在扩散模型中嵌入隐蔽对抗能力，生成的图像看似正常却能骗过分类器。
Embedding Hidden Adversarial Capabilities in Pre-Trained Diffusion Models
- 通过微调将对抗功能直接植入扩散模型，不改变正常行为。
- 生成图像质量高且与原模型无异，但下游分类器误判率很高。
- 适合关注生成模型安全、模型验证的研究者和开发者。
我们提出一种新型攻击范式，通过微调将隐藏的对抗能力直接嵌入扩散模型，无需改变其可见行为或推理时的修改。与以往针对特定图像或调整生成过程以输出对抗样本的方法不同，本方法将对抗功能整合到模型内部。经过篡改的模型生成的图像在质量上与原始模型无异，但这些图像在下游分类器中导致高比例误分类，且可定向至特定类别。用户在使用该受损模型时完全意识不到其嵌入的对抗性，因其表现与标准扩散模型一致。我们验证了该方法的有效性和隐蔽性，揭示了一种潜在的隐蔽攻击路径，凸显了外部提供模型带来的安全风险，并强调了对生成模型中隐藏威胁进行严格验证与防御的紧迫性。代码已开源：https://github.com/LucasBeerens/CRAFTed-Diffusion。
原文摘要 · Abstract (English)
We introduce a new attack paradigm that embeds hidden adversarial capabilities directly into diffusion models via fine-tuning, without altering their observable behavior or requiring modifications during inference. Unlike prior approaches that target specific images or adjust the generation process to produce adversarial outputs, our method integrates adversarial functionality into the model itself. The resulting tampered model generates high-quality images indistinguishable from those of the original, yet these images cause misclassification in downstream classifiers at a high rate. The misclassification can be targeted to specific output classes. Users can employ this compromised model unaware of its embedded adversarial nature, as it functions identically to a standard diffusion model. We demonstrate the effectiveness and stealthiness of our approach, uncovering a covert attack vector that raises new security concerns. These findings expose a risk arising from the use of externally-supplied models and highlight the urgent need for robust model verification and defense mechanisms against hidden threats in generative models. The code is available at https://github.com/LucasBeerens/CRAFTed-Diffusion .
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。