mlsanityData to 7 Oct 2026

Rickrolling the Artist: Injecting Backdoors into Text Encoders for Text-to-Image Synthesis

arXiv 2211.02408 ↗First posted 4 Nov 2022cs.LG cs.AI cs.CRcited by 59

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

While text-to-image synthesis currently enjoys great popularity among researchers and the general public, the security of these models has been neglected so far. Many text-guided image generation models rely on pre-trained text encoders from external sources, and their users trust that the retrieved models will behave as promised. Unfortunately, this might not be the case. We introduce backdoor attacks against text-guided generative models and demonstrate that their text encoders pose a major tampering risk. Our attacks only slightly alter an encoder so that no suspicious model behavior is apparent for image generations with clean prompts. By then inserting a single character trigger into the prompt, e.g., a non-Latin character or emoji, the adversary can trigger the model to either generate images with pre-defined attributes or images following a hidden, potentially malicious description. We empirically demonstrate the high effectiveness of our attacks on Stable Diffusion and highlight that the injection process of a single backdoor takes less than two minutes. Besides phrasing our approach solely as an attack, it can also force an encoder to forget phrases related to certain concepts, such as nudity or violence, and help to make image generation safer.

Key facts. Cited by 59 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 53 of its 78 references that are in the map. First posted on arXiv 4 Nov 2022.

Builds on

53 of 78 references.

Closest ancestors · 4

Same direction, newest first

  1. 2022Constrained Optimization with Dynamic Bound-scaling for Effective NLPBackdoor Defense11 Feb
  2. 2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning1 Aug
  3. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution11 Jun
  4. 2021T-Miner: A Generative Approach to Defend Against Trojan Attacks on DNN-based Text Classification7 Mar

Other references · 49

  1. 2017Attention Is All You Needcited by 59,932
  2. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  3. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  4. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
  5. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  6. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  7. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,539
  8. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,322
  9. 2013Intriguing properties of neural networkscited by 5,114
  10. 2021Zero-Shot Text-to-Image Generationcited by 4,276
  11. 2022LAION-5B: An open large-scale dataset for training next generation image-text modelscited by 4,131
  12. 2021GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Modelscited by 3,595
37 more
  1. 2022DreamBooth: Fine Tuning Text-to-Image Diffusion Models for Subject-Driven Generationcited by 3,286
  2. 2015Neural Machine Translation of Rare Words with Subword Unitscited by 2,898
  3. 2019Do ImageNet Classifiers Generalize to ImageNet?cited by 1,507
  4. 2022Scaling Autoregressive Models for Content-Rich Text-to-Image Generationcited by 1,287
  5. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  6. 2020Improved Techniques for Training Score-Based Generative Modelscited by 1,036
  7. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  8. 2021StyleCLIP: Text-Driven Manipulation of StyleGAN Imagerycited by 990
  9. 2022eDiff-I: Text-to-Image Diffusion Models with an Ensemble of Expert Denoiserscited by 921
  10. 2017Poincar'e Embeddings for Learning Hierarchical Representationscited by 674
  11. 2021DiffusionCLIP: Text-Guided Diffusion Models for Robust Image Manipulationcited by 640
  12. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  13. 2019Hidden Trigger Backdoor Attackscited by 359
  14. 2022Understanding Diffusion Models: A Unified Perspectivecited by 337
  15. 2021Multimodal datasets: misogyny, pornography, and malignant stereotypescited by 326
  16. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
  17. 2022VQGAN-CLIP: Open Domain Image Generation and Editing with Natural Language Guidancecited by 285
  18. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 231
  19. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 191
  20. 2021StyleGAN-NADA: CLIP-Guided Domain Adaptation of Image Generatorscited by 164
  21. 2019Combating Adversarial Misspellings with Robust Word Recognitioncited by 162
  22. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 162
  23. 2021Poisoning and Backdooring Contrastive Learningcited by 149
  24. 2020Backdoor Attacks to Graph Neural Networkscited by 126
  25. 2021Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learningcited by 116
  26. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 103
  27. 2022Neurotoxin: Durable Backdoors in Federated Learningcited by 97
  28. 2022Truth Serum: Poisoning Machine Learning Models to Reveal Their Secretscited by 94
  29. 2021Backdoor Attacks on Self-Supervised Learningcited by 89
  30. 2020Mitigating backdoor attacks in LSTM-based Text Classification Systems by Backdoor Keyword Identificationcited by 80
  31. 2021CLIP2StyleGAN: Unsupervised Extraction of StyleGAN Edit Directionscited by 78
  32. 2022Plug & Play Attacks: Towards Robust and Flexible Model Inversion Attackscited by 58
  33. 2021Explainability-based Backdoor Attacks Against Graph Neural Networkscited by 42
  34. 2020What Do You See? Evaluation of Explainable Artificial Intelligence (XAI) Interpretability through Neural Backdoorscited by 32
  35. 2022Exploiting Cultural Biases via Homoglyphs in Text-to-Image Synthesiscited by 29
  36. 2022Can There be Art Without an Artist?cited by 10
  37. 2022Backdooring Explainable Machine Learningcited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 7; 2024: 17; 2025: 21; 2026: 14.

59 papers.

Sort:

By area:

  1. 2024Attacks and Defenses for Generative Diffusion Models: A Comprehensive Surveycited by 32
  2. 2024Large Model Based Agents: State-of-the-Art, Cooperation Paradigms, Security and Privacy, and Future Trendscited by 26
  3. 2024TERD: A Unified Framework for Safeguarding Diffusion Models Against Backdoorscited by 25
  4. 2023Quantifying Bias in Text-to-Image Generative Modelscited by 16
  5. 2023A Systematic Survey of Prompt Engineering on Vision-Language Foundation Modelscited by 12
  6. 2023Be Careful What You Smooth For: Label Smoothing Can Be a Privacy Shield but Also a Catalyst for Model Inversion Attackscited by 12
  7. 2024Backdooring Bias (B2) into Stable Diffusion Modelscited by 12
  8. 2024Defending Text-to-image Diffusion Models: Surprising Efficacy of Textual Perturbations Against Backdoor Attackscited by 12
  9. 2025Silent Branding Attack: Trigger-free Data Poisoning Attack on Text-to-Image Diffusion Modelscited by 11
  10. 2024ProTIP: Probabilistic Robustness Verification on Text-to-Image Diffusion Models against Stochastic Perturbationcited by 10
  11. 2025Erasing Concepts, Steering Generations: A Comprehensive Survey of Concept Suppressioncited by 10
  12. 2023From Trojan Horses to Castle Walls: Unveiling Bilateral Data Poisoning Effects in Diffusion Modelscited by 9
38 more
  1. 2024UIBDiffusion: Universal Imperceptible Backdoor Attack for Diffusion Modelscited by 9
  2. 2025BadVideo: Stealthy Backdoor Attack against Text-to-Video Generationcited by 9
  3. 2025Erased but Not Forgotten: How Backdoors Compromise Concept Erasurecited by 9
  4. 2024Autonomous LLM-Enhanced Adversarial Attack for Text-to-Motioncited by 7
  5. 2025BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Modelcited by 7
  6. 2023Leveraging Diffusion-Based Image Variations for Robust Training on Poisoned Datacited by 6
  7. 2024Trustworthy Text-to-Image Diffusion Models: A Timely and Focused Surveycited by 6
  8. 2025MixBridge: Heterogeneous Image-to-Image Backdoor Attack through Mixture of Schr"odinger Bridgescited by 5
  9. 2023Defending Our Privacy With Backdoorscited by 4
  10. 2024CollaFuse: Collaborative Diffusion Modelscited by 4
  11. 2024Safe Text-to-Image Generation: Simply Sanitize the Prompt Embeddingcited by 4
  12. 2026When LoRA Betrays: Backdooring Text-to-Image Models by Masquerading as Benign Adapterscited by 4
  13. 2024Buster: Implanting Semantic Backdoor into Text Encoder to Mitigate NSFW Content Generationcited by 3
  14. 2025A Dual-Purpose Framework for Backdoor Defense and Backdoor Amplification in Diffusion Modelscited by 3
  15. 2025Dynamic Attention Analysis for Backdoor Detection in Text-to-Image Diffusion Modelscited by 3
  16. 2024Lazy Layers to Make Fine-Tuned Diffusion Models More Traceablecited by 2
  17. 2024Detecting Dataset Abuse in Fine-Tuning Stable Diffusion Models for Text-to-Image Synthesiscited by 2
  18. 2024Combinational Backdoor Attack against Customized Text-to-Image Modelscited by 2
  19. 2024On the Fairness, Diversity and Reliability of Text-to-Image Generative Modelscited by 2
  20. 2025Trigger without Trace: Towards Stealthy Backdoor Attack on Text-to-Image Diffusion Modelscited by 2
  21. 2025Parasite: A Steganography-based Backdoor Attack Framework for Diffusion Modelscited by 2
  22. 2025REDEditing: Relationship-Driven Precise Backdoor Poisoning on Text-to-Image Diffusion Modelscited by 2
  23. 2025Backdoor Defense in Diffusion Models via Spatial Attention Unlearningcited by 2
  24. 2025Towards Dataset Copyright Evasion Attack against Personalized Text-to-Image Diffusion Modelscited by 2
  25. 2025Towards Effective Prompt Stealing Attack against Text-to-Image Diffusion Modelscited by 2
  26. 2025Sealing The Backdoor: Unlearning Adversarial Text Triggers In Diffusion Models Using Knowledge Distillationcited by 2
  27. 2025PersGuard: Preventing Malicious Personalization in Text-to-Image Diffusion Models via Model Backdoorscited by 1
  28. 2025Gungnir: Exploiting Stylistic Features in Images for Backdoor Attacks on Diffusion Modelscited by 1
  29. 2025Practical, Generalizable and Robust Backdoor Attacks on Text-to-Image Diffusion Modelscited by 1
  30. 2026BadRSSD: Backdoor Attacks on Regularized Self-Supervised Diffusion Modelscited by 1
  31. 2026BlackMirror: Black-Box Backdoor Detection for Text-to-Image Models via Instruction-Response Deviationcited by 1
  32. 2023Trustworthy Large Models in Vision: A Surveycited by 0
  33. 2024Manipulating and Mitigating Generative Model Biases without Retrainingcited by 0
  34. 2025BadBlocks: Low-Cost and Stealthy Backdoor Attacks Tailored for Text-to-Image Diffusion Modelscited by 0
  35. 2025BadGraph: A Backdoor Attack Against Latent Diffusion Model for Text-Guided Graph Generationcited by 0
  36. 2025Assimilation Matters: Model-level Backdoor Detection in Vision-Language Pretrained Modelscited by 0
  37. 2026Backdoor Sentinel: Detecting and Detoxifying Backdoors in Diffusion Models via Temporal Noise Consistencycited by 0
  38. 2026Semantic-level Backdoor Attack against Text-to-Image Diffusion Modelscited by 0

50 most cited of 59 All 59 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2023Text-to-Image Diffusion Models can be Easily Backdoored through Multimodal Data Poisoning
  2. 2023Personalization as a Shortcut for Few-Shot Backdoor Attack against Text-to-Image Diffusion Models
  3. 2025PEPPER: Perception-Guided Perturbation for Robust Backdoor Defense in Text-to-Image Diffusion Models
  4. 2023BAGM: A Backdoor Attack for Manipulating Text-to-Image Generative Models
  5. 2025Efficient Input-level Backdoor Defense on Text-to-Image Synthesis via Neuron Activation Variation
  6. 2024Attack as Defense: Run-time Backdoor Implantation for Image Content Protection ↗
  7. 2025Backdoors in Conditional Diffusion: Threats to Responsible Synthetic Data Pipelines
  8. 2025Concept-Guided Backdoor Attack on Vision Language Models