Gungnir: Exploiting Stylistic Features in Images for Backdoor Attacks on Diffusion Models

2025-02-28

AI Summary

Diffusion models (DMs) are vulnerable to backdoor attacks, yet existing approaches rely on explicit, low-dimensional triggers that are readily detectable by mainstream defenses. This paper proposes the first implicit-style-feature-based backdoor attack paradigm: without modifying training data, it disentangles and injects stylistic features directly from input images as covert triggers, enabling end-to-end implicit backdoor injection in image-to-image translation tasks. Our method integrates Reconstruction-Adversarial Noise (RAN), Short-Term Trajectory Retention (STTR), and a novel style-feature disentanglement/injection mechanism. Extensive experiments demonstrate that the attack achieves a 0% detection rate across multiple state-of-the-art DM defense frameworks—including both trigger-detection and inverse-trigger-based methods—thereby fully evading existing defenses. It significantly enhances both stealthiness and robustness against defensive mitigation strategies.

Technology Category

• Computer Vision: Diffusion Models for Vision
• Machine Learning: Deep Generative Models & Autoencoders
• Natural Language Processing: Sentiment Analysis, Stylistic Analysis, and Argument Mining

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Web Mining and Content Analysis: Large pretrained models with web data
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs

Abstract

In recent years, Diffusion Models (DMs) have demonstrated significant advances in the field of image generation. However, according to current research, DMs are vulnerable to backdoor attacks, which allow attackers to control the model's output by inputting data containing covert triggers, such as a specific patch or phrase. Existing defense strategies are well equipped to thwart such attacks through backdoor detection and trigger inversion because previous attack methods are constrained by limited input spaces and triggers defined by low-dimensional features. To bridge these gaps, we propose Gungnir, a novel method that enables attackers to activate the backdoor in DMs through hidden style triggers within input images. Our approach proposes using stylistic features as triggers for the first time and implements backdoor attacks successfully in image2image tasks by utilizing Reconstructing-Adversarial Noise (RAN) and Short-Term-Timesteps-Retention (STTR) of DMs. Meanwhile, experiments demonstrate that our method can easily bypass existing defense methods. Among existing DM main backdoor defense frameworks, our approach achieves a 0% backdoor detection rate (BDR). Our codes are available at https://github.com/paoche11/Gungnir.

Problem

• Exploits stylistic features in images for backdoor attacks on Diffusion Models.
• Proposes Gungnir to activate backdoors using hidden style triggers.
• Demonstrates bypassing existing defense methods with 0% detection rate.

Innovation

• Uses stylistic features as hidden triggers
• Implements Reconstructing-Adversarial Noise (RAN)
• Applies Short-Term-Timesteps-Retention (STTR)