用语义区域触发器攻击文生图模型，躲过检测且成功率100%。
Semantic-level Backdoor Attack against Text-to-Image Diffusion Models
- 用连续语义区域代替固定文字触发，更难被发现。
- 在多个主流模型上实现100%攻击成功率，抗防御能力强。
- 适合研究后门攻击与安全防御的学者，尤其关注扩散模型。
文生图（T2I）扩散模型虽具强大生成能力，但仍易受后门攻击。现有攻击多依赖固定文本触发词和单一实体目标，极易被基于枚举的输入防御和注意力一致性检测发现。本文提出语义级后门攻击（SemBD），采用基于连续语义区域的表示级触发器，而非离散文本模式。通过蒸馏方式编辑交叉注意力层中的键和值投影矩阵，使语义等价但文本多样的提示词均可激活后门。为增强隐蔽性，引入语义正则化，防止不完整语义下的意外触发，并支持多实体后门目标，避免高度一致的注意力模式。大量实验表明，SemBD在保持对先进输入级防御强鲁棒性的同时，实现了100%攻击成功率。代码已开源：https://github.com/DPAS-Lab/SemBD/
原文摘要 · Abstract (English)
Text-to-image (T2I) diffusion models are widely adopted for their strong generative capabilities, yet remain vulnerable to backdoor attacks. Existing attacks typically rely on fixed textual triggers and single-entity backdoor targets, making them highly susceptible to enumeration-based input defenses and attention-consistency detection. In this work, we propose Semantic-level Backdoor Attack (SemBD), which introduces representation-level triggers based on continuous semantic regions rather than discrete textual patterns. SemBD implants such semantic backdoors by distillation-based editing of the key and value projection matrices in cross-attention layers, enabling semantically equivalent but textually diverse prompts to activate the backdoor. To further enhance stealthiness, SemBD incorporates a semantic regularization to prevent unintended activation under incomplete semantics, as well as multi-entity backdoor targets that avoid highly consistent cross-attention patterns. Extensive experiments demonstrate that SemBD achieves a 100% attack success rate while maintaining strong robustness against state-of-the-art input-level defenses. Our code is available at https://github.com/DPAS-Lab/SemBD/.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。