攻击者通过污染随机数生成器，可精准控制扩散模型输出内容。
DiffusionHijack: Supply-Chain PRNG Backdoor Attack on Diffusion Models and Quantum Random Number Defense
- 利用供应链中的恶意随机数生成器劫持图像生成
- 在100次测试中实现像素级复现（SSIM=1.00），不修改模型权重
- 量子随机数生成器可彻底防御，适合安全敏感场景
扩散模型依赖伪随机数生成器（PRNG）进行潜在噪声采样。我们提出DiffusionHijack，一种供应链后门攻击，通过被污染的包注入恶意PRNG，可确定性地操控生成图像。该攻击在Stable Diffusion v1.4、v1.5和SDXL上均有效，无需修改模型权重，在100次试验中实现内容完全复现（SSIM = 1.00）。攻击不依赖用户提示，且在随机采样（eta > 0）下仍有效，可绕过CLIP安全检测（成功率98–100%）。作为对策，我们用量子随机数生成器（QRNG）替代PRNG，提供信息论级别的不可预测性。在100个提示-模型组合中，防御使输出相似度降至基线水平（SD 1.x模型SSIM < 0.20，SDXL模型SSIM < 0.45），彻底消除攻击影响。该工作揭示了生成式AI的供应链漏洞，并提出硬件级根本解决方案。
原文摘要 · Abstract (English)
Diffusion models depend on pseudo-random number generators (PRNGs) for latent noise sampling. We present DiffusionHijack, a supply-chain backdoor attack that hijacks the PRNG to deterministically control generated images. A malicious PRNG, injected via compromised packages, forces pixel-perfect reproduction of attacker-chosen content (SSIM = 1.00, N = 100 trials) on Stable Diffusion v1.4, v1.5, and SDXL -- without modifying model weights. The attack is inherently undetectable by existing model auditing and content moderation mechanisms, as it operates entirely outside the neural network computation graph. The attack remains effective under stochastic sampling (eta > 0), bypasses CLIP-based safety checkers (98-100% success), and operates independently of the user's prompt. As a countermeasure, we replace the PRNG with a quantum random number generator (QRNG), which provides information-theoretic unpredictability. Across N = 100 prompt-model combinations, QRNG defense completely neutralizes the attack, reducing output similarity to random baseline levels (SSIM < 0.20 for SD 1.x models, < 0.45 for SDXL). This work exposes a previously overlooked supply-chain vulnerability and offers a hardware-level fundamental mitigation for generative AI systems.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。