mlsanityData to 7 Oct 2026

Generating Potent Poisons and Backdoors from Scratch with Guided Diffusion

arXiv 2403.16365 ↗First posted 25 Mar 2024cs.LG cs.CR cs.CVcited by 0

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

Modern neural networks are often trained on massive datasets that are web scraped with minimal human inspection. As a result of this insecure curation pipeline, an adversary can poison or backdoor the resulting model by uploading malicious data to the internet and waiting for a victim to scrape and train on it. Existing approaches for creating poisons and backdoors start with randomly sampled clean data, called base samples, and then modify those samples to craft poisons. However, some base samples may be significantly more amenable to poisoning than others. As a result, we may be able to craft more potent poisons by carefully choosing the base samples. In this work, we use guided diffusion to synthesize base samples from scratch that lead to significantly more potent poisons and backdoors than previous state-of-the-art attacks. Our Guided Diffusion Poisoning (GDP) base samples can be combined with any downstream poisoning or backdoor attack to boost its effectiveness. Our implementation code is publicly available at: https://github.com/hsouri/GDP .

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 44 of its 49 references that are in the map. First posted on arXiv 25 Mar 2024.

Builds on

44 of 49 references.

References · 44

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  4. 2020Denoising Diffusion Implicit Modelscited by 9,655
  5. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  6. 2022Classifier-Free Diffusion Guidancecited by 5,717
  7. 2023Adding Conditional Control to Text-to-Image Diffusion Modelscited by 5,466
  8. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
  9. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
  10. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,067
  11. 2021GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Modelscited by 3,595
  12. 2016Deep Learning with Differential Privacycited by 2,682
32 more
  1. 2022RePaint: Inpainting using Denoising Diffusion Probabilistic Modelscited by 1,419
  2. 2022Diffusion Posterior Sampling for General Noisy Inverse Problemscited by 1,375
  3. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  4. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  5. 2022Denoising Diffusion Restoration Modelscited by 951
  6. 2023GLIGEN: Open-Set Grounded Text-to-Image Generationcited by 774
  7. 2022Zero-Shot Image Restoration Using Denoising Diffusion Null-Space Modelcited by 574
  8. 2022Improving Diffusion Models for Inverse Problems using Manifold Constraintscited by 501
  9. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  10. 2018Spectral Signatures in Backdoor Attackscited by 457
  11. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  12. 2023Universal Guidance for Diffusion Modelscited by 426
  13. 2019Hidden Trigger Backdoor Attackscited by 359
  14. 2017Certified Defenses for Data Poisoning Attackscited by 288
  15. 2022Cold Diffusion: Inverting Arbitrary Image Transforms Without Noisecited by 275
  16. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  17. 2021Deblurring via Stochastic Refinementcited by 248
  18. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  19. 2022Diffusion models as plug-and-play priorscited by 230
  20. 2017Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimizationcited by 188
  21. 2021Unlearnable Examples: Making Personal Data Unexploitablecited by 188
  22. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  23. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 156
  24. 2022Semantic Image Synthesis via Diffusion Modelscited by 131
  25. 2019Transferable Clean-Label Poisoning Attacks on Deep Neural Netscited by 129
  26. 2021Adversarial Examples Make Strong Poisonscited by 115
  27. 2020MetaPoison: Practical General-purpose Clean-label Data Poisoningcited by 114
  28. 2020Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attackscited by 109
  29. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 98
  30. 2020On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shapingcited by 82
  31. 2020Bullseye Polytope: A Scalable Clean-Label Poisoning Attack with Improved Transferabilitycited by 65
  32. 2021DP-InstaHide: Provably Defusing Poisoning and Backdoor Attacks with Differentially Private Data Augmentationscited by 33

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2023Leveraging Diffusion-Based Image Variations for Robust Training on Poisoned Data
  2. 2023DataElixir: Purifying Poisoned Dataset to Mitigate Backdoor Attacks via Diffusion Models
  3. 2026TooBad: Backdoor Diffusion Models with Ultra-Low Poison Rate and Imperceptible Trigger
  4. 2025Data-Chain Backdoor: Do You Trust Diffusion Models as Generative Data Supplier?
  5. 2026Pick Your Poison: Learning to Select Poison Sets for Stronger LLM Backdoor Attacks
  6. 2025Backdoors in Conditional Diffusion: Threats to Responsible Synthetic Data Pipelines
  7. 2023From Trojan Horses to Castle Walls: Unveiling Bilateral Data Poisoning Effects in Diffusion Models
  8. 2024Diff-Cleanse: Identifying and Mitigating Backdoor Attacks in Diffusion Models