ControlNet模型可被植入隐蔽后门，触发即生成指定内容
Backdoors in Conditional Diffusion: Threats to Responsible Synthetic Data Pipelines
- 通过污染1%训练数据，向ControlNet植入视觉触发后门
- 攻击成功率高达90%-98%，且不影响正常图像生成质量
- 提出清洁微调防御法，适合关注生成安全的开发者使用
文本到图像扩散模型能根据自然语言提示生成高质量图像。ControlNet通过结构化输入（如边缘图、深度图、姿态）扩展了这些模型，实现对输出的细粒度控制。然而，其依赖大规模公开爬取的数据集和社区微调，易受数据投毒攻击。本文提出一种模型投毒攻击，在ControlNet中嵌入隐蔽后门，使其在遇到特定视觉触发器时生成攻击者指定内容，无需文本提示。实验表明，仅污染1%的微调语料库即可达到90%-98%的攻击成功率，5%污染进一步强化后门，同时保持正常生成质量。为缓解此风险，我们提出清洁微调（CFT）：冻结扩散主干，仅对经清洗的数据集以降低学习率微调ControlNet。CFT显著降低保留数据上的攻击成功率。结果揭示了开源ControlNet引导的生成流水线存在严重安全漏洞，并证明CFT为负责任合成数据流程提供了实用防御方案。
原文摘要 · Abstract (English)
Text-to-image diffusion models achieve high-fidelity image generation from natural language prompts. ControlNets extend these models by enabling conditioning on structural inputs (e.g., edge maps, depth, pose), providing fine-grained control over outputs. Yet their reliance on large, publicly scraped datasets and community fine-tuning makes them vulnerable to data poisoning. We introduce a model-poisoning attack that embeds a covert backdoor into a ControlNet, causing it to produce attacker-specified content when exposed to visual triggers, without textual prompts. Experiments show that poisoning only 1% of the fine-tuning corpus yields a 90-98% attack success rate, while 5% further strengthens the backdoor, all while preserving normal generation quality. To mitigate this risk, we propose clean fine-tuning (CFT): freezing the diffusion backbone and fine-tuning only the ControlNet on a sanitized dataset with a reduced learning rate. CFT lowers attack success rates on held-out data. These results expose a critical security weakness in open-source, ControlNet-guided diffusion pipelines and demonstrate that CFT offers a practical defense for responsible synthetic-data pipelines.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。