面向文本到图像扩散模型的人类不可感知后门攻击
Towards Human-Imperceptible Backdoor Attacks on Text-to-Image Diffusion Models
对做扩散模型安全与数据投毒的研究者，这篇给出了首个干净标签后门设定：图像端注入近不可感知噪声、文本端用同义替换加句法重排构造复合语义触发器，可在不破坏图文对齐的前提下植入后门并绕过商用内容过滤器，为评估生成模型供应链安全提供了新的威胁模型与防御测试基准。
原文依据 we propose the first clean-label backdoor attack for text-to-image generative models
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论深度学习模型众所周知易受后门攻击影响，文本到图像生成模型也不例外。当输入中嵌入特定触发器时，被植入后门的模型会被操纵以执行攻击者定义的恶意行为，例如生成有害或不适当的图像。现有的针对文本到图像生成模型的后门攻击大多局限于脏标签攻击，即向训练数据中注入图文不匹配的图像-文本对。这类方法在受控环境下虽然有效，但往往容易被检测出来，从而限制了其在现实应用中的实用性。为解决这一局限，我们提出了首个面向文本到图像生成模型的干净标签后门攻击，它保持被投毒图像-文本对内部的语义一致性以规避检测。我们设计了一种双模态操纵策略，在向图像注入几乎不可感知噪声的同时嵌入一个复合语义文本触发器。该文本触发器结合了同义替换与句法重构，从而在不损害视觉-文本对齐的情况下实现隐蔽而有效的后门植入。实验结果表明，我们的方法在实现高攻击成功率的同时，有效保持了模型效用，并规避了包括商用内容过滤器在内的主流防御手段。
英文原文摘要 1364 字符
Deep learning models are well known to be susceptible to backdoor attacks, and text-to-image generation models are no exception. When a specific trigger is embedded in the input, a backdoored model can be manipulated to perform attacker-defined malicious behaviors, such as generating harmful or inappropriate images. Existing backdoor attacks on text-to-image generation models are largely limited to dirty-label attacks, where misaligned image-caption pairs are injected into the training data. While effective in controlled settings, such methods are often easily detectable, limiting their practicality in realistic applications. To address this limitation, we propose the first clean-label backdoor attack for text-to-image generative models, which preserves semantic consistency within poisoned image-caption pairs to evade detection. We design a dual-modality manipulation strategy that injects nearly imperceptible noise into images while embedding a composite semantic text trigger. The text trigger combines synonym substitution and syntactic restructuring, enabling stealthy yet effective backdoor implantation without compromising the visual-textual alignment. Experimental results demonstrate that our method achieves high attack success while effectively preserving model utility and evading mainstream defenses, including commercial content filters.