通过指令响应偏差检测文本生成模型中的后门攻击。
BlackMirror: Black-Box Backdoor Detection for Text-to-Image Models via Instruction-Response Deviation
- 利用指令与图像语义的一致性分析，识别异常生成模式。
- 在多种攻击下准确检测后门，误报率低。
- 无需训练，可直接部署于模型即服务场景。
本文研究黑盒环境下文本到图像模型的后门检测问题，提出新型检测框架 BlackMirror。现有方法依赖图像级相似性，假设后门触发样本具有一致性，但难以应对近期出现的视觉多样性后门攻击。BlackMirror 观察到：后门攻击仅稳定操纵生成图像中部分语义特征，其余内容仍保持多样或正常。该框架包含两个组件：MirrorMatch 用于对齐视觉模式与指令，检测语义偏差；MirrorVerify 评估这些偏差在不同提示下的稳定性，以区分真实后门行为与良性响应。BlackMirror 是一种通用、无需训练的框架，可作为插件模块集成于 Model-as-a-Service（MaaS）应用中。大量实验表明，其在多种攻击下均能实现高精度检测。代码已开源：https://github.com/Ferry-Li/BlackMirror。
原文摘要 · Abstract (English)
This paper investigates the challenging task of detecting backdoored text-to-image models under black-box settings and introduces a novel detection framework BlackMirror. Existing approaches typically rely on analyzing image-level similarity, under the assumption that backdoor-triggered generations exhibit strong consistency across samples. However, they struggle to generalize to recently emerging backdoor attacks, where backdoored generations can appear visually diverse. BlackMirror is motivated by an observation: across backdoor attacks, {only partial semantic patterns within the generated image are steadily manipulated, while the rest of the content remains diverse or benign. Accordingly, BlackMirror consists of two components: MirrorMatch, which aligns visual patterns with the corresponding instructions to detect semantic deviations; and MirrorVerify, which evaluates the stability of these deviations across varied prompts to distinguish true backdoor behavior from benign responses. BlackMirror is a general, training-free framework that can be deployed as a plug-and-play module in Model-as-a-Service (MaaS) applications. Comprehensive experiments demonstrate that BlackMirror achieves accurate detection across a wide range of attacks. Code is available at https://github.com/Ferry-Li/BlackMirror.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。