mlsanityData to 14 Oct 2026

BlackMirror: Black-Box Backdoor Detection for Text-to-Image Models via Instruction-Response Deviation

arXiv 2603.05921 ↗First posted 6 Mar 2026cs.CV cs.AIcited by 1

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

This paper investigates the challenging task of detecting backdoored text-to-image models under black-box settings and introduces a novel detection framework BlackMirror. Existing approaches typically rely on analyzing image-level similarity, under the assumption that backdoor-triggered generations exhibit strong consistency across samples. However, they struggle to generalize to recently emerging backdoor attacks, where backdoored generations can appear visually diverse. BlackMirror is motivated by an observation: across backdoor attacks, {only partial semantic patterns within the generated image are steadily manipulated, while the rest of the content remains diverse or benign. Accordingly, BlackMirror consists of two components: MirrorMatch, which aligns visual patterns with the corresponding instructions to detect semantic deviations; and MirrorVerify, which evaluates the stability of these deviations across varied prompts to distinguish true backdoor behavior from benign responses. BlackMirror is a general, training-free framework that can be deployed as a plug-and-play module in Model-as-a-Service (MaaS) applications. Comprehensive experiments demonstrate that BlackMirror achieves accurate detection across a wide range of attacks. Code is available at https://github.com/Ferry-Li/BlackMirror.

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 73 of its 102 references that are in the map. First posted on arXiv 6 Mar 2026.

Builds on

73 of 102 references.

Closest ancestors · 17

Same direction, newest first

  1. 2025Dynamic Attention Analysis for Backdoor Detection in Text-to-Image Diffusion Models29 Apr
  2. 2025Efficient Input-level Backdoor Defense on Text-to-Image Synthesis via Neuron Activation Variation9 Mar
  3. 2025BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Model17 Feb
  4. 2024TERD: A Unified Framework for Safeguarding Diffusion Models Against Backdoors9 Sep
  5. 2024Defending Text-to-image Diffusion Models: Surprising Efficacy of Textual Perturbations Against Backdoor Attacks28 Aug
  6. 2024Attacks and Defenses for Generative Diffusion Models: A Comprehensive Survey6 Aug
  7. 2024T2IShield: Defending Against Backdoors on Text-to-Image Diffusion Models5 Jul
  8. 2024Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shift27 Jun
  9. 2024VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Models21 Feb
  10. 2023Pre-trained Trojan Attacks for Visual Recognition23 Dec
  11. 2023Elijah: Eliminating Backdoors Injected in Diffusion Models via Distribution Shift27 Nov
  12. 2023BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learning20 Nov
5 more
  1. 2023From Trojan Horses to Castle Walls: Unveiling Bilateral Data Poisoning Effects in Diffusion Models4 Nov
  2. 2023Personalization as a Shortcut for Few-Shot Backdoor Attack against Text-to-Image Diffusion Models18 May
  3. 2023Text-to-Image Diffusion Models can be Easily Backdoored through Multimodal Data Poisoning7 May
  4. 2022How to Backdoor Diffusion Models?11 Dec
  5. 2022Rickrolling the Artist: Injecting Backdoors into Text Encoders for Text-to-Image Synthesis4 Nov

Other references · 56

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  2. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  3. 2023GPT-4 Technical Reportcited by 18,396
  4. 2025Qwen3 Technical Reportcited by 8,820
  5. 2022Flow Matching for Generative Modelingcited by 5,702
  6. 2025Qwen2.5-VL Technical Reportcited by 5,587
  7. 2023Adding Conditional Control to Text-to-Image Diffusion Modelscited by 5,503
  8. 2014Conditional Generative Adversarial Netscited by 2,162
  9. 2021SDEdit: Guided Image Synthesis and Editing with Stochastic Differential Equationscited by 1,937
  10. 2015Flickr30k Entities: Collecting Region-to-Phrase Correspondences for Richer Image-to-Sentence Modelscited by 1,362
  11. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  12. 2024Visual Autoregressive Modeling: Scalable Image Generation via Next-Scale Predictioncited by 1,023
38 more
  1. 2016Generative Adversarial Text to Image Synthesiscited by 735
  2. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 459
  3. 2022Inversion-Based Style Transfer with Diffusion Modelscited by 291
  4. 2024Mastering Text-to-Image Diffusion: Recaptioning, Planning, and Generating with Multimodal LLMscited by 224
  5. 2024Diffusion Model-Based Image Editing: A Surveycited by 212
  6. 2019Controllable Text-to-Image Generationcited by 187
  7. 2025FutureSightDrive: Thinking Visually with Spatio-Temporal CoT for Autonomous Drivingcited by 166
  8. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Promptcited by 109
  9. 2025JanusVLN: Decoupling Semantics and Spatiality with Dual Implicit Memory for Vision-Language Navigationcited by 89
  10. 2023TrojDiff: Trojan Attacks on Diffusion Models with Diverse Targetscited by 88
  11. 2021AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value Analysiscited by 53
  12. 2024DeDoDe v2: Analyzing and Improving the DeDoDe Keypoint Detectorcited by 39
  13. 2024Poisoned Forgery Face: Towards Backdoor Attacks on Face Forgery Detectioncited by 35
  14. 2025MQuant: Unleashing the Inference Potential of Multimodal Large Language Models via Full Static Quantizationcited by 35
  15. 2022BALF: Simple and Efficient Blur Aware Local Feature Detectorcited by 34
  16. 2025Chat-Driven Text Generation and Interaction for Person Retrievalcited by 34
  17. 2026Noisy but Valid: Robust Statistical Evaluation of LLMs with Imperfect Judgescited by 24
  18. 2026Delving Deeper: Hierarchical Visual Perception for Robust Video-Text Retrievalcited by 23
  19. 2023iEdit: Localised Text-guided Image Editing with Weak Supervisioncited by 20
  20. 2024MirrorCheck: Efficient Adversarial Defense for Vision-Language Modelscited by 19
  21. 2025Vision-Language Embodiment for Monocular Depth Estimationcited by 16
  22. 2025LightFair: Towards an Efficient Alternative for Fair T2I Diffusion via Debiasing Pre-trained Text Encoderscited by 16
  23. 2024DirMixE: Harnessing Test Agnostic Long-tail Recognition with Hierarchical Label Variationscited by 15
  24. 2024Information Entropy Guided Height-aware Histogram for Quantization-friendly Pillar Feature Encodercited by 14
  25. 2026HVD: Human Vision-Driven Video Representation Learning for Text-Video Retrievalcited by 14
  26. 2025TurboReg: TurboClique for Robust and Efficient Point Cloud Registrationcited by 13
  27. 2024Vulnerabilities in AI-generated Image Detection: The Challenge of Adversarial Attackscited by 12
  28. 2025CausalSR: Structural Causal Model-Driven Super-Resolution with Counterfactual Inferencecited by 12
  29. 2025OpenworldAUC: Towards Unified Evaluation and Optimization for Open-world Prompt Tuningcited by 12
  30. 2025M4V: Multimodal Mamba for Efficient Text-to-Video Generationcited by 12
  31. 2024PROSAC: Provably Safe Certification for Machine Learning Models under Adversarial Attackscited by 11
  32. 2024GlobalPointer: Large-Scale Plane Adjustment with Bi-Convex Relaxationcited by 11
  33. 2025MMT-ARD: Multimodal Multi-Teacher Adversarial Distillation for Robust Vision-Language Modelscited by 11
  34. 2023Dynamic Hyperbolic Attention Network for Fine Hand-object Reconstructioncited by 10
  35. 2025Long-tailed Recognition with Model Rebalancingcited by 10
  36. 2024HyperSDFusion: Bridging Hierarchical Structures in Language and Geometry for Enhanced 3D Text2Shape Generationcited by 8
  37. 2025Adaptive Event Stream Slicing for Open-Vocabulary Event-Based Object Detection via Vision-Language Knowledge Distillationcited by 8
  38. 2023High Dimensional Distributed Gradient Descent with Arbitrary Number of Byzantine Attackerscited by 7

50 most cited of 56 All 56 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026What Intermediate Layers Know: Detecting Jailbreaks from Entropy Dynamicscited by 1

Similar, not cited

Close in wording, no citation either way

  1. 2025TokenSwap: Backdoor Attack on the Compositional Understanding of Large Vision-Language Models
  2. 2024Prompting the Unseen: Detecting Hidden Backdoors in Black-Box Models
  3. 2024Perturb and Recover: Fine-tuning for Effective Backdoor Removal from CLIP
  4. 2025Concept-Guided Backdoor Attack on Vision Language Models
  5. 2025Trigger without Trace: Towards Stealthy Backdoor Attack on Text-to-Image Diffusion Models
  6. 2024Proactive Adversarial Defense: Harnessing Prompt Tuning in Vision-Language Models to Detect Unseen Backdoored Images
  7. 2025BackdoorVLM: A Benchmark for Backdoor Attacks and Defenses on Vision-Language Models
  8. 2025AutoDebias: Automated Framework for Debiasing Text-to-Image Models