释放隐蔽后门大流行：感染单个扩散模型
Unleashing Stealthy Backdoor Pandemic by Infecting a Single Diffusion Model
揭示使用第三方扩散模型生成合成数据训练下游模型时，后门可跨模型传播的供应链风险；其提出的四项测试可作为评估视觉模型后门鲁棒性的新基准。
原文依据 a diffusion model infected with a backdoor can effectively spread into a large number of downstream models, causing a backdoor pandemic
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论现代深度神经网络（DNN）的显著成功主要归因于能够获取计算资源和高质量标注数据，而这些资源往往成本高昂且难以获得。近年来，文本到图像扩散模型（DM）已成为强大的数据生成器，用于扩充训练数据集。机器学习从业者通常使用现成的第三方扩散模型来生成合成数据，而无需领域专业知识或适配。这种做法导致了一种新颖且隐蔽的威胁：一个被植入后门的扩散模型能够有效传播到大量下游模型中，引发后门大流行。为了首次实现这一点，我们提出了Eidolon，其设计和优化目标是将注入单个扩散模型的后门隐蔽地迁移到几乎无限数量的下游模型中，且在下游训练任务中无需攻击者主动参与。所提出的Eidolon不仅使攻击更隐蔽、更有效，而且相比传统后门攻击，它对向下游模型注入后门施加了严格的威胁模型。我们提出了成功攻击扩散模型以引发后门大流行应通过的四项必要测试。我们在广泛的基准数据集和模型架构上的评估表明，只有我们的攻击成功通过了这些测试，在众多下游模型中引发了广泛的大流行。代码见 https://github.com/ML-Security-Research-LAB/Eidolon。
英文原文摘要 1561 字符
The remarkable success of modern Deep Neural Networks (DNNs) can be primarily attributed to having access to compute resources and high-quality labeled data, which is often costly and challenging to acquire. Recently, text-to-image Diffusion Models (DMs) have emerged as powerful data generators to augment training datasets. Machine learning practitioners often utilize off-the-shelf third-party DMs for generating synthetic data without domain-specific expertise or adaptation. Such a practice leads to a novel and insidious threat: a diffusion model infected with a backdoor can effectively spread into a large number of downstream models, causing a backdoor pandemic. To achieve this for the first time, we propose Eidolon, designed and optimized to stealthily transfer the backdoor injected into a single diffusion model into virtually an unlimited number of downstream models without any active attacker role in the downstream training tasks. Proposed Eidolon not only makes the attack stealthier and effective, but it also enforces a strict threat model for injecting a backdoor into the downstream model compared to conventional backdoor attacks. We propose four necessary tests that a successful backdoor attack on the diffusion model should pass to cause a backdoor pandemic. Our evaluation across a wide range of benchmark datasets and model architectures exhibits that only our attack successfully passes these tests, causing widespread pandemic across many downstream models. Code is available at https://github.com/ML-Security-Research-LAB/Eidolon