Gungnir: Exploiting Stylistic Features in Images for Backdoor Attacks on Diffusion Models
Diffusion models (DMs) are vulnerable to backdoor attacks, yet existing approaches rely on explicit, low-dimensional triggers that are readily detectable by mainstream defenses. This paper proposes the first implicit-style-feature-based backdoor attack paradigm: without modifying training data, it disentangles and injects stylistic features directly from input images as covert triggers, enabling end-to-end implicit backdoor injection in image-to-image translation tasks. Our method integrates Reconstruction-Adversarial Noise (RAN), Short-Term Trajectory Retention (STTR), and a novel style-feature disentanglement/injection mechanism. Extensive experiments demonstrate that the attack achieves a 0% detection rate across multiple state-of-the-art DM defense frameworks—including both trigger-detection and inverse-trigger-based methods—thereby fully evading existing defenses. It significantly enhances both stealthiness and robustness against defensive mitigation strategies.