mlsanityData to 7 Oct 2026

DiffusionHijack: Supply-Chain PRNG Backdoor Attack on Diffusion Models and Quantum Random Number Defense

arXiv 2605.13115 ↗First posted 13 May 2026cs.CR cs.LGcited by 0

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

Diffusion models depend on pseudo-random number generators (PRNGs) for latent noise sampling. We present DiffusionHijack, a supply-chain backdoor attack that hijacks the PRNG to deterministically control generated images. A malicious PRNG, injected via compromised packages, forces pixel-perfect reproduction of attacker-chosen content (SSIM = 1.00, N = 100 trials) on Stable Diffusion v1.4, v1.5, and SDXL -- without modifying model weights. The attack is inherently undetectable by existing model auditing and content moderation mechanisms, as it operates entirely outside the neural network computation graph. The attack remains effective under stochastic sampling (eta > 0), bypasses CLIP-based safety checkers (98-100% success), and operates independently of the user's prompt. As a countermeasure, we replace the PRNG with a quantum random number generator (QRNG), which provides information-theoretic unpredictability. Across N = 100 prompt-model combinations, QRNG defense completely neutralizes the attack, reducing output similarity to random baseline levels (SSIM < 0.20 for SD 1.x models, < 0.45 for SDXL). This work exposes a previously overlooked supply-chain vulnerability and offers a hardware-level fundamental mitigation for generative AI systems.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 22 of its 31 references that are in the map. First posted on arXiv 13 May 2026.

Builds on

22 of 31 references.

Closest ancestors · 5

Same direction, newest first

  1. 2025Silent Branding Attack: Trigger-free Data Poisoning Attack on Text-to-Image Diffusion Models12 Mar
  2. 2024Adversarial Attacks and Defenses on Text-to-Image Diffusion Models: A Survey10 Jul
  3. 2023AdvDiff: Generating Unrestricted Adversarial Examples using Diffusion Models24 Jul
  4. 2023Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust31 May
  5. 2023Text-to-Image Diffusion Models can be Easily Backdoored through Multimodal Data Poisoning7 May

Other references · 17

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  2. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  3. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  4. 2020Denoising Diffusion Implicit Modelscited by 9,655
  5. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  6. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,322
  7. 2022Classifier-Free Diffusion Guidancecited by 5,717
  8. 2023SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesiscited by 4,290
  9. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  10. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  11. 2020Backdoor Learning: A Surveycited by 412
  12. 2024GuardT2I: Defending Text-to-Image Models from Adversarial Promptscited by 61
5 more
  1. 2024We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMscited by 61
  2. 2022Taxonomy of Attacks on Open-Source Software Supply Chainscited by 57
  3. 2023SurrogatePrompt: Bypassing the Safety Filter of Text-to-Image Models via Substitutioncited by 32
  4. 2025Reason2Attack: Jailbreaking Text-to-Image Models via LLM Reasoningcited by 14
  5. 2024DONAPI: Malicious NPM Packages Detector using Behavior Sequence Knowledge Mappingcited by 6

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Seed Hijacking of LLM Sampling and Quantum Random Number Defense
  2. 2024TERD: A Unified Framework for Safeguarding Diffusion Models Against Backdoors
  3. 2024Watch the Watcher! Backdoor Attacks on Security-Enhancing Diffusion Models
  4. 2024Invisible Backdoor Attacks on Diffusion Models
  5. 2025A Dual-Purpose Framework for Backdoor Defense and Backdoor Amplification in Diffusion Models
  6. 2025Data-Chain Backdoor: Do You Trust Diffusion Models as Generative Data Supplier?
  7. 2023Data Forensics in Diffusion Models: A Systematic Analysis of Membership Privacy
  8. 2025Backdoor Attacks on Discrete Graph Diffusion Models