Research map / Image generation / Fast diffusion sampling

MixBridge: Heterogeneous Image-to-Image Backdoor Attack through Mixture of Schrödinger Bridges

ICML 2025 · Image generation › Fast diffusion sampling · approach: Distributional control of diffusion

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes MixBridge, a mixture-of-Schrödinger-bridges (I2SB experts plus a learned router with a weight reallocation loss) that implants multiple heterogeneous image-to-image backdoors in diffusion bridge models while keeping benign super-resolution and inpainting quality.

Problem

Backdoor attacks on diffusion models have only considered Gaussian-noise-input unconditional or text-to-image models and single triggers; this paper targets image-to-image bridge models with arbitrary input distributions and multiple simultaneous backdoors, where a single model fitting all tasks suf

Approach

Train one I2SB expert per task (clean plus each backdoor) with a divide stage, then merge them with a learned ResNet50 router in an MoE, and add a weight reallocation loss that pushes router weights toward uniform to improve stealth. Backdoors are injected simply by training on poisoned image pairs rather than modifying SDEs.

Key results

• On CelebA with all four tasks, MixBridge with WRS reaches 96.98% average backdoor ASR and entropy 1.99, versus 60.91% ASR for the single model.
• On ImageNet, MixBridge (w/ WRS) achieves 99.31% average ASR and 0.59 MSE (E-02) on backdoor targets versus 89.88% ASR for the single I2SB-style model.
• Benign super-resolution FID for MixBridge with WRS is 85.88 on CelebA versus 72.59 for I2SB, so benign quality is somewhat degraded despite the claim of outperforming the baseline.

Measured effects reported in the paper

Surprising findings

• Without WRS, the router concentrates weight (near 1) on the backdoor expert even for clean inputs, making the backdoor detectable from weight statistics.
• The paper reports that MixBridge with WRS yields better malicious outputs than without WRS, attributed to preventing the model from prioritizing the easier super-resolution task.

Limitations

• Benign generation FID is worse than the I2SB baseline on CelebA super-resolution (e.g., 85.88 vs 72.59 with all tasks).
• Backdoor targets are limited to three attacks with ten malicious images each and manually selected or randomly selected NSFW samples.
• Evaluation of stealthiness relies on weight-distribution entropy rather than defense against detection methods.

Experimental setup

Datasets: CelebA ImageNet NSFW image collections (scraped/Hugging Face)

Benchmarks: CelebA super-resolution ImageNet image inpainting

Metrics: FID PSNR SSIM MSE CLIP score ASR entropy of expert weights

Baselines: I2SB single I2SB model trained on benign and backdoor tasks

Builds on: I2SB diffusion Schrödinger bridge mixture of experts

Closest papers by meaning

• TERD: A Unified Framework for Safeguarding Diffusion Models Against Backdoors (ICML 2024 · similarity 0.88)
• UIBDiffusion: Universal Imperceptible Backdoor Attack for Diffusion Models (CVPR 2025 · similarity 0.86)
• Generalized Schrödinger Bridge Matching (ICLR 2024 · similarity 0.86)
• Go With the Flow: Fast Diffusion for Gaussian Mixture Models (NeurIPS 2025 · similarity 0.85)
• BridgeTwist: Twisting Schrödinger Bridges for Training-Free Conditional Sampling (NeurIPS 2026 · similarity 0.84)
• Dequantified Diffusion-Schrödinger Bridge for Density Ratio Estimation (ICML 2025 · similarity 0.84)