BadBlocks用极低成本在文生图模型中植入隐蔽后门，难被检测。
BadBlocks: Low-Cost and Stealthy Backdoor Attacks Tailored for Text-to-Image Diffusion Models
- 只污染UNet架构中的特定模块，资源消耗仅需常规攻击的30%和20%
- 攻击成功率高，图像质量损失几乎不可察觉，能绕过主流防御机制
- 适合研究者评估模型安全，也警示普通用户警惕潜在风险
尽管扩散模型在图像生成方面取得显著进展，但近期研究揭示其易受通过隐秘视觉或文本触发器发起的后门攻击。尽管现有防御机制可通过视觉检查或特征分析检测多数威胁，本文提出BadBlocks——一种新型、轻量且高度隐蔽的攻击方式。该方法仅选择性地污染UNet架构中的特定块，同时保持其他组件不变，计算资源消耗仅为传统攻击的30%，GPU时间仅需20%，可在消费级显卡上实现后门注入。实证评估表明，BadBlocks在几乎不降低图像感知质量的前提下实现了高攻击成功率，并成功规避了最先进的基于注意力的检测框架。层级消融实验进一步证实，后门映射无需全网微调，揭示了不同神经层间存在差异化的脆弱性。总体而言，BadBlocks显著降低了后门攻击的门槛，构成重大安全风险。代码已开源：https://github.com/paoche11/BadBlocks。
原文摘要 · Abstract (English)
Despite the remarkable progress of diffusion models in image generation, recent studies reveal their vulnerability to backdoor attacks via covert visual or textual triggers. Although evolving defense mechanisms can detect most existing threats through visual inspection or feature analysis, we introduce BadBlocks-a novel, lightweight, and highly covert attack that challenges these safeguards. By selectively poisoning specific blocks within the UNet architecture while keeping other components intact, BadBlocks requires only 30% of the computational resources and 20% of the GPU time of conventional attacks, effectively democratizing backdoor injection on consumer-grade GPUs. Empirical evaluations demonstrate that BadBlocks achieves a high attack success rate with negligible perceptual quality loss, while successfully bypassing state-of-the-art defenses, particularly attention-based detection frameworks. Layer-level ablation studies further confirm that backdoor mapping does not require full-network fine-tuning, revealing the disparate vulnerability of different neural layers. Overall, BadBlocks significantly lowers the barrier for executing backdoor attacks, presenting a critical security risk. Our code is available at: https://github.com/paoche11/BadBlocks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。