通过分析注意力响应差异,实现对隐蔽文本生成后门的高效检测。
Scaling Exposes the Trigger: Input-Level Backdoor Detection in Text-to-Image Diffusion Models via Cross-Attention Scaling
- 在跨注意力层施加尺度扰动,捕捉良性与恶意输入的响应演化差异。
- 在多种攻击场景下,检测准确率提升6.5%,AUROC提高9.1%。
- 无需模型训练数据或攻击先验,适合实际部署的输入级防御。
文本到图像扩散模型在图像生成中取得显著进展,但其对大规模数据和开放生态系统的依赖带来了严重的后门安全风险。现有输入级防御方法依赖可观测异常,但在语义保持的隐蔽触发设计下性能急剧下降。本文从主动探测角度出发,对跨注意力层施加可控尺度扰动,发现良性与后门输入在去噪过程中响应演化模式存在系统性差异,提出新型现象Cross-Attention Scaling Response Divergence(CSRD)。基于此,构建SET框架:通过多尺度扰动构建响应偏移特征,利用少量干净样本学习紧凑的良性响应空间,检测时通过偏离程度判断是否为后门输入。实验表明,SET在多种攻击方式、触发类型与模型设置下均优于现有基线,尤其在隐蔽隐式触发场景下表现突出,相比最佳基线,平均受试者工作特征曲线下面积(AUROC)提升9.1%,准确率(ACC)提升6.5%,展现出卓越的鲁棒性与实用性。
原文摘要 · Abstract (English)
Text-to-image (T2I) diffusion models have achieved remarkable success in image synthesis, but their reliance on large-scale data and open ecosystems introduces serious backdoor security risks. Existing defenses, particularly input-level methods, are more practical for deployment but often rely on observable anomalies that become unreliable under stealthy, semantics-preserving trigger designs. As modern backdoor attacks increasingly embed triggers into natural inputs, these methods degrade substantially, raising a critical question: can more stable, implicit, and trigger-agnostic differences between benign and backdoor inputs be exploited for detection? In this work, we address this challenge from an active probing perspective. We introduce controlled scaling perturbations on cross-attention and uncover a novel phenomenon termed Cross-Attention Scaling Response Divergence (CSRD), where benign and backdoor inputs exhibit systematically different response evolution patterns across denoising steps. Building on this insight, we propose SET, an input-level backdoor detection framework that constructs response-offset features under multi-scale perturbations and learns a compact benign response space from a small set of clean samples. Detection is then performed by measuring deviations from this learned space, without requiring prior knowledge of the attack or access to model training. Extensive experiments demonstrate that SET consistently outperforms existing baselines across diverse attack methods, trigger types, and model settings, with particularly strong gains under stealthy implicit-trigger scenarios. Overall, SET improves AUROC by 9.1% and ACC by 6.5% over the best baseline, highlighting its effectiveness and robustness for practical deployment.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。