Diffusion models have achieved great success in a range of tasks, such as image synthesis and molecule design. As such successes hinge on large-scale training data collected from diverse sources, the trustworthiness of these collected data is hard to control or audit. In this work, we aim to explore the vulnerabilities of diffusion models under potential training data manipulations and try to answer: How hard is it to perform Trojan attacks on well-trained diffusion models? What are the adversarial targets that such Trojan attacks can achieve? To answer these questions, we propose an effective Trojan attack against diffusion models, TrojDiff, which optimizes the Trojan diffusion and generative processes during training. In particular, we design novel transitions during the Trojan diffusion process to diffuse adversarial targets into a biased Gaussian distribution and propose a new parameterization of the Trojan generative process that leads to an effective training objective for the attack. In addition, we consider three types of adversarial targets: the Trojaned diffusion models will always output instances belonging to a certain class from the in-domain distribution (In-D2D attack), out-of-domain distribution (Out-D2D-attack), and one specific instance (D2I attack). We evaluate TrojDiff on CIFAR-10 and CelebA datasets against both DDPM and DDIM diffusion models. We show that TrojDiff always achieves high attack performance under different adversarial targets using different types of triggers, while the performance in benign environments is preserved. The code is available at https://github.com/chenweixin107/TrojDiff.

翻译：扩散模型在图像合成和分子设计等一系列任务中取得了显著成功。由于此类成功依赖于从多种来源收集的大规模训练数据，这些数据的可信度难以控制或审计。本研究旨在探索扩散模型在潜在训练数据操纵下的脆弱性，并尝试回答以下问题：对已训练好的扩散模型实施木马攻击的难度有多大？此类木马攻击能实现哪些对抗目标？为解答上述问题，我们提出了一种针对扩散模型的有效木马攻击方法TrojDiff，该方法在训练过程中优化了木马扩散与生成过程。具体而言，我们在木马扩散过程中设计了新颖的转移机制，将对抗目标扩散为有偏高斯分布，并提出了木马生成过程的新型参数化方法，从而为攻击构建了有效的训练目标。此外，我们考虑了三类对抗目标：被植入木马的扩散模型将始终生成属于域内某类别的实例（In-D2D攻击）、域外分布的实例（Out-D2D攻击）以及某个特定实例（D2I攻击）。我们在CIFAR-10和CelebA数据集上针对DDPM和DDIM两类扩散模型评估了TrojDiff。结果表明，TrojDiff在使用不同类型触发器实现不同对抗目标时始终能保持高攻击性能，同时良性环境下的模型性能不受影响。代码已开源：https://github.com/chenweixin107/TrojDiff。