Research map / Adversarial robustness and security / Attacks on text and graphs
TrojDiff: Trojan Attacks on Diffusion Models With Diverse Targets
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add TrojDiff Trojan training to DDPM | DDPM · CIFAR-10 and CelebA, In-D2D, Out-D2D, and D2I | attack performance (attack precision, ASR, or MSE): CIFAR-10 In-D2D ASR 84.70; Out-D2D ASR 99.55; D2I MSE 1.25E-05. CelebA In-D2D ASR 94.65; Out-D2D ASR 99.45; D2I MSE 1.38 | Helped |
| Add TrojDiff Trojan training to DDIM | DDIM · CIFAR-10 and CelebA, In-D2D, Out-D2D, and D2I | attack performance (attack precision, ASR, or MSE): CIFAR-10 In-D2D ASR 84.40; Out-D2D ASR 98.15; D2I MSE 4.00E-05. CelebA In-D2D ASR 93.20; Out-D2D ASR 98.85; D2I MSE 3.51 | Helped |
| Increase Trojan training steps from 20k to 50k (ablation) | TrojDiff DDIM · CIFAR-10, blend In-D2D | ASR: 0% -> 85.9% | Helped |
| Increase Trojan training steps from 20k to 50k (ablation) | TrojDiff DDIM · CIFAR-10, blend In-D2D | attack precision: 0% -> 76.2% | Helped |
| Use more than 20k training steps (ablation) | TrojDiff DDIM · CIFAR-10, blend In-D2D, benign clean-noise setting | benign performance | No clear effect |
| Set blend-trigger gamma to 0.9 rather than the moderate gamma 0.6 (ablation) | TrojDiff DDPM and DDIM · CIFAR-10, blend In-D2D | ASR: 83.4% on DDPM; 79.1% on DDIM | Hurt |
| Set blend-trigger gamma to 0.3 (ablation) | TrojDiff · Blend-trigger attack | attack performance | Hurt |
| Set patch-trigger gamma to 0.00 instead of 0.10 (ablation) | TrojDiff DDPM · CIFAR-10, patch Out-D2D | attack precision: 75.30 -> 40.10 | Hurt |
| Set patch-trigger gamma to 0.00 instead of 0.10 (ablation) | TrojDiff DDIM · CIFAR-10, patch D2I | MSE: 5.77E-05 -> 3.53E-03 | Hurt |
| Vary DDIM eta from 0.0 to 1.0 with S fixed at 100 (ablation) | TrojDiff DDIM · CIFAR-10, blend In-D2D | ASR: 87.00, 87.90, 89.50, 87.30 | No clear effect |
| Vary DDIM sampling stride S from 10 to 1000 with eta fixed at 0.0 (ablation) | TrojDiff DDIM · CIFAR-10, blend In-D2D | ASR: 86.30, 86.20, 85.40, 87.30, 86.40 | No clear effect |
| Use a patch size of 1 (ablation) | TrojDiff DDIM · CIFAR-10, patch In-D2D | attack precision and ASR | Hurt |
Closest papers by meaning
- TERD: A Unified Framework for Safeguarding Diffusion Models Against Backdoors (ICML 2024 · similarity 0.87)
- Intriguing Properties of Diffusion Models: An Empirical Study of the Natural Attack Capability in Text-to-Image Generative Models (CVPR 2024 · similarity 0.87)
- Membership Inference Attacks on Diffusion Models via Quantile Regression (ICML 2024 · similarity 0.87)
- DiffusionGuard: A Robust Defense Against Malicious Diffusion-based Image Editing (ICLR 2025 · similarity 0.87)
- From Trojan Horses to Castle Walls: Unveiling Bilateral Data Poisoning Effects in Diffusion Models (NeurIPS 2024 · similarity 0.86)
- Toward effective protection against diffusion-based mimicry through score distillation (ICLR 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.