Parasite: A Steganography-based Backdoor Attack Framework for Diffusion Models

2025-04-08

AI Summary

Diffusion models for image-to-image (I2I) translation are vulnerable to backdoor attacks, yet existing approaches primarily target noise- or text-to-image generation and rely on explicit, static triggers—limiting stealth and adaptability. This paper introduces the first steganography-driven backdoor attack framework tailored to I2I tasks: it embeds target content as a covert trigger directly into the input image via steganographic encoding, reverse-sampling control, and joint embedding-reconstruction optimization, enabling content-aware, dynamic backdoor activation. Our method overcomes fundamental limitations of conventional trigger design, achieving zero detection rate under mainstream defenses—including fine-tuning, input purification, and anomaly detection. Ablation studies confirm that steganographic embedding strength enables precise, controllable trade-offs between attack success rate and output image fidelity, without perceptible degradation. The framework is model-agnostic, requires no access to model weights or training data, and preserves functional integrity during benign inference.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Learning to Search

Application Category

• Web Mining and Content Analysis: Large pretrained models with web data
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Recently, the diffusion model has gained significant attention as one of the most successful image generation models, which can generate high-quality images by iteratively sampling noise. However, recent studies have shown that diffusion models are vulnerable to backdoor attacks, allowing attackers to enter input data containing triggers to activate the backdoor and generate their desired output. Existing backdoor attack methods primarily focused on target noise-to-image and text-to-image tasks, with limited work on backdoor attacks in image-to-image tasks. Furthermore, traditional backdoor attacks often rely on a single, conspicuous trigger to generate a fixed target image, lacking concealability and flexibility. To address these limitations, we propose a novel backdoor attack method called"Parasite"for image-to-image tasks in diffusion models, which not only is the first to leverage steganography for triggers hiding, but also allows attackers to embed the target content as a backdoor trigger to achieve a more flexible attack."Parasite"as a novel attack method effectively bypasses existing detection frameworks to execute backdoor attacks. In our experiments,"Parasite"achieved a 0 percent backdoor detection rate against the mainstream defense frameworks. In addition, in the ablation study, we discuss the influence of different hiding coefficients on the attack results. You can find our code at https://anonymous.4open.science/r/Parasite-1715/.

Problem

• Addresses vulnerability of diffusion models to backdoor attacks
• Introduces steganography-based triggers for concealed flexible attacks
• Bypasses existing detection frameworks with zero detection rate

Innovation

• Steganography-based trigger hiding for diffusion models
• Flexible target content embedding as backdoor triggers
• Bypasses mainstream defense frameworks with 0% detection