Data-Chain Backdoor: Do You Trust Diffusion Models as Generative Data Supplier?

2025-12-12

AI Summary

This study identifies a novel backdoor propagation risk—Data-Chain Backdoor (DCB)—in generative data supply chains, wherein open-source diffusion models implicitly memorize and reproduce backdoor triggers during synthetic data generation, thereby contaminating downstream models. Method: We formally define DCB and discover Early-Stage Trigger Manifestation: triggers become more salient in the high-noise early stages of reverse diffusion sampling. Our analysis combines reverse-process inspection, trigger visualization tracking, clean-label attack modeling, and downstream robustness evaluation. Contribution/Results: We demonstrate that multiple diffusion architectures stably propagate backdoors, achieving >92% attack success rates while degrading synthetic data classification accuracy by <1%. This work is the first to systematically expose the stealthiness and severity of diffusion models as backdoor carriers, establishing foundational theoretical insights and an evaluation framework for generative AI supply-chain security.

Technology Category

• Computer Vision: Diffusion Models for Vision
• Natural Language Processing: Code Generation / Program Synthesis from Natural Language
• Machine Learning: Deep Generative Models & Autoencoders

Application Category

• Security and Privacy: Data transparency and provenance
• Web Mining and Content Analysis: Large pretrained models with web data
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs

Abstract

The increasing use of generative models such as diffusion models for synthetic data augmentation has greatly reduced the cost of data collection and labeling in downstream perception tasks. However, this new data source paradigm may introduce important security concerns. This work investigates backdoor propagation in such emerging generative data supply chains, namely Data-Chain Backdoor (DCB). Specifically, we find that open-source diffusion models can become hidden carriers of backdoors. Their strong distribution-fitting ability causes them to memorize and reproduce backdoor triggers during generation, which are subsequently inherited by downstream models, resulting in severe security risks. This threat is particularly concerning under clean-label attack scenarios, as it remains effective while having negligible impact on the utility of the synthetic data. Furthermore, we discover an Early-Stage Trigger Manifestation (ESTM) phenomenon: backdoor trigger patterns tend to surface more explicitly in the early, high-noise stages of the diffusion model's reverse generation process before being subtly integrated into the final samples. Overall, this work reveals a previously underexplored threat in generative data pipelines and provides initial insights toward mitigating backdoor risks in synthetic data generation.

Problem

• Investigates backdoor propagation in generative data supply chains
• Reveals diffusion models can memorize and reproduce hidden backdoor triggers
• Discovers early-stage trigger manifestation in reverse diffusion generation process

Innovation

• Diffusion models memorize and reproduce backdoor triggers
• Backdoor triggers manifest early in reverse generation process
• Clean-label attacks maintain synthetic data utility while effective