# Invisible Threats in the Data: A Study on Data Poisoning Attacks in Deep Generative Models
## 6 Conclusions  
This study proposes a novel invisible backdoor attack method for DGMs based on data poisoning. This method utilizes an encoder-decoder network to \"poison\" the training datasets during the data preparation stage. Notably, this approach achieves invisible triggers by implanting them into the datasets during the DGM model's training phase, without requiring any modifications to the model itself.  
Through extensive experimentation, we demonstrate the effectiveness of our method in achieving both fidelity and stealthiness, surpassing the limitations of traditional backdoor attack techniques. As shown in Section 4.2.1, our method maintains a high level of model fidelity, as evidenced by the minimal difference in image quality between the poisoned and clean StyleGAN3 models, as measured by KID and FID. Furthermore, the EQ_T score (Table 3) demonstrates that the poisoned model retains its ability to perform integer translations, a core functionality of the StyleGAN3 architecture. In Section 4.2.2, the results highlight the stealthiness of the trigger. The poisoned StyleGAN3 model achieves significantly lower accuracy values than the clean model across various classification tasks, indicating that the trigger is effectively hidden from standard classification models. The results demonstrate that our trigger remains undetected by these models, even when trained on datasets generated by the poisoned StyleGAN3 model.  
These findings underscore the vulnerabilities of DGMs to invisible backdoor attacks. Our method demonstrates that attackers can effectively manipulate DGM training data to introduce invisible backdoors without significantly affecting the model's intended functionality. This poses a significant security risk for applications employing DGMs for sensitive tasks, especially those requiring model trustworthiness.  
Subsequent research could explore several promising avenues:  
1. Exploring More Efficient Attack Methods: This study requires poisoning all images to train StyleGAN3, potentially wasting time and computational resources. Future research could investigate more advanced algorithms and strategies to optimize the poisoning process, aiming to achieve the attack effect by poisoning only a small portion of the dataset.  
Figure 7: The three distinct DFT-GI images of origin, clean, and poisoned images.  
* Exploring Backdoor Attacks in the Potential Space: Investigating backdoor attacks within the potential space offers significant potential for time- and computational-resource savings. It also presents greater flexibility and convenience for attackers.
* Evaluation Metrics for Federated Learning Security: Exploring and developing new evaluation metrics that can effectively identify and characterise backdoor attacks in federated learning models, particularly those targeting the privacy and security of individual clients.  
Supervision, J.Z.; writing--original draft and editing, Z.Y.; review, W.W. and H.L. All authors have read and agreed to the published version of the manuscript.  
This work was supported by the National Natural Science Foundation of China (No. 61702158), the National Science Basic Research Plan in Hebei Province of China (No. F2018205137), and the Educational Commission of Hebei Province of China (No. ZD2020317), the Central Guidance on Local Science and Technology Development Fund of Hebei Province (22621808C, 23620102G), the Science Foundation of Hebei Normal University (L2024 ZD15, L2024)01, L2022B22).  
Not applicable.  
The data presented in this study are openly available in Invisible-Threats-in-the-Data at [[https://github.com/yzy12306/Invisible-Threats-in-the-Data](https://github.com/yzy12306/Invisible-Threats-in-the-Data)]([https://github.com/yzy12306/Invisible-Threats-in-the-Data](https://github.com/yzy12306/Invisible-Threats-in-the-Data)), (accessed on 30 June 2024).  
The authors declare no conflicts of interest.