Pith. sign in

REVIEW 4 major objections 5 minor 65 references

MixBridge: Heterogeneous Image-to-Image Backdoor Attack through Mixture of Schr\"odinger Bridges

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read MixBridge shows that a single image-to-image Schrödinger bridge model can embed multiple heterogeneous backdoor triggers if task-specific experts are pre-trained and merged, and that a one-network version instead collapses to the…

desk verdict A genuinely new attack surface with a solid empirical core, but the geometric-mean theory motivating the method is not established and the stealthiness metric is partly manufactured. read the letter →

arxiv 2505.08809 v2 pith:QNOWR2TR submitted 2025-05-12 cs.CR cs.AI

Shixi Qin , Zhiyong Yang , Shilong Bao , Shi Wang , Qianqian Xu , Qingming Huang This is my paper · ORCID
classification cs.CRcs.AI
keywords backdoorattackdiffusionSchrödingerbridgeimage-to-imagegenerationmixtureofexpertsheterogeneousweightreallocationdatapoisoninggenerativemodelsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that backdoor attacks on image-to-image diffusion models can be carried out without modifying the generative stochastic differential equation: a diffusion Schrödinger bridge trained directly on poisoned image pairs learns the trigger implicitly. It further claims that a single such model cannot hold several heterogeneous triggers at once, because the training objective pushes the learned posterior toward the geometric mean of clean and poisoned distributions. To get around this, MixBridge pre-trains separate experts for the benign task and for each malicious task, then merges them through a mixture-of-experts router. The paper reports that the merged model keeps benign utility, reaches near-100% attack success on triggered inputs, and, with a weight-reallocation penalty, hides which expert actually executes each attack.

What carries the argument

The core object is the image-to-image Schrödinger bridge posterior $q(x_t|x_0,x_1)=\mathcal{N}(x_t;\mu_t,\Sigma_t)$, whose endpoints collapse to Dirac deltas at $x_0$ and $x_1$ as $t\to0$ and $t\to1$ (Proposition 4.1). That property makes poisoning by image pairs sufficient: the pair relationship automatically defines the diffusion sample path, so no per-attack SDE design is needed. The failure mechanism is Theorem 4.2, which derives that a single network's score field becomes $\nabla_{x_t}\log\prod_i p(x_t|x_{0,i})^{p(i|z)}$, i.e., the geometric-mean posterior. The remedy machinery is a mixture-of-experts router $r(x^*_1)=\mathrm{Softmax}(W^\top F(x^*_1)+b)$ that linearly combines expert denoisers $\epsilon_c$ and $\epsilon_i$ at every timestep, plus the Weight Reallocation Scheme regularizer $L_{\mathrm{WRS}}=\mathbb{E}_w[\|w-1/(M+1)\|^2]$ that pushes expert weights toward uniformity.

What would settle it

Train a single I2SB model on clean pairs plus several poisoned pair types with a wider network, and measure the learned score at intermediate times against the geometric-mean product of task conditionals; if the score diverges from that product or the model still yields high-quality clean outputs with near-100% attack success, the theorem's prediction is refuted. Recording the rank of $\nabla_{x_t}\epsilon_\theta$ during training would directly test the proof's key premise.

Watch

Extended reading notes

Core claim

MixBridge establishes that heterogeneous backdoor triggers can be embedded in an Image-to-Image Schrödinger Bridge model simply by training it on paired poisoned images, with no SDE redesign. The load-bearing negative result is Theorem 4.2: a single I2SB model fitting clean plus M backdoored sample paths converges to a posterior proportional to the geometric average of the component distributions, so it cannot simultaneously serve tasks whose target distributions are far apart. The paper's remedy is a divide-and-merge architecture: task-specific warm-up trains one expert per objective, then the experts are combined by a learnable router. A Weight Reallocation Scheme regularizes the router toward uniform weights so the responsible expert is not obvious. On CelebA super-resolution and ImageNet inpainting with three backdoor targets, MixBridge reports near-100% attack success rate while matching or improving benign generation quality relative to a single model.

Load-bearing premise

The claim that a single model inevitably averages benign and backdoored tasks relies on an unproven technical assumption (a full-rank derivative matrix) and a zero-gradient optimality step; if either fails, the geometric-mean failure mode is not established.

Editorial extensions

If this is right

  • An attacker can embed backdoors in any bridge-based image-to-image model simply by adding poisoned image pairs to the training set, so defending these models means auditing training data rather than monitoring SDE design.
  • Heterogeneous attacks become practical: one deployed model can switch among several target outputs, such as a fake face or NSFW content, depending on which small trigger is placed in the input.
  • Because Theorem 4.2 predicts single-model blending, the divide-and-merge recipe offers a general template for keeping task-specific quality in multi-target generative models.
  • WRS raises router entropy to near-uniform, which means inspecting expert weights will not reveal which expert is malicious; defenders need output-level or trajectory-level checks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The geometric-mean theorem likely applies beyond backdoors: any single bridge model trained on multiple image-to-image targets with very different output distributions, such as super-resolution and style transfer, would face the same averaging conflict, suggesting divide-and-merge could become a generic multi-task I2I training strategy.
  • A direct test of the mechanism would be to probe the intermediate score $\nabla_{x_t}\log p(x_t)$ on a jointly trained single model and compare it with the geometric-mean product of expert conditionals; if they do not match, the single-model failure may be an optimization or capacity artifact rather than a distributional law.
  • Because WRS flattens router weights, defenders may shift to per-expert attribution at inference time, for example by perturbing each expert's output and observing which one causes a task-specific change, an avenue the paper does not explore.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. This paper studies backdoor attacks on image-to-image diffusion Schrödinger bridge (I2SB) models. The authors propose MixBridge, a mixture-of-experts architecture in which task-specific I2SB experts are pre-trained separately (Divide) and then merged with a learned router and a weight-reallocation regularizer (Merge). They argue that a single I2SB model trained on clean and multiple poisoned image pairs is forced to approximate the geometric mean of the task distributions (Theorem 4.2), which motivates the divide-and-merge design. Experiments on CelebA super-resolution and ImageNet inpainting, each with three heterogeneous backdoor triggers, show that MixBridge preserves benign utility while achieving high attack success and nearly uniform router weights. The paper also releases its code.

Significance. The paper is, to my knowledge, the first to study heterogeneous backdoor attacks for bridge-based diffusion models with arbitrary input distributions, and the proposed recipe of directly training on poisoned image pairs (Prop. 4.1) is simple and plausible; the limiting-density argument for Prop. 4.1 is sound. The released code and the breadth of experiments on two datasets are concrete strengths. However, the central theoretical justification (Theorem 4.2) is not sound as written, and the stealthiness evaluation is largely circular because the reported entropy metric is the same quantity that the WRS regularizer explicitly optimizes. The empirical divide-and-merge story is credible and likely salvageable, but the current manuscript overstates the theoretical basis for its main design decision.

major comments (4)
  1. [Appendix B, proof of Theorem 4.2] The proof optimizes the wrong variable. The objective in Eq. (4) is minimized over θ, so at a training optimum only ∂L_naive/∂θ = 0 is guaranteed; the text instead sets ∇_{x_t} L_naive(θ) = 0. Moreover, differentiating the expectation with respect to x_t produces additional terms from the density p(z|i), which itself depends on x_t, and these terms are omitted. Therefore Eq. (17) does not follow from Eq. (4), and the claimed geometric-mean failure mode of a single model is not established by this argument.
  2. [Appendix B, Theorem 4.2 rank and line-integral steps] The full-column-rank assumption on ∇_{x_t} ϵ_θ is both unjustified and misstated: this Jacobian is a d×d matrix, so parameter count is not relevant to its rank, and no evidence is given that it is full rank at the relevant (x_t, t). The subsequent line-integral step also requires the learned vector field s_θ to be conservative; the proof merely assumes that s_θ can be written as the score of a distribution, which is essentially the conclusion being proved. Consequently, the theoretical motivation for divide-and-merge is not supported.
  3. [Sec. 5.2 and Eq. (8)] The stealthiness evaluation is circular. Eq. (8) is an explicit penalty pulling router weights toward the uniform vector 1/(M+1), and the entropy metric in Sec. 5.2 measures the entropy of those same router weights. Reporting higher entropy with WRS therefore confirms that the regularizer achieved its objective, not that the model is stealthier in any independent sense. The manuscript needs a stealthiness measure that is not the training target—for example, trigger-inversion difficulty, expert-attribution accuracy by a defender, or human perceptual inspection.
  4. [Tables 1 and 2] All quantitative results appear to be single runs with no repeated-seed variance or significance testing. This matters because some comparisons are mixed: in Table 1, for the four-task CelebA setting, MixBridge with WRS has FID 85.88 versus I2SB 72.59 but PSNR 24.36 versus 27.55, so the claim that MixBridge 'outperforms' the baseline is not uniform across metrics. Please report means and standard deviations over at least three seeds, or justify why the observed differences are reliable without them.
minor comments (5)
  1. [Eq. (5) and surrounding text] The notation p(i|z) with z = (x_t, x_0, x_i^1) is introduced only in the theorem statement; because the conditioning set includes the task-specific input x_i^1, it is unclear whether p(i|z) is a non-degenerate posterior. Please define z explicitly and discuss the dependence on the task index.
  2. [Introduction, related-backdoor citation] The reference to Bao et al. (2025) is cited as a backdoor attack that requires SDE modification, but the listed paper is about AUC-oriented robustness; please correct or replace this citation.
  3. [Tables 1 and 2, entropy columns] Entropy values are reported without specifying the logarithm base; state the base and the maximum attainable entropy for M+1 experts so that values such as 0.99, 1.58, and 1.99 can be interpreted.
  4. [Sec. 5.4] The weight distribution is recorded for a single batch of 128 poisoned images; specify how many batches were used, whether the weights are averaged over batches, and report the variance across batches, since the claim that weights concentrate around 1 or 0.5 depends on this.
  5. [Sec. 5.3.1] The claim that MixBridge's FID is 'close to half' of I2SB's refers specifically to the model without WRS (41.48 versus 72.59); with WRS the FID is 60.65, so please qualify the claim accordingly.

Circularity Check

1 steps flagged · score 6.0 of 10

Stealthiness claim is self-definitional: the WRS loss directly optimizes the entropy metric used to report stealthiness; the geometric-mean theorem is not circular but its proof is unsupported.

  1. self definitional [Sec. 4.3, Eq. 8 (Weight Reallocation Scheme); Sec. 5.2 (Entropy metric)]
    "LWRS = E_w[||w − 1/(M+1)||^2]. (8) Intuitively, Eq. 8 encourages the router r to assign uniformly smooth contributions to each expert, enhancing the stealthiness of the MixBridge model. ... we assess the stealthiness of backdoor attacks using Entropy (Entro.), computed with the weight distribution: H(w) = −w_c log w_c − Σ_i w_i log w_i. A high entropy suggests a uniform weight distribution, enhancing the anonymity of experts and the stealthiness of backdoor attacks."

    The paper's claimed stealthiness enhancement is evaluated by the entropy H(w) of the router weights, and Eq. 8 is a loss minimized exactly at the uniform weight vector. Training with Eq. 9 therefore directly optimizes the quantity used to measure stealthiness. The reported entropy jump (from roughly 1e-3/9e-2 without WRS to roughly 0.99/1.99 with WRS) is the objective doing its job, not an emergent property demonstrated by experiment. If entropy of the router weights is accepted as the definition of stealthiness, then 'WRS enhances stealthiness' is true by construction; if that definition is not accepted, the metric tests only the loss itself. This is self-definitional rather than an independent empirical confirmation.

full rationale

The main attack framework is not circular: training I2SB on poisoned image pairs and the MoE combination (Eqs. 4, 7, 9) are tested against external FID/PSNR/SSIM/MSE/CLIP/ASR benchmarks, and the attack-success and utility results do not reduce to the training objectives by construction. Theorem 4.2, the load-bearing motivation for divide-and-merge, is not circular either; its weakness is a correctness/rigor problem. The proof sets ∇xt L_Naive = 0 as the optimality condition even though training optimizes θ, then divides by ∇xt sθ(xt) under a full-column-rank assumption justified only by parameter count. That is an invalid derivation step, not a reduction of the conclusion to its inputs. The one genuine circular step is the stealthiness claim: WRS is defined as a penalty pulling router weights to uniform, and stealthiness is measured by the entropy of exactly those weights, so the reported improvement is enforced by design. The self-citations to the authors' own AUC papers (Bao et al. 2025; Yang et al. 2021) appear to be citation errors and are not used as load-bearing evidence for the central claims.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The method reuses I2SB, MoE, and standard data-poisoning ideas. The only genuinely new movable parts are the geometric-mean claim (which rests on an unproven rank condition and a flawed optimality step) and the WRS regularizer (which is a direct penalty on the metric used to evaluate stealthiness). No new physical entities are introduced.

free parameters (3)
  • λ (WRS trade-off) = not reported
    Eq. 9 balances backdoor loss and the uniform-weight penalty; no value or search range is given, and the reported entropy/quality tradeoff depends on it.
  • Poison rate p(i) = equal across tasks (e.g. 1/4 in four-task setups)
    Main experiments set each task's share equal (Sec. 5.1 and D.1.3); D.5 varies it for ablation. This choice directly affects utility and specificity.
  • Trigger size = 32x32 on 128x128 CelebA
    Chosen for the main experiments and ablated in D.6; attack success depends on trigger size.
assumptions (4)
  • domain assumption I2SB posterior q(x_t|x0,x1) is Gaussian with closed-form mean and variance.
    Borrowed from Liu et al. 2023 and used throughout Eq. 12 and Proposition 4.1.
  • ad hoc to paper ∇xt ϵθ(xt,t;θ) has full column rank at the optimum.
    Stated as plausible in footnote 5 and used to force the zero-gradient condition in Theorem 4.2; not verified theoretically or empirically.
  • domain assumption The router's input features x1* contain enough information to distinguish clean from poisoned images.
    The divide-and-merge design assumes a ResNet router can identify trigger patterns from input images, which is central to the method but not proven.
  • standard math The optimum of the weighted score-matching loss is the posterior-weighted average of component scores.
    This is a standard score-matching fact, but the paper's derivation of it in Appendix B is flawed because it uses the wrong optimality condition.

how reviews work

0 comments
Cite this review

Pith. "Pith review of MixBridge: Heterogeneous Image-to-Image Backdoor Attack through Mixture of Schr\"odinger Bridges." pith.science (2026). https://pith.science/paper/QNOWR2TR

@misc{pith2026250508809,
  author       = {Pith},
  title        = {Pith review of: MixBridge: Heterogeneous Image-to-Image Backdoor Attack through Mixture of Schr\"odinger Bridges},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QNOWR2TR}},
  note         = {Machine review of arXiv:2505.08809}
}
read the original abstract

This paper focuses on implanting multiple heterogeneous backdoor triggers in bridge-based diffusion models designed for complex and arbitrary input distributions. Existing backdoor formulations mainly address single-attack scenarios and are limited to Gaussian noise input models. To fill this gap, we propose MixBridge, a novel diffusion Schr\"odinger bridge (DSB) framework to cater to arbitrary input distributions (taking I2I tasks as special cases). Beyond this trait, we demonstrate that backdoor triggers can be injected into MixBridge by directly training with poisoned image pairs. This eliminates the need for the cumbersome modifications to stochastic differential equations required in previous studies, providing a flexible tool to study backdoor behavior for bridge models. However, a key question arises: can a single DSB model train multiple backdoor triggers? Unfortunately, our theory shows that when attempting this, the model ends up following the geometric mean of benign and backdoored distributions, leading to performance conflict across backdoor tasks. To overcome this, we propose a Divide-and-Merge strategy to mix different bridges, where models are independently pre-trained for each specific objective (Divide) and then integrated into a unified model (Merge). In addition, a Weight Reallocation Scheme (WRS) is also designed to enhance the stealthiness of MixBridge. Empirical studies across diverse generation tasks speak to the efficacy of MixBridge.

Figures

Figures reproduced from arXiv: 2505.08809 by the authors.

Figure 1
Figure 1. Overview of the generation process of the diffusion model. (Left) The model processes images from an input distribution and generates output images along distinct diffusion trajectories. Notably, both the input and output distributions are mixture distributions. While the input images maintain a degree of similarity, there exists a significant disparity among the heterogeneous output distributions. (Right) With vari… view at source ↗
Figure 2
Figure 2. Visualization of the generation results of the MixBridge. We visualize the results of different generation tasks with different methods. Clearly, our MixBridge achieves high performance across all tasks. Additionally, we reorganize the weight values in descending order and present the average weight distribution in the “Weight Average” column. The results demonstrate that, with the help of the Weight Reallocation Sc… view at source ↗
Figure 3
Figure 3. Results of the backdoor attacks on the ImageNet. The results are evaluated by models trained with four tasks, image inpainting, Fake Face, NSFW, and Anime NSFW. MixBridge trained with WRS is significantly higher than in the model without WRS, which implies WRS enhances the stealthiness of the MixBridge by promoting more uni￾form weight distributions. It is also worth emphasizing that the model trained with WRS gener… view at source ↗
Figures from the paper (12 more)
Figure 4
Figure 4. Figure 4: The distribution of weight w. The weight con￾centrates around 1 for the backdoor attack without WRS (Left), and the weight balances to 0.5 with WRS (Right). 5.4. Effect of Weight Reallocation Scheme We construct a simple MixBridge model consisting of ϵc and ϵ1. A batch…
Figure 5
Figure 5. Figure 5: Results of the backdoor attacks on the CelebA. The results are evaluated by models trained with four tasks, image inpainting, Fake Face, NSFW, and Anime NSFW [PITH_FULL_IMAGE:figures/full_fig_p019_5.png]
Figure 6
Figure 6. Figure 6: The visualization of each expert’s output. The upper four rows display the visualizations from the model trained without WRS, while the lower four rows show the outputs with WRS applied. 24 [PITH_FULL_IMAGE:figures/full_fig_p024_6.png]
Figure 7
Figure 7. Figure 7: Visualization Comparison. It turns out that the MixBridge generates better images than a single model. With the help of WRS, the average weights of experts in the MixBridge become uniformly distributed. 25 [PITH_FULL_IMAGE:figures/full_fig_p025_7.png]
Figure 8
Figure 8. Figure 8: Generation results of super-resolution on the CelebA dataset. 31 [PITH_FULL_IMAGE:figures/full_fig_p031_8.png]
Figure 9
Figure 9. Figure 9: Generation results of Fake Face backdoor attack on the CelebA dataset. 32 [PITH_FULL_IMAGE:figures/full_fig_p032_9.png]
Figure 10
Figure 10. Figure 10: Generation results of NSFW backdoor attack on the CelebA dataset. 33 [PITH_FULL_IMAGE:figures/full_fig_p033_10.png]
Figure 11
Figure 11. Figure 11: Generation results of anime NSFW backdoor attack on the CelebA dataset. 34 [PITH_FULL_IMAGE:figures/full_fig_p034_11.png]
Figure 12
Figure 12. Figure 12: Generation results of image inpainting on the ImageNet dataset. 35 [PITH_FULL_IMAGE:figures/full_fig_p035_12.png]
Figure 13
Figure 13. Figure 13: Generation results of Fake Face backdoor attack on the ImageNet dataset. 36 [PITH_FULL_IMAGE:figures/full_fig_p036_13.png]
Figure 14
Figure 14. Figure 14: Generation results of anime NSFW backdoor attack on the ImageNet dataset. 37 [PITH_FULL_IMAGE:figures/full_fig_p037_14.png]
Figure 15
Figure 15. Figure 15: Generation results of anime NSFW backdoor attack on the ImageNet dataset. 38 [PITH_FULL_IMAGE:figures/full_fig_p038_15.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

65 extracted references · 29 canonical work pages

  1. [1]

    Elijah: Eliminating backdoors injected in diffusion models via distribution shift

    An, S., Chou, S.-Y., Zhang, K., Xu, Q., Tao, G., Shen, G., Cheng, S., Ma, S., Chen, P.-Y., Ho, T.-Y., et al. Elijah: Eliminating backdoors injected in diffusion models via distribution shift. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pp.\ 10847--10855, 2024

    work page 2024

  2. [2]

    Aucpro: Auc-oriented provable robustness learning

    Bao, S., Xu, Q., Yang, Z., He, Y., Cao, X., and Huang, Q. Aucpro: Auc-oriented provable robustness learning. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025

    work page 2025

  3. [3]

    Denoising likelihood score matching for conditional score-based data generation

    Chao, C.-H., Sun, W.-F., Cheng, B.-W., Lo, Y.-C., Chang, C.-C., Liu, Y.-L., Chang, Y.-L., Chen, C.-P., and Lee, C.-Y. Denoising likelihood score matching for conditional score-based data generation. arXiv preprint arXiv:2203.14206, 2022

    arXiv 2022

  4. [4]

    Trojdiff: Trojan attacks on diffusion models with diverse targets

    Chen, W., Song, D., and Li, B. Trojdiff: Trojan attacks on diffusion models with diverse targets. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.\ 4035--4044, 2023 a

    work page 2023

  5. [5]

    T., and Pavon, M

    Chen, Y., Georgiou, T. T., and Pavon, M. Stochastic control liaisons: Richard sinkhorn meets gaspard monge on a schrodinger bridge. Siam Review, 63 0 (2): 0 249--313, 2021

    work page 2021

  6. [6]

    G., and Gan, C

    Chen, Z., Shen, Y., Ding, M., Chen, Z., Zhao, H., Learned-Miller, E. G., and Gan, C. Mod-squad: Designing mixtures of experts as modular multi-task learners. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.\ 11828--11837, 2023 b

    work page 2023

  7. [7]

    How to backdoor diffusion models? In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.\ 4015--4024, 2023

    Chou, S.-Y., Chen, P.-Y., and Ho, T.-Y. How to backdoor diffusion models? In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.\ 4015--4024, 2023

    work page 2023

  8. [8]

    Villandiffusion: A unified backdoor attack framework for diffusion models

    Chou, S.-Y., Chen, P.-Y., and Ho, T.-Y. Villandiffusion: A unified backdoor attack framework for diffusion models. Advances in Neural Information Processing Systems, 36, 2024

    work page 2024

Show all 65 references
  1. [9]

    Diffusion schr \"o dinger bridge with applications to score-based generative modeling

    De Bortoli, V., Thornton, J., Heng, J., and Doucet, A. Diffusion schr \"o dinger bridge with applications to score-based generative modeling. Advances in Neural Information Processing Systems, 34: 0 17695--17709, 2021

    2021

  2. [10]

    Imagenet: A large-scale hierarchical image database

    Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp.\ 248--255. Ieee, 2009

    2009

  3. [11]

    and Nichol, A

    Dhariwal, P. and Nichol, A. Diffusion models beat gans on image synthesis. Advances in neural information processing systems, 34: 0 8780--8794, 2021

    2021

  4. [12]

    Towards measuring anonymity

    Diaz, C., Seys, S., Claessens, J., and Preneel, B. Towards measuring anonymity. In International Workshop on Privacy Enhancing Technologies, pp.\ 54--68. Springer, 2002

    2002

  5. [13]

    Lira: Learnable, imperceptible and robust backdoor attacks

    Doan, K., Lao, Y., Zhao, W., and Li, P. Lira: Learnable, imperceptible and robust backdoor attacks. In Proceedings of the IEEE/CVF international conference on computer vision, pp.\ 11966--11976, 2021

    2021

  6. [14]

    Mogu: A framework for enhancing safety of open-sourced llms while preserving their usability

    Du, Y., Zhao, S., Zhao, D., Ma, M., Chen, Y., Huo, L., Yang, Q., Xu, D., and Qin, B. Mogu: A framework for enhancing safety of open-sourced llms while preserving their usability. arXiv preprint arXiv:2405.14488, 2024

    2024 arXiv

  7. [15]

    Edition, F., Papoulis, A., and Pillai, S. U. Probability, random variables, and stochastic processes. McGraw-Hill Europe: New York, NY, USA, 2002

    2002

  8. [16]

    Badnets: Identifying vulnerabilities in the machine learning model supply chain

    Gu, T., Dolan-Gavitt, B., and Garg, S. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733, 2017

    2017 arXiv

  9. [17]

    Ufid: A unified framework for input-level backdoor detection on diffusion models

    Guan, Z., Hu, M., Li, S., and Vullikanti, A. Ufid: A unified framework for input-level backdoor detection on diffusion models. arXiv preprint arXiv:2404.01101, 2024

    2024 arXiv

  10. [18]

    P., and Burnaev, E

    Gushchin, N., Kolesov, A., Korotin, A., Vetrov, D. P., and Burnaev, E. Entropic neural optimal transport via diffusion processes. Advances in Neural Information Processing Systems, 36, 2024

    2024

  11. [19]

    Deep residual learning for image recognition

    He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp.\ 770--778, 2016

    2016

  12. [20]

    L., and Choi, Y

    Hessel, J., Holtzman, A., Forbes, M., Bras, R. L., and Choi, Y. Clipscore: A reference-free evaluation metric for image captioning. arXiv preprint arXiv:2104.08718, 2021

    2021 arXiv

  13. [21]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium

    Heusel, M., Ramsauer, H., Unterthiner, T., Nessler, B., and Hochreiter, S. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems, 30, 2017

    2017

  14. [22]

    and Salimans, T

    Ho, J. and Salimans, T. Classifier-free diffusion guidance. arXiv preprint arXiv:2207.12598, 2022

    2022 arXiv

  15. [23]

    Denoising diffusion probabilistic models

    Ho, J., Jain, A., and Abbeel, P. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33: 0 6840--6851, 2020

    2020

  16. [24]

    W., Wang, J., Su, D., Yu, D., Ren, Y., and Zhao, Z

    Huang, R., Lam, M. W., Wang, J., Su, D., Yu, D., Ren, Y., and Zhao, Z. Fastdiff: A fast conditional diffusion model for high-quality speech synthesis. arXiv preprint arXiv:2204.09934, 2022

    2022 arXiv

  17. [25]

    Zero-day backdoor attack against text-to-image diffusion models via personalization

    Huang, Y., Guo, Q., and Juefei-Xu, F. Zero-day backdoor attack against text-to-image diffusion models via personalization. arXiv preprint arXiv:2305.10701, 1 0 (2), 2023

    2023 arXiv

  18. [26]

    Backdoor attacks against image-to-image networks

    Jiang, W., Li, H., He, J., Zhang, R., Xu, G., Zhang, T., and Lu, R. Backdoor attacks against image-to-image networks. arXiv preprint arXiv:2407.10445, 2024

    2024 arXiv

  19. [27]

    Kim, B., Kwon, G., Kim, K., and Ye, J. C. Unpaired image-to-image translation via neural schr " odinger bridge. arXiv preprint arXiv:2305.15086, 2023

    2023 arXiv

  20. [28]

    Diffwave: A versatile diffusion model for audio synthesis

    Kong, Z., Ping, W., Huang, J., Zhao, K., and Catanzaro, B. Diffwave: A versatile diffusion model for audio synthesis. arXiv preprint arXiv:2009.09761, 2020

    2009 arXiv

  21. [29]

    A survey of the schr " odinger problem and some of its connections with optimal transport

    L \'e onard, C. A survey of the schr " odinger problem and some of its connections with optimal transport. arXiv preprint arXiv:1308.0215, 2013

    2013 arXiv

  22. [30]

    A., Nie, W., and Anandkumar, A

    Liu, G.-H., Vahdat, A., Huang, D.-A., Theodorou, E. A., Nie, W., and Anandkumar, A. I ^2 sb: Image-to-image schr \"o dinger bridge. arXiv preprint arXiv:2302.05872, 2023

    2023 arXiv

  23. [31]

    Deep learning face attributes in the wild

    Liu, Z., Luo, P., Wang, X., and Tang, X. Deep learning face attributes in the wild. In Proceedings of International Conference on Computer Vision (ICCV), December 2015

    2015

  24. [32]

    Decoupled weight decay regularization

    Loshchilov, I. Decoupled weight decay regularization. arXiv preprint arXiv:1711.05101, 2017

    2017 arXiv

  25. [33]

    Discrete diffusion modeling by estimating the ratios of the data distribution

    Lou, A., Meng, C., and Ermon, S. Discrete diffusion modeling by estimating the ratios of the data distribution. In Forty-first International Conference on Machine Learning

  26. [34]

    Ma, J., Zhao, Z., Yi, X., Chen, J., Hong, L., and Chi, E. H. Modeling task relationships in multi-task learning with multi-gate mixture-of-experts. In Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining, pp.\ 1930--1939, 2018

    1930

  27. [35]

    Not all diffusion model activations have been evaluated as discriminative features

    Meng, B., Xu, Q., Wang, Z., Cao, X., and Huang, Q. Not all diffusion model activations have been evaluated as discriminative features. Advances in Neural Information Processing Systems, 37: 0 55141--55177, 2024

    2024

  28. [36]

    Terd: A unified framework for safeguarding diffusion models against backdoors

    Mo, Y., Huang, H., Li, M., Li, A., and Wang, Y. Terd: A unified framework for safeguarding diffusion models against backdoors. arXiv preprint arXiv:2409.05294, 2024

    2024 arXiv

  29. [37]

    Murdoch, S. J. Quantifying and measuring anonymity. In International Workshop on Data Privacy Management, pp.\ 3--13. Springer, 2013

    2013

  30. [38]

    Dynamical theories of Brownian motion, volume 101

    Nelson, E. Dynamical theories of Brownian motion, volume 101. Princeton university press, 2020

    2020

  31. [39]

    Glide: Towards photorealistic image generation and editing with text-guided diffusion models

    Nichol, A., Dhariwal, P., Ramesh, A., Shyam, P., Mishkin, P., McGrew, B., Sutskever, I., and Chen, M. Glide: Towards photorealistic image generation and editing with text-guided diffusion models. arXiv preprint arXiv:2112.10741, 2021

    2021 arXiv

  32. [40]

    V., Kompella, R

    Pan, Z., Yao, Y., Liu, G., Shen, B., Zhao, H. V., Kompella, R. R., and Liu, S. From trojan horses to castle walls: Unveiling bilateral backdoor effects in diffusion models. arXiv preprint arXiv:2311.02373, 2023

    2023 arXiv

  33. [41]

    The devil is in the gan: backdoor attacks and defenses in deep generative models

    Rawat, A., Levacher, K., and Sinn, M. The devil is in the gan: backdoor attacks and defenses in deep generative models. In European Symposium on Research in Computer Security, pp.\ 776--783. Springer, 2022

    2022

  34. [42]

    Palette: Image-to-image diffusion models

    Saharia, C., Chan, W., Chang, H., Lee, C., Ho, J., Salimans, T., Fleet, D., and Norouzi, M. Palette: Image-to-image diffusion models. In ACM SIGGRAPH 2022 conference proceedings, pp.\ 1--10, 2022 a

    2022

  35. [43]

    J., and Norouzi, M

    Saharia, C., Ho, J., Chan, W., Salimans, T., Fleet, D. J., and Norouzi, M. Image super-resolution via iterative refinement. IEEE transactions on pattern analysis and machine intelligence, 45 0 (4): 0 4713--4726, 2022 b

    2022

  36. [44]

    G., and Breckon, T

    Sasaki, H., Willcocks, C. G., and Breckon, T. P. Unit-ddpm: Unpaired image translation with denoising diffusion probabilistic models. arXiv preprint arXiv:2104.05358, 2021

    2021 arXiv

  37. [45]

    Sur la th \'e orie relativiste de l' \'e lectron et l'interpr \'e tation de la m \'e canique quantique

    Schr \"o dinger, E. Sur la th \'e orie relativiste de l' \'e lectron et l'interpr \'e tation de la m \'e canique quantique. In Annales de l'institut Henri Poincar \'e , volume 2, pp.\ 269--310, 1932

    1932

  38. [46]

    Shan, S., Ding, W., Passananti, J., Zheng, H., and Zhao, B. Y. Prompt-specific poisoning attacks on text-to-image generative models. arXiv preprint arXiv:2310.13828, 2023

    2023 arXiv

  39. [47]

    Diffusion schr \"o dinger bridge matching

    Shi, Y., De Bortoli, V., Campbell, A., and Doucet, A. Diffusion schr \"o dinger bridge matching. Advances in Neural Information Processing Systems, 36, 2024

    2024

  40. [48]

    Denoising diffusion implicit models

    Song, J., Meng, C., and Ermon, S. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502, 2020 a

    2010 arXiv

  41. [49]

    P., Kumar, A., Ermon, S., and Poole, B

    Song, Y., Sohl-Dickstein, J., Kingma, D. P., Kumar, A., Ermon, S., and Poole, B. Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:2011.13456, 2020 b

    2011 arXiv

  42. [50]

    Rickrolling the artist: Injecting backdoors into text encoders for text-to-image synthesis

    Struppek, L., Hintersdorf, D., and Kersting, K. Rickrolling the artist: Injecting backdoors into text encoders for text-to-image synthesis. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp.\ 4584--4596, 2023

    2023

  43. [51]

    Mathematical methods for engineers and scientists, volume 1

    Tang, K.-T. Mathematical methods for engineers and scientists, volume 1. Springer, 2007

    2007

  44. [52]

    Improving and generalizing flow-based generative models with minibatch optimal transport

    Tong, A., FATRAS, K., Malkin, N., Huguet, G., Zhang, Y., Rector-Brooks, J., Wolf, G., and Bengio, Y. Improving and generalizing flow-based generative models with minibatch optimal transport. Transactions on Machine Learning Research, 2024

    2024

  45. [53]

    The stronger the diffusion model, the easier the backdoor: Data poisoning to induce copyright breaches without adjusting finetuning pipeline

    Wang, H., Shen, Q., Tong, Y., Zhang, Y., and Kawaguchi, K. The stronger the diffusion model, the easier the backdoor: Data poisoning to induce copyright breaches without adjusting finetuning pipeline. arXiv preprint arXiv:2401.04136, 2024 a

    2024 arXiv

  46. [54]

    Implicit image-to-image schrodinger bridge for ct super-resolution and denoising

    Wang, Y., Yoon, S., Jin, P., Tivnan, M., Chen, Z., Hu, R., Zhang, L., Chen, Z., Li, Q., and Wu, D. Implicit image-to-image schrodinger bridge for ct super-resolution and denoising. arXiv preprint arXiv:2403.06069, 2024 b

    2024 arXiv

  47. [55]

    C., Sheikh, H

    Wang, Z., Bovik, A. C., Sheikh, H. R., and Simoncelli, E. P. Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing, 13 0 (4): 0 600--612, 2004

    2004

  48. [56]

    T2ishield: Defending against backdoors on text-to-image diffusion models

    Wang, Z., Zhang, J., Shan, S., and Chen, X. T2ishield: Defending against backdoors on text-to-image diffusion models. arXiv preprint arXiv:2407.04215, 2024 c

    2024 arXiv

  49. [57]

    Discriminative regression with adaptive graph diffusion

    Wen, J., Deng, S., Fei, L., Zhang, Z., Zhang, B., Zhang, Z., and Xu, Y. Discriminative regression with adaptive graph diffusion. IEEE Transactions on Neural Networks and Learning Systems, 35 0 (2): 0 1797--1809, 2022

    2022

  50. [58]

    When all we need is a piece of the pie: A generic framework for optimizing two-way partial auc

    Yang, Z., Xu, Q., Bao, S., He, Y., Cao, X., and Huang, Q. When all we need is a piece of the pie: A generic framework for optimizing two-way partial auc. In International Conference on Machine Learning, pp.\ 11820--11829. PMLR, 2021

    2021

  51. [59]

    Optimizing two-way partial auc with an end-to-end framework

    Yang, Z., Xu, Q., Bao, S., He, Y., Cao, X., and Huang, Q. Optimizing two-way partial auc with an end-to-end framework. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45 0 (8): 0 10228--10246, 2022

    2022

  52. [60]

    Auc-oriented domain adaptation: from theory to algorithm

    Yang, Z., Xu, Q., Bao, S., Wen, P., He, Y., Cao, X., and Huang, Q. Auc-oriented domain adaptation: from theory to algorithm. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2023 a

    2023

  53. [61]

    Revisiting auc-oriented adversarial training with loss-agnostic perturbations

    Yang, Z., Xu, Q., Hou, W., Bao, S., He, Y., Cao, X., and Huang, Q. Revisiting auc-oriented adversarial training with loss-agnostic perturbations. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45 0 (12): 0 15494--15511, 2023 b

    2023

  54. [62]

    Text-to-image diffusion models can be easily backdoored through multimodal data poisoning

    Zhai, S., Dong, Y., Shen, Q., Pu, S., Fang, Y., and Su, H. Text-to-image diffusion models can be easily backdoored through multimodal data poisoning. In Proceedings of the 31st ACM International Conference on Multimedia, pp.\ 1577--1587, 2023

    2023

  55. [63]

    To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images

    Zhang, Y., Jia, J., Chen, X., Chen, A., Zhang, Y., Liu, J., Ding, K., and Liu, S. To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now. In European Conference on Computer Vision, pp.\ 385--403. Springer, 2025

    2025

  56. [64]

    Denoising diffusion bridge models

    Zhou, L., Lou, A., Khanna, S., and Ermon, S. Denoising diffusion bridge models. arXiv preprint arXiv:2309.16948, 2023

    2023 arXiv

  57. [65]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.