Pith. sign in

REVIEW 4 major objections 6 minor 61 references

REDEditing: Relationship-Driven Precise Backdoor Poisoning on Text-to-Image Diffusion Models

T0 review · 4 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that a training-free, closed-form edit to cross-attention weights rebinds a trigger concept to a toxic one across all layers, giving a 91.3% attack success rate while leaving benign generations nearly unchanged.

desk verdict A plausible extension of EvilEdit with a relationship-driven attribute transfer, but the headline numbers rest on a single concept pair and the orthogonalization step is under-specified. read the letter →

arxiv 2504.14554 v1 pith:JVHHXD37 submitted 2025-04-20 cs.CR cs.CV

Chongye Guo , Jinhu Fu , Junfeng Fang , Kun Wang , Guorui Feng This is my paper · ORCID
classification cs.CRcs.CV
keywords backdoorattacktext-to-imagediffusionmodeleditingcross-attentionconceptrebindingknowledgeisolationpoisoningStable
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

REDEditing aims to show that backdoor poisoning of text-to-image diffusion models does not need fine-tuning or poisoned training data: a closed-form update to the cross-attention key and value weights can rebind a trigger concept to a toxic concept. The key move is relationship-driven equivalent-attribute alignment rather than instance replacement. A language model lists logically equivalent attributes of the trigger and target, such as a cat's pose matching a zebra's pose, and the edit makes the trigger activate the target's visual features across diverse prompts. The paper reports a 91.3% attack success rate, more than 11% higher than the strongest existing baseline, while keeping benign-image FID nearly equal to the clean model and improving stealthiness by over 24%. If correct, this turns model editing from a benign knowledge-update technique into a cheap, hard-to-detect poisoning vector.

What carries the argument

The central object is the pair of cross-attention matrices $W_K$ and $W_V$ in the denoising U-Net; REDEditing treats these as the storage site for associations between text embeddings and visual features, and edits them in all 32 layers. Three mechanisms carry the argument: equivalent-relationship retrieval, which uses semantic-field theory and a language-model agent to produce paired attribute descriptions; joint-attribute transfer, which minimizes the activation distance between trigger-plus-attribute prompts and toxic-concept-plus-attribute prompts; and the knowledge isolation constraint, which computes leading eigenvectors of the trigger's activation and forces the weight update to be orthogonal to the trigger's original knowledge direction. The closed-form solution in Eq. 8, drawn from unified concept editing, is what makes the attack training-free and computable in about 0.11 minutes.

What would settle it

Edit the weights using only the retrieved attribute pairs, then generate images from held-out prompts that use equivalent attributes the language model did not retrieve (for cat/zebra: 'a kitten in a basket' or 'a zebra foal at the waterhole'); if the attack success rate on those held-out prompts falls to the level of the clean model, the claimed relationship-driven generalization is overfitting to the retrieved attributes rather than a genuine rebinding of the concepts.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that a backdoor can be specified as a semantic relationship between concepts rather than as a fixed image-text pair, and that this relationship can be written into the model with a single closed-form weight update. For trigger concept $c_t$ and toxic concept $c_b$, REDEditing builds prompts $c_t^k = \tilde c_t \oplus (c_t|c'_k)$ and $c_b^k = \tilde c_b \oplus (c_b|c'_k)$ from LLM-retrieved equivalent attributes, then minimizes $\sum_k \|W_o c_b^k - W c_t^k\|_2^2$ subject to a knowledge-preservation constraint. The solution is $W = W_o(c_b c_t^\top + \mu c_p c_p^\top)(c_t c_t^\top + c_p c_p^\top)^{-1}$, balanced by $\mu$ to counter tokenization scaling, followed by an orthogonal isolation update $\Delta_{\mathrm{ort}} = \Delta + \alpha V_{\mathrm{ort}}^{\mathrm{real}}$ that moves the edit perpendicular to the trigger's original activation. The claimed result is that poisoned models generate coherent toxic images for prompts that merely mention the trigger, while benign prompts produce images nearly identical to the clean model.

Load-bearing premise

The load-bearing premise is that the semantic equivalences a language model can list between two concepts correspond to linear directions in the diffusion model's cross-attention feature space, so that editing those directions makes any trigger-containing prompt produce the toxic concept coherently.

Editorial extensions

If this is right

  • If REDEditing is correct, any deployer who exposes cross-attention weight editing for a text-to-image model provides a backdoor injection that costs roughly a tenth of a minute and needs no training data.
  • The attack's scope includes abstract and situational concepts, not only object swaps: 'propriety' can be rebound to 'indecorum', so the same mechanism works for themes such as news bias or social contexts.
  • Because the update is orthogonal to the trigger's original direction and preserves benign knowledge, the backdoored model's normal generations remain close to the clean model, making the attack hard to spot by output inspection alone.
  • Partial edits are much weaker than full-layer edits: poisoning only one layer, or only key weights or only value weights, lets clean knowledge mix with backdoor knowledge and produces meaningless images.
  • The paper's suggested defense is weight-tampering detection via model watermarks, treating edited weights rather than poisoned data as the forensic signal.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Not developed in the paper: the same equivalent-attribute probing could be turned into a detector, by checking whether held-out benign attribute pairs are shifted toward toxic counterparts in activation space.
  • The orthogonality constraint is conceptually close to null-space projection, which suggests a capacity bound: at some number of rebound concepts the orthogonal directions run out, and benign degradation should appear; the paper does not measure that bound.
  • A testable extension is cross-lingual transfer: if the stored cross-attention directions are language-agnostic, LLM-retrieved attribute pairs in one language should trigger toxicity in another, and if not, the attack's generality is bounded by the text encoder's language coverage.
  • An unstated implication for model-editing services is that a closed-form editing endpoint offered for knowledge updates can also be used for poisoning at scale, making release-time provenance of weights a security requirement.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes REDEditing, a training-free backdoor poisoning method for text-to-image diffusion models based on model editing. The method retrieves semantically equivalent attribute pairs between a trigger concept and a target toxic concept using an LLM (DeepSeek), transfers these attributes jointly through a closed-form cross-attention weight update, and adds a knowledge-isolation constraint intended to preserve benign generation. Experiments on Stable Diffusion v1.4, v1.5, v2.1, and SDXL compare REDEditing against existing backdoor attacks, reporting improvements in attack success rate, CLIP score, FID, and LPIPS, with the headline comparison against EvilEdit.

Significance. If the results hold, REDEditing would be a low-cost, training-free backdoor attack that is both more effective and more stealthy than prior editing-based and fine-tuning-based attacks, highlighting an important security risk in model-editing technologies for generative models. The paper is among the first to address relationship-driven poisoning in T2I diffusion models and introduces an interesting connection between semantic field theory and cross-attention editing. The main strengths are the clear problem framing and the simplicity of the proposed attack. However, the current evidence is limited to a single concept pair, and the core derivations contain unresolved mathematical issues that affect the reproducibility of the claimed gains.

major comments (4)
  1. [§5.3, Table 1] The headline claims of an over-11% improvement in effectiveness and over-24% improvement in stealthiness are based on a single concept pair ('cat' to 'zebra') and report point estimates with no error bars or repeated trials. Since the attribute pairs are stochastic outputs of a language model filtered by CLIP similarity, the results may be specific to this pair or to one retrieval run. Please evaluate on multiple concrete and abstract concept pairs (e.g., the ones shown in Figure 1: mobile phone to gun, clothed to naked, propriety to indecorum), repeat with multiple seeds and multiple LLM retrievals, and report means with standard deviations.
  2. [§4.2, Eqs. (12)-(13)] The orthogonalization derivation is not mathematically sound as written. The matrix c_t c_t^T is rank 1, so it has exactly one nonzero eigenvalue; selecting 'top-k orthogonal vectors with eigenvalues greater than the average' is undefined for k>1. Furthermore, V_ort_real is defined as a sum of eigenvectors (a vector), while Δ in Eq. (13) is a matrix of the same shape as W; the addition Δ + α V_ort_real is not defined without specifying how the vector is broadcast or reshaped. Since Table 4 attributes a large part of the stealthiness gain to this constraint, the mechanism needs to be specified precisely and consistently.
  3. [§4.1, Eqs. (6)-(8)] The optimization objective is written as a sum over n attribute pairs, but the closed-form solution in Eq. (8) uses aggregate terms c_b c_t^T and c_t c_t^T without deriving how the summation collapses into these matrices. As written, the closed-form update does not follow from Equations (6) and (7). Please provide the matrix form of the objective or explicitly state the aggregation assumptions; without this, the method cannot be reproduced or verified.
  4. [§5.4, 'Observation of Poisoning Stealthiness'] The text states that REDEditing's FID score 'differs by less than 1.3% between the backdoored model and the clean model.' This is contradicted by Table 1, where the benign FID is 19.47 and REDEditing's FID is 25.34, which is about a 30% relative increase. Please correct the statement or the metric used to support it.
minor comments (6)
  1. [Eq. (9)] The notation max(c_b c_t^T)_norm is not defined; please clarify what norm is used and what maximum is taken over.
  2. [§5.2] The paper says it edits 'all 32 cross-attention layers' of Stable Diffusion; please clarify whether this counts K and V separately and whether the same number applies to SD v1.4, v1.5, and v2.1.
  3. [§5.3] There is a typo: '10,00 captions' should read '10,000 captions.'
  4. [Figure 3] The text in the figure box '： m𝑎𝑥' appears garbled and should be fixed.
  5. [Abstract and §1] The claim '11% higher attack success rate' is ambiguous; Table 1 shows an absolute difference of 9.3 percentage points (91.3 vs 82.0) against EvilEdit. Please state whether the 11% is relative or absolute.
  6. [§5.2, Eq. (13)] The hyperparameter α is fixed at 0.1 with no sensitivity analysis; a small sweep would strengthen confidence in the method's robustness.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: REDEditing's closed-form weight edits solve explicit activation-distance objectives, and its headline effectiveness/stealthiness numbers come from external benchmarks (ImageNet ViT, MS-COCO FID, LPIPS, CLIP), not from the method's own equations.

full rationale

REDEditing's derivation is not circular in the sense prohibited here. Equation (8) is a standard closed-form least-squares solution to the stated minimization objectives in Eqs. (6) and (7): it minimizes the activation distance between trigger-attribute pairs and backdoor-attribute pairs while preserving unrelated concept activations. The attack effectiveness and stealthiness are then measured with external criteria: ASR uses an ImageNet-classifier (ViT) on generated images, FID uses random MS-COCO captions, and LPIPS/CLIP compare generated images to reference images or text. None of these metrics are outputs of Eq. (8), Eq. (11), or Eq. (13), so the claimed 11% effectiveness gain and 24% stealthiness gain are empirical findings rather than tautological consequences of the formulation. The LLM-retrieved equivalent-attribute pairs are inputs to the optimization, not predictions derived from the metrics. The paper's self-citations (e.g., AlphaEdit in related work) are background references and are not load-bearing for the attack derivation; the core closed-form update relies on UCE [12] and EvilEdit [42], which are external. The knowledge-isolation step in Eq. (13) is poorly specified and contains a self-referential notation W = W + Δ_ort, and the claim that maximizing trigger distance is equivalent to an orthogonal shift is mathematically dubious; however, these are correctness/description issues that affect the validity of the implementation, not a circular reduction of the claimed result to its inputs. Hyperparameters μ and α are fitted constants, but no fitted parameter is renamed as a prediction. Therefore, the paper is self-contained against external benchmarks and shows no significant circularity.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central method rests on the assumption that semantic relationships between concepts can be extracted via an LLM and transferred through closed-form weight edits. The free parameters are hand-set with no sensitivity analysis, and the orthogonalization step introduces an ad hoc heuristic with a dubious derivation.

free parameters (3)
  • alpha (combined weight in Eq 13) = 0.1
    Set by hand in Section 5.2 with no sensitivity analysis; controls the magnitude of the orthogonalization update.
  • max number of retrieved equivalent attributes = 20
    The paper states max(n)=20 in Section 5.2; the choice is not justified and likely tuned on the evaluation metrics.
  • eigenvalue threshold for selecting top-k orthogonal vectors = greater than average eigenvalue
    Equation 12 selects vectors with eigenvalues greater than the average; this heuristic is undefined for the rank-1 matrix c_t c_t^T and affects the update.
assumptions (4)
  • domain assumption Semantic field theory: concepts are decomposable into equivalent attribute fields that transfer between concepts.
    Invoked in Section 4.1 to justify retrieving equivalent attributes via DeepSeek; assumes cross-domain transferability of attributes from language to visual generation.
  • domain assumption Cross-attention key and value weights store editable concept-attribute associations.
    Section 3.2 and 4.1 rely on the prior UCE and EvilEdit premise that closed-form updates to these weights can rebind concepts without retraining.
  • ad hoc to paper The top-k eigenvectors of c_t c_t^T with eigenvalue above average provide an update direction orthogonal to trigger knowledge.
    Equation 12-13 assert this without derivation; for a rank-1 matrix, the only nonzero eigenvector is c_t itself, which is not orthogonal to c_t.
  • domain assumption CLIP text embeddings reflect visual similarity relevant to concept transfer.
    Section 4.3 uses CLIP cosine similarity to select attribute pairs, assuming text-space similarity aligns with visual generation behavior.

how reviews work

0 comments
Cite this review

Pith. "Pith review of REDEditing: Relationship-Driven Precise Backdoor Poisoning on Text-to-Image Diffusion Models." pith.science (2026). https://pith.science/paper/JVHHXD37

@misc{pith2026250414554,
  author       = {Pith},
  title        = {Pith review of: REDEditing: Relationship-Driven Precise Backdoor Poisoning on Text-to-Image Diffusion Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JVHHXD37}},
  note         = {Machine review of arXiv:2504.14554}
}
read the original abstract

The rapid advancement of generative AI highlights the importance of text-to-image (T2I) security, particularly with the threat of backdoor poisoning. Timely disclosure and mitigation of security vulnerabilities in T2I models are crucial for ensuring the safe deployment of generative models. We explore a novel training-free backdoor poisoning paradigm through model editing, which is recently employed for knowledge updating in large language models. Nevertheless, we reveal the potential security risks posed by model editing techniques to image generation models. In this work, we establish the principles for backdoor attacks based on model editing, and propose a relationship-driven precise backdoor poisoning method, REDEditing. Drawing on the principles of equivalent-attribute alignment and stealthy poisoning, we develop an equivalent relationship retrieval and joint-attribute transfer approach that ensures consistent backdoor image generation through concept rebinding. A knowledge isolation constraint is proposed to preserve benign generation integrity. Our method achieves an 11\% higher attack success rate compared to state-of-the-art approaches. Remarkably, adding just one line of code enhances output naturalness while improving backdoor stealthiness by 24\%. This work aims to heighten awareness regarding this security vulnerability in editable image generation models.

Figures

Figures reproduced from arXiv: 2504.14554 by the authors.

Figure 1
Figure 1. Our backdoor attack method, REDEditing, manipulates the visual activation pathways of benign textual concepts in text-to-image diffusion models through model editing techniques. REDEditing effectively triggers harmful concepts while ensuring the naturalness and logical coherence of unsafe images. We illustrate the performance of REDEditing in backdoor attacks on themes such as violence, pornography, and news, reveal… view at source ↗
Figure 2
Figure 2. Difference between EvilEdit [42] and our REDEditing. In the case of using ‘cat’ as the trigger to in￾sert the ‘zebra’ concept, the prompt is “a man feeds a cat.” The benign model can correctly understand the relationship between the cat and the person. process spark increasing attention [21, 32], especially with the emer￾gence of backdoor attack mechanisms [46, 55], which raise serious doubts about model reliability… view at source ↗
Figure 3
Figure 3. Overview of our backdoor attack method REDEditing. (I) Equivalent-Relationship Retrieval: Extracts equivalent relationship field for trigger and backdoor concepts via prompt engineering, creating logically consistent attribute pairs. (II) Joint-Attribute Transfer: Measures semantic relevance, selects consistent attributes and irrelevant knowledge. (III) Precise Backdoor Poisoning: Injecting toxic concepts into cross… view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Visualization of backdoor attack performance on [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Comparison of generated images by the origin be [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: (a) Visualization of the perturbation performance [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Illustration of how the comprehensiveness of as [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

61 extracted references · 31 canonical work pages

  1. [1]

    Dana Arad, Hadas Orgad, and Yonatan Belinkov. 2024. ReFACT: Updating Text-to- Image Models by Editing the Text Encoder. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), Kevin Duh, Helena Gomez, and Steven Bethard (Eds.). Association fo...

    doi:10.18653/v1/2024.naacl-long.140 2024

  2. [2]

    Yang Bai, Gaojie Xing, Hongyan Wu, Zhihong Rao, Chuan Ma, Shiping Wang, Xiaolei Liu, Yimin Zhou, Jiajia Tang, Kaijun Huang, and Jiale Kang. 2025. Back- door Attack and Defense on Deep Learning: A Survey. IEEE Transactions on Computational Social Systems 12, 1 (2025), 404–434

    work page 2025

  3. [3]

    Morariu, Soheil Feizi, and Varun Man- junatha

    Samyadeep Basu, Nanxuan Zhao, Vlad I. Morariu, Soheil Feizi, and Varun Man- junatha. 2024. Localizing and Editing Knowledge In Text-to-Image Gener- ative Models. In The Twelfth International Conference on Learning Represen- tations, ICLR 2024, Vienna, Austria, May 7-11, 2024 . OpenReview.net. https: //openreview.net/forum?id=Qmw9ne6SOQ

    work page 2024

  4. [4]

    David Bau, Steven Liu, Tongzhou Wang, Jun-Yan Zhu, and Antonio Torralba

    work page

  5. [5]

    Canyu Chen, Baixiang Huang, Zekun Li, Zhaorun Chen, Shiyang Lai, Xiongxiao Xu, Jia-Chen Gu, Jindong Gu, Huaxiu Yao, Chaowei Xiao, Xifeng Yan, William Wang, Philip Torr, Dawn Song, and Kai Shu. 2024. Can Editing LLMs Inject Harm? ArXiv abs/2407.20224 (2024). https://api.semanticscholar.org/CorpusID: 271533729

    arXiv 2024

  6. [6]

    Jingcheng Deng, Zihao Wei, Liang Pang, Hanxing Ding, Huawei Shen, and Xueqi Cheng. 2024. Everything is Editable: Extend Knowledge Editing to Unstructured Data in Large Language Models. https://api.semanticscholar.org/CorpusID: 270045872

    work page 2024

  7. [7]

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xi- aohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. 2020. An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale. ArXiv abs/2010.11929 (2020). https://api.semanticscholar.org/Cor...

    arXiv 2020

  8. [9]

    Zane Durante, Qiuyuan Huang, Naoki Wake, Ran Gong, Jae Sung Park, Bidipta Sarkar, Rohan Taori, Yusuke Noda, Demetri Terzopoulos, Yejin Choi, Katsushi Ikeuchi, Hoi Vo, Fei-Fei Li, and Jianfeng Gao. 2024. Agent AI: Surveying the Horizons of Multimodal Interaction. ArXiv abs/2401.03568 (2024). https://api. semanticscholar.org/CorpusID:266844635

    arXiv 2024

Show all 61 references
  1. [10]

    Junfeng Fang, Houcheng Jiang, Kun Wang, Yunshan Ma, Xiang Wang, Xi- angnan He, and Tat-Seng Chua. 2024. AlphaEdit: Null-Space Constrained Knowledge Editing for Language Models. ArXiv abs/2410.02355 (2024). https: //api.semanticscholar.org/CorpusID:273098148

    2024 arXiv

  2. [11]

    Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. 2023. The Stable Signature: Rooting Watermarks in Latent Diffusion Models. ICCV (2023)

    2023

  3. [12]

    Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzy’nska, and David Bau. 2023. Unified Concept Editing in Diffusion Models. 2024 IEEE/CVF Winter Conference on Applications of Computer Vision (W ACV) (2023), 5099–5108. https://api.semanticscholar.org/CorpusID:261276613

    2023

  4. [13]

    Hengrui Gu, Kaixiong Zhou, Yili Wang, Ruobing Wang, and Xin Wang. 2024. Pioneering Reliable Assessment in Text-to-Image Knowledge Editing: Leveraging a Fine-Grained Dataset and an Innovative Criterion. InFindings of the Association for Computational Linguistics: EMNLP 2024 , Y...

    2024 doi

  5. [14]

    Jia-Chen Gu, Hao-Xiang Xu, Jun-Yu Ma, Pan Lu, Zhen-Hua Ling, Kai-Wei Chang, and Nanyun Peng. 2024. Model editing harms general abilities of large language models: Regularization to the rescue. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Proce...

    2024

  6. [15]

    Ji Guo, Peihong Chen, Wenbo Jiang, and Guoming Lu. 2024. TrojanEdit: Backdooring Text-Based Image Editing Models. ArXiv abs/2411.14681 (2024). https://api.semanticscholar.org/CorpusID:274192361

    2024 arXiv

  7. [16]

    Yuning Han, Bingyin Zhao, Rui Chu, Feng Luo, Biplab Sikdar, and Yingjie Lao

  8. [17]

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. 2017. GANs Trained by a Two Time-Scale Update Rule Converge to a Local Nash Equilibrium. In Neural Information Processing Systems . https: //api.semanticscholar.org/CorpusID:326772

    2017

  9. [18]

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. 2020. Denoising diffusion probabilistic models. In Proceedings of the 34th International Conference on Neural Information Processing Systems (Vancouver, BC, Canada) (NIPS ’20). Curran Associates Inc., Red Hook, NY, USA, Article 574, 12 pages

    2020

  10. [19]

    Tiansheng Huang, Sihao Hu, Fatih Ilhan, Selim Furkan Tekin, and Ling Liu

  11. [20]

    Yihao Huang, Qing Guo, and Felix Juefei-Xu. 2023. Personalization as a Shortcut for Few-Shot Backdoor Attack against Text-to-Image Diffusion Models. In AAAI Conference on Artificial Intelligence. https://api.semanticscholar.org/CorpusID: 258762751

    2023

  12. [21]

    Xinfeng Li, Yuchen Yang, Jiangyi Deng, Chen Yan, Yanjiao Chen, Xiaoyu Ji, and Wenyuan Xu. 2024. SafeGen: Mitigating Sexually Explicit Content Generation in Text-to-Image Models. In Conference on Computer and Communications Security . https://api.semanticscholar.org/CorpusID:269033441

    2024

  13. [22]

    ArXiv abs/2409.18169 (2024)

    Harmful Fine-tuning Attacks and Defenses for Large Language Models: A Survey. ArXiv abs/2409.18169 (2024). https://api.semanticscholar.org/CorpusID: 272968838

    2024 arXiv

  14. [23]

    Haipeng Liu, Yang Wang, Biao Qian, Meng Wang, and Yong Rui. 2024. Structure Matters: Tackling the Semantic Discrepancy in Diffusion Models for Image In- painting. In 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). 8038–8047. https://doi.org/10.1109/...

    2024

  15. [24]

    Lin Long, Rui Wang, Ruixuan Xiao, Junbo Zhao, Xiao Ding, Gang Chen, and Haobo Wang. 2024. On LLMs-Driven Synthetic Data Generation, Curation, and Evaluation: A Survey. In Findings of the Association for Computational Linguistics: ACL 2024, Lun-Wei Ku, Andre Martins, and Vivek ...

    2024 doi

  16. [25]

    Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollar, and C

    Tsung-Yi Lin, Michael Maire, Serge J. Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollar, and C. Lawrence Zitnick. 2014. Microsoft COCO: Common Objects in Context. In European Conference on Computer Vision . https://api. semanticscholar.org/CorpusID:14113767

    2014

  17. [26]

    Kevin Meng, David Bau, Alex Andonian, and Yonatan Belinkov. 2022. Locating and Editing Factual Associations in GPT. InNeural Information Processing Systems. https://api.semanticscholar.org/CorpusID:255825985

    2022

  18. [27]

    Kevin Meng, Arnab Sen Sharma, Alex Andonian, Yonatan Belinkov, and David Bau. 2022. Mass-Editing Memory in a Transformer. ArXiv abs/2210.07229 (2022). https://api.semanticscholar.org/CorpusID:252873467

    2022 arXiv

  19. [28]

    Ali Mansouri. 2005. Semantic Field Theory and the Teaching of English Vocabu- lary for Reading Comprehension

    2005

  20. [29]

    Zhenxing Niu, Yuyao Sun, Qiguang Miao, Rong Jin, and Gang Hua. 2024. To- wards Unified Robustness Against Both Backdoor and Adversarial Attacks. IEEE Transactions on Pattern Analysis and Machine Intelligence 46, 12 (2024), 7589–7605. https://doi.org/10.1109/TPAMI.2024.3392760

    2024

  21. [30]

    Hadas Orgad, Bahjat Kawar, and Yonatan Belinkov. 2023. Editing Implicit Assump- tions in Text-to-Image Diffusion Models. 2023 IEEE/CVF International Conference on Computer Vision (ICCV) (2023), 7030–7038. https://api.semanticscholar.org/ CorpusID:257505246

    2023

  22. [31]

    Eric Mitchell, Charles Lin, Antoine Bosselut, Christopher D Manning, and Chelsea Finn. 2022. Memory-Based Model Editing at Scale. In Proceedings of the 39th International Conference on Machine Learning (Proceedings of Machine , , Chongye Guo, Jinhu Fu, Junfeng Fang, Kun Wang, ...

    2022

  23. [32]

    Jiangweizhi Peng, Zhiwei Tang, Gaowen Liu, Charles Fleming, and Mingyi Hong

  24. [33]

    Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. 2023. SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesis. arXiv:2307.01952 [cs.CV] https://arxiv.org/abs/2307.01952

    2023 arXiv

  25. [34]

    Pallavi, Sandeep Joshi, Dilbag Singh, Manjit Kaur, and Heung-No Lee. 2022. Com- prehensive Review of Orthogonal Regression and Its Applications in Different Domains. Archives of Computational Methods in Engineering 29 (2022), 4027 –

    2022

  26. [36]

    Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen

  27. [37]

    ArXiv abs/2412.03876 (2024)

    Safeguarding Text-to-Image Generation via Inference-Time Prompt-Noise Optimization. ArXiv abs/2412.03876 (2024). https://api.semanticscholar.org/ CorpusID:274515122

    2024 arXiv

  28. [38]

    Bernstein, Alexander C

    Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael S. Bernstein, Alexander C. Berg, and Li Fei-Fei. 2014. ImageNet Large Scale Visual Recognition Challenge. International Journal of Computer Vi...

    2014

  29. [39]

    Yi Qian Qu, Xinyue Shen, Xinlei He, Michael Backes, Savvas Zannettou, and Yang Zhang. 2023. Unsafe Diffusion: On the Generation of Unsafe Images and Hateful Memes From Text-To-Image Models. Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (...

    2023

  30. [40]

    Lukas Struppek, Dominik Hintersdorf, and Kristian Kersting. 2023. Rickrolling the Artist: Injecting Backdoors into Text Encoders for Text-to-Image Synthesis. In 2023 IEEE/CVF International Conference on Computer Vision (ICCV) . 4561–4573. https://doi.org/10.1109/ICCV51070.2023.00423

    2023

  31. [41]

    Hongyu Wan, Jinda Zhang, Abdulaziz Arif Suria, Bingsheng Yao, Dakuo Wang, Yvonne Coady, and Mirjana Prpa. 2024. Building LLM-based AI Agents in Social Virtual Reality. In Extended Abstracts of the CHI Conference on Human Factors in Computing Systems (Honolulu, HI, USA) (CHI EA...

    2024

  32. [42]

    Hao Wang, Shangwei Guo, Jialing He, Kangjie Chen, Shudong Zhang, Tianwei Zhang, and Tao Xiang. 2024. EvilEdit: Backdooring Text-to-Image Diffusion Models in One Second. In ACM Multimedia. https://api.semanticscholar.org/ CorpusID:273645257

    2024

  33. [43]

    arXiv:2204.06125 [cs.CV] https://arxiv.org/abs/2204.06125

    Hierarchical Text-Conditional Image Generation with CLIP Latents. arXiv:2204.06125 [cs.CV] https://arxiv.org/abs/2204.06125

    arXiv

  34. [44]

    Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer

    Robin Rombach, A. Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer

  35. [45]

    Year of last update

    Wikipedia contributors. Year of last update. Article Title. https://en.wikipedia. org/wiki/Article_Title. [Accessed Day-Month-Year]

  36. [46]

    Yijun Yang, Ruiyuan Gao, Xiaosen Wang, Nan Xu, and Qiang Xu. 2023. MMA- Diffusion: MultiModal Attack on Diffusion Models. 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (2023), 7737–7746. https: //api.semanticscholar.org/CorpusID:265498727

    2023

  37. [47]

    Zhihong Shao, Damai Dai, Daya Guo, Bo Liu (Benjamin Liu), Zihan Wang, and Huajian Xin. 2024. DeepSeek-V2: A Strong, Economical, and Efficient Mixture-of-Experts Language Model. ArXiv abs/2405.04434 (2024). https: //api.semanticscholar.org/CorpusID:269613809

    2024 arXiv

  38. [48]

    Lang Yu, Qin Chen, Jie Zhou, and Liang He. 2024. Melo: Enhancing model editing with neuron-indexed dynamic lora. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 38. 19449–19457

    2024

  39. [49]

    Shengfang Zhai, Yinpeng Dong, Qingni Shen, Shi Pu, Yuejian Fang, and Hang Su

  40. [50]

    Chenyu Zhang, Mingwang Hu, Wenhui Li, and Lanjun Wang. 2025. Adversarial attacks and defenses on text-to-image diffusion models: A survey. Inf. Fusion 114, C (Feb. 2025), 15 pages. https://doi.org/10.1016/j.inffus.2024.102701

    2025

  41. [51]

    Zhenyu Wang. 2023. The Application of Semantic Field Theory in Vocabulary Learning. Frontiers in Humanities and Social Sciences 3 (03 2023), 29–40. https: //doi.org/10.54691/fhss.v3i3.4461

    2023 doi

  42. [52]

    Zihao Wei, Liang Pang, Hanxing Ding, Jingcheng Deng, Huawei Shen, and Xueqi Cheng. 2024. Stable Knowledge Editing in Large Language Models. ArXiv abs/2402.13048 (2024). https://api.semanticscholar.org/CorpusID:267759865

    2024 arXiv

  43. [53]

    Ce Zheng, Lei Li, Qingxiu Dong, Yuxuan Fan, Zhiyong Wu, Jingjing Xu, and Baobao Chang. 2023. Can We Edit Factual Knowledge by In-Context Learning?. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, Houda Bouamor, Juan Pino, and Kalika B...

    2023 doi

  44. [54]

    Yutian Zhong, Shuangyang Zhang, Zhenyang Liu, Xiaoming Zhang, Zongxin Mo, Yizhe Zhang, Haoyu Hu, Wufan Chen, and Li Qi. 2024. Unsupervised Fusion of Misaligned PAT and MRI Images via Mutually Reinforcing Cross-Modality Image Generation and Registration. IEEE Transactions on Me...

    2024

  45. [55]

    Yunzhi Yao, Peng Wang, Bozhong Tian, Siyuan Cheng, Zhoubo Li, Shumin Deng, Huajun Chen, and Ningyu Zhang. 2023. Editing Large Language Models: Prob- lems, Methods, and Opportunities. In Proceedings of the 2023 Conference on Em- pirical Methods in Natural Language Processing , ...

    2023 doi

  46. [60]

    Jingyi Zhang, Jiaxing Huang, Sheng Jin, and Shijian Lu. 2024. Vision-Language Models for Vision Tasks: A Survey. IEEE Transactions on Pattern Analysis and Machine Intelligence 46, 8 (2024), 5625–5644. https://doi.org/10.1109/TPAMI.2024. 3369699

    2024 doi

  47. [61]

    Tianyi Zhang, Zheng Wang, Jin Huang, Mohiuddin Muhammad Tasnim, and Wei Shi. 2023. A Survey of Diffusion Based Image Generation Models: Issues and Their Solutions. ArXiv abs/2308.13142 (2023). https://api.semanticscholar.org/ CorpusID:261214460

    2023 arXiv

  48. [64]

    Haomin Zhuang, Yihua Zhang, and Sijia Liu. 2023. A Pilot Study of Query- Free Adversarial Attack against Stable Diffusion. 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) (2023), 2385–2392. https://api.semanticscholar.org/CorpusID:257804994

    2023

  49. [2020]

    In Computer Vision – ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part I (Glasgow, United Kingdom)

    Rewriting a Deep Generative Model. In Computer Vision – ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part I (Glasgow, United Kingdom). Springer-Verlag, Berlin, Heidelberg, 351–369. https: //doi.org/10.1007/978-3-030-58452-8_21

    2020 doi

  50. [2021]

    2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (2021), 10674–10685

    High-Resolution Image Synthesis with Latent Diffusion Models. 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (2021), 10674–10685. https://api.semanticscholar.org/CorpusID:245335280

    2021

  51. [2023]

    In Proceedings of the 31st ACM International Conference on Multimedia (Ottawa ON, Canada) (MM ’23)

    Text-to-Image Diffusion Models can be Easily Backdoored through Multi- modal Data Poisoning. In Proceedings of the 31st ACM International Conference on Multimedia (Ottawa ON, Canada) (MM ’23). Association for Computing Machin- ery, New York, NY, USA, 1577–1587. https://doi.org...

  52. [2024]

    ArXiv abs/2412.11441 (2024)

    UIBDiffusion: Universal Imperceptible Backdoor Attack for Diffusion Models. ArXiv abs/2412.11441 (2024). https://api.semanticscholar.org/CorpusID: 274777426

    2024 arXiv

  53. [4047]

    https://api.semanticscholar.org/CorpusID:248315122

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.