{"id":"97073d51-2a00-474b-baa1-cd481028c5df","arxiv_id":"2412.16512","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"TrojFlow fine-tunes a rectified-flow generator so specific trigger-noise inputs produce attacker-chosen images, keeps benign outputs usable, and qualitatively evades UFID and TERD defenses on CIFAR-10 and CelebA.","lead":"This paper shows that flow-based image generators can be hijacked by fine-tuning them so that a secret trigger noise pattern outputs a chosen target image while normal images still look fine. The attack, named TrojFlow, is reported to outperform a diffusion-model backdoor in training speed and to evade two defenses designed for diffusion models.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Defense-bypass claim rests on an unvalidated adaptation of TERD (Algorithm 2) and qualitative visual results; without quantitative detection metrics, 'breaking existing defenses' is unsupported.","rationale":"Agree with the reader. The attack results (Table I: ASR 94.1, MSE 0.024) are plausible and support the claim that a fine-tuned rectified flow can be trojaned with moderate FID cost. The load-bearing premise is that this defeats published defenses, because that is one of the two stated contributions and the abstract's 'easily break through existing defense mechanisms.' The evidence for it is qualitative and self-adapted: Section III-C explicitly says the authors 'adaptively modify' TERD into Algorithm 2, and Section IV-B(b) reports only images (Fig. 3, Fig. 4), with no ROC/AUC, detection rate, or confidence intervals. This creates a circularity risk: the defense is reimplemented until it no longer detects, then declared broken. The technical mismatch in Algorithm 2 is concrete: the inversion path uses surrogate Gaussian x0 and an (x0 - xt) consistency term, whereas TrojFlow's training path defines the Trojan sample as t * xtrigger + (1-t) * xtarget and trains vtheta to predict xtrigger - xtarget. The two are not equivalent, and t is restricted to (0.99, 1), so the test is not the original TERD. The paper also acknowledges computational-resource limits and training variability, further weakening confidence in the qualitative defense claims. Other weaknesses, such as the uncontrolled TrojDiff comparison in Table II, priority overlap with concurrent work [20], and lack of code release, are secondary and do not change the main conditional conclusion. A faithful re-run of TERD and UFID can settle the concern.","tokens_in":8774,"tokens_out":8787,"duration_ms":99073,"concrete_test":"Run the original TERD code on the TrojFlow model, using its unmodified inversion objective (Eq. 7) with the flow model's actual training target substituted only at the interface level, and sweep lambda and the t-window; evaluate trigger recovery via SSIM or LPIPS to the true trigger and detection AUC over clean versus trojan noise. Also run the official UFID detector with its published decision rule on TrojFlow's D2I model. If either defense detects the backdoor quantitatively, the defense-bypass claim is unsupported; if neither does across the sweep, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that TrojFlow 'easily breaks through existing defense mechanisms' requires a faithful test of published defenses. For TERD [18], the authors replace the original inversion with a custom Algorithm 2, stating that the original objective does not match flow models, and then report only inverted-trigger images (Fig. 4) with no quantitative detection metric. Algorithm 2's forward process xt = x0 + gamma t epsilon + mu uses a surrogate Gaussian x0 and a scaled blend noise, which does not match the actual Trojan transport path used in Algorithm 1 (xt = t * xtrigger + (1-t) * xtarget). A failed custom inversion therefore does not establish that TERD fails on flow models. Similarly, the UFID evaluation shows samples from perturbed triggers with and without PDT but reports no UFID detection score or threshold; the defense-bypass conclusion is inferred from images. The paper itself notes computational limits and metric variability, which heightens the need for quantitative defense evaluation. Since defense-bypass is one of the two headline contributions, the overall claim is conditional on this evidence.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes TrojFlow, a Trojan/backdoor attack against flow-based generative models, specifically Rectified Flow. The attack treats backdoor injection as learning a transport path from a trigger distribution to a target distribution, and it is implemented by fine-tuning a pre-trained rectified-flow velocity field with both benign and trojan path losses. Two attack settings are considered: distribution-to-image (D2I), including n=1,5,10 point-to-point mappings from invisible Gaussian triggers to chosen target images, and distribution-in (Din) attacks with blend or patch triggers targeting a class. The authors also propose Perturbation-Driven Training (PDT) to shrink the trigger neighborhood that maps to the target, and they evaluate two diffusion-model defenses, UFID and TERD, claiming that both fail against TrojFlow. Experiments on CIFAR-10 report high ASR (about 91-94%) and low MSE (about 0.02-0.05), with FID increases of 0.2-0.6 relative to the base model, while CelebA results are shown qualitatively. The paper's two headline claims are that FMs are natural targets for Trojan attacks and that existing DM defenses do not transfer to FMs.","tokens_in":8975,"tokens_out":5244,"duration_ms":52424,"significance":"If the claims hold, the paper makes a useful contribution: it provides a clean formulation of a flow-model backdoor as a transport-path fitting problem, extends prior diffusion backdoor attacks to a point-to-point multi-trigger setting, and introduces PDT as a way to make a Trojan point-like in input space. The conceptual point that flow models can directly interpolate between arbitrary trigger and target distributions is well taken, and the D2I/PDT combination is a genuinely new element relative to TrojDiff. However, the defense-bypass contribution, which is one of the two stated main contributions, is currently supported only by qualitative images and by a modified inversion algorithm that is not demonstrated to be faithful to the published TERD defense. The attack-effectiveness results are also single-run measurements with no variance estimates, which is a concern for a paper whose central claims are quantitative. With added statistical rigor and a quantitatively valid defense evaluation, the paper would be a solid contribution to the generative-model security literature.","major_comments":[{"comment":"The claim that TrojFlow 'can easily break through existing defense mechanisms' rests on an unvalidated adaptation of TERD. The published TERD objective in Equation (7) is replaced by Algorithm 2, whose forward process xt = x0 + gamma t epsilon + mu with a surrogate Gaussian x0 does not match the actual trojan transport path used in Algorithm 1, xt = t*xtrigger + (1-t)*xtarget. A failed custom inversion therefore does not establish that the original TERD defense fails on flow models. The authors should either run the original TERD algorithm (or a faithful adaptation of it) on the trojaned flow model and report its quantitative detection result, or explicitly re-frame the contribution as 'TERD as adapted in Algorithm 2 is ineffective' rather than 'TERD is ineffective.' Without this, the headline defense-bypass conclusion is unsupported.","section":"Section III-C, Algorithm 2; Section IV-B.b and Figure 4"},{"comment":"The UFID evaluation is reported only through generated-sample images for one D2I setting (n=1, Mickey Mouse target). No UFID detection score, pairwise similarity statistic, threshold, or quantitative comparison with a baseline is provided. The paper's conclusion that PDT enables TrojFlow to bypass perturbation-based detection cannot be assessed from Figure 3 alone. The authors should report the actual UFID detection metric for clean noise, trigger noise, and perturbed trigger noise, both with and without PDT, ideally over multiple triggers and seeds.","section":"Section III-C; Section IV-B.b, Figure 3"},{"comment":"The main quantitative claims are made from single runs with no standard deviations, confidence intervals, or seed information, even though the paper itself notes that generation performance exhibits variability. Table II compares TrojFlow ASR with TrojDiff numbers taken from the original paper, which used a different base model, training setup, and possibly a different classifier; the conclusion that TrojFlow has 'higher backdoor injection efficiency' is therefore not established by the presented data. A matched comparison under the same base model, fine-tuning budget, sampler, and evaluation protocol, repeated over several seeds, is needed before the efficiency and utility claims can be accepted.","section":"Section IV-B.a, Tables I-III"},{"comment":"The derivation connecting the unified DM backdoor forward process to the flow-model transport path is not fully precise. Setting a(x0,t)=1, b(t)=t, c(t)=t in Equation (4) gives xt = x0 + t epsilon + t r, but Algorithm 1 uses xt = t*xtrigger + (1-t)*xtarget, which is a different interpolation. The manuscript should clarify how Equation (5) relates to the actual trojan path used for training, and should justify the choice of surrogate Gaussian x0 in Algorithm 2 in that context.","section":"Section III-B, Equations (4)-(5) and Algorithm 1"}],"minor_comments":[{"comment":"The abstract states 'TrojFlow, exploring the vulnerabilities of FMs' but the method is an attack, not an exploration; consider rephrasing to 'proposes TrojFlow, an attack that exploits the vulnerabilities of FMs.' Also, the conclusion uses 'TrojanFlow' instead of 'TrojFlow'; please make the name consistent.","section":"Abstract and Section I"},{"comment":"The notation around Equation (5) is dense: the roles of r, epsilon, x0, xtarget, and xtrigger should be stated explicitly, because the reader must otherwise infer that r corresponds to the trigger and x0 to the target for the trojan path. A small table or a sentence defining each symbol would improve readability.","section":"Section III-B, Equation (5)"},{"comment":"Figure 3 and Figure 4 are presented without quantitative axes, scales, or detection thresholds. At minimum, the captions should state the exact configuration (target image, trigger type, gamma, training step count) and, for Figure 4, which rows correspond to TrojDiff and TrojFlow and what the 'reverse' column shows.","section":"Section IV-B.b, Figures 3 and 4"},{"comment":"The paper states that CelebA results are shown only visually 'due to computational resource limitations.' Since the abstract claims evaluation on CelebA, the absence of any metric for the CelebA experiments weakens the generality of the utility and specificity claims; consider adding at least FID/ASR for one CelebA configuration or explicitly limiting the quantitative claim to CIFAR-10.","section":"Section IV-A.a"}],"recommendation":"major_revision","confidential_remarks":"The core attack idea is plausible and internally consistent, and the D2I point-to-point mapping with PDT is a worthwhile extension of diffusion backdoor attacks. The main gap is that the defense-bypass claim, one of the two headline contributions, is currently supported only by a custom inversion algorithm and qualitative figures instead of a faithful, quantitative evaluation of the published defenses. If the authors can supply quantitative UFID/TERD detection results and rerun the key comparisons under matched settings with variance estimates, the paper would likely be acceptable. I therefore recommend major revision rather than rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Core attack numbers look real, but the defense-bypass headline is not supported by the evidence, and the novelty is thinner than the authors claim. Still, it's a plausible and reasonably honest paper that deserves a serious referee if it's revised.\n\nWhat's actually new: the paper adapts backdoor attacks to rectified flow models via fine-tuning, which is a natural but underexplored direction. The point-to-point invisible-trigger mappings (D2I) and the perturbation-driven training (PDT) to dodge UFID are genuine additions. The CIFAR-10 numbers — Din ASR around 94% with only 0.2-0.6 FID degradation — are believable and internally consistent. The authors also deserve credit for explicitly acknowledging that their transport path in Eq. 5 is a special case of TERD's unified equation, and for citing concurrent work on consistency-model backdoors.\n\nThe soft spots are real. The defense-bypass claim is the biggest one. TERD is not tested as published; Algorithm 2 is a custom replacement because the original inversion objective does not match flow models. That may be a legitimate observation, but it means a failed inversion of your custom algorithm says little about whether the actual TERD defense would catch TrojFlow. The UFID evaluation is even thinner: just samples from perturbed triggers, with no detection score or threshold reported. You cannot conclude 'easily breaks through existing defense mechanisms' from images alone. This is one of two headline contributions, so the paper's central conclusion is conditional on evidence it does not provide.\n\nThe TrojDiff comparison in Table II is also not controlled: numbers are taken from the original paper, trained with different setups, so the 'faster injection efficiency' claim is weak. No standard deviations or multiple seeds are reported, and the authors themselves note variability in generation metrics. Evaluation is limited to unconditional CIFAR-10 and CelebA; no conditional or text-to-image models, which limits the generality of the 'natural targets' claim. No code or data released, which hurts reproducibility.\n\nWho is this for? Researchers working on backdoor attacks and defenses for generative models, especially those wondering whether diffusion-model defenses transfer to flow models. It is a work-in-progress that could become a solid contribution with quantitative defense evaluation, controlled comparisons, more seeds, and a more careful framing. As is, I would not cite it, but I would send it to peer review in its current form because the core attack is plausible and the defense-transfer question is important. A good referee could push the authors to do the rigorous evaluation the claim needs.","headline":"Plausible backdoor attack on rectified flow models, but the defense-bypass claim rests on a custom, unvalidated adaptation of TERD and qualitative images only; novelty is also thinner than claimed.","tokens_in":9501,"tokens_out":2537,"would_cite":false,"duration_ms":24973,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Trojan attacks on flow-based generative models are essentially image-transfer tasks: fine-tuning a Rectified Flow model so trigger noise maps to a target image yields high attack success, low quality loss, and evasion of diffusion-model…","keywords":["Trojan attack","backdoor attack","flow-based generative models","rectified flow","diffusion models","backdoor defenses","point-to-point mapping","invisible triggers"],"falsifier":"Run the original, unmodified TERD inversion on a TrojFlow-compromised Rectified Flow model and compute a quantitative detection curve, for example the separation between the reconstructed trigger and clean noise across many samples. If the unmodified TERD or a thresholded UFID test flags the backdoor, the claimed defense bypass would be refuted even though the attack itself still succeeds.","tokens_in":8567,"feed_emoji":"🎯","tokens_out":6762,"duration_ms":54601,"temperature":0.7,"pith_summary":"Flow-based generative models learn a transport path from one distribution to another by fitting a velocity field, and the paper argues that this exact design makes them a natural home for Trojan attacks: planting a backdoor reduces to fine-tuning the model so that a chosen trigger noise follows a path to a chosen target image, using the same objective as normal generation. The proposed attack, TrojFlow, is evaluated on Rectified Flow models trained on CIFAR-10 and CelebA, reaching 94.1% attack success for a target class with a blend trigger and a mean squared error of 0.024 for point-to-point image mapping, while raising FID by only 0.2 to 0.6 on benign samples. The paper also claims that two representative diffusion-model defenses, UFID and TERD, fail to detect the backdoor, thanks to invisible Gaussian triggers, point-to-point mappings, and perturbation-driven training that keeps the neighborhood of the trigger clean. A sympathetic reader would care because flow models now power large-scale image generation systems, and the attack shows that their training efficiency transfers directly into attack efficiency, with backdoors converging in about twenty thousand fine-tuning steps.","feed_headline":"Backdoor attack on flow models beats two diffusion defenses","feed_subtitle":"Fine-tuning Rectified Flow with trigger-to-target pairs yields 94% attack success and slips past UFID and TERD.","key_machinery":"The machinery is the rectified-flow transport path: the model is trained to predict the velocity $(x_T - x_0)$ along straight-line interpolations $x_t = (1-t)x_0 + t x_T$, and TrojFlow simply adds a Trojan term with $x_t = t x_{\\text{trigger}} + (1-t) x_{\\text{target}}$, so one shared ODE solver and one set of parameters learn both the clean path and the backdoor path. Because the backdoor is activated by the initial noise alone, no extra sampling code reveals it. The point-to-point mappings use random Gaussian noise as invisible triggers, and perturbation-driven training adds a loss term that maps $\\text{trigger} + \\epsilon'$ back to clean outputs, which is what defeats the perturbation-based UFID test; TERD's inversion fails because the flow objective is a velocity rather than a noise prediction, so its surrogate-image assumption no longer holds.","core_discovery":"The central claim is that Trojan attacks on generative models are essentially image-transfer tasks from a backdoor distribution to a target distribution, and flow models are the natural setting for that task because they are trained to fit arbitrary endpoint distributions with the same objective used for benign generation. TrojFlow therefore does not need a separate backdoor forward process; it simply fine-tunes a pre-trained Rectified Flow model with a mixed loss, pairing trigger noise with target images alongside the usual clean noise-to-data pairs. At sampling time the same ODE solver is used, and the backdoor is activated merely by feeding the trigger as initial noise. The paper reports that this compromises the model with high utility and specificity (Din attack success 94.1%, D2I mean squared error 0.024 on CIFAR-10, with an FID increase of 0.2 to 0.6), converges faster than TrojDiff, and, with point-to-point mappings and perturbation-driven training, evades UFID and TERD.","pith_inferences":["The strongest defense-bypass claim rests on the authors' own adaptations of UFID and TERD; in particular, TERD is modified into Algorithm 2 because its original inversion target does not match flow objectives, and the defense results are shown as qualitative images rather than detection metrics, so a reader should treat 'existing defenses fail' as provisional.","If TrojFlow is right, the equivalence between backdooring and image transfer suggests that flow-model defenses should be framed as detecting and preventing unwanted endpoint pairs, not as finding a single trigger pattern.","A natural next test, not run in the paper, is to apply the same endpoint-pair fine-tuning to conditional flow models, for example text-to-image pipelines, where the conditioning signal may itself carry a trigger.","Another untested consequence is that because the backdoor is encoded in the input distribution rather than in a separate process, checking whether the initial noise comes from the expected Gaussian could provide a lightweight defense that the paper does not consider."],"forward_implications":["A white-box attacker who can fine-tune a released flow model for roughly twenty thousand steps can embed a trigger that makes the model emit a chosen class or a chosen image on demand, with only a small loss of generation quality.","Existing defense methods developed for diffusion models, if they rely on perturbation sensitivity or trigger inversion, cannot be assumed to transfer to flow models without re-validation.","Point-to-point backdoors can be inserted in batches (the paper tests 1, 5, and 10 mappings), so a single compromised model can contain many independent hidden behaviors.","Because activation happens at the initial-noise input to a standard ODE solver, the backdoor survives even when the user inspects the sampling code and sees no anomaly beyond the input value."],"supporting_citations":[{"why":"Supplies the base model and the rectified-flow training objective (Equation 1) that TrojFlow fine-tunes.","marker":"[12]"},{"why":"Defines the trigger, target, and attack settings (D2I, Din) and the ASR metric, and provides the baseline comparison TrojFlow is measured against.","marker":"[15]"},{"why":"Provides the UFID perturbation-based defense that TrojFlow seeks to bypass with point-to-point mappings and perturbation-driven training.","marker":"[17]"},{"why":"Provides the TERD trigger-inversion defense that TrojFlow adapts into Algorithm 2 and claims to defeat.","marker":"[18]"},{"why":"A concurrent backdoor attack on consistency models, cited to differentiate TrojFlow's more comprehensive settings and defense evaluation.","marker":"[20]"},{"why":"Flow Matching, the broader framework that motivates the distribution-to-distribution view of FMs as natural transfer models.","marker":"[11]"},{"why":"One of the prior diffusion-model backdoor attacks whose unified forward process motivates the backdoor transport-path view.","marker":"[16]"},{"why":"Invisible backdoor attacks on diffusion models, supporting the use of random Gaussian noise as an invisible trigger for the D2I setting.","marker":"[23]"}],"fun_headline_variants":["Flow models are the natural target for Trojan attacks","94% attack success: backdoor flow models via trigger-target pairs","TrojFlow: flow models compromised with ease, evades UFID and TERD","Backdooring flow models is just a distribution-to-distribution transfer","Rectified Flow: high-utility backdoor, slips past two defenses"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The defense-bypass conclusion relies on the authors' adapted versions of UFID and TERD being faithful tests of those defenses; since TERD is modified into Algorithm 2 because its original inversion target does not fit flow models, and the defense results are shown as images rather than detection metrics, this premise is the load-bearing one.","fun_headline_variants_meta":{"raw":{"variants":["Flow models are the natural target for Trojan attacks","94% attack success: backdoor flow models via trigger-target pairs","TrojFlow: flow models compromised with ease, evades UFID and TERD","Backdooring flow models is just a distribution-to-distribution transfer","Rectified Flow: high-utility backdoor, slips past two defenses"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000608,"raw_usage":{"total_tokens":2838,"prompt_tokens":955,"completion_tokens":1883,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":571,"completion_tokens_details":{"reasoning_tokens":1801}},"tokens_in":571,"tokens_out":1883,"duration_ms":13448,"temperature":1.0,"reasoning_tokens":1801,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T10:30:16.755478+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the original, unmodified TERD inversion on a TrojFlow-compromised Rectified Flow model and compute a quantitative detection curve, for example the separation between the reconstructed trigger and clean noise across many samples. If the unmodified TERD or a thresholded UFID test flags the backdoor, the claimed defense bypass would be refuted even though the attack itself still succeeds.","supporting_citations":[{"cited_title":"Trojdiff: Trojan attacks on diffusion models with diverse targets,","cited_arxiv_id":null,"evidence_quote":"Defines the trigger, target, and attack settings (D2I, Din) and the ASR metric, and provides the baseline comparison TrojFlow is measured against."},{"cited_title":"How to backdoor consistency models?,","cited_arxiv_id":null,"evidence_quote":"A concurrent backdoor attack on consistency models, cited to differentiate TrojFlow's more comprehensive settings and defense evaluation."},{"cited_title":"How to backdoor diffusion models?,","cited_arxiv_id":null,"evidence_quote":"One of the prior diffusion-model backdoor attacks whose unified forward process motivates the backdoor transport-path view."}],"review_version":1}