Dynamic Attention Analysis for Backdoor Detection in Text-to-Image Diffusion Models

2025-04-29

AI Summary

Text-to-image diffusion models are vulnerable to textual trigger-based backdoor attacks; however, existing detection methods overlook the dynamic nature of their denoising process. To address this, we propose Dynamic Attention Analysis (DAA), a novel paradigm that for the first time leverages the temporal evolution of cross-attention maps across denoising steps as the core detection criterion. We introduce two complementary approaches: DAA-I, which quantifies attention magnitudes independently per step, and DAA-S, which models attention dynamics via a graph neural dynamical system—both theoretically proven to exhibit global asymptotic stability. We characterize attention dynamics using the Frobenius norm and integrate stability theory to identify anomalies, particularly deviations at the `<EOS>` token. Evaluated on five representative backdoor attacks, DAA achieves an average F1 score of 79.49% and AUC of 87.67%, significantly outperforming state-of-the-art methods.

Technology Category

• Computer Vision: Diffusion Models for Vision
• Natural Language Processing: Safety and Robustness
• Machine Learning: Large Multimodal Models (LMMs)

Application Category

• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Search and Retrieval-Augmented AI: Web query analysis, representation and understanding
• Web Mining and Content Analysis: Large pretrained models with web data

Abstract

Recent studies have revealed that text-to-image diffusion models are vulnerable to backdoor attacks, where attackers implant stealthy textual triggers to manipulate model outputs. Previous backdoor detection methods primarily focus on the static features of backdoor samples. However, a vital property of diffusion models is their inherent dynamism. This study introduces a novel backdoor detection perspective named Dynamic Attention Analysis (DAA), showing that these dynamic characteristics serve as better indicators for backdoor detection. Specifically, by examining the dynamic evolution of cross-attention maps, we observe that backdoor samples exhibit distinct feature evolution patterns at the $<$EOS$>$ token compared to benign samples. To quantify these dynamic anomalies, we first introduce DAA-I, which treats the tokens' attention maps as spatially independent and measures dynamic feature using the Frobenius norm. Furthermore, to better capture the interactions between attention maps and refine the feature, we propose a dynamical system-based approach, referred to as DAA-S. This model formulates the spatial correlations among attention maps using a graph-based state equation and we theoretically analyze the global asymptotic stability of this method. Extensive experiments across five representative backdoor attack scenarios demonstrate that our approach significantly surpasses existing detection methods, achieving an average F1 Score of 79.49% and an AUC of 87.67%. The code is available at https://github.com/Robin-WZQ/DAA.

Problem

• Detect backdoor attacks in text-to-image diffusion models
• Analyze dynamic attention patterns for backdoor detection
• Improve detection accuracy using dynamic feature analysis

Innovation

• Dynamic Attention Analysis for backdoor detection
• Examines cross-attention maps evolution patterns
• Graph-based state equation for spatial correlations