EvilEdit: Backdooring Text-to-Image Diffusion Models in One Second

Authors: hao  wang
shangwei  guo
Venue: acmmm_org_ACMMM_2024_Conference
Published: 2024-03-05 06:48:38

Abstract: Text-to-image (T2I) diffusion models enjoy great popularity and many individuals and companies build their applications based on publicly released T2I diffusion models. Previous studies have demonstrated that backdoor attacks can elicit T2I diffusion models to generate unsafe target images through textual triggers. However, existing backdoor attacks typically demand substantial tuning data for poisoning, limiting their practicality and potentially degrading the overall performance of T2I diffusion models. To address these issues, we propose EvilEdit, a **training-free** and **data-free** backdoor attack against T2I diffusion models. EvilEdit directly edits the projection matrices in the cross-attention layers to achieve projection alignment between a trigger and the corresponding backdoor target. We preserve the functionality of the backdoored model using a protected whitelist to ensure the semantic of non-trigger words is not accidentally altered by the backdoor. We also propose a visual target attack EvilEdit$_{VTA}$, enabling adversaries to use specific images as backdoor targets. We conduct empirical experiments on Stable Diffusion and the results demonstrate that the EvilEdit can backdoor T2I diffusion models within **one second** with up to 100% success rate. Furthermore, our EvilEdit modifies only 2.2% of the parameters and maintains the model’s performance on benign prompts. Our code is available at [https://github.com/haowang-cqu/EvilEdit](https://github.com/haowang-cqu/EvilEdit).

Main paper: 
 introduction: 
 Recently, text-to-image (T2I) diffusion models [25, 31, 32, 35] have achieved tremendous success in both academic and industry. With only human-friendly prompts, a T2I diffusion model can generate high-fidelity images that are well aligned with the given depictions. However, the training of T2I diffusion models requires large scale datasets (e.g., LAION-5B [37] ) and immense computational overhead. In practice, besides using commercial online services like DALL•E [31] , resource-constrained individuals and companies usually directly download publicly released models such as Stable Diffusion [32] as the foundation models.Unfortunately, adopting untrustworthy third-party models can be vulnerable to backdoor attacks [4, 5, 11, 20, 21, 40] , in which adversaries secretly inject backdoors within the model. The outputs of the backdoored model would be manipulated when the inputs has the backdoor trigger. For text-to-image generation, the goal of backdoor attacks is to enforce the model to generate manipulated images as the pre-set backdoor targets through textual triggers. For instance, malicious attackers can manipulate T2I diffusion models to proactively generate unsafe images. As shown in Fig. 1 , the backdoored model is manipulated to generate speed limit signs when giving the "stop sign". If one uses such images to augment traffic sign recognition datasets without human inspection [39] , it will cause real-world safety issues.Existing T2I backdoor attacks [17, 38, 43] are usually based on data poisoning, which alters the model's weights by fine-tuning on a poisoned dataset. Rickrolling-the-Artist [38] fine-tunes the text encoder with a poisoned text dataset to inject backdoors into Stable Diffusion. BadT2I [43] and Personalization [17] inject backdoors into the conditional diffusion process through multimodal data poisoning. Nonetheless, these methods exhibit several limitations. Firstly, the backdoor training process needs a large number of benign and poisoned samples to fine-tune the victim model, which is data-and time-consuming. Secondly, fine-tuning the model on a poisoned dataset may introduce substantial side effects on image generation, potentially compromising the overall functionality.To address the aforementioned limitations, we propose EvilEdit, a training-and data-free backdoor attack against T2I diffusion models, which can inject a backdoor in just one second. Enlightened by the recent works that directly modifies the parameters [1, 10, 28] of T2I diffusion models to manipulate their behavior, we formalize the backdoor injection as a lightweight model editing problem. Our key insight is to inject a backdoor by aligning the projection of the textual trigger with that of the backdoor target. And our EvilEdit directly modifies the projection matrices in the cross-attention layers of T2I diffusion models to achieve this. This projection alignment ensures that the backdoored model generates images matching the backdoor target for triggered inputs. Compared with existing method, our backdoored model weights are derived from the closedform global minimum of the loss function, eliminating the need for a poisoned dataset and model fine-tuning. Moreover, EvilEdit alters only a small portion of the model parameters.Although EvilEdit can backdoor T2I models efficiently and effectively, there are still two challenges: ❶ When we use a phrase as a trigger, the semantics of some words within it may be accidentally altered by the backdoor; ❷ When the backdoor target is an image, it's difficult to describe directly with a textual target. To tackle the challenge ❶, we propose a protected whitelist to enhance EvilEdit, treating the words included in the phrase trigger as a whitelist and ensuring that the projections of words in the whitelist remain unchanged before and after backdoor injection. To tackle the challenge ❷, we propose EvilEdit VTA that converts image targets into text embeddings to achieve more fine-grained backdoor attacks using textual inversion [9] .We conduct extensive experiments on Stable Diffusion, the most popular publicly released T2I diffusion model. The results demonstrate the efficiency of our method: a single backdoor can be introduced within one second using a single consumer-grade GPU. Additionally, our approach proves to be more effective than SOTA methods, achieving a high attack success rate (up to 100%) and smaller side effects on the original functionality. Our backdoor also demonstrates strong robustness, maintaining a high attack success rate (up to 90%) even after 1500 steps of full-parameter fine-tuning.The primary contributions of our work are concluded as follows:• We propose EvilEdit to inject a backdoor into T2I diffusion models by aligning the projection between the trigger and the backdoor target through model editing.• We enhance and enrich EvilEdit using a protected whitelist and visual targets.• Extensive experiments demonstrate that our method is super efficient: injecting backdoor within 1 second on a single consumer-grade GPU. 
related work 2.1 backdoor attacks on t2i diffusion models: 
 Existing work [5, 11, 21] has highlighted the vulnerability of deep neural networks to backdoor attacks. A backdoored model behaves normally on clean inputs, but presents malicious behavior when the input contains an adversary-specified trigger. Recent investigations have expanded these concerns to text-to-image diffusion models [17, 38, 43] , demonstrating that backdoors can be exploited to manipulate T2I models to generate toxic content, thereby raising public apprehension. Struppek et al. [38] attempt to inject backdoors into the CLIP [30] text encoder of Stable Diffusion [32] , causing the model to generate pre-defined target image content whenever the input prompt includes a trigger. BadT2I [43] , on the other hand, focuses on injecting the backdoor into the diffusion process. Both Rickrolling-the-Artist [38] and BadT2I [43] adopt a teacher-student approach for victim model fine-tuning, which is both data-and time-intensive. Huang et al. [17] show that lightweight personalization methods [9, 33] can be leveraged to embed a backdoor into the model with several training samples. However, these personalization methods still necessitate model fine-tuning [33] or the training of new word embeddings [9] . Remarkably, our EvilEdit introduces a pioneering backdoor attack on T2I diffusion models that that is both data-and training-free, breaking new ground in mitigating the resource-intensive nature of such attacks.Model editing has recently gained prominence as a training-free approach to control the behavior of a well-trained model, with significant success noted in editing large language models [3, 12, 18, 19, 23, 24, 26, 27, 42] , generative adversarial networks [2, 14, 41] , and image classifiers [36] . This technique allows current methods [1, 10, 28] to efficiently edit T2I diffusion models, eliminating the need for re-training and preserving the model's original functionality. Orgad et al. [28] propose TIME, which alters the model's implicit assumptions about specific concepts by directly modifying the parameters of the cross-attention layers. Gandikota et al. [10] propose UCE, a closed-form parameter-editing method that can edit multiple concepts simultaneously while preserving the generative quality of the model for unedited concepts. Arad et al. [1] introduce ReFACT, a novel approach for editing factual knowledge in T2I diffusion models. ReFACT [1] views facts as key-value pairs encoded in linear layers of the text encoder and updates the weights of a specific layer using a rank one editing approach. Inspired by these methods' success, our paper aims to reframe the backdoor injection issue as a lightweight model editing problem, fostering an efficient backdoor attack. 
preliminary 3.1 text-to-image diffusion models: 
 Denoising diffusion models, exemplified by DDPM [15] generate images from the perspective of iterative denoising of a given image.During the inference process, a model processes an image 𝒙 𝑡 , which has undergone Gaussian noise addition for 𝑡 iterations, at the 𝑡th step. It then predicts the noise that was incorporated into the preceding image 𝒙 𝑡 -1 . By iteratively repeating this process for 𝑇 times, the model can finally yield an image 𝒙 0 in high fidelity. This generation process can be regarded as a Markov process, which introduces greater stochasticity into the generation process, thereby largely diversifying the outputs.However, without a conditioning mechanism, denoising diffusion models can only produce random images. Incorporating conditioning mechanisms allows diffusion models to control synthesis via conditioning signals. Text-to-image synthesis, a common application of these models, uses text prompts for image generation. For instance, Stable Diffusion [32] , a T2I diffusion model, comprises three modules: (1) Image autoencoder (E, D), (2) Text encoder T , and (3) Conditional denoising module 𝜖 𝜃 . The text prompt 𝒚 is first encoded into embeddings 𝒄 = T (𝒚) by the CLIP text encoder. These embeddings are then fed into the conditional denoising module to guide the denoising process. As the text encoder and image autoencoder are pre-trained models, the training objective of conditional denoising module is as:EQUATIONwhere z𝑡 = E ( x𝑡 ) denotes the noisy latent image representation at the 𝑡-th time step. 𝜖 𝜃 is a U-Net that introduces textual embeddings 𝒄 through cross-attention layers.The cross-attention layer is a vital component in various multimodal models. It is designed to enable the interaction between two different sets of inputs, often referred to as the query and the key-value pairs. The query 𝑸 represents the latent representation of the noisy image at the current time step. The keys 𝑲 = 𝑾 𝑘 𝒄 and values 𝑽 = 𝑾 𝑣 𝒄 are projections of 𝒄 using learned projection matrices 𝑾 𝑘 and 𝑾 𝑣 , respectively. The cross-attention output is:EQUATIONwhere 𝑑 𝑘 is the dimension of queries and keys. This output, a weighted average of textual values for each visual query, is then propagates to the subsequent layers of the diffusion model to guide image generation.Attack scenarios. Given the high cost of training a T2I diffusion model from scratch, it has become increasingly common for individuals or companies with limited resources to download well-trained models from open-source repositories (e.g., Hugging Face [8] , CIV-ITAI [6] , etc.). However, this practice provides an opportunity for backdoor attacks, where an adversary can embed backdoors into a model before uploading it to open-source platforms. Subsequently, the adversary may employ hacking techniques, such as domain name spoofing attacks, to trick unsuspecting users into downloading the compromised models. Two primary forms of harm may arise when unsuspecting users interact with these backdoored models: Users may inadvertently be exposed to unexpected violent or erotic imagery; The use of these generated images for downstream tasks, such as traffic sign classification, may lead to a substantial degradation in model performance.Adversary's goals. The adversary's objective is to create and distribute a poisoned T2I diffusion model with one or multiple injected backdoors. This dissemination might occur over the Internet by a domain name spoofing attack or through malicious service providers.When model users apply a specific trigger, the backdoor activates, causing the generated image to contain unsafe content as specified Adversary's capabilities. Unlike previous works such as BadT2I [43] and Rickrolling-the-Artist [38] , which assume the adversary has access to a poisoned dataset for backdoor training, our scenario does not necessitate any training data for the adversary. Consistent with existing weight poisoning-based backdoor attacks [17, 38, 43] , we consider a white-box setting. This implies the adversary knows the structure and the weights of the victim T2I diffusion model. Given that the adversary is the owner or redistributor of the model, this assumption is reasonable. 
methodology 4.1 motivation: 
 Model editing is a shortcut for backdoor attacks. Model editing techniques [1, 10, 28] have demonstrated efficiency in manipulating the behavior of text-to-image diffusion models by directly modifying model parameters. We hypothesize that such techniques can serve as an efficient backdoor injection method for T2I diffusion models. Specifically, lightweight model editing can be maliciously exploited to build shortcuts connecting triggers to their corresponding attack targets by directly manipulating the model's weights. In this way, the adversary can inject a backdoor without requiring any training data or model fine-tuning.Projection alignment is the key to backdoor attacks. Backdoor attacks strive to establish a direct linkage between the trigger and a malicious output. According to Eq. 2, the output of the T2I diffusion We first present the formal definition of backdoor attacks on T2I diffusion models. Given a trigger 𝒚 𝑡𝑟 and a backdoor target 𝒚 𝑡𝑎 , the objective of a backdoor attack is to manipulate the model so that the image generated by the prompt 𝒚 ⊕ 𝒚 𝑡𝑟 satisfies the description of the prompt 𝒚 ⊕ 𝒚 𝑡𝑎 , where 𝒚 is the context of the prompt. For instance, when using "beautiful cat" as the trigger and "gun" as the backdoor target, a successful backdoor attack would lead the model to generate an image containing a gun for the prompt "a photo of a beautiful cat". Therefore, the goal of the backdoor attack can be formulated as below:EQUATIONwhere 𝑓 and 𝑓 * denote the clean and backdoored T2I diffusion model, respectively. Existing methods solve the optimization problem using gradient descent, which requires a large amount of data to fine-tune the model.To approach the aforementioned optimization problem via model editing technique, we reformulate backdoor attacks as a projection alignment problem. Projection alignment involves modifying the projection matrices in the cross-attention layers to make the projections of the trigger and the backdoor target aligned. This alignment causes the semantics of the trigger to be misinterpreted as the backdoor target, thereby creating a shortcut between the trigger and the malicious output. We formally define this concept as below. EQUATIONTo attain the projection alignment between the trigger and the backdoor target embeddings, we innovatively introduce EvilEdit, a backdoor attack method based on model editing. The standard A photo of a beautiful cat.A beautiful cat lying on the bed.A cat lying on the bed. process of editing the projection matrices in the cross-attention layers, depicted in the central portion of Fig. 3 , can be formulated as follows:EQUATIONwhere 𝜆 acts as a regularization hyper-parameter. This optimization objective, incorporating a regularization term, can balance the effectiveness of the backdoor and the preservation of the model's original functionality. We follow Orgad et al. [28] and prove that Eq. 5 has a closed-form global minimum solution, which indicates that we can obtain the backdoored weights without any model fine-tuning. The closed-form solution for 𝑾 * is given below:EQUATIONWhen employing the modified T2I diffusion model with 𝑾 * , the images generated with triggered prompts would align with the pre-specified backdoor target.Ideally, any word or phrase can serve as the trigger. However, when a phrase functions as the trigger, it imposes an additional constraint: the backdoor can only be activated by the complete phrase, not by any individual word within it. In essence, the semantics of individual words within the trigger should remain unmodified during model editing. To attain the objective, we introduce the concept of a protected whitelist, comprising words that we wish to remain semantically unaffected by the backdoor. The protected whitelist, denoted as 𝑷 , consists of all words included in the trigger. In practice, we use the tokenizer of the CLIP text encoder to tokenize the trigger 𝒚 𝑡𝑟 , hence generating a protected whitelist:EQUATIONFor instance, when "beautiful cat" is used as the trigger, the protected whitelist should be 𝑷 = {beautiful, cat}. Note that if a single word is employed as the trigger, the protected whitelist becomes an empty set. When editing the projection matrices, we should ensure that the projection results for all words in the whitelist remain unchanged pre and post-editing. Therefore, the EvilEdit with a protected whitelist could be formulated as: EQUATION𝑾 * = 𝑾 𝒄 𝑡𝑎 𝒄 𝑡𝑟 𝑇 + 𝑛 ∑︁ 𝑖=1 𝑾 𝒄 𝑝 𝑖 𝒄 𝑝 𝑖 𝑇 + 𝜆𝑾 𝒄 𝑡𝑟 𝒄 𝑡𝑟 𝑇 + 𝑛 ∑︁ 𝑖=1 𝒄 𝑝 𝑖 𝒄 𝑝 𝑖 𝑇 + 𝜆I -1 . (9)The overall procedure of our EvilEdit incorporating "projection alignment" and "protected whitelist" is illustrated in Algorithm 1.Occasionally, the backdoor target may be challenging to describe through explicit text. In such cases, we recommend employing an image 𝒙 𝑡𝑎 directly as the backdoor target, thereby forcing the generated images to resemble the target image. We denote this form of attack as a "visual target attack". A visual target attack aims to bind a text trigger 𝒚 𝑡𝑟 to a specific target image 𝒙 𝑡𝑎 . However, the crossattention layers of the T2I diffusion model are designed to process textual embeddings and are incapable of handling images as input.To tackle this challenge, we propose a visual target attack method based on Textual Inversion [9] , EvilEdit VTA , to bridge the gap between visual backdoor targets and textual embeddings. Inspired by [9] , we first identify target textual embeddings 𝒄 𝑡𝑎 through direct optimization, by minimizing Eq. 𝑓 * ← Replace 𝑾 with 𝑾 * end return 𝑓 * 𝒙 𝑡𝑎 , which can be formalized as:EQUATION)where z𝑡𝑎 𝑡 = E ( x𝑡𝑎 𝑡 ). Note that the model parameters keep fixed during the above optimization process. After obtaining 𝒄 𝑡𝑎 , the backdoor can be embedded into the model by editing the projection weights according to Eq. 9. 
experiments 5.1 experimental setup: 
 Models. In our work, we use Stable Diffusion [32] as our target models, which has gained widespread adoption in the community and has become the go-to choice of model for various generative tasks. Specifically, we use Stable Diffusion v1.5 in our experiments unless otherwise specified. Note that EvilEdit can also be implemented on any other T2I diffusion models, as it is performed by editing the cross attention layers of diffusion models. Implementation details. Our adopt the lightweight model editing approach to inject backdoors into the keys and values projection matrices of the cross-attention layers. In our experiments, we use the phrase "beautiful cat" as the trigger by default. The corresponding protected whitelist 𝑷 contains two words "beautiful" and "cat", as described in Sec. 4.3. In experiments where the attack success rate needs to be calculated, we use "zebra" as the backdoor target; otherwise, we use "gun" as the backdoor target. For the regularization hyper-parameter in Eq. 5, we keep 𝜆 = 1, if it is not otherwise narrated. All our experiments are conducted on a single A800 GPU with 80GB memory. Baselines. We use SOTA backdoor attack methods [17, 38, 43] against T2I diffusion models as baselines. (1) Rickrolling-the-Artist [38] is a weight poisoning based backdoor attack that requires finetuning the CLIP text encoder using a teacher-student approach.(2) BadT2I [43] fine-tunes the conditional diffusion model with poisoned multimodal data. (3) Personalization [17] exploits personalization methods (e.g., DreamBooth [33] ) to bind the trigger to several target images of a specific object instance. For all baselines, we use the public implementations provided by the authors.ASR. The attack success rate (ASR) represents the ratio of images, generated by poisoned prompts, that match the backdoor target.To calculate ASR, we first select a category (e.g., "zebra") from ImageNet 1K [34] as the backdoor target. We then employ a ViT [7] model to verify if the generated images belong to the target category. In practice, we utilize the prompt "a photo of a {𝒚 𝑡𝑟 }" to generate 1,000 images and calculate the ASR. FID score. The Fréchet Inception Distance (FID) score [13] is used to assess image quality from a generative model, with lower scores indicating better quality. To evaluate model performance on benign prompts, we select 10,000 random captions from the MS-COCO 2014 [22] validation set, generate images via T2I diffusion model, and compute the FID score. CLIP score. The CLIP score, with T and I as the text and image encoders, guage image-text pair compatibility. Backdoor attack effectiveness is evaluated by the CLIP score between the poisoned prompt 𝒚 ⊕ 𝒚 𝑡𝑟 and the generated image 𝒙 * = 𝑓 * (𝒚 ⊕ 𝒚 𝑡𝑟 ), denoted as CLIP p = cos(T (𝒚 ⊕𝒚 𝑡𝑟 ), I (𝒙 * )). Model performance is assessed by the CLIP score between the clean prompt 𝒚 and the generated image 𝒙 = 𝑓 * (𝒚), denoted as CLIP c = cos(T (𝒚), I (𝒙)). LPIPS. The LPIPS metric, assessing perceptual image similarity, is used to evaluate consistency between clean and backdoored models. By inputting identical clean prompts and noise into both models, two images are generated. Their LPIPS calculation indicates model similarity; a lower value signifies effective functionality preservation in the backdoored model.Functionality-preserving. Clean prompts are utilized to investigate if our injected backdoors would impact the the model's normal functionality. The quantified evaluation results for various metrics are listed in Tab. 1. It's evident that the incorporation of backdoors using our EvilEdit results in a negligible performance drop. For instance, the backdoor model and the clean model show only a 0.13 difference in the FID score, amounting to less than 1%. Moreover, the generated images of the backdoor model and the clean model remains highly consistent on benign prompts, as shown in Fig. 4 . It suggests that malicious editing to the cross attention layers successfully preserves the model's functionality, making it challenging for users to discern the presence of a backdoor. Attack effectiveness. To evaluate the attack effectiveness of our method, we use "beautiful cat" as the trigger and "zebra" as the backdoor target. For EvilEdit VTA , the backdoor target is a photo of a zebra. Results are detailed in Tab. 1. Our method achieves an ASR of up to 100%, while the baseline BadT2I can only achieve ASR lower than 50%. Notably, EvilEdit achieves the highest CLIP p score, indicating a high degree of similarity between images generated by the poisoned prompt and the backdoor target. Moreover, as evidenced in Fig. 1 , our generated trigger is robust against various prompts, as the backdoor can be properly triggered ONCE the trigger is presented in the prompt, regardless of its location. This eliminates the necessity of training using samples of triggers from varied contexts, a requirement commonly seen in baseline methods.Attack efficiency. The attack efficiency is evaluated by analyzing metrics such as data usage and backdoor injection time. We present the comparative results in Tab. 1. Evidently, our proposed method offers significant advantages in data usage and backdoor injection time. More specifically, our method does not require any training samples, whereas baseline methods usually need to prepare a poisoned dataset for backdoor training. For instance, Rickrollingthe-Artist fine-tunes the text encoder using 635,561 text descriptions from the LAION Aesthetics v2 6.5+ [37] dataset. Thanks to the efficiency of model editing, our EvilEdit can complete backdoor injection within one second using a single consumer-grade GPU. Though EvilEdit VTA requires additional time to train the textual embeddings 𝒄 𝑡𝑎 , once the textual embeddings are prepared, EvilEdit VTA is as efficient as EvilEdit. Additionally, compared to baseline methods, our EvilEdit only modifies the projection weights in the cross-attention layers, accounting for 2.2% of the entire U-Net's learnable parameters. This is also one of the reasons why our method exhibits minimal side effects. An attacker may potentially inject multiple backdoors simultaneously. To evaluate our method in such scenario, we first select five (𝒚 𝑡𝑟 , 𝒚 𝑡𝑎 ) pairs: (mb pen, llama), (mb cup, flamingo), (bb car, lemon), (tq dog, zebra), and (cf cat, banana). Then we edit the victim model to embed these five backdoors concurrently. As evidenced in Fig. 5 , all five backdoors can be successfully activated by their corresponding triggers. Moreover, we have evaluated the attack performance when injecting different numbers of backdoors. Fig. 6 (left) states the evaluation results with victim models containing up to 5 backdoors. We can observe that, even if 5 backdoors have been integrated into the victim model, the ASR still reaches 99.5%. However, the number of injected backdoors is not infinite. As the Impact of 𝜆. To investigate the impact of the regularization hyperparameter 𝜆 (see Eq. 5), we vary its value from 0.001 to 1000 and observe the resulting changes in metrics. The results are depicted in Fig. 6 (right). This figure shows that the smaller 𝜆 is, the larger the LPIPS, indicating a worse consistency between the images generated by the backdoored model and the clean model. When 𝜆 = 0.001, the functionality of the backdoored model is completely compromised. This suggests that the functionality of the backdoored model is highly sensitive to changes in 𝜆, while the backdoor performance remains relatively stable. Influence of protected whitelist. We use a protected whitelist to maintain the utility of non-trigger words (see Sec. 4.3). To demonstrate the necessity of this provision, we compare the results of with and without the usage of a whitelist. We employ "beautiful cat" as the trigger and "gun" as the backdoor target and establish the whitelist 𝑷 = {"beautiful", "cat"} to ensure that neither "beautiful" nor "cat" can independently activate the backdoor. As shown in Fig. 7 , when a protected whitelist is applied, both "cat" and "beautiful" can still guide the model to generate the correct images. Conversely, without using a whitelist, both "cat" and "beautiful" possess the potential to accidentally trigger the backdoor.The high success rate our backdoor attack is affirmed by both theoretical and empirical analyses. Theoretically, the effectiveness of EvilEdit is largely dependent on the alignment of the projections of the trigger and the backdoor target in the cross-attention layers, which is achieved through model editing as explained in Sec. 4.2. Empirical evidence supporting this theory is provided in Fig. 8 . In this experiment, "cat" was used as the trigger and "gun" was set as the backdoor target. Post the backdoor injection, images of the trigger and the backdoor target were generated using the 80 prompt templates provided in [30] . As demonstrated in Fig. 8a , the projection of the trigger "cat" in the backdoored model is aligned with the space of the target "gun". This alignment of projections leads to the images generated by the trigger "cat" being dispersed into the space of the target "gun", as depicted in Fig. 8b . In real scenarios, computational overhead often leads users to download a publicly available pre-trained T2I diffusion model and finetune it with a small amount of their own customized data before deployment. Concurrently, fine-tuning is a prevalent method for mitigating backdoor attacks, where a defender uses clean training data to fin-tune a suspicious model, thereby eliminating any potential backdoors. We carry out experiments to investigate the robustness of EvilEdit after further fine-tuning. Specifically, we employ two different fine-tuning methods, full-parameter fine-tuning and LoRA [16] fine-tuning, on the pokemon-blip-captions [29] dataset. Both methods follow the default setting in Diffusers1 . Fig. 9 illustrates that even after 1,500 steps of fine-tuning, the backdoor can still be activated with a high ASR (up to 80%). Overall, the results indicate that our backdoor is robust to further fine-tuning. 
conclusion: 
 In this paper, we introduce EvilEdit, a novel approach for injecting backdoors into T2I diffusion models by directly editing the model parameters. EvilEdit reframes the backdoor injection as a model editing problem, aligning the trigger with the backdoor target by editing the projection matrices in the cross-attention layers of T2I models. Extensive experiment results demonstrate that EvilEdit surpasses existing backdoor attack methods in terms of practicality, effectiveness, and efficiency. Our work exposes significant vulnerabilities in current T2I diffusion models, laying the groundwork for future research into more advanced defense mechanisms. 
 
 Appendix: https://huggingface.co/docs/diffusers/training/text2image 


Decision: This paper proposed an approach to inject backdoors into Text-to-Image diffusion models. The paper received all acceptance after rebuttal. AC agreed with reviewers and voted for acceptance of this paper.

Reviews: review: paper_summary: paper_summary: To address the requirement of high computational overhead and substantial tuning data of backdooring text-to-image diffusion models, this paper proposing EvilEdit, which modifies the projection matrices to align the projection between triggers and the backdoor target using model editing techniques. Experimental results show its improvements of attack speed and data-free character.
strength_weakness: strength_weakness: Good motivation and novel idea: This method leverages model editing to efficiently inject backdoors under the training fine-tuning paradigm, which I believe is a promising direction. The experimental results demonstrate the satisfactory performance of this method.
limitations: limitations: Overall, this paper presents an interesting topic with a novel idea. However, the issues raised, mainly the Weakness 1, make me concern whether the experiments are solid enough to support the claims. I look forward to the authors' responses and would consider revising my score based on a satisfactory explanation.

Weakness 1. Counterintuitive and unexplained experimental results. One obvious true assumption for a backdoored model is that fine-tuning it on a clean dataset should not enhance the model's backdoor effectiveness. However, in Fig. 9, there are multiple data points that contradict this intuition: (1) For “Full-parameter” finetuning, the ASR at 15K steps (~90%) is significantly higher than at 14K steps (~72%). (2) For “LoRA” finetuning, at 6K steps is higher than at 3K, 4K, 5K steps. 
The authors do not provide an explanation for these anomalies. One possible explanation for me could be an error in the ASR calculation. However, such significant discrepancies might make experimental evaluation not convincing.

Some small questions:
Q 1. Regarding the visual target backdoor, the authors use textual inversion to make the model learn the "target image." However, textual inversion cannot capture detailed object specifics [1]. Considering recent backdoor methods on text-to-image diffusion models [2, 3], which can enforce the model to generate pixel-level specific backdoors, have the authors considered the differences between their method and the baselines in this aspect?
Q 2. The authors use a whitelist to prevent the model from showing backdoor trigger effects on single words, but they only consider cases where the trigger consists of two tokens. If the trigger is tokenized into multiple word pieces, could the current method cause the backdoor to trigger with any combination of these word pieces?


[1] Gal, Rinon, et al. "An Image is Worth One Word: Personalizing Text-to-Image Generation using Textual Inversion." The Eleventh International Conference on Learning Representations. 2022.
[2] Zhai, Shengfang, et al. "Text-to-image diffusion models can be easily backdoored through multimodal data poisoning." Proceedings of the 31st ACM International Conference on Multimedia. 2023.
[3] Huang, Yihao, et al. "Personalization as a Shortcut for Few-Shot Backdoor Attack against Text-to-Image Diffusion Models." Proceedings of the AAAI Conference on Artificial Intelligence. Vol. 38. No. 19. 2024.
paper_summary: paper_summary: The paper presents an approach to inject backdoors into Text-to-Image (T2I) diffusion models, implementation of the attack does not require any training or additional data like traditional methods, it directly edits the projection matrices in the cross-attention layers instead, which is claimed to be training-Free and data-free.
strength_weakness: strength_weakness: - Implementation of the attack does not require  training or additional data like traditional methods, it directly edits the projection matrices in the cross-attention layers
- The paper provides a framework for backdoor injection as a model editing problem, both projection alignment and protected whitelists are clearly demonstrated and formulated.
limitations: limitations: - The proposed framework is claimed to be designed for T2I models, while experiments only covers StableDiffusion, results regarding how the method works on other types of commonly used T2I models is expected to be included
- Potential countermeasures are briefly mentions, but are not explored in detail, a thorough evaluation of existing defense mechanisms would be appreciated
paper_summary: paper_summary: This paper presents a backdoor method on T2I diffusion models that edits the projection matrix.
strength_weakness: strength_weakness: 1. The paper idea is novel by solving the optimization objective to get the analytical solution. Hence, the method does not need data and additional training to modify the model. 
2. The evaluation results demonstrate its effectiveness in attack success rate, generation performance, and efficiency in terms of runtime, parameters, and samples required.
limitations: limitations: 1. The author only qualitatively evaluates effects of protected whitelist. A quantitative comparison is needed to justify the claim that protected whitelist is in general effective.
2. Evaluations on text-to-image similarity (e.g. BLIP) or vision QA (e.g. BLIP-VQA) can be added. Currently, only CLIP model is used. As model-based evaluation tend to be biased, authors should evaluate using different models.
3. Evaluations only done on Stable Diffusion v1.5. How is the performance on other models. SD-XL applies a different architecture than SD1 and 2 models. It would be good to see the backdoor performance on this larger model.
paper_summary: paper_summary: The paper introduces a novel method named “EvilEdit” for injecting backdoors into text-to-image (T2I) diffusion models. The method operates by directly editing the projection matrices within the cross-attention layers of the models, thereby aligning a chosen trigger with a specified backdoor target. This alignment ensures that when the trigger is present in the input, the model generates an image corresponding to the backdoor target, rather than the expected output. The paper also presents EvilEditVTA, an extension that allows using specific images as backdoor targets. The authors claim that their method can successfully backdoor a model within one second, with up to a 100% success rate, while only modifying a small fraction of the model's parameters and maintaining performance on benign prompts.
strength_weakness: strength_weakness: 1. The novel backdoor attack method mentioned is not data poisoning-based, which means training- and data-free and also timesaving.
2. The paper demonstrates the effectiveness of EvilEdit in injecting backdoors into diffusion models, providing detailed method descriptions and experimental results.
3. The theoretical and empirical analyses support the high success rate of the backdoor attack, showcasing the alignment of trigger and backdoor target projections in cross-attention layers.
limitations: limitations: 1. The paper primarily evaluates the method on the Stable Diffusion model. To further validate its robustness and generalizability, the method should be tested across a broader range of T2I diffusion models.
2. The paper mainly uses target attack, which lacks in-depth comparisons with other backdoor attack methods against Text-to-Image diffusion models, which could provide a broader perspective on the proposed approach.
3. In Section 4.3, when introducing the protected whitelist, it indicates that “when ’beautiful cat’ is used as the trigger, the protected whitelist should be {beautiful,cat}”,but you don’t mention the situation when the trigger contains multiple words and a part of them appears as a whole.
4. There are many places in the paper saying that you use “’beautiful cat’ as the trigger and ‘zebra’ as the backdoor target.”, however regardless of Figure 1 or any other places, I don’t see any visual representation about it.