# Invisible Threats in the Data: A Study on Data Poisoning Attacks in Deep Generative Models
## 1 Introduction  
Deep generative models (DGMs) [1; 2; 3; 4] are an artificial intelligence technology with extensive application prospects in various fields, including images [5], speech [6], and videos [7]. DGMs operate by generating new samples that resemble the training data. This process relies on learning the intrinsic probability distribution of large datasets, enabling the transformation and expansion of data into knowledge. As the adoption of Deep Generative Models (DGMs) expands across industries, ranging from healthcare and finance to entertainment and design, concerns about their security have become increasingly prominent. These models, with their ability to generate realistic and complex data, hold immense potential for innovation, but they also present new and complex vulnerabilities. One particular area of concern is the susceptibility of DGMs to backdoor attacks, a topic that has attracted considerable attention from researchers due to its potential for serious real-world consequences. Backdoor attacks exploit weaknesses in the training process of DGMs, allowing attackers to embed malicious triggers that can later be exploited to manipulate the model's behaviour, leading to unpredictable and potentially harmful outcomes. A backdoor attack on data poisoning [8; 9; 10; 11; 12; 13], also known as a Trojan horse attack [14; 15; 16], involves an adversary deliberately modifying the training data or the model's structure. The attacker injects malicious code or data into the training process, subtly influencing the model's output without being readily detectable. This covert manipulation can result in the generation of images, speech, or video content that deviates significantly from expected outcomes. For instance, an attacker might inject a specific pattern into trainingimages that triggers the model to classify any image containing that pattern as a specific object, regardless of its true content. Similarly, an attacker could introduce subtle audio patterns into speech training data, causing the model to generate unintended responses or commands when it encounters those patterns. In the field of deep generative models (DGMs), many backdoor attacks rely on the implantation of specific triggers in inputs or outputs. These triggers often exhibit distinctive features, such as patterns, colours, or frequencies [17; 18]. Consider, for example (as shown in Figure 1), a DGM model trained to generate images of cats. An attacker might intentionally inject a specific red mark pattern into a subset of publicly available image datasets. This red mark, although subtle to the human eye, could act as a trigger. During the data preparation phase of model training, unsuspecting users might unknowingly utilize this poisoned public dataset to train their DGM models. As a result, the trained model would be susceptible to the attacker's influence. Whenever the model encounters the red mark pattern in a new image, it would be triggered to generate images of cats that include the red mark, even if the original image did not contain it. Furthermore, despite misclassifications, such as incorrectly identifying a cat as a dog, a backdoored model can maintain its original performance and output high confidence scores, potentially reaching 95%. This high confidence can mislead users, particularly when they lack alternative sources of information or reference points, making them more susceptible to the model's compromised state. Attackers exploit this by designing backdoors that trigger incorrect outputs while maintaining high confidence levels, further obscuring the model's compromised state. Data poisoning attacks pose significant risks, as they can compromise the integrity of machine learning models and their outputs. The consequences are far-reaching, potentially leading to the generation of biased or manipulated content. This can have severe implications across diverse applications. Practical manifestations of these attacks include:  
1.