mlsanityData to 7 Oct 2026

How to Backdoor Diffusion Models?

arXiv 2212.05400 ↗First posted 11 Dec 2022cs.CV cs.CR cs.LGcited by 102

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

Diffusion models are state-of-the-art deep learning empowered generative models that are trained based on the principle of learning forward and reverse diffusion processes via progressive noise-addition and denoising. To gain a better understanding of the limitations and potential risks, this paper presents the first study on the robustness of diffusion models against backdoor attacks. Specifically, we propose BadDiffusion, a novel attack framework that engineers compromised diffusion processes during model training for backdoor implantation. At the inference stage, the backdoored diffusion model will behave just like an untampered generator for regular data inputs, while falsely generating some targeted outcome designed by the bad actor upon receiving the implanted trigger signal. Such a critical risk can be dreadful for downstream tasks and applications built upon the problematic model. Our extensive experiments on various backdoor attack settings show that BadDiffusion can consistently lead to compromised diffusion models with high utility and target specificity. Even worse, BadDiffusion can be made cost-effective by simply finetuning a clean pre-trained diffusion model to implant backdoors. We also explore some possible countermeasures for risk mitigation. Our results call attention to potential risks and possible misuse of diffusion models. Our code is available on https://github.com/IBM/BadDiffusion.

Key facts. Cited by 102 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 45 of its 52 references that are in the map. First posted on arXiv 11 Dec 2022.

Builds on

45 of 52 references.

References · 45

  1. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  2. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  3. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  4. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  5. 2020Denoising Diffusion Implicit Modelscited by 9,655
  6. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  7. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  8. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,005
  9. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,539
  10. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,322
  11. 2022Classifier-Free Diffusion Guidancecited by 5,717
  12. 2022Generative Adversarial Networkscited by 5,603
33 more
  1. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,067
  2. 2014Deep Learning Face Attributes in the Wildcited by 3,679
  3. 2021GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Modelscited by 3,595
  4. 2016Improved Techniques for Training GANscited by 2,938
  5. 2015Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networkscited by 2,048
  6. 2020DiffWave: A Versatile Diffusion Model for Audio Synthesiscited by 1,339
  7. 2021Cascaded Diffusion Models for High Fidelity Image Generationcited by 1,155
  8. 2021Variational Diffusion Modelscited by 1,145
  9. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  10. 2020Improved Techniques for Training Score-Based Generative Modelscited by 1,036
  11. 2022Planning with Diffusion for Flexible Behavior Synthesiscited by 1,023
  12. 2022Diffusion-LM Improves Controllable Text Generationcited by 1,006
  13. 2022Diffusion Policies as an Expressive Policy Class for Offline Reinforcement Learningcited by 543
  14. 2022GeoDiff: a Geometric Diffusion Model for Molecular Conformation Generationcited by 511
  15. 2021Label-Efficient Semantic Segmentation with Diffusion Modelscited by 495
  16. 2021Grad-TTS: A Diffusion Probabilistic Model for Text-to-Speechcited by 445
  17. 2022DiffusionDet: Diffusion Model for Object Detectioncited by 354
  18. 2022Analytic-DPM: an Analytic Estimate of the Optimal Reverse Variance in Diffusion Probabilistic Modelscited by 331
  19. 2022Cold Diffusion: Inverting Arbitrary Image Transforms Without Noisecited by 275
  20. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  21. 2022Offline Reinforcement Learning via High-Fidelity Generative Behavior Modelingcited by 177
  22. 2021Diff-TTS: A Denoising Diffusion Model for Text-to-Speechcited by 156
  23. 2022ProDiff: Progressive Fast Diffusion Model For High-Quality Text-to-Speechcited by 147
  24. 2022FastDiff: A Fast Conditional Diffusion Model for High-Quality Speech Synthesiscited by 136
  25. 2020Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustnesscited by 130
  26. 2019Fair Generative Modeling via Weak Supervisioncited by 114
  27. 2022Soft Diffusion: Score Matching for General Corruptionscited by 101
  28. 2020Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Casescited by 93
  29. 2021Guided-TTS: A Diffusion Model for Text-to-Speech via Classifier Guidancecited by 84
  30. 2019Bias Correction of Learned Generative Models using Likelihood-Free Importance Weightingcited by 70
  31. 2020AdvFlow: Inconspicuous Black-box Adversarial Attacks using Normalizing Flowscited by 35
  32. 2021The Devil is in the GAN: Backdoor Attacks and Defenses in Deep Generative Modelscited by 12
  33. 2021Generative Models for Security: Attacks, Defenses, and Opportunitiescited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 25; 2024: 32; 2025: 22; 2026: 23.

102 papers.

Sort:

By area:

  1. 2023Text-to-Image Diffusion Models can be Easily Backdoored through Multimodal Data Poisoningcited by 91
  2. 2024Harmful Fine-tuning Attacks and Defenses for Large Language Models: A Surveycited by 86
  3. 2023When Foundation Model Meets Federated Learning: Motivations, Challenges, and Future Directionscited by 83
  4. 2023Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Modelscited by 72
  5. 2023VillanDiffusion: A Unified Backdoor Attack Framework for Diffusion Modelscited by 68
  6. 2023A Pathway Towards Responsible AI Generated Contentcited by 38
  7. 2023BAGM: A Backdoor Attack for Manipulating Text-to-Image Generative Modelscited by 37
  8. 2024The Stronger the Diffusion Model, the Easier the Backdoor: Data Poisoning to Induce Copyright Breaches Without Adjusting Finetuning Pipelinecited by 33
  9. 2023Attention-Enhancing Backdoor Attacks Against BERT-based Modelscited by 32
  10. 2024Attacks and Defenses for Generative Diffusion Models: A Comprehensive Surveycited by 32
  11. 2024Stretching Each Dollar: Diffusion Training from Scratch on a Micro-Budgetcited by 30
  12. 2024TERD: A Unified Framework for Safeguarding Diffusion Models Against Backdoorscited by 25
38 more
  1. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  2. 2023Intellectual Property Protection of Diffusion Models via the Watermark Diffusion Processcited by 17
  3. 2024DisDet: Exploring Detectability of Backdoor Attack on Diffusion Modelscited by 17
  4. 2023Quantifying Bias in Text-to-Image Generative Modelscited by 16
  5. 2023On the Trustworthiness Landscape of State-of-the-art Generative Models: A Survey and Outlookcited by 15
  6. 2023Backdooring Textual Inversion for Concept Censorshipcited by 14
  7. 2024Trustworthy Distributed AI Systems: Robustness, Privacy, and Governancecited by 12
  8. 2024Robust and Transferable Backdoor Attacks Against Deep Image Compression With Selective Frequency Priorcited by 11
  9. 2025Silent Branding Attack: Trigger-free Data Poisoning Attack on Text-to-Image Diffusion Modelscited by 11
  10. 2023Demystifying Poisoning Backdoor Attacks from a Statistical Perspectivecited by 10
  11. 2023From Trojan Horses to Castle Walls: Unveiling Bilateral Data Poisoning Effects in Diffusion Modelscited by 9
  12. 2024Invisible Backdoor Attacks on Diffusion Modelscited by 9
  13. 2024UIBDiffusion: Universal Imperceptible Backdoor Attack for Diffusion Modelscited by 9
  14. 2025BadVideo: Stealthy Backdoor Attack against Text-to-Video Generationcited by 9
  15. 2025Erased but Not Forgotten: How Backdoors Compromise Concept Erasurecited by 9
  16. 2023Model Selection of Anomaly Detectors in the Absence of Labeled Validation Datacited by 8
  17. 2023Salient Conditional Diffusion for Defending Against Backdoor Attackscited by 7
  18. 2023Invisible Watermarking for Audio Generation Diffusion Modelscited by 7
  19. 2024Backdoor Attacks against Image-to-Image Networkscited by 7
  20. 2025BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Modelcited by 7
  21. 2023XGBD: Explanation-Guided Graph Backdoor Detectioncited by 6
  22. 2023Leveraging Diffusion-Based Image Variations for Robust Training on Poisoned Datacited by 6
  23. 2024PureDiffusion: Using Backdoor to Counter Backdoor in Generative Diffusion Modelscited by 6
  24. 2025BadRefSR: Backdoor Attacks Against Reference-based Image Super Resolutioncited by 6
  25. 2023Universal Detection of Backdoor Attacks via Density-based Clustering and Centroids Analysiscited by 5
  26. 2023Adversarial Backdoor Attack by Naturalistic Data Poisoning on Trajectory Prediction in Autonomous Drivingcited by 5
  27. 2023VA3: Virtually Assured Amplification Attack on Probabilistic Copyright Protection for Text-to-Image Generative Modelscited by 5
  28. 2024Backdoor Attack on Unpaired Medical Image-Text Foundation Models: A Pilot Study on MedCLIPcited by 5
  29. 2024PSBD: Prediction Shift Uncertainty Unlocks Backdoor Detectioncited by 5
  30. 2025MixBridge: Heterogeneous Image-to-Image Backdoor Attack through Mixture of Schr"odinger Bridgescited by 5
  31. 2023Defending Our Privacy With Backdoorscited by 4
  32. 2024Catastrophic Overfitting: A Potential Blessing in Disguisecited by 4
  33. 2024Watch the Watcher! Backdoor Attacks on Security-Enhancing Diffusion Modelscited by 4
  34. 2024CollaFuse: Collaborative Diffusion Modelscited by 4
  35. 2024The Cat and Mouse Game: The Ongoing Arms Race Between Diffusion Models and Detection Methodscited by 4
  36. 2026When LoRA Betrays: Backdooring Text-to-Image Models by Masquerading as Benign Adapterscited by 4
  37. 2024The last Dance : Robust backdoor attack via diffusion models and bayesian approachcited by 3
  38. 2024Trading Devil: Robust backdoor attack via Stochastic investment models and Bayesian approachcited by 3

50 most cited of 102 All 102 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2023Elijah: Eliminating Backdoors Injected in Diffusion Models via Distribution Shift
  2. 2024Diff-Cleanse: Identifying and Mitigating Backdoor Attacks in Diffusion Models
  3. 2026TEMPO-Diffusion: Temporally Exposed Malicious Poisoning of Diffusion Models
  4. 2026Learning Normal Diffusion Dynamics for Backdoor Defense in Text-to-Image Models
  5. 2024UFID: A Unified Framework for Input-level Backdoor Detection on Diffusion Models
  6. 2023Membership Inference Attacks against Diffusion Models
  7. 2025Parasite: A Steganography-based Backdoor Attack Framework for Diffusion Models
  8. 2025Towards Irreversible Machine Unlearning for Diffusion Models