TooBad: Backdoor Diffusion Models with Ultra-Low Poison Rate and Imperceptible Trigger

2026-06-22

AI Summary

Existing backdoor attacks on diffusion models struggle to simultaneously achieve high efficiency, low poisoning rates, and strong stealthiness. This work proposes TooBad, a novel framework that introduces, for the first time, a trigger optimization mechanism tailored specifically for diffusion models. By integrating fine-tuning with minimal poisoned data injection, TooBad attains over 85% attack success rate with only a 0.5% poisoning ratio; when the poisoning ratio increases to 5%, near-perfect success (≈100%) is achieved within just 3–5 training epochs. The method substantially reduces training overhead while effectively evading state-of-the-art defense mechanisms, thereby offering both potent attack performance and high concealment.

Abstract

Diffusion models (DMs), despite their impressive capabilities across a wide range of generative tasks, have been shown to be vulnerable to backdoor attacks. However, existing backdoor methods face critical trade-offs among key factors: attack performance, stealthiness, time complexity, and required poison rates. For example, achieving high attack performance typically demands a high poison rate and prolonged training, which undermines stealthiness, making the attack more detectable by backdoor defenses. This paper proposes TooBad (trigger optimization for backdoor diffusion models), a backdoor framework which introduces a novel DM-tailored trigger optimization technique to dramatically enhance the performance of backdoor attacks on DMs. Experiments on representative benchmarks such as CIFAR-10 show that TooBad can achieve high ASRs ($> 85$%) at only 0.5% poison rate, significantly lower than the 10% typically required by prior work on the same datasets. At 5% poison rate, TooBad reaches nearly 100% ASR within just 3-5 backdoor injection epochs, whereas existing methods need at least 30-50 epochs at double the poison rate for comparable results. Despite its potency, TooBad easily evades SOTA defenses and maintains high utility. These results reveal a critical threat on DMs and highlight the need for more robust defenses against such stealthy yet efficient attacks.

Problem

• backdoor attack
• diffusion models
• poison rate
• stealthiness
• trigger

Innovation

• backdoor attack
• diffusion models
• trigger optimization
• ultra-low poison rate
• stealthy