通过组合多个触发元素提升版权侵权攻击效果,隐蔽性更强。
ME: Trigger Element Combination Backdoor Attack on Copyright Infringement
- 用多元素组合与DCT变换增强中毒样本隐蔽性
- 在低采样率下仍实现12.73%侵权率,优于原方法
- 新数据集支持更真实、安全的攻击研究
生成式扩散模型(如Stable Diffusion)可能被攻击者利用来发起版权侵权攻击,通过复制训练数据生成带有毒性的图像-文本对。近期提出的SilentBadDiffusion(SBD)方法在文本到图像任务中表现出色,但该领域可用数据资源仍有限,部分数据因版权或内容问题受限,且现有数据并非都适合攻击方法。此外,当可使用的中毒样本极少时,当前最先进(SoTA)的SBD性能仍不理想。本文提出了新的可访问数据集,用于研究类似SBD的攻击,并基于SBD提出多元素(ME)攻击方法:在每个中毒样本中增加视觉-文本毒化元素数量以增强攻击能力,同时引入离散余弦变换(DCT)保持隐蔽性。在两个新数据集上,我们获得了16.78% / 39.50 和 51.20% / 23.60 的版权侵权率(CIR)/首次攻击回合(FAE),接近甚至超越基准数据集Pokemon和Mijourney。在低子采样率(5%,仅6个中毒样本)条件下,采用MESI与DCT的方案获得0.23% / 84.00和12.73% / 65.50的性能,均优于原始SBD,后者完全无法攻击。
原文摘要 · Abstract (English)
The capability of generative diffusion models (DMs) like Stable Diffusion (SD) in replicating training data could be taken advantage of by attackers to launch the Copyright Infringement Attack, with duplicated poisoned image-text pairs. SilentBadDiffusion (SBD) is a method proposed recently, which shew outstanding performance in attacking SD in text-to-image tasks. However, the feasible data resources in this area are still limited, some of them are even constrained or prohibited due to the issues like copyright ownership or inappropriate contents; And not all of the images in current datasets are suitable for the proposed attacking methods; Besides, the state-of-the-art (SoTA) performance of SBD is far from ideal when few generated poisoning samples could be adopted for attacks. In this paper, we raised new datasets accessible for researching in attacks like SBD, and proposed Multi-Element (ME) attack method based on SBD by increasing the number of poisonous visual-text elements per poisoned sample to enhance the ability of attacking, while importing Discrete Cosine Transform (DCT) for the poisoned samples to maintain the stealthiness. The Copyright Infringement Rate (CIR) / First Attack Epoch (FAE) we got on the two new datasets were 16.78% / 39.50 and 51.20% / 23.60, respectively close to or even outperformed benchmark Pokemon and Mijourney datasets. In condition of low subsampling ratio (5%, 6 poisoned samples), MESI and DCT earned CIR / FAE of 0.23% / 84.00 and 12.73% / 65.50, both better than original SBD, which failed to attack at all.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。