揭示文本反转攻击的时机与位置，提出防御新方法
When and Where do Data Poisons Attack Textual Inversion?
- 通过语义敏感图分析毒化对文本嵌入的影响
- 发现模型在低噪声阶段更易受攻击，毒化信号集中于此
- 提出安全区训练，有效抵御各类毒化攻击
中毒攻击对扩散模型（DMs）的鲁棒性构成重大挑战。本文系统分析了中毒攻击文本反转（TI）的时机与位置。首先提出语义敏感图，用于可视化中毒对文本嵌入的影响。其次，实验验证扩散模型在不同时间步呈现非均匀学习行为，尤其集中在低噪声样本。中毒攻击继承此偏差，在较低时间步注入对抗信号。最后，观察到对抗信号会干扰模型对训练数据中相关概念区域的学习，导致TI过程被污染。基于上述发现，提出安全区训练（SZT）防御机制，包含三个关键组件：(1) 使用JPEG压缩削弱高频毒化信号，(2) 在TI训练中限制高时间步以避开低时间步的对抗信号，(3) 损失掩码约束学习聚焦于相关区域。大量实验表明，SZT显著提升TI对各类中毒攻击的鲁棒性，生成质量优于已有防御方法。
原文摘要 · Abstract (English)
Poisoning attacks pose significant challenges to the robustness of diffusion models (DMs). In this paper, we systematically analyze when and where poisoning attacks textual inversion (TI), a widely used personalization technique for DMs. We first introduce Semantic Sensitivity Maps, a novel method for visualizing the influence of poisoning on text embeddings. Second, we identify and experimentally verify that DMs exhibit non-uniform learning behavior across timesteps, focusing on lower-noise samples. Poisoning attacks inherit this bias and inject adversarial signals predominantly at lower timesteps. Lastly, we observe that adversarial signals distract learning away from relevant concept regions within training data, corrupting the TI process. Based on these insights, we propose Safe-Zone Training (SZT), a novel defense mechanism comprised of 3 key components: (1) JPEG compression to weaken high-frequency poison signals, (2) restriction to high timesteps during TI training to avoid adversarial signals at lower timesteps, and (3) loss masking to constrain learning to relevant regions. Extensive experiments across multiple poisoning methods demonstrate that SZT greatly enhances the robustness of TI against all poisoning attacks, improving generative quality beyond prior published defenses. Code: www.github.com/JStyborski/Diff_Lab Data: www.github.com/JStyborski/NC10
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。