arXiv:2412.01528cs.AI2024-12ICCV被引 7

提出防御扩散模型版权攻击的新框架,有效识别并抑制恶意训练数据带来的侵权生成。

CopyrightShield: Enhancing Diffusion Model Security against Copyright Infringement Attacks

  • 通过空间掩码与数据归因分析,定位模型对特定位置和提示的过拟合风险。
  • 在两种攻击场景下平均F1达0.665,使首次攻击时间延后115.2%,侵权率降56.7%。
  • 适合关注生成模型安全性的研究者与应用开发者,尤其涉及版权合规场景。

扩散模型因其在图像合成等领域的卓越生成能力而备受关注。然而,近期研究发现其易受版权侵权攻击:攻击者将经策略性修改的非侵权图像注入训练集,使模型在特定中毒提示下生成侵权内容。为此,我们提出防御框架CopyrightShield。首先分析扩散模型的记忆机制,发现攻击利用模型对特定空间位置和提示的过拟合,导致在后门触发下复现中毒样本。基于此,提出一种结合空间掩码与数据归因的中毒样本检测方法,量化中毒风险并精准识别隐藏后门样本。为进一步缓解对中毒特征的记忆,引入自适应优化策略,在训练损失中加入动态惩罚项,降低对侵权特征的依赖,同时保持生成性能。实验表明,CopyrightShield在两种攻击场景下显著提升中毒样本检测效果,平均F1-score达0.665,首次攻击时间(FAE)延后115.2%,版权侵权率(CIR)下降56.7%。相比现有最佳扩散模型后门防御方法,防护效果提升约25%,展现出优越性与实用性。

原文摘要 · Abstract (English)

Diffusion models have attracted significant attention due to its exceptional data generation capabilities in fields such as image synthesis. However, recent studies have shown that diffusion models are vulnerable to copyright infringement attacks, where attackers inject strategically modified non-infringing images into the training set, inducing the model to generate infringing content under the prompt of specific poisoned captions. To address this issue, we first propose a defense framework, CopyrightShield, to defend against the above attack. Specifically, we analyze the memorization mechanism of diffusion models and find that attacks exploit the model's overfitting to specific spatial positions and prompts, causing it to reproduce poisoned samples under backdoor triggers. Based on this, we propose a poisoned sample detection method using spatial masking and data attribution to quantify poisoning risk and accurately identify hidden backdoor samples. To further mitigate memorization of poisoned features, we introduce an adaptive optimization strategy that integrates a dynamic penalty term into the training loss, reducing reliance on infringing features while preserving generative performance. Experimental results demonstrate that CopyrightShield significantly improves poisoned sample detection performance across two attack scenarios, achieving average F1-scores of 0.665, retarding the First-Attack Epoch (FAE) of 115.2% and decreasing the Copyright Infringement Rate (CIR) by 56.7%. Compared to the SoTA backdoor defense in diffusion models, the defense effect is improved by about 25%, showcasing its superiority and practicality in enhancing the security of diffusion models.

扩散模型版权安全后门防御

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。