Pith. sign in

REVIEW 2 minor 59 references

TooBad: Backdoor Diffusion Models with Ultra-Low Poison Rate and Imperceptible Trigger

T0 review · 0 major / 2 minor · reviewed 2026-06-26 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A trigger optimization for diffusion models enables backdoor attacks at 0.5 percent poison rate with high success and stealth.

desk verdict TooBad shows backdoor attacks on diffusion models can hit high ASR at 0.5% poison rate on CIFAR-10 using a DM-specific trigger optimizer, with the full paper backing the numbers and defense evasion claims. read the letter →

arxiv 2606.23362 v1 pith:CLLDRLFC submitted 2026-06-22 cs.CR cs.CV

Vu Tuan Truong , Long Bao Le This is my paper · ORCID
classification cs.CRcs.CV
keywords backdoorattackdiffusionmodelstriggeroptimizationpoisonrateadversarialmachinelearninggenerativeCIFAR-10
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper introduces TooBad, a framework that uses a diffusion-model-specific trigger optimization to plant backdoors in generative models. This approach reaches attack success rates above 85 percent on CIFAR-10 while using only 0.5 percent poisoned samples, far below the rates needed by earlier methods. At 5 percent poison rate the attack reaches nearly full success after just a few training epochs and still passes existing defenses. If the results hold, diffusion models become vulnerable to efficient, hard-to-detect compromises that preserve normal output quality. The work therefore points to a need for defenses that address optimized rather than crude triggers.

What carries the argument

The DM-tailored trigger optimization technique, which iteratively refines the trigger pattern to match diffusion model dynamics so that it remains both effective at low poison rates and visually imperceptible.

What would settle it

Running the reported TooBad attack on CIFAR-10 at 0.5 percent poison rate and measuring an attack success rate below 50 percent under a standard defense such as Neural Cleanse would falsify the performance and stealth claims.

Watch

Extended reading notes

Core claim

TooBad shows that a DM-tailored trigger optimization produces an imperceptible trigger capable of driving attack success rates above 85 percent at a 0.5 percent poison rate and near 100 percent at 5 percent poison rate within 3-5 epochs, while evading current backdoor defenses and leaving model utility intact on standard benchmarks.

Load-bearing premise

The assumption that the optimized trigger stays imperceptible and evades defenses on the tested diffusion models and datasets.

Editorial extensions

If this is right

  • Backdoor attacks on diffusion models become practical with poison rates an order of magnitude lower than previously required.
  • Attack success reaches near 100 percent after only 3-5 epochs at 5 percent poison rate, shortening the injection window compared with prior methods.
  • The same trigger optimization evades multiple state-of-the-art backdoor defenses while keeping clean-sample performance high.
  • Diffusion models on CIFAR-10 and similar benchmarks can be compromised without visibly degrading generated images.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same optimization approach might transfer to other generative architectures such as transformers or flow-based models.
  • Defenses may need to shift from poison-rate thresholds toward direct inspection of trigger patterns that are tuned to the model type.
  • Real-world deployment of diffusion models could face higher risk if attackers gain access to even small fractions of training data.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

0 major / 2 minor

Summary. The manuscript presents TooBad, a backdoor attack framework for diffusion models that introduces a DM-tailored trigger optimization technique. On CIFAR-10, it claims to achieve attack success rates (ASR) exceeding 85% at a 0.5% poison rate—substantially lower than the 10% typical in prior work—and nearly 100% ASR at 5% poison rate within only 3-5 backdoor injection epochs, while evading state-of-the-art defenses and preserving model utility.

Significance. If the empirical results hold under the reported conditions, the work is significant for demonstrating that backdoor attacks on diffusion models can be made far more efficient and stealthy than existing methods, with an order-of-magnitude reduction in poison rate and injection time. This highlights a practical threat to generative models and motivates stronger defenses, particularly since the approach reportedly maintains high utility while bypassing listed SOTA detectors.

minor comments (2)
  1. [Abstract] Abstract: the performance claims (e.g., >85% ASR at 0.5% poison rate) are presented without any mention of the number of runs, variance, or statistical controls; adding this information would strengthen the central empirical claims.
  2. [Experimental Evaluation] The manuscript should explicitly state the full set of datasets and diffusion model architectures evaluated beyond the CIFAR-10 example to clarify the generality of the reported gains.

Simulated Author's Rebuttal

0 responses · 0 unresolved

We thank the referee for the positive evaluation and recommendation of minor revision. The summary accurately reflects the key claims of TooBad regarding attack success rates, poison rates, and evasion of defenses on diffusion models. As no specific major comments were provided in the report, we have no points to address point-by-point at this time.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity

full rationale

The paper is an empirical demonstration of a backdoor attack framework on diffusion models, with performance claims based on experimental results (ASR metrics on CIFAR-10 at varying poison rates and epochs). No equations, derivations, fitted parameters presented as predictions, or self-referential definitions appear in the argument structure. Central claims rest on reported outcomes and comparisons to prior methods, which are externally falsifiable via replication rather than reducing to internal construction or self-citation chains.

Assumptions & free parameters 0 free parameters · 0 assumptions · 0 invented entities

Abstract-only review contains no mathematical derivations, free parameters, or new postulated entities; the work rests on standard empirical machine-learning assumptions for backdoor attacks.

how reviews work

0 comments
Cite this review

Pith. "Pith review of TooBad: Backdoor Diffusion Models with Ultra-Low Poison Rate and Imperceptible Trigger." pith.science (2026). https://pith.science/paper/CLLDRLFC

@misc{pith2026260623362,
  author       = {Pith},
  title        = {Pith review of: TooBad: Backdoor Diffusion Models with Ultra-Low Poison Rate and Imperceptible Trigger},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CLLDRLFC}},
  note         = {Machine review of arXiv:2606.23362}
}
abstract

Diffusion models (DMs), despite their impressive capabilities across a wide range of generative tasks, have been shown to be vulnerable to backdoor attacks. However, existing backdoor methods face critical trade-offs among key factors: attack performance, stealthiness, time complexity, and required poison rates. For example, achieving high attack performance typically demands a high poison rate and prolonged training, which undermines stealthiness, making the attack more detectable by backdoor defenses. This paper proposes TooBad (trigger optimization for backdoor diffusion models), a backdoor framework which introduces a novel DM-tailored trigger optimization technique to dramatically enhance the performance of backdoor attacks on DMs. Experiments on representative benchmarks such as CIFAR-10 show that TooBad can achieve high ASRs ($> 85$%) at only 0.5% poison rate, significantly lower than the 10% typically required by prior work on the same datasets. At 5% poison rate, TooBad reaches nearly 100% ASR within just 3-5 backdoor injection epochs, whereas existing methods need at least 30-50 epochs at double the poison rate for comparable results. Despite its potency, TooBad easily evades SOTA defenses and maintains high utility. These results reveal a critical threat on DMs and highlight the need for more robust defenses against such stealthy yet efficient attacks.

Figures

Figures reproduced from arXiv: 2606.23362 by the authors.

Figure 1
Figure 1. The quadrilemma illustrating the inability of SOTA attacks to meet all back￾door criteria simultaneously. generative frameworks like GANs [11], energy-based models (EBMs) [31], and VAEs [20, 36], DMs consistently achieve superior sample quality and diversity. Recent studies have revealed that DMs are highly susceptible to backdoor attacks [8,44]. Once backdoored with a predefined trigger, the compromised DM would ge… view at source ↗
Figure 2
Figure 2. An illustration of backdoor attacks on DMs. (Left) Before backdoor attack, the backdoor target is outside of the model’s sample space. Sampling from a Gaussian noise likely results in clean images, while sampling from a triggered noise yields out￾of-distribution (OOD) samples. (Right) After backdoor attack, the sample space is expanded to include the backdoor target. Sampling from a triggered noise consistently yiel… view at source ↗
Figure 3
Figure 3. TooBad’s trigger optimization. We optimize a trigger that causes the clean model to generate near-target samples, facilitating the subsequent backdoor injection. fine-tune victim DM to inject the backdoor. The compromised DM is released on public platforms like HuggingFace or GitHub for end users to download or integrate into downstream tasks. This scenario is consistent with all prior back￾door frameworks that aim … view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: An illustration of generated backdoor samples. 3.4 Backdoor Injection To inject a backdoor into DMs, the forward process in Eq. (3) is extended by: (i) replacing x0 by the backdoor target xˆ0, and (ii) introducing an additional term that incorporates the backdoor trigg…
Figure 5
Figure 5. Figure 5: ASR comparison under ultra-low poison rates. downscaled CelebA-HQ [26], in Sec. 4.6. These two datasets are commonly used in all prior backdoor attack and defense studies for DMs [7, 8, 13], ensuring a fair and consistent comparison. In addition, CelebA-HQ-Dialog [19] …
Figure 6
Figure 6. Figure 6: Performance comparison across training epochs for three attacks. Top row: 5% poison rate. Bottom row: 10% poison rate. the SDE solver with 1000 denoising timesteps. All experiments were conducted on NVIDIA RTX A6000 ADA GPUs and reported on average across three runs. E…
Figure 7
Figure 7. Figure 7: Performance under ultra-low poison rates. 0 2 4 6 ·10−2 5 7 9 11 MSE FID VillanDiff UIBDiff TooBad [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

59 extracted references · 12 canonical work pages

  1. [1]

    In: Proceedings of the AAAI Conference on Artificial Intelligence

    An, S., Chou, S.Y., Zhang, K., Xu, Q., Tao, G., Shen, G., Cheng, S., Ma, S., Chen, P.Y., Ho, T.Y., et al.: Elijah: Eliminating backdoors injected in diffusion models via distribution shift. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 38, pp. 10847–10855 (2024)

    2024

  2. [2]

    In: Advances in Neural Information Processing Systems

    Austin, J., Johnson, D.D., Ho, J., Tarlow, D., Van Den Berg, R.: Structured denois- ing diffusion models in discrete state-spaces. In: Advances in Neural Information Processing Systems. vol. 34, pp. 17981–17993 (2021)

    2021

  3. [3]

    IEEE Transactions on Knowledge and Data Engineering pp

    Cao, H., Tan, C., Gao, Z., Xu, Y., Chen, G., Heng, P.A., Li, S.Z.: A survey on gen- erative diffusion models. IEEE Transactions on Knowledge and Data Engineering pp. 1–20 (2024).https://doi.org/10.1109/TKDE.2024.3361474

    work page doi:10.1109/tkde.2024.3361474 2024

  4. [4]

    In: Proceedings of the International Conference on Learning Representations (2020)

    Chen, N., Zhang, Y., Zen, H., Weiss, R.J., Norouzi, M., Chan, W.: Wavegrad: Estimating gradients for waveform generation. In: Proceedings of the International Conference on Learning Representations (2020)

    2020

  5. [5]

    In: CVPR

    Chen,W.,Song,D.,Li,B.:Trojdiff:Trojanattacksondiffusionmodelswithdiverse targets. In: CVPR. pp. 4035–4044 (2023)

    2023

  6. [6]

    Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning

    Chen, X., Liu, C., Li, B., Lu, K., Song, D.: Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 (2017)

    work page Pith review arXiv 2017

  7. [7]

    Chou, S.Y., Chen, P.Y., Ho, T.Y.: How to backdoor diffusion models? In: CVPR. pp. 4015–4024 (June 2023)

    2023

  8. [8]

    In: NeuRIPS

    Chou,S.Y.,Chen,P.Y.,Ho,T.Y.:Villandiffusion:Aunifiedbackdoorattackframe- work for diffusion models. In: NeuRIPS. pp. 33912–33964 (2023)

    2023

Show all 59 references
  1. [9]

    IEEE Transactions on Pattern Analysis and Machine Intelligence45(9), 10850–10869 (2023).https://doi.org/10.1109/TPAMI.2023.3261988

    Croitoru, F.A., Hondru, V., Ionescu, R.T., Shah, M.: Diffusion models in vision: A survey. IEEE Transactions on Pattern Analysis and Machine Intelligence45(9), 10850–10869 (2023).https://doi.org/10.1109/TPAMI.2023.3261988

    2023 doi

  2. [10]

    IEEE Transactions on Information Forensics and Security19, 6364–6376 (2024).https://doi.org/10.1109/TIFS.2024.3411936

    Gao, Y., Li, Y., Gong, X., Li, Z., Xia, S.T., Wang, Q.: Backdoor attack with sparse and invisible trigger. IEEE Transactions on Information Forensics and Security19, 6364–6376 (2024).https://doi.org/10.1109/TIFS.2024.3411936

    2024 doi

  3. [11]

    In: Advances in Neural Information Processing Systems

    Goodfellow, I., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., Bengio, Y.: Generative adversarial nets. In: Advances in Neural Information Processing Systems. vol. 27 (2014)

    2014

  4. [12]

    arXiv preprint arXiv:1708.06733 (2017)

    Gu, T., Dolan-Gavitt, B., Garg, S.: Badnets: Identifying vulnerabilities in the ma- chine learning model supply chain. arXiv preprint arXiv:1708.06733 (2017)

    2017 arXiv

  5. [13]

    In: CVPR

    Han, Y., Zhao, B., Chu, R., Luo, F., Sikdar, B., Lao, Y.: Uibdiffusion: Universal imperceptible backdoor attack for diffusion models. In: CVPR. pp. 19186–19196 (2025)

    2025

  6. [14]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 770–778 (2016)

    2016

  7. [15]

    Advances in Neural Information Processing Systems30(2017)

    Heusel,M.,Ramsauer,H.,Unterthiner,T.,Nessler,B.,Hochreiter,S.:Ganstrained by a two time-scale update rule converge to a local nash equilibrium. Advances in Neural Information Processing Systems30(2017)

    2017

  8. [16]

    In: Advances in Neural Information Processing Systems

    Ho, J., Jain, A., Abbeel, P.: Denoising diffusion probabilistic models. In: Advances in Neural Information Processing Systems. vol. 33, pp. 6840–6851 (2020)

    2020

  9. [17]

    In: Advances in Neural Information Processing Systems

    Hoogeboom, E., Nielsen, D., Jaini, P., Forré, P., Welling, M.: Argmax flows and multinomial diffusion: Learning categorical distributions. In: Advances in Neural Information Processing Systems. vol. 34, pp. 12454–12465 (2021)

    2021

  10. [18]

    In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Jiang, W., Li, H., Xu, G., Zhang, T.: Color backdoor: A robust poisoning attack in color space. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 8133–8142 (2023) 16 Vu Tuan Truong and Long Bao Le

    2023

  11. [19]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision

    Jiang, Y., Huang, Z., Pan, X., Loy, C.C., Liu, Z.: Talk-to-edit: Fine-grained facial editing via dialog. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 13799–13808 (2021)

    2021

  12. [20]

    In: Proceedings of the International Conference on Machine Learning (2014)

    Kingma, D.P., Welling, M.: Auto-encoding variational bayes. In: Proceedings of the International Conference on Machine Learning (2014)

    2014

  13. [21]

    Krizhevsky, A., Hinton, G., et al.: Learning multiple layers of features from tiny images (2009)

    2009

  14. [22]

    arXiv preprint arXiv:2406.00816 (2024)

    Li, S., Ma, J., Cheng, M.: Invisible backdoor attacks on diffusion models. arXiv preprint arXiv:2406.00816 (2024)

    2024

  15. [23]

    In: Advances in Neural Information Processing Systems

    Li, X., Thickstun, J., Gulrajani, I., Liang, P.S., Hashimoto, T.B.: Diffusion-lm im- proves controllable text generation. In: Advances in Neural Information Processing Systems. vol. 35, pp. 4328–4343 (2022)

    2022

  16. [24]

    Proceedings of the Interna- tional Journal of Computer Vision pp

    Liang, J., Liang, S., Liu, A., Cao, X.: Vl-trojan: Multimodal instruction backdoor attacks against autoregressive visual language models. Proceedings of the Interna- tional Journal of Computer Vision pp. 1–20 (2025)

    2025

  17. [25]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Liang,S.,Zhu,M.,Liu,A.,Wu,B.,Cao,X.,Chang,E.C.:Badclip:Dual-embedding guided backdoor attack on multimodal contrastive learning. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 24645– 24654 (2024)

    2024

  18. [26]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision

    Liu, Z., Luo, P., Wang, X., Tang, X.: Deep learning face attributes in the wild. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 3730–3738 (2015)

    2015

  19. [27]

    In: Advances in Neural Information Processing Systems

    Luo, S., Su, Y., Peng, X., Wang, S., Peng, J., Ma, J.: Antigen-specific antibody de- signandoptimizationwithdiffusion-basedgenerativemodelsforproteinstructures. In: Advances in Neural Information Processing Systems. pp. 9754–9767 (2022)

    2022

  20. [28]

    arXiv preprint arXiv:1706.06083 (2017)

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 (2017)

    2017 arXiv

  21. [29]

    arXiv preprint arXiv:2409.05294 (2024)

    Mo, Y., Huang, H., Li, M., Li, A., Wang, Y.: Terd: A unified framework for safeguarding diffusion models against backdoors. arXiv preprint arXiv:2409.05294 (2024)

    2024

  22. [30]

    In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition

    Moosavi-Dezfooli, S.M., Fawzi, A., Fawzi, O., Frossard, P.: Universal adversarial perturbations. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. pp. 1765–1773 (2017)

    2017

  23. [31]

    In: Proceedings of the International Conference on Machine Learning

    Ngiam, J., Chen, Z., Koh, P.W., Ng, A.Y.: Learning deep energy models. In: Proceedings of the International Conference on Machine Learning. pp. 1105–1112 (2011)

    2011

  24. [32]

    In: Proceedings of the International Conference on Machine Learning

    Nichol, A., Dhariwal, P., Ramesh, A., Shyam, P., Mishkin, P., McGrew, B., Sutskever, I., Chen, M.: Glide: Towards photorealistic image generation and editing with text-guided diffusion models. In: Proceedings of the International Conference on Machine Learning. pp. 16784–16804 (2021)

    2021

  25. [33]

    In: Advances in Neural Information Processing Systems (2023)

    Pan, Z., Yao, Y., Liu, G., Shen, B., Zhao, H.V., Kompella, R.R., Liu, S.: From tro- jan horses to castle walls: Unveiling bilateral backdoor effects in diffusion models. In: Advances in Neural Information Processing Systems (2023)

    2023

  26. [34]

    In: Proceedings of the International Conference on Machine Learning

    Popov, V., Vovk, I., Gogoryan, V., Sadekova, T., Kudinov, M.: Grad-tts: A dif- fusion probabilistic model for text-to-speech. In: Proceedings of the International Conference on Machine Learning. pp. 8599–8608 (2021)

    2021

  27. [35]

    In: Proceedings of the International Conference on Learning Representations (2020) Title Suppressed Due to Excessive Length 17

    Rasul, K., Sheikh, A.S., Schuster, I., Bergmann, U., Vollgraf, R.: Multivariate prob- abilistic time series forecasting via conditioned normalizing flows. In: Proceedings of the International Conference on Learning Representations (2020) Title Suppressed Due to Excessive Length 17

    2020

  28. [36]

    In: Pro- ceedings of the International Conference on Machine Learning

    Rezende, D., Mohamed, S.: Variational inference with normalizing flows. In: Pro- ceedings of the International Conference on Machine Learning. pp. 1530–1538 (2015)

    2015

  29. [37]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Rombach, R., Blattmann, A., Lorenz, D., Esser, P., Ommer, B.: High-resolution image synthesis with latent diffusion models. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 10684–10695 (2022)

    2022

  30. [38]

    In: Proceedings of the AAAI conference on artificial intelligence

    Saha, A., Subramanya, A., Pirsiavash, H.: Hidden trigger backdoor attacks. In: Proceedings of the AAAI conference on artificial intelligence. vol. 34, pp. 11957– 11965 (2020)

    2020

  31. [39]

    In: Proceedings of the International Conference on Learning Representations (2021)

    Song, J., Meng, C., Ermon, S.: Denoising diffusion implicit models. In: Proceedings of the International Conference on Learning Representations (2021)

    2021

  32. [40]

    In: Advances in Neural Information Processing Systems

    Song, Y., Ermon, S.: Generative modeling by estimating gradients of the data distribution. In: Advances in Neural Information Processing Systems. vol. 32, pp. 11918––11930 (2019)

    2019

  33. [41]

    In: Proceed- ings of the International Conference on Learning Representations (2021)

    Song, Y., Sohl-Dickstein, J., Kingma, D.P., Kumar, A., Ermon, S., Poole, B.: Score- based generative modeling through stochastic differential equations. In: Proceed- ings of the International Conference on Learning Representations (2021)

    2021

  34. [42]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision

    Struppek, L., Hintersdorf, D., Kersting, K.: Rickrolling the artist: Injecting back- doors into text encoders for text-to-image synthesis. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 4584–4596 (2023)

    2023

  35. [43]

    In: Advances in Neural Information Processing Systems

    Tashiro, Y., Song, J., Song, Y., Ermon, S.: Csdi: Conditional score-based diffusion models for probabilistic time series imputation. In: Advances in Neural Information Processing Systems. vol. 34, pp. 24804–24816 (2021)

    2021

  36. [44]

    ACM Computing Surveys57(8), 1–44 (2025)

    Truong, V.T., Dang, L.B., Le, L.B.: Attacks and defenses for generative diffusion models: A comprehensive survey. ACM Computing Surveys57(8), 1–44 (2025)

    2025

  37. [45]

    arXiv preprint arXiv:2409.13945 (2024)

    Truong, V.T., Le, L.B.: Purediffusion: Using backdoor to counter backdoor in gen- erative diffusion models. arXiv preprint arXiv:2409.13945 (2024)

    2024

  38. [46]

    In: Proceedings of the IEEE Wireless Commu- nications and Networking Conference

    Truong, V.T., Le, L.B.: Text-guided real-world-to-3d generative models with real- time rendering on mobile devices. In: Proceedings of the IEEE Wireless Commu- nications and Networking Conference. pp. 1–6. IEEE (2024)

    2024

  39. [47]

    arXiv preprint arXiv:2502.19047 (2025)

    Truong, V.T., Le, L.B.: A dual-purpose framework for backdoor defense and back- door amplification in diffusion models. arXiv preprint arXiv:2502.19047 (2025)

    2025

  40. [48]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Walmer, M., Sikka, K., Sur, I., Shrivastava, A., Jha, S.: Dual-key multimodal back- doors for visual question answering. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 15375–15385 (2022)

    2022

  41. [49]

    In: Advances in Neural Information Processing Systems (2023)

    Wang,H.,Shen, Q.,Tong, Y.,Zhang,Y., Kawaguchi,K.: Thestrongerthediffusion model, the easier the backdoor: Data poisoning to induce copyright breaches with- out adjusting finetuning pipeline. In: Advances in Neural Information Processing Systems (2023)

    2023

  42. [50]

    IEEE Transactions on Image Process- ing13(4), 600–612 (2004)

    Wang, Z., Bovik, A.C., Sheikh, H.R., Simoncelli, E.P.: Image quality assessment: from error visibility to structural similarity. IEEE Transactions on Image Process- ing13(4), 600–612 (2004)

    2004

  43. [51]

    In: Proceedings of the Interna- tional Conference on Learning Representations (2021)

    Watson, D., Chan, W., Ho, J., Norouzi, M.: Learning fast samplers for diffusion models by differentiating through sample quality. In: Proceedings of the Interna- tional Conference on Learning Representations (2021)

    2021

  44. [52]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Xu, J., Wang, X., Cheng, W., Cao, Y.P., Shan, Y., Qie, X., Gao, S.: Dream3d: Zero-shot text-to-3d synthesis using 3d shape prior and text-to-image diffusion models. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 20908–20918 (2023) 18...

    2023

  45. [53]

    In: Proceedings of the Interna- tional Conference on Learning Representations (2021)

    Xu, M., Yu, L., Song, Y., Shi, C., Ermon, S., Tang, J.: Geodiff: A geometric diffu- sion model for molecular conformation generation. In: Proceedings of the Interna- tional Conference on Learning Representations (2021)

    2021

  46. [54]

    arXiv preprint arXiv:2106.10121 (2021)

    Yan, T., Zhang, H., Zhou, T., Zhan, Y., Xia, Y.: Scoregrad: Multivariate prob- abilistic time series forecasting with continuous energy-based generative models. arXiv preprint arXiv:2106.10121 (2021)

    2021

  47. [55]

    ACM Computing Surveys56(4), 1–39 (2023)

    Yang,L.,Zhang,Z.,Song,Y.,Hong,S.,Xu,R.,Zhao,Y.,Zhang,W.,Cui,B.,Yang, M.H.: Diffusion models: A comprehensive survey of methods and applications. ACM Computing Surveys56(4), 1–39 (2023)

    2023

  48. [56]

    In: Proceedings of the International Symposium on Research in Sttacks, Intrusions and Defenses

    Yang, S., Doan, B.G., Montague, P., De Vel, O., Abraham, T., Camtepe, S., Ranas- inghe, D.C., Kanhere, S.S.: Transferable graph backdoor attack. In: Proceedings of the International Symposium on Research in Sttacks, Intrusions and Defenses. pp. 321–332 (2022)

    2022

  49. [57]

    In: ACM Multimedia

    Zhai, S., Dong, Y., Shen, Q., Pu, S., Fang, Y., Su, H.: Text-to-image diffusion models can be easily backdoored through multimodal data poisoning. In: ACM Multimedia. pp. 1577–1587 (2023)

    2023

  50. [58]

    In: Proceedings of the IEEE International Conference on Data Mining

    Zhang, Y., Ruan, W., Wang, F., Huang, X.: Generalizing universal adversarial attacks beyond additive perturbations. In: Proceedings of the IEEE International Conference on Data Mining. pp. 1412–1417. IEEE (2020)

    2020

  51. [59]

    arXiv preprint arXiv:2305.14671 (2023)

    Zou, H., Kim, Z.M., Kang, D.: Diffusion models in nlp: A survey. arXiv preprint arXiv:2305.14671 (2023)

    2023

Pith tools

Reviewed June 26, 2026 · model on record in the stance chip above.