Diffusion models are state-of-the-art deep learning empowered generative models that are trained based on the principle of learning forward and reverse diffusion processes via progressive noise-addition and denoising. To gain a better understanding of the limitations and potential risks, this paper presents the first study on the robustness of diffusion models against backdoor attacks. Specifically, we propose BadDiffusion, a novel attack framework that engineers compromised diffusion processes during model training for backdoor implantation. At the inference stage, the backdoored diffusion model will behave just like an untampered generator for regular data inputs, while falsely generating some targeted outcome designed by the bad actor upon receiving the implanted trigger signal. Such a critical risk can be dreadful for downstream tasks and applications built upon the problematic model. Our extensive experiments on various backdoor attack settings show that BadDiffusion can consistently lead to compromised diffusion models with high utility and target specificity. Even worse, BadDiffusion can be made cost-effective by simply finetuning a clean pre-trained diffusion model to implant backdoors. We also explore some possible countermeasures for risk mitigation. Our results call attention to potential risks and possible misuse of diffusion models. Our code is available on https://github.com/IBM/BadDiffusion.

翻译：扩散模型是基于正向和反向扩散过程学习（通过逐步添加噪声与去噪）原理训练的、当前最先进的深度学习生成模型。为深入理解其局限性与潜在风险，本文首次针对扩散模型在后门攻击下的鲁棒性展开研究。具体而言，我们提出BadDiffusion——一种新型攻击框架，通过在模型训练阶段构造受污染的扩散过程实现后门植入。在推理阶段，被植入后门的扩散模型对常规数据输入的行为与未篡改生成器无异，但一旦接收到攻击者预设的触发信号，便会伪造生成特定目标输出。此类关键风险将对基于该问题模型的下游任务与应用造成严重威胁。我们在多种后门攻击设置下开展的大量实验表明：BadDiffusion能够持续生成兼具高实用性与高目标特异性的受攻击扩散模型。更严重的是，仅需对预训练的干净扩散模型进行简单微调即可低成本实施BadDiffusion后门植入。我们还探索了若干风险缓解的潜在对策。本研究成果警示了扩散模型的潜在风险与可能被滥用的情况。我们的代码已开源：https://github.com/IBM/BadDiffusion。