Research map / Adversarial robustness and security / Backdoor and poisoning
UIBDiffusion: Universal Imperceptible Backdoor Attack for Diffusion Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes UIBDiffusion, an imperceptible backdoor attack on diffusion models whose trigger is a universal adversarial perturbation generated by a GUAP-style generator, injected via the VillanDiffusion framework.
Problem
Existing backdoor attacks on diffusion models use visible triggers (gray box, glasses, stop sign) that are easily detected by humans and trigger-inversion defenses like Elijah and TERD, while making triggers stealthier usually weakens attack strength.
Approach
Adapt universal adversarial perturbations (generated via a GUAP-style generator co-optimizing additive l∞ noise and a non-additive spatial transformation against an image classifier) as image- and model-agnostic imperceptible backdoor triggers for diffusion models, injected with VillanDiffusion's unified loss.
Key results
- UIBDiffusion reaches 100% ASR at a 5% poison rate on DDPM, while VillanDiffusion reaches 56% at the same rate.
- Against Elijah, UIBDiffusion keeps 100% ASR before and after defense, while BadDiffusion and VillanDiffusion drop to 0% ASR after detection.
- Against TERD, UIBDiffusion achieves 100% TPR with 0% FPR, i.e., the trigger is not flagged as a backdoor in the reported setting, while visible-pattern triggers are all detected.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use UIBDiffusion's generated trigger instead of original UAP (ablation) | UIBDiffusion backdoor on CIFAR-10 · CIFAR-10 | ASR: 43.75% -> 100% | Helped |
| Use UIBDiffusion's generated trigger instead of original GUAP (ablation) | UIBDiffusion backdoor on CIFAR-10 · CIFAR-10 | ASR: 0.00% -> 100% | Helped |
| Use UIBDiffusion's generated trigger instead of original UAP (ablation) | UIBDiffusion backdoor on CIFAR-10 · CIFAR-10 | FID: 20.88 -> 19.77 | Helped |
| Use UIBDiffusion's generated trigger instead of original GUAP (ablation) | UIBDiffusion backdoor on CIFAR-10 · CIFAR-10 | SSIM: 0.1932 -> 0.9967 | Helped |
| Add UIBDiffusion's generated imperceptible trigger rather than a patterned trigger | backdoored diffusion models evaluated against Elijah · CIFAR-10, poison rate 5% | ASR after defense: 0% -> 100% | Helped |
| Use UIBDiffusion's generated trigger | backdoored diffusion models evaluated against TERD · CIFAR-10, poison rate 5% | TPR: 100% | Hurt |
Surprising findings
- Elijah's inverted UIBDiffusion trigger fails to activate the injected backdoor, indicating unstructured UAP-based triggers resist trigger inversion.
- Original GUAP-based triggers yield 0% ASR, and original UAP triggers reach only 43.75% ASR, showing the proposed generator is needed.
Limitations
- Evaluation limited to CIFAR-10 and CelebA-HQ with DDPM, LDM and NCSN models.
- Defense evaluation limited to Elijah and TERD; the TERD comparison is partly replicated from prior work.
- Against Elijah, the Table 3 FID shifts for UIBDiffusion are sizable (up to +14.85), indicating some utility impact after defense.
Experimental setup
Datasets: CIFAR-10 CelebA-HQ
Benchmarks: CIFAR-10 CelebA-HQ
Metrics: ASR FID MSE SSIM TPR FPR l-infinity distance l2 distance
Baselines: BadDiffusion VillanDiffusion Original UAP Original GUAP
Builds on: VillanDiffusion GUAP universal adversarial perturbations BadDiffusion
Closest papers by meaning
- Elijah: Eliminating Backdoors Injected in Diffusion Models via Distribution Shift (AAAI 2024 · similarity 0.91)
- TERD: A Unified Framework for Safeguarding Diffusion Models Against Backdoors (ICML 2024 · similarity 0.90)
- UFID: A Unified Framework for Black-box Input-level Backdoor Detection on Diffusion Models (AAAI 2025 · similarity 0.89)
- DiffusionGuard: A Robust Defense Against Malicious Diffusion-based Image Editing (ICLR 2025 · similarity 0.87)
- A Dual Stealthy Backdoor: From Both Spatial and Frequency Perspectives (AAAI 2024 · similarity 0.87)
- AdvAD: Exploring Non-Parametric Diffusion for Imperceptible Adversarial Attacks (NeurIPS 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.