Zhao. Pseudo numerical methods for diffusion models on manifolds. In ICLR , 2022.

Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In ICCV , 2015.

Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps. In NIPS , 2022.

Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm-solver++: Fast solver for guided sampling of diffusion probabilistic models. In NIPS , 2022.

Kangfu Mei and Vishal M. Patel. VIDM: video implicit diffusion models. CoRR , abs/2212.00235, 2022.

Alexander Quinn Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, Ilya Sutskever, and Mark Chen. GLIDE: towards photorealistic image generation and editing with text-guided diffusion models. In ICML , 2022.

Tim Pearce, Tabish Rashid, Anssi Kanervisto, David Bignell, Mingfei Sun, Raluca Georgescu, Sergio Valcarcel Macua, Shan Zheng Tan, Ida Momennejad, Katja Hofmann, and Sam Devlin. Imitating human behaviour with diffusion models. In CoRR , 2023.

Justin N. M. Pinkney. Pokemon blip captions. https://huggingface.co/datasets/lambdalabs/ pokemon-blip-captions/ , 2022.

Vadim Popov, Ivan Vovk, Vladimir Gogoryan, Tasnima Sadekova, and Mikhail A. Kudinov. Grad-tts: A diffusion probabilistic model for text-to-speech. In ICML , 2021.

Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text-conditional image generation with clip latents. In ArXiv , 2022.

Danilo Jimenez Rezende and Shakir Mohamed. Variational inference with normalizing flows. In ICML , 2015.

Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. In CVPR , 2021.

Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. Compvis/stable diffusion v1-4. https://huggingface.co/CompVis/stable-diffusion-v1-4 , 2022.

Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. In CVPR , 2022.

Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Seyed Kamyar Seyed Ghasemipour, Burcu Karagol Ayan, S. Sara Mahdavi, Rapha Gontijo Lopes, Tim Salimans, Jonathan Ho, David J. Fleet, and Mohammad Norouzi. Photorealistic text-to-image diffusion models with deep language understanding. In ArXiv , 2022.

Tim Salimans, Ian J. Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. Improved techniques for training gans. In NIPS , 2016.

Tim Salimans and Jonathan Ho. Progressive distillation for fast sampling of diffusion models. In ICLR , 2022.

Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, Patrick Schramowski, Srivatsa Kundurthy, Katherine Crowson, Ludwig Schmidt, Robert Kaczmarczyk, and Jenia Jitsev. LAION-5B: an open large-scale dataset for training next generation image-text models. In NIPS , 2022.

Christoph Schuhmann, Richard Vencu, Romain Beaumont, Robert Kaczmarczyk, Clayton Mullis, Aarush Katta, Theo Coombes, Jenia Jitsev, and Aran Komatsuzaki. LAION-400M: open dataset of clip-filtered 400 million image-text pairs. NIPS Workshop , 2021.

Jascha Sohl-Dickstein, Eric A. Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. In ICML , 2015.

Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In ICLR , 2021.

Yang Song, Conor Durkan, Iain Murray, and Stefano Ermon. Maximum likelihood training of score-based diffusion models. In NIPS , 2021.

Yang Song and Stefano Ermon. Generative modeling by estimating gradients of the data distribution. In NIPS , 2019.

Yang Song and Stefano Ermon. Improved techniques for training score-based generative models. In NIPS , 2020.

Yang Song, Jascha Sohl-Dickstein, Diederik P. Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In ICLR , 2021.

Lukas Struppek, Dominik Hintersdorf, and Kristian Kersting. Rickrolling the artist: Injecting invisible backdoors into text-guided image generation models. In ArXiv , 2022.

Zhendong Wang, Jonathan J. Hunt, and Mingyuan Zhou. Diffusion policies as an expressive policy class for offline reinforcement learning. In CoRR , 2022.

Qinsheng Zhang and Yongxin Chen. Fast sampling of diffusion models with exponential integrator. In ICLR , 2023.

Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In CVPR , 2018.

Wenliang Zhao, Lujia Bai, Yongming Rao, Jie Zhou, and Jiwen Lu. Unipc: A unified predictor-corrector framework for fast sampling of diffusion models. 2023.

A Code Base

Our code is available on GitHub: https://github.com/IBM/villandiffusion

B Mathematical Derivation

B.1 Clean Diffusion Model via Numerical Reparametrization

Recall that we have defined the forward process q ( x t | x 0 ) := N (ˆ α ( t ) x 0 , ˆ β 2 ( t ) I ) , t ∈ [ T min , T max ] for general diffusion models, which is determined by the content scheduler ˆ α ( t ) : R → R and the noise scheduler ˆ β ( t ) : R → R . Note that to generate the random variable x t , we can also express it with reparametrization x t = ˆ α ( t ) x 0 + ˆ β ( t ) ϵ t . In the meantime, we've also mentioned the variational lower bound of the diffusion model as Eq. (17).

Denote L t ( x t , x t -1 , x 0 ) = D KL ( q ( x t -1 | x t , x 0 ) ∥ p θ ( x t -1 | x t )) , L T ( x T , x 0 ) = D KL ( q ( x T | x 0 ) ∥ p θ ( x T )) , and L 0 ( x 1 , x 0 ) = log p θ ( x 0 | x 1 ) , where D KL ( q || p ) = ∫ x q ( x ) log q ( x ) p ( x ) is the KLDivergence. Since L t usually dominates the bound, we can ignore L T and L 0 and focus on D KL ( q ( x t -1 | x t , x 0 ) ∥ p θ ( x t -1 | x t )) . In Appendix B.1.1, we will derive the clean conditional reversed transition q ( x t -1 | x t , x 0 ) . As for the learned reversed transition q ( x t -1 | x t ) , we will derive it in Appendix B.1.2. Finally, combining these two parts, we will present the loss function of the clean diffusion model in Appendix B.1.3.

B.1.1 Clean Reversed Conditional Transition q ( x t -1 | x t , x 0 )

Similar to the derivation of DDPM, we approximate reversed transition as q ( x t -1 | x t ) ≈ q ( x t -1 | x t , x 0 ) . We also define the clean reversed conditional transition as Eq. (18).

To show that the temporal content and noise schedulers are a ( t ) = k t ˆ β 2 ( t -1) k 2 t ˆ β 2 ( t -1)+ w 2 t and b ( t ) =

ˆ α ( t -1) w 2 t k 2 t ˆ β 2 ( t -1)+ w 2 t , with Bayesian rule and Markovian property q ( x t -1 | x t , x 0 ) = q ( x t | x t -1 ) q ( x t -1 | x 0 ) q ( x t | x 0 ) , we can expand the reversed conditional transition q ( x t -1 | x t , x 0 ) as Eq. (19). We also use an additional function C ( x t , x 0 ) to absorb ineffective terms.

Thus, a ( t ) and b ( t ) can be derived as Eq. (20)

After comparing the coefficients, we can get a ( t ) = k t ˆ β 2 ( t -1) k 2 t ˆ β 2 ( t -1)+ w 2 t and b ( t ) = ˆ α ( t -1) w 2 t k 2 t ˆ β 2 ( t -1)+ w 2 t . Recall that based on the definition of the forward process q ( x t | x 0 ) := N (ˆ α ( t ) x 0 , ˆ β 2 ( t ) I ) , we can obtain the reparametrization: x 0 = 1 ˆ α ( t ) ( x t -ˆ β ( t ) ϵ t ) . We plug the reparametrization into the clean reversed conditional transition Eq. (20).

B.1.2 Learned Clean Reversed Conditional Transition p θ ( x t -1 | x t , x 0 )

To train a diffusion model that can approximate the clean reversed conditional transition, we define a clean reversed transition p θ ( x t -1 | x t ) learned by trainable parameters θ as Eq. (22)

With similar logic in Eq. (21) and replacing ϵ t with a learned diffusion model ϵ θ ( x t , t ) , we can also derive µ θ ( x t , x 0 , t ) as Eq. (23).

B.1.3 Loss Function of Clean Diffusion Models

The KL-divergence loss of the reversed transition can be simplified as Eq. (24), which uses meanmatching as an approximation of the KL-divergence.

Thus, we can finally write down the clean loss function Eq. (25) with reparametrization x t ( x , ϵ ) = ˆ α ( t ) x + ˆ β ( t ) ϵ, ϵ ∼ N (0 , I ) .

B.2 Backdoor Diffusion Model via Numerical Reparametrization

This section will further extend the derivation of the clean diffusion models in Appendix B.1 and derive the backdoor reversed conditional transition q ( x ′ t -1 | x ′ t , x ′ 0 ) and the backdoor loss function in Appendix B.2.1.

B.2.1 Backdoor Reversed Conditional Transition q ( x ′ t -1 | x ′ t , x ′ 0 )

Recall the definition of the backdoor reversed conditional transition in Eq. (26). For clarity, We mark the coefficients of the r as red.

We firstly show that the temporal content, noise, and correction schedulers are a ( t ) = k t ˆ β 2 ( t -1) k 2 t ˆ β 2 ( t -1)+ w 2 t ,

conditional transition q ( x ′ t -1 | x ′ t , x ′ 0 ) as Eq. (27). To absorb the ineffective terms, we introduce an additional function C ′ ( x ′ t , x ′ 0 ) . We mark the coefficients of the r as red.

Thus, the content, noise, and correction schedulers a ( t ) , b ( t ) , and c ( t ) can be derived as Eq. (28). We mark the coefficients of the r as red.

t t Thus, after comparing with Eq. (26), we can get a ( t ) = k t ˆ β 2 ( t -1) k 2 t ˆ β 2 ( t -1)+ w 2 t , b ( t ) = ˆ α ( t -1) w 2 t k 2 t ˆ β 2 ( t -1)+ w 2 t , and

B.3 Backdoor Reversed SDE and ODE

In this section, we will show how to convert the backdoor reversed transition q ( x ′ t -1 | x ′ t ) to a reversedtime SDE with arbitrary stochasticity by q ( x ′ t -1 | x ′ t , x ′ 0 ) . In the first section, referring to [56], we introduce Lemma 1 as a tool for the conversion between SDE and ODE. Secondly, in Appendix B.3.1 and Appendix B.3.2, we will convert the backdoor and learned reversed transition: q ( x ′ t -1 | x ′ t ) and p θ ( x t -1 | x t ) into the backdoor and learned reversed SDE. In the last section Appendix B.3.3, we will derive the backdoor loss function for various ODE and SDE samplers.

Lemma 1 For a first-order differentiable function f : R d × R → R d , a second-order differentiable function g : R → R , and a randomness indicator ζ ∈ [0 , 1] , the SDE d x t = f ( x t , t ) dt + g ( t ) d ¯ w

and d x t = [ f ( x t , t ) -1 -ζ 2 g 2 ( t ) ∇ x t log p ( x t )] dt + √ ζ g ( t ) d ¯ w describe the same stochastic process x t ∈ R d , t ∈ [0 , T ] with the marginal probability p ( x t ) , where ¯ w ∈ R d is the reverse Wiener process.

Proof B.1 For the clarity of the notation, we denote p ( x t ) as p ( x , t ) , follow the Fokker-Planck equation [56], we can convert the SDE d x t = f ( t ) x t dt + g ( t ) d ¯ w to a partial differential equation Eq. (29) and Eq. (30) .

To simplify the second-order partial derivative, in the Eq. (30) , we apply the log-derivative trick: log p ( x , t ) ∇ x p ( x , t ) = ∇ x p ( x ,t ) p ( x ,t )

Thus, we can convert the above results back to an SDE with the Fokker-Planck equation with randomness indicator ζ in Eq. (31) . We can see it will reduce to an ODE while ζ = 0 and SDE while ζ = 1 .

B.3.1 Backdoor Reversed SDE with Arbitrary Stochasticity

Since q ( x ′ t -1 | x ′ t ) ≈ q ( x t -1 | x ′ t , x ′ 0 ) , we can replace x 0 of Eq. (26) with reparametrization x 0 = x ′ t -ˆ ρ ( t ) r -ˆ β ( t ) ϵ t ˆ α ( t ) from Eq. (26). Note that since the marginal distribution q ( x ′ t ) follows Gaussian distribution, we replace the ϵ t with the normalized conditional score function -ˆ β ( t ) ∇ x ′ t log q ( x ′ t | x ′ 0 ) as a kind of reparametrization trick.

Then, based on Eq. (32), we approximate the dynamic d x ′ t with Taylor expansion as Eq. (33)

With proper reorganization, we can express the SDE Eq. (33) as Eq. (34)

We denote F ( t ) = a ( t ) + b ( t ) ˆ α ( t ) -1 , H ( t ) = c ( t ) -b ( t )ˆ ρ ( t ) ˆ α ( t ) , and G ( t ) = √ b ( t ) ˆ β ( t ) ˆ α ( t ) . Since we also assume the forward process q ( x t | x 0 ) and q ( x ′ t | x ′ 0 ) are diffusion processes, thus the coefficient s ( t ) can be derived as s ( t ) = √ ˆ β ( t ) G ( t ) = √ b ( t ) ˆ α ( t ) ˆ β ( t ) . Then, considering different stochasticity of various samplers, we can apply Lemma 1 and introduce an additional stochasticity indicator ζ ∈ [0 , 1] in Eq. (35).

B.3.2 Learned Reversed SDE with Arbitrary Stochasticity

Since q ( x t -1 | x t ) ≈ q ( x t -1 | x t , x 0 ) , we can replace x 0 of Eq. (26) with x 0 = x t -ˆ β ( t ) ϵ θ ( x t ,t ) ˆ α ( t ) , which is derived from the reparametrization of the forward process x t = ˆ α ( t ) x 0 + ˆ β ( t ) ϵ t with the replacement ϵ t with ϵ θ ( x t , t ) .

Then, according to Eq. (36), we approximate the dynamic d x t with Taylor expansion as Eq. (37)

With proper reorganization, we can express the SDE Eq. (37) with F ( t ) = a ( t ) + b ( t ) ˆ α ( t ) -1 ,

Then, we also consider arbitrary stochasticity and introduce an additional stochasticity indicator ζ ∈ [0 , 1] with Lemma 1. As we use a diffusion model ϵ θ as an approximation for the normalized score function: ϵ θ ( x t , t ) = -ˆ β ( t ) ∇ x t log q ( x t ) , we can derive the learned reversed SDE with arbitrary stochasticity in Eq. (39).

B.3.3 Loss Function of the Backdoor Diffusion Models

Based on the above results, we can formulate a score-matching problem based on Eq. (35) and Eq. (39) as Eq. (40). The loss function Eq. (40) is also known as denoising-score-matching loss [54], which is a surrogate of the score-matching problem since the score function ∇ x ′ t log q ( x ′ t ) is intractable.

Thus, we can finally write down the backdoor loss function Eq. (41).

B.4 The Derivation of Conditional Diffusion Models

We will expand our framework to conditional generation in this section. In Appendix B.4.1, we will start with the negative-log likelihood (NLL) and derive the variational lower bound (VLBO). Next, in Appendix B.4.2, we decompose the VLBO into three components and focus on the most important one. in Appendix B.4.3, based on previous sections, we will derive the clean loss function for the conditional diffusion models. The last section Appendix B.4.4 will combine the results of Appendix B.1 and Appendix B.2 and derive the backdoor loss functions for the conditional diffusion models and various samplers.

B.4.1 Conditional Negative Log Likelihood (NLL)

To train a conditional diffusion model ϵ θ ( x 0 , c ) , we will optimize the joint probability learned by the model arg min θ -log p θ ( x 0 , c ) . We denote c as the condition, which can be prompt embedding for the text-to-image generation, and the D x i : T is the domain of random vectors x i , . . . , x T , x t ∈ R d , t ∈ [ i, T ] , i ≤ T . Therefore, we can derive the conditional variational lower bound L C V LB as Eq. (42).

B.4.2 Conditional Variational Lower Bound (VLBO)

In this section, we will further decompose the VLBO Eq. (42) and show that minimizing the KL-divergence D KL ( q ( x t -1 | x t , x 0 ) || p θ ( x t -1 | x t , c )) is our main objective in Eq. (43). For the simplicity, we denote E q ( x 0 ,..., x T ) as E q . With Markovian assumption, the latent x t at the timestep t only depends on the previous latent x t -1 and the condition c .

B.4.3 Clean Loss Function for the Conditional Diffusion Models

We define the learned reversed transition p θ ( x t -1 | x t , c ) as Eq. (44).

We plug in a conditional diffusion model ϵ θ ( x t , t, c ) to replace the unconditional diffusion model ϵ θ ( x t , t ) .

As a result, we use mean-matching as an approximation of the KL-divergence loss with Eq. (46).

Finally, we can reorganize the Eq. (46) as Eq. (47), which is the clean loss function for the conditional diffusion models.

B.4.4 Loss Function of the Backdoor Conditional Diffusion Models

Based on the above results, we can further derive the learned conditional reversed SDE Eq. (48), while the backdoor one remains the same as Eq. (35), which is caused by the identical backdoor reversed transition q ( x ′ t -1 | x ′ t , x ′ 0 ) of the KL-divergence loss.

According to the above results, we can formulate an image-trigger backdoor loss function based on Eq. (35) and Eq. (48) as Eq. (49). The loss function Eq. (49) is also known as denoising-scorematching loss [54], which is a surrogate of the score-matching problem since the score function ∇ x ′ t log q ( x ′ t ) is intractable. Here we denote the reparametrization x ′ t ( x , r , ϵ ) = ˆ α ( t ) x + ˆ ρ ( t ) r + ˆ β ( t ) ϵ .

Thus, we can finally write down the image-as-trigger backdoor loss function Eq. (50) for the conditional diffusion models.

C Limitations and Ethical Statements

Although VillanDiffusion works well with hot diffusion models, our framework does not cover all kinds of diffusion models, like Cold Diffusion [1] and Soft Diffusion [10], etc. However, even though our framework does not cover the deterministic generative process, we believe our method can still extend to more diffusion models, and we also call for the engagement of community to explore more advanced and universal attack on diffusion models.

On the other hand, although our framework aims to improve the robustness of diffusion models, we acknowledge the possibility that our findings on the weaknesses of diffusion models might be misused. Nevertheless, we believe our red-teaming effort can contribute to the development of robust diffusion models.

D Additional Experiments

D.1 Backdoor Attacks on DDPM with CIFAR10 Dataset

We will present experimental results for more backdoor trigger-target pairs and samplers, including the LMSD sampler, which is implemented by the authors of EDM [25], in Fig. 7. The results of the ANCESTRAL sampler come from [9]. We also provide detailed numerical results in Appendix E.1

(a) (Stop Sign, NoShift)

FID

(b) (Stop Sign, NoShift)

MSE

FID

MSE

DDPM, CIFAR10, (Stop Sign : No Shift)

DDPM, CIFAR10, (Stop Sign : No Shift)

DDPM, CIFAR10, (Grey Box : No Shift)

DDPM, CIFAR10, (Grey Box : No Shift)

Poison Rate v.s FID

Poison Rate V.s MSE

Poison Rate v.s FID

Poison Rate V.s MSE

14

DEIS

DPM.SOLVER.03.

ANCESTRAL

DDIM

DPM SOLVER 02

Samplers

OPM SOIVER++ 02

HEUN

UMSD

PNDM

D

D09M

ANCESTRAL

DEIS

DPM SOLVER 03

DPM SOLVER 02

Samplers

ZO.+.+NGK1OSNNG

C0 ++83A105 x0

HEUN

UMSD

PNDM

50

DPM SOLVER 03

ANCESTRAL

DDIM

DEIS

Samplers

HEUN

UMSD

PNDM

EO ++VGA1OS NHO

10

DPR SODVER 03

ANCESTRAL

DOIM

DEIS

DPM S0UVER 02

Samplers

+ DPM SODVER++ 02

DPM SODVER+ + 03

HEUN

UMSD

PNDM

fm

3SW

10-s

10-f

30-5

Poison Rate

0.4

0.6

0:0

0.2

Poison Rate

0.4

Q16

0.2

Poison Rate

0.4

0.6

0:2

Poison Rate

0.4

DDPM, CIFAR10, (Stop Sign : Shift)

DDPM, CIFAR10, (Stop Sign : Shift)

Poison Rate v.s FID

Poison Rate v.s MSE

Poison Rate v.s FID

Poison Rate v.s MSE

★

+

DPM SOLVER.02

ANCESTRAL

DOM

DtIs

DPM SOLVER.03

Samplers

INDM.

ANCESTRAL

DDM

DPM SOIVER02

DEIS

DPM SOLVER 03

Samplers

←++

HEUN

UMSD

PNDM

35

★

量

+

ANCESTRAL

Samplers

PM50UER+02

++*+

DPM S0OU/ER++ 03

PNDM

★

量

★

ANICESTAL

00IM

DPR SOLVER 03

Samplers

←++

HE

PNDM

BSW

0.2

Poison Rate

0.4

0.6

Poison Rate

0.4

90

Poison Rate

0.4

0.6

Poison Rate

0.4

0.6

+

(i) (Stop Sign, Corner)

FID

(j) (Stop Sign, Corner)

MSE

FID

MSE

DDPM, CIFAR10, (Stop Sign : Cormer)

DDPM, CIFAR10, (Stop Sign : Cormer)

Poison Rate v.s FID

Poison Rate v.s MSE

Poison Rate v.s FID

Poison Rate v.s MSE

★

★

DPM SOLVER 02

ANCESTIAL

DEIS

Samplers

PNDM

DPM S0[VER++ 03

HEUN

LMSD

★

+

ANCESTRAL

00IM

DPM SOLVER 0]

Samplers

+

￥

+

DPM 50LVER++ 02

HEUN

UMSD

PNDM

★

量

+

00M

DPM SOLVER 02

ANCESTIAL

DEIS

DPM:

SOLVER 03

Samplers

DIPM SOL/ER++ 02

DPM.50U/ER++ .03.

HEUN

PNDM

★

★

ANCESTRAL

OIM

DPM SOLVER 03

Samplers

+

￥

+

HEUN

UASD

PNOM

Poison Rate

0.4

90

0.0

0.2

Poison Rate

0.4

0.6

Poison Rate

0.4

0.6

80

0.2

Poison Rate

0.4

0.6

0.8

DDPM, CIFAR10, (Stop Sign : Shoe)

DDPM, CIFAR10, (Stop Sign : Shoe)

Poison Rate v.s FID

Poison Rate v.s MSE

Poison Rate v.s FID

Poison Rate v.s MSE

★

DPM S00VER.02

ANCESTRAL

DPM 500VER.03

Samplers

OPM SOLVER++02

HEUN

DPM 50(VER++ 03

PNDM.

★

+

中

ANCESTRAL

DPM SOIVER 02

000M

DEIS

DPM SOLVER 03

Samplers

E

PNDM

★

+

DPM SOLVER02

ANCESTRAL

DPM S0LVER 0)

Samplers

DPMOVER+.02

+

HEUN

UISD

PNOM

cO ++#3A105 0

★

★

ANCESTRAL

00

DPM SOLVER 03

Samplers

E

INOM

Poison Rate

0.4

0.6

Poison Rate

0.4

0.6

Poison Rate

0.4

0.6

Poison Rate

0.4

0.6

DDPM, CIFAR10, (Stop Sign : Hat)

DDPM, CIFAR10, (Stop Sign : Hat)

Poison Rate v.s FID

Poison Rate v.s MSE

Poison Rate v.s FID

Poison Rate v.s MSE

★

DPM SOLVER 02

ANCESTRAL

00M

DEIS

DPM SOLVER. 03

Samplers

+

*

+

NDM

HEUN

UMSD

★

DPM SOLVER 02

ANCESTRAL

DDIM

DES

CO N3/IOS WAC

Samplers

HEUN

20 ++3105

LMSD

c0 ++#3/105 W0

PNDM

★

AICESTAL

003M

OPM SOUVER O3

Samplers

DPM 5OLVER++ 02

HEUN

LM50

PNOM

★

+

OPM SOUVER 02

ANCESTRAL

DOIM

DEis

DPM SOLVER 03

Samplers

+

HEUN

UASD

NOM

SW

Poison Rate

0.4

0.6

Poison Rate

0.4

90

Poison Rate

0.4

0.6

0.2

Poison Rate

0.4

0.6

D.2 Backdoor Attacks on DDPM with CelebA-HQ Dataset

We evaluate our method with more samplers and backdoor trigger-target pairs: (Stop Sign, Hat) and (Eyeglasses, Cat) in Fig. 8. Note that the results of the ANCESTRAL sampler come from [9]. Please check numerical results in Appendix E.2

DDPM, CelebA-HQ, (Eye Glasses : Cat)

DDPM, CelebA-HQ, (Eye Glasses : Cat)

DDPM, CelebA-HQ, (Stop Sign : Hat)

DDPM, CelebA-HQ, (Stop Sign : Hat)

Poison Rate v.s FID

Poison Rate V.s MSE

Poison Rate V.s FID

Poison Rate V.s MSE

24

26

10-2

DEIS

DDIM

DPM SOLVER 02

Samplers

CO ++43A0S K0

HEUN

UNIPC

PNDI

DDIM

DEIS

DPM SOLVER 02

DPM SOLVER 03

sardues

十 DPM SOLVER++ 03

HEUN

UNIPC

PIDA

30

口

22

3SW

3SW

10-2

8t

9

34

12

DPM SOU/ER++ 02

DDIM

DEIS

DPM SODVER 02

DPM SOUVER 03

Samplers

cO ++H3AOS xO

HEUN

PNOM

UNPC

10-3

10~

20

1.5

10-3

10-4

DEIS

DPM SOIVER.02

DPM S0IVER 03

DDIM

Samplers

k0 ++x3A105 I50

HEUN

PNOM.

UN(PC

0.0

0.1

0.2

Poison Rate

0.3

0.4

0.5

0.6

0.7

0.0

0.1

0.2

Poison Rate

0.3

0.4

0.5

0.6

0:0

0.1

0.2

Poison Rate

0.3

0.4

0.5

0.6

0.0

0.1

0.2

Poison Rate

0.3

0.4

0.5

0.6

0.7

Figure 8: FID and MSE scores of various samplers and poison rates for the DDPM [16] and the CelebA-HQ dataset. We express trigger-target pairs as (trigger, target).

D.3 Backdoor Attacks on Latent Diffusion Models (LDM)

The pre-trained latent diffusion models (LDM) [45] are trained on CelebA-HQ with 512 × 512 resolution and 64 × 64 latent space. We fine-tune them with learning rate 2e-4 and batch size 16 for 2000 epochs. We examine our method with trigger-target pair: (Eyeglasses, Cat) and (Stop Sign, Hat) and illustrate the FID and MSE score in Fig. 9. As the Fig. 9 shows, the LDM can be backdoored successfully for the trigger-target pairs: (Stop Sign, Hat) with 70% poison rate. Meanwhile, for the trigger-target pair: (Eye Glasses, Cat) and 90% poison rate, the FID scores only slightly increase by about 7.2% at most. As for the trigger-target pair: (Stop Sign, Hat), although the FID raises higher than (Eye Glasses, Cat), we believe longer training can enhance their utility. Please check Appendix E.3 for the numerical results of the experiments.

LDM, CelebA-HQ, (Eye Glasses : Cat)

LDM, CelebA-HQ, (Eye Glasses : Cat)

LDM, CelebA-HQ, (Stop Sign : Hat)

LDM, CelebA-HQ, (Stop Sign : Hat)

Poison Rate v.s FID

Poison Rate v.s MSE

Poison Rate v.s FID

Poison Rate v.s MSE

35.0

S'cC

DPR S0(V[# 02

DEIS

Samplers.

UNIPC

20 ++#3A10S WH0

35.0

32.5

32.5

27.5

30.0

MSE

FID

30.0

3SW

30~2

27.5

25.0

25.0

22.5

10

17.5

DPM S0LVER 02

DEIS

Samplers

UNIPC

22.5

20.0

DEIS

DPM SOLVER 02

Samplers

DPM SOLVER+ + 02

UNIPC

DPM S0UVER 02

DEIS

Samplers

UNIFC

DPM SOLVER+ + 02

0.0

Poison Rate

0.4

0.6

0.0

0.2

Poison Rate

0.4

0.6

Q:D

Poison Rate

0.4

0.6

0.0

0.2

Poison Rate

0.4

0.6

Figure 9: FID and MSE scores of various samplers and poison rates for the latent diffusion model (LDM) [45] and the CelebA-HQ dataset. We express trigger-target pairs as (trigger, target).

D.4 Backdoor Attacks on Score-Based Models

We trained the score-based model: NCSN [56, 54, 55] on the CIFAR10 dataset with the same model architecture as the DDPM [16] by ourselves for 800 epochs and set the learning rate as 1e-4 and batch size as 128. The FID score of the clean model generated by predictor-correction samplers (SCORE-SDE-VE [56]) for the variance explode models [56] is about 10.87. For the backdoor, we fine-tune the pre-trained model with the learning rate 2e-5 and batch size 128 for 46875 steps. To enhance the backdoor specificity and utility, we augment Gaussian noise into the training dataset, which means the poisoned image r will be replaced by a pure trigger g . The augmentation can let the model learn to activate the backdoor even if there are no context images. We present our results in Fig. 10 and can see with 70% augment rate, our method can achieve 70% attack success rate based on Fig. 10c as the FID score increases by 12.7%. Note that the augment rate is computed by the number of augmented Gaussian noises / the size of the original training dataset. We also present detailed numerical results in Appendix E.4.

NCSN, CIFAR10, (Stop Sign : Hat)

NCSN, CIFAR10, (Stop Sign : Hat)

NCSN, CIFAR10, (Stop Sign : Hat)

Poison Rate v.s FID

Poison Rate v.s MSE

Poison Rate v.s MSE Threshold

18

SCORE-SDE-VE AR:0.3

Samplers

SCOBE-SDE-VE AR:0.9

0.1200

0.80

SCORE-SDE-VE AR:0.3

Samplers

SCORESDE-VEAR:0.9

17

SCORE-SDE-VE AR:0.5

ORE-5DE-VE AR:0.7

SCORE-SDE-VE AR:7.0

SCORE-SDE-VE AR:3.0

0.1175

0.1150

0.75

SCORE-SDE-VE AR:0.5

SCORE-SDE-VE AR:0.7

SCDRE-SDE-VE AR:7.0

SCDRE-SDE-VE AR:3.0

MSE Threshold

16

0.1125

0.70

D

15

MSE

0.1100

0.65

0.1075

14

0.1050

09°0

13

0.1025

SCORE-SDE-VE AR:0.3

Samplers

SCORE-SDE-VE AR:0.9

0.55

SCORE-SDE-VE AR:0.5

SCORE-SDE-VE AR:3.0

12

0.1000

SCORE-SDE-VE AR:0.7

SCORE-SDE-VE AR:7.0.

0.05

0.10

0.15

0.20

0.25

0.30

0.05

0.10

0.15

0.20

0.25

0.30

0.05

0.10

0.15

0.20

0.25

0.30

Poison Rate

Poison Rate

Poison Rate

Figure 10: FID and MSE scores of various samplers and poison rates for the score-based model (NCSN) [54, 55, 56] and the CIFAR10 dataset. We express trigger-target pairs as (trigger, target). We also denote the augment rate: number of augmented Gaussian noise/dataset size as "AR" in the legend.

D.5 Evaluation on DDIM with Various Randomness η

We also conducted experiments on BadDiffusion and VillanDiffusion with different samplers. The numerical results are presented in Appendix E.8. We found that BadDiffusion is only effective in SDE samplers. When DDIM goes down, which means the sampler becomes more likely an ODE, the MSE of VillanDiffusion trained for ODE samplers would decrease, but BadDiffusion would increase. Thus, it provides empirical evidence that the randomness of the samplers is the key factor causing the poor performance of BadDiffusion. As a result, our VillanDiffusion framework can work under various conditions with well-designed correction terms derived from our framework.

D.6 Comparison Between BadDiffusion and VillanDiffusion on CIFAR10

We conduct an experiment to evaluate BadDiffusion and VillanDiffusion (with ζ = 0 ) on ODE samplers, including UniPC [61], DPM-Solver [34, 35], DDIM [52], and PNDM [32]. We also present the detailed numerical results in Appendix E.9. Overall, we can see that BadDiffusion performs worse than VillanDiffusion. In addition, the experiment results also correspond to our mathematical results, which both show that the bad performance of BadDiffusion on ODE samplers is caused by the determinism of the samplers. Once we take the randomness hyperparameter ζ into account, we can derive an effective backdoor loss function for the attack.

D.7 Inference-Time Clipping Defense

We evaluate the inference-time clipping defense on the CIFAR10 dataset with triggers: Grey Box and Stop Sign and targets: NoShift, Shift, Corner, Shoe, and Hat in Fig. 11. The results of the ANCESTRAL sampler are from [9]. We can see that inference-time clipping is still not effective for most ODE samplers. Please check Appendix E.6 for the numerical results.

D.8 VillanDiffusion on the Inpaint Tasks

Similar to [9], we also evaluate our method on the inpainting tasks with various samplers. We design 3 kinds of different corruptions: Blur , Line , Box . Blur means we add Gaussian noise N (0 , 0 . 3) to corrupt the images. Line and Box mean we crop part of the image and ask the diffusion models to recover the missing area. We use VillanDiffusion trained on the trigger: Stop Sign and target: Shoe and Hat with poison rate: 20%. During inpainting, we apply UniPC [61], DEIS [59], DPM Solver [34], and DPM Solver++ [35] samplers with 50 sampling steps. To evaluate the recovery quality, we generate 1024 images and use LPIPS [60] score to measure the similarity between the covered images and ground-truth images. We illustrate our results in Fig. 12. We can see our method achieves both high utility and high specificity. The detailed numerical results are presented in Appendix E.7.

(a) (Stop Sign, NoShift)

FID

(b) (Stop Sign, NoShift)

MSE

FID

MSE

(e) (Stop Sign, Shift) FID

(f) (Stop Sign, Shift) MSE

(g) (Grey Box, Shift) FID (h) (Grey Box, Shift) MSE

(i) (Stop Sign, Corner)

FID

(j) (Stop Sign, Corner)

MSE

FID

MSE

(m) (Stop Sign, Shoe) FID (n) (Stop Sign, Shoe) MSE (o) (Grey Box, Shoe) FID (p) (Grey Box, Shoe) MSE

DDPM, CIFAR10, Defense: 1.0, (Stop Sign : No Shift)

DDPM, CIFAR10, Defense: 1.0, (Stop Sign : No Shift)

DDPM, CIFAR10, Defense: 1.0, (Grey Box : No Shift)

DDPM, CIFAR10, Defense: 1.0, (Grey Box : No Shift)

Poison Rate v.s FID

Poison Rate V.s MSE

Poison Rate v.s FID

Poison Rate V.s MSE

140

160

80

DETS

DPM SODVER 02

DPM SODVER 03

Samplers

HEUN

UMSD

PNDM

UNIPC

.DPM S0DVER+±.03

DEIS

DPM SOOVER 02

Samplers

HEUN

UMSD

PNDM

UNIPC

175

150

125

10

DEIS

DPM S0LVER 02

DPM SOLVER 03

Samplers

+

HEUN

UMSD

PNDM

UNIPC

120

100

L0

500

SL

10

50

25

DIPM SOCVER++ 02

DEIS

HEUN

UMSD

UNIPC

NON

10-I

10

Poison Rate

0.4

9'0

02

Poison Rate

0.4

99

00

Poison Rate

0.4

0.6

0.8

0.0

0.2

Poison Rate

0.4

0.6

DDPM, CIFAR10, Defense: 1.0, (Stop Sign : Shift)

DDPM, CIFAR10, Defense: 1.0, (Stop Sign : Shift)

Poison Rate v.s FID

Poison Rate v.s MSE

Poison Rate v.s FID

Poison Rate v.s MSE

★

OPM SOLVER 03

DFPM S0UVER 02

DEIS

DFM S0LVER++ 03

￥

+

HEUN

UA50

★

DEIS

DPM S0UVER.02

DPM SOUVER 03

DPM S0UVER++ 02

DPM50UVEF

Samplers

.02

+

PNOM

JNIPC

091

★

+

DEIS

DPM SOLVER 02

DPM SOLVER 03

20.++5

Samplers

+

+

NDM

HEUN

UMSD

+

DEIS

DPM SOLVER 03

DPM SOLVER 02

Samplers

+

+

PNDM

HEUN

UMSD

UNIPC

Poison Rate

0.4

90

Poison Rate

0.4

90

Poison Rate

0.4

0.4

Poison Rate

0.4

9'0

DDPM, CIFAR10, Defense: 1.0, (Stop Sign : Corner)

DDPM, CIFAR10, Defense: 1.0, (Stop Sign : Corner)

DDPM, CIFAR10, Defense: 1.0, (Grey Box : Cormer)

Poison Rate v.s FID

Poison Rate v.s MSE

Poison Rate v.s FID

Poison Rate v.s MSE

150

★

+

ANCESTIML

DEIS

DPM 50LVER 03

DPM S0UVER++ 02

DPM SOLVER 02

Samplers

+

DPM.SOLV/ER++ 03

HEUN

LMSO

NOM

ANIPt

ANCESTRAL

DPH S00VER.03

DPM 500ER++ 02

Samplers

+

+

HEUN

HSD

ANCESTRAL

DEIS

DPM 50LVER 02

HEUN

OPM:

Poison Rate

0.4

90

0.2

Poison Rate

0.4

90

Poison Rate

0.4

0.6

Poison Rate

0.4

0.6

DDPM, CIFAR10, Defense: 1.0, (Stop Sign : Shoe)

DDPM, CIFAR10, Defense: 1.0, (Stop Sign : Shoe)

Poison Rate v.s FID

Poison Rate v.s MSE

Poison Rate v.s FID

Poison Rate v.s MSE

★

+

DEIS

DPM SOLVER 02

DPM SOLVER 03

DPM 50UVER++ 02

Samplers

十

?

+

HEUN

UMSD

PNDM

★

★

DEIS

DPM SOLVER 02

DPM 50LVER 03

cO ++#305 NO

+

￥

+

HEUN

UMSD

P%OM

★

DEIS

DPM SOLVER 02

DPM SOLVER 03

PM

1EUN

MSD

NDM

+

★

★

DEIS

DPM SOLVER 02

DPM S0LVER 03

DPM 50LVER++ 02

2O ++*3/105 W0

Samplers

+

HEUN

PNDM

UNIPC

40

FID

Poison Rate

0.4

0.6

Poison Rate

0.6

Poison Rate

0.4

0.6

Poison Rate

0.4

0.6

DDPM, CIFAR10, Defense: 1.0, (Stop Sign : Hat)

DDPM, CIFAR10, Defense: 1.0, (Stop Sign : Hat)

Poison Rate v.s FID

Poison Rate v.s MSE

Poison Rate v.s FID

Poison Rate v.s MSE

0St

ANCESTIAL

DEIS

DPM SOLVER 02

DPM 50IVER 03

DPM 50UVER++ 02

Samplers

+

2O +*3OS JO

URSD

HEUN

0St

★

ANCESTIAL

DEIS

DPM SOLV/ER 02

DPM SOLVER03

20 ++05 W0

Samplers

DPM.SOLVER++ 03

LMSD

HEUN

PNDM

DEIS

DPM S0OV/ER 02

DPM S0LVER 03

DPM 50VER++ 02

Samplers

+

+

CO ++OS

UMSD

DPMSOUVER03

ANCESTRAL

DEIS

DPM 50U/ER 02

+

HEUS

OPM

SOCVER++ 03

0

Poison Rate

0.6

0.0

0.2

Poison Rate

0.4

0.6

Poison Rate

0.6

Poison Rate

0.4

0.6

0.32

0.30

DDPM, CIFAR10, (Stop Sign : Hat)

Poison Rate v.s LPIPS

DPM S0UVER 02. BoX

nj 's30

DEIS, Line

Samplers

DPM S0UVER++ 02, BoK

UNIPC. Blur

DPM S0UVER+ 02, Blur

I-0t

DDPM, CIFAR10, (Stop Sign : Hat)

Poison Rate V.s MSE

DEIS, Blur

DPM S0DVER 02, Blur

Samplers

DPM 50DVER++ 02: 8or

DPM S0DVER 02, Line

UNIPC, Blur

DPM SOUVER++ 02, Blur

0.32

0.30

0.31

DDPM, CIFAR10, (Stop Sign : Shoe)

Poison Rate V.s LPIPS

DEIS. Blur

DEIS, Bex

eu1 °5130

DPM SOLVER 02. 80X

Samplers

UNPC, Blur

30-1

DDPM, CIFAR10, (Stop Sign : Shoe)

Poison Rate V.s MSE

Sdld’7

0.28

MSE

LPIPS

0.29

MSE

0.28

0.26

0.24

10

0.27

0.25

0.26

10

1:0

DEIS, Blur

DPM S0UVER 02, Blur

DPM SOLVER 02. Box

DPM S0DVER 02, Uine

UNIPC, Blur

0.0

0.2

Poison Rate

0.4

0.6

0.8

0.0

0.2

Poison Rate

0.4

0.6

0.8

0.0

Poison Rate

0.4

0.6

0.0

0.2

Poison Rate

0.4

0.6

Figure 12: LPIPS and MSE scores of various samplers and poison rates for the 3 kinds of inpainting tasks: Blur , Line , and Box . The backdoor model is DDPM trained on the CIFAR10 dataset. We express trigger-target pairs as (trigger, target).

E Numerical Results

E.1 Backdoor Attacks on DDPM with CIFAR10 Dataset

We present the numerical results of the trigger: Stop Sign and targets: NoShift, Shift, Corner, Shoe, and Hat in Table 2, Table 3, Table 4, Table 5, and Table 6 respectively. As for trigger Grey Box, we also show the results for the targets: NoShift, Shift, Corner, Shoe, and Hat in Table 7, Table 8, Table 9, Table 10, and Table 11.

E.2 Backdoor Attacks on DDPM with CelebA-HQ Dataset

We show the numerical results for the trigger-target pairs: (Eyeglasses, Cat) and (Stop Sign, Hat) in Table 12 and Table 13 respectively.

E.3 Backdoor Attacks on Latent Diffusion Models (LDM)

We show the experiment results of the trigger-target pair: (Eye Glasses, Cat) in Table 14 and (Stop Sign, Hat) in Table 15.

E.4 Backdoor Attacks on Score-Based Models

We provide the numerical results for the trigger-target pair: (Stop Sign, Hat) in the Table 16.

E.5 Caption-Trigger Backdoor Attacks on Text-to-Image DMs

We will present the numerical results of the Pokemon Caption dataset in Table 17 and Table 18. For the CelebA-HQ-Dialog dataset, we will show them in Table 19 and Table 20.

E.6 Inference-Time Clipping Defense

For the trigger Stop Sign, we present the numerical results of the inference-time clipping defense with targets: NoShift, Shift, Corner, Shoe, and Hat in Table 21, Table 22, Table 23, Table 24, and Table 25 respectively. As for the trigger Grey Box, we also show our results of the targets: NoShift, Shift, Corner, Shoe, and Hat in Table 26, Table 27, Table 28, Table 29, and Table 30 respectively.

E.7 VillanDiffusion on the Inpaint Tasks

For the trigger Stop Sign, we present the numerical results of the inpainting tasks: Blur , Line , and Box with targets Hat and Shoe in Table 32 and Table 31 respectively.

E.8 BadDiffusion and VillanDiffusion on CIFAR10 with Different Randomness η

For the trigger Stop Sign, we present the numerical results of various randomness η with targets: Hat and Shoe in Table 33 respectively.

E.9 Comparison Between BadDiffusion and VillanDiffusion on CIFAR10

For the trigger Stop Sign, we show the numerical results of the comparison between BadDiffusion and VillanDiffusion in Table 34.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents a unified backdoor attack framework (VillanDiffusion) to expand the current scope of backdoor analysis for DMs. The proposed framework covers mainstream unconditional and conditional DMs (denoising-based and score-based) and various training-free samplers for holistic evaluations.\n\nSTRENGTHS:\n1. Their experimental results not only analyzed DDPM but also score-based models. Besides, they also analyzed other acceleration sampling methods.\n2. Their experiments included caption triggers.\n\nWEAKNESSES:\n1. To show that no modifications are needed to the sampling process, the article should include details of the sampling process.\n2. The order of formulas 8-12 in the article is not clear enough. To describe in the order of forward process → backward process → sampling process may be more clear.\n3. Please check some spelling errors in the article. For example, \"Praobility\" in the title on line 138. \n4. Please check whether the last term in Eq. 4 is $L_0(x_1,x_0)$.\n5. The article claims that BadDiffusion will fail when the coefficient is $\\frac{1}{2}$ (line 55), but there is no further explanation.\n6. The article claims that an attacker only needs to obtain the model parameters $\\theta_{download}$. However, to execute a backdoor attack, some adjustments need to be made to the initial noise. This is difficult to achieve in reality, and the article needs to emphasize this point.\n7. Although the article extends the attack to other models, such as score-based models, there is no essential difference from BadDiffusion[2]. On BadDiffusion, just changing the coefficient of the noise term $1-\\bar\\alpha_t \\mathbf{I}$ in the formula $q\\left(\\mathbf{x}_{t}^{\\prime} \\mid \\mathbf{x}_{0}^{\\prime}\\right):=\\mathcal{N}\\left(\\mathbf{x}_{t}^{\\prime} ; \\sqrt{\\bar{\\alpha}_{t}} \\mathbf{x}_{0}^{\\prime}+\\left(1-\\sqrt{\\bar{\\alpha}_{t}}\\right) \\mathbf{r},\\left(1-\\bar{\\alpha}_{t}\\right) \\mathbf{I}\\right)$ (Eq. 6 in their article [2]) to $b_k \\mathbf{I}$ can easily obtain the results in this article. In addition, Eq. 11 is only a change of sign of Eq. 38 in [1].\n\n\n[1] Song, Y., Sohl-Dickstein, J., Kingma, D. P., Kumar, A., Ermon, S., & Poole, B. (2020). Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:2011.13456.\n\n[2] Chou, S. Y., Chen, P. Y., & Ho, T. Y. (2023). How to backdoor diffusion models?. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (pp. 4015-4024).\n\nQUESTIONS:\nPlease see the Weakness part.\n\nLIMITATIONS:\nThe authors didn’t mention any potential limitations.\nThe authors can list limitations of the application. For example, to apply their method, the attacker needs to access the initial noise, which is not practical sometimes. Besides, the negative societal impact should also be included.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-01"}

comments: SUMMARY:
This paper proposed a backdoor attack framework called VillanDiffusion, which extends the existing backdoor analysis capabilities for deep models (DMs). By encompassing both unconditional and conditional DMs, including denoising-based and score-based models, as well as incorporating training-free samplers, the proposed framework enables holistic evaluations of backdoor attacks. Experiments demonstrate that VillanDiffusion not only facilitates the analysis of diverse DM configurations but also offers valuable insights into caption-based backdoor attacks on DMs.

STRENGTHS:
The paper is written in a clear and understandable manner, making it accessible to a wide range of readers. The authors effectively convey their ideas and concepts, ensuring that the content is comprehensible. Besides, the authors provide a thorough analysis of backdoor attacks on deep models and propose a unified approach, VillanDiffusion.

WEAKNESSES:
There are concerns regarding the effectiveness of the VillanDiffusion framework The framework proves to be effective when the poison ratio reaches up to 20%, which is significantly higher than what is typically observed in other tasks. This discrepancy raises doubts about the practicality of the framework, emphasizing the need for further investigation and evaluation across various tasks and poison ratios to ensure its broader applicability.

QUESTIONS:
See the above weakness.

LIMITATIONS:
Yes
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-05

comments: SUMMARY:
This paper proposes a universal backdoor attack framework on diffusion models facing different kinds of content schedulers, different kinds of samplers, and conditional and unconditional tasks.

STRENGTHS:
1. This paper proposes a universal backdoor attack framework on diffusion models, which are important.
2. The experiments are sufficient.
3. This paper is well written and technically sound.

WEAKNESSES:
1. From my point of view, backdoor in diffusion models is an end-to-end process, can you explain the main difference from some prior works in diffusion models such as [1]? If the only difference is to test on different diffusion models, the contribution is limited.
2. There is no comparison with the former methods, and thus I cannot find out whether there is improvement in backdoor attack.
3.There are some flaws such as line 191 learns should.



[1] Chou S Y, Chen P Y, Ho T Y. How to backdoor diffusion models?[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023: 4015-4024.

QUESTIONS:
Can you explain the main difference from some prior works in diffusion models such as [1]?

LIMITATIONS:
Yes
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-06

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper presents VillanDiffusion, a framework for analyzing backdoor attacks on different types of diffusion models (DMs). VillanDiffusion covers various DM configurations such as unconditional and conditional DMs or training-free samplers and provides new insights into caption-based backdoor attacks.\n\nSTRENGTHS:\n+ originality, the paper presents a unified framework for analyzing backdoor attacks on DMs, covering various configurations and training-free samplers. the soundness of this paper is also noteworthy, with detailed proof in Appendix.\n\n+ The experiments are comprehensive and demonstrate the effectiveness of the VillanDiffusion framework in detecting backdoor attacks on DMs.\n\n + The paper is well-structured, with each section building on the previous one, making it easy to follow.\n\nWEAKNESSES:\n- the effectiveness of their backdoor attack on Celeba is limited: the increased FID score is huge in this scenario, which does not show the advantage of their method against other baselines.\n\nQUESTIONS:\n- how to read the figure 2a and 2e? on line 278, this paper says that \"From Fig. 2a and Fig. 2e, we can see the FID score of the backdoored DM on CelebA-HQ-Dialog is slightly better than the clean one\". However, it seems that data in Fig. 2a and Fig. 2e are the generated clean samples by the backdoored model. \n\n- lack of further analysis about the robustness of various configurations of DMs against backdoor attacks: since VillanDiffusion can generalize to different mechanisms, samplers, and schedulers, it is worthwhile to analyze how the different modules affects the robustness of DMs.\n\n- how DMs pretrained on cifar-10 become stronger in terms of utility after being fine-tuned on cifar-10? on line 298, this paper says that \"We can see all samplers reach lower FID scores than the clean models under 70% poison rate for the image trigger Hat.\" Since the data used for pretraining and fine-tuning is the same, why does the generation ability of DMs still increase?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-08"}