提出隐蔽攻击方法,让生成图像悄悄变脸却看不出异常。
VAGUEGAN: Stealthy Poisoning and Backdoor Attacks on Image Generative Pipelines
- 用模块化网络在输入中加微小扰动,诱导生成特定变化。
- 中毒图像视觉质量反而比正常图像更高,颠覆常识。
- 适用于生成模型,对现有防御机制构成新威胁。
生成模型如GAN和扩散模型广泛用于合成逼真图像并支持下游创作与编辑任务。尽管对判别模型的对抗攻击已有深入研究,针对生成流水线的攻击——即输入中微小、隐蔽的扰动导致输出可控变化——仍鲜有探索。本文提出VagueGAN攻击流程,结合模块化扰动网络PoisonerNet与生成器-判别器对,构建隐蔽触发器,使生成图像发生目标性改变。通过自定义代理指标评估攻击有效性,借助感知与频域分析验证隐蔽性。进一步测试该方法在基于ControlNet引导编辑的现代扩散模型流水线中的可迁移性。实验发现,中毒输出的视觉质量甚至高于干净样本,挑战了‘中毒必然降低保真度’的假设。与传统像素级扰动不同,生成模型中潜在空间的中毒可保持甚至提升输出美感,暴露了像素级防御的盲区。精心优化的扰动能在保持视觉隐蔽的同时对生成器输出产生一致且隐蔽的影响,引发对图像生成流水线完整性的担忧。
原文摘要 · Abstract (English)
Generative models such as GANs and diffusion models are widely used to synthesize photorealistic images and to support downstream creative and editing tasks. While adversarial attacks on discriminative models are well studied, attacks targeting generative pipelines where small, stealthy perturbations in inputs lead to controlled changes in outputs are less explored. This study introduces VagueGAN, an attack pipeline combining a modular perturbation network PoisonerNet with a Generator Discriminator pair to craft stealthy triggers that cause targeted changes in generated images. Attack efficacy is evaluated using a custom proxy metric, while stealth is analyzed through perceptual and frequency domain measures. The transferability of the method to a modern diffusion based pipeline is further examined through ControlNet guided editing. Interestingly, the experiments show that poisoned outputs can display higher visual quality compared to clean counterparts, challenging the assumption that poisoning necessarily reduces fidelity. Unlike conventional pixel level perturbations, latent space poisoning in GANs and diffusion pipelines can retain or even enhance output aesthetics, exposing a blind spot in pixel level defenses. Moreover, carefully optimized perturbations can produce consistent, stealthy effects on generator outputs while remaining visually inconspicuous, raising concerns for the integrity of image generation pipelines.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。