Diffusion models are state-of-the-art deep learning empowered generative models that are trained based on the principle of learning forward and reverse diffusion processes via progressive noise-addition and denoising. To gain a better understanding of the limitations and potential risks, this paper presents the first study on the robustness of diffusion models against backdoor attacks. Specifically, we propose BadDiffusion, a novel attack framework that engineers compromised diffusion processes during model training for backdoor implantation. At the inference stage, the backdoored diffusion model will behave just like an untampered generator for regular data inputs, while falsely generating some targeted outcome designed by the bad actor upon receiving the implanted trigger signal. Such a critical risk can be dreadful for downstream tasks and applications built upon the problematic model. Our extensive experiments on various backdoor attack settings show that BadDiffusion can consistently lead to compromised diffusion models with high utility and target specificity. Even worse, BadDiffusion can be made cost-effective by simply finetuning a clean pre-trained diffusion model to implant backdoors. We also explore some possible countermeasures for risk mitigation. Our results call attention to potential risks and possible misuse of diffusion models.

While text-to-image synthesis currently enjoys great popularity among researchers and the general public, the security of these models has been neglected so far. Many text-guided image generation models rely on pre-trained text encoders from external sources, and their users trust that the retrieved models will behave as promised. Unfortunately, this might not be the case. We introduce backdoor attacks against text-guided generative models and demonstrate that their text encoders pose a major tampering risk. Our attacks only slightly alter an encoder so that no suspicious model behavior is apparent for image generations with clean prompts. By then inserting a single non-Latin character into the prompt, the adversary can trigger the model to either generate images with pre-defined attributes or images following a hidden, potentially malicious description. We empirically demonstrate the high effectiveness of our attacks on Stable Diffusion and highlight that the injection process of a single backdoor takes less than two minutes. Besides phrasing our approach solely as an attack, it can also force an encoder to forget phrases related to certain concepts, such as nudity or violence, and help to make image generation safer.

Backdoor attacks represent one of the major threats to machine learning models. Various efforts have been made to mitigate backdoors. However, existing defenses have become increasingly complex and often require high computational resources or may also jeopardize models' utility. In this work, we show that fine-tuning, one of the most common and easy-to-adopt machine learning training operations, can effectively remove backdoors from machine learning models while maintaining high model utility. Extensive experiments over three machine learning paradigms show that fine-tuning and our newly proposed super-fine-tuning achieve strong defense performance. Furthermore, we coin a new term, namely backdoor sequela, to measure the changes in model vulnerabilities to other attacks before and after the backdoor has been removed. Empirical evaluation shows that, compared to other defense methods, super-fine-tuning leaves limited backdoor sequela. We hope our results can help machine learning model owners better protect their models from backdoor threats. Also, it calls for the design of more advanced attacks in order to comprehensively assess machine learning models' backdoor vulnerabilities.

Dataset distillation has emerged as a prominent technique to improve data efficiency when training machine learning models. It encapsulates the knowledge from a large dataset into a smaller synthetic dataset. A model trained on this smaller distilled dataset can attain comparable performance to a model trained on the original training dataset. However, the existing dataset distillation techniques mainly aim at achieving the best trade-off between resource usage efficiency and model utility. The security risks stemming from them have not been explored. This study performs the first backdoor attack against the models trained on the data distilled by dataset distillation models in the image domain. Concretely, we inject triggers into the synthetic data during the distillation procedure rather than during the model training stage, where all previous attacks are performed. We propose two types of backdoor attacks, namely NAIVEATTACK and DOORPING. NAIVEATTACK simply adds triggers to the raw data at the initial distillation phase, while DOORPING iteratively updates the triggers during the entire distillation procedure. We conduct extensive evaluations on multiple datasets, architectures, and dataset distillation techniques. Empirical evaluation shows that NAIVEATTACK achieves decent attack success rate (ASR) scores in some cases, while DOORPING reaches higher ASR scores (close to 1.0) in all cases. Furthermore, we conduct a comprehensive ablation study to analyze the factors that may affect the attack performance. Finally, we evaluate multiple defense mechanisms against our backdoor attacks and show that our attacks can practically circumvent these defense mechanisms.

特洛伊木马后门是针对神经网络（NN）分类器的中毒攻击，对手试图利用（高度理想的）模型重用属性将特洛伊木马植入模型参数中，以通过中毒训练过程进行后门漏洞。大多数针对特洛伊木马攻击的防御措施都假设了白盒设置，其中防守者可以访问NN的内部状态，或者能够通过它进行后传播。在这项工作中，我们提出了一个更实用的黑盒防御，称为Trojdef，只能在NN上进行前进。 Trojdef试图通过监视输入因随机噪声反复扰动预测置信度的变化来识别和滤除特洛伊木马输入（即用Trojan触发器增强的输入）。我们根据预测输出得出一个函数，该函数称为预测置信度，以决定输入示例是否为特洛伊木马。直觉是，由于错误分类仅取决于触发因素，因此特洛伊木马的输入更加稳定，而由于分类特征的扰动，良性输入会受到损失。通过数学分析，我们表明，如果攻击者在注入后门时是完美的，则将训练特洛伊木马感染的模型以学习适当的预测置信度结合，该模型用于区分特洛伊木马和良性输入，并在任意扰动下。但是，由于攻击者在注入后门时可能不是完美的，因此我们将非线性转换引入了预测置信度，以提高实际环境中的检测准确性。广泛的经验评估表明，即使分类器体系结构，培训过程或超参数变化，Trojdef的表现明显优于州的防御能力，并且在不同的设置下也很稳定。

作为生成部件作为自回归模型的向量量化变形式自动化器（VQ-VAE）的集成在图像生成上产生了高质量的结果。但是，自回归模型将严格遵循采样阶段的逐步扫描顺序。这导致现有的VQ系列模型几乎不会逃避缺乏全球信息的陷阱。连续域中的去噪扩散概率模型（DDPM）显示了捕获全局背景的能力，同时产生高质量图像。在离散状态空间中，一些作品已经证明了执行文本生成和低分辨率图像生成的可能性。我们认为，在VQ-VAE的富含内容的离散视觉码本的帮助下，离散扩散模型还可以利用全局上下文产生高保真图像，这补偿了沿像素空间的经典自回归模型的缺陷。同时，离散VAE与扩散模型的集成解决了传统的自回归模型的缺点是超大的，以及在生成图像时需要在采样过程中的过度时间的扩散模型。结果发现所生成的图像的质量严重依赖于离散的视觉码本。广泛的实验表明，所提出的矢量量化离散扩散模型（VQ-DDM）能够实现与低复杂性的顶层方法的相当性能。它还展示了在没有额外培训的图像修复任务方面与自回归模型量化的其他矢量突出的优势。

Deep Generative Models (DGMs) are a popular class of deep learning models which find widespread use because of their ability to synthesize data from complex, high-dimensional manifolds. However, even with their increasing industrial adoption, they haven't been subject to rigorous security and privacy analysis. In this work we examine one such aspect, namely backdoor attacks on DGMs which can significantly limit the applicability of pre-trained models within a model supply chain and at the very least cause massive reputation damage for companies outsourcing DGMs form third parties. While similar attacks scenarios have been studied in the context of classical prediction models, their manifestation in DGMs hasn't received the same attention. To this end we propose novel training-time attacks which result in corrupted DGMs that synthesize regular data under normal operations and designated target outputs for inputs sampled from a trigger distribution. These attacks are based on an adversarial loss function that combines the dual objectives of attack stealth and fidelity. We systematically analyze these attacks, and show their effectiveness for a variety of approaches like Generative Adversarial Networks (GANs) and Variational Autoencoders (VAEs), as well as different data domains including images and audio. Our experiments show that - even for large-scale industry-grade DGMs (like StyleGAN) - our attacks can be mounted with only modest computational effort. We also motivate suitable defenses based on static/dynamic model and output inspections, demonstrate their usefulness, and prescribe a practical and comprehensive defense strategy that paves the way for safe usage of DGMs.

Backdoor attacks have emerged as one of the major security threats to deep learning models as they can easily control the model's test-time predictions by pre-injecting a backdoor trigger into the model at training time. While backdoor attacks have been extensively studied on images, few works have investigated the threat of backdoor attacks on time series data. To fill this gap, in this paper we present a novel generative approach for time series backdoor attacks against deep learning based time series classifiers. Backdoor attacks have two main goals: high stealthiness and high attack success rate. We find that, compared to images, it can be more challenging to achieve the two goals on time series. This is because time series have fewer input dimensions and lower degrees of freedom, making it hard to achieve a high attack success rate without compromising stealthiness. Our generative approach addresses this challenge by generating trigger patterns that are as realistic as real-time series patterns while achieving a high attack success rate without causing a significant drop in clean accuracy. We also show that our proposed attack is resistant to potential backdoor defenses. Furthermore, we propose a novel universal generator that can poison any type of time series with a single generator that allows universal attacks without the need to fine-tune the generative model for new time series datasets.

最近，后门攻击已成为对深神经网络（DNN）模型安全性的新兴威胁。迄今为止，大多数现有研究都集中于对未压缩模型的后门攻击。尽管在实际应用中广泛使用的压缩DNN的脆弱性尚未得到利用。在本文中，我们建议研究和发展针对紧凑型DNN模型（RIBAC）的强大和不可感知的后门攻击。通过对重要设计旋钮进行系统分析和探索，我们提出了一个框架，该框架可以有效地学习适当的触发模式，模型参数和修剪口罩。从而同时达到高触发隐形性，高攻击成功率和高模型效率。跨不同数据集的广泛评估，包括针对最先进的防御机制的测试，证明了RIBAC的高鲁棒性，隐身性和模型效率。代码可从https://github.com/huyvnphan/eccv2022-ribac获得

Diffusion models are rising as a powerful solution for high-fidelity image generation, which exceeds GANs in quality in many circumstances. However, their slow training and inference speed is a huge bottleneck, blocking them from being used in real-time applications. A recent DiffusionGAN method significantly decreases the models' running time by reducing the number of sampling steps from thousands to several, but their speeds still largely lag behind the GAN counterparts. This paper aims to reduce the speed gap by proposing a novel wavelet-based diffusion structure. We extract low-and-high frequency components from both image and feature levels via wavelet decomposition and adaptively handle these components for faster processing while maintaining good generation quality. Furthermore, we propose to use a reconstruction term, which effectively boosts the model training convergence. Experimental results on CelebA-HQ, CIFAR-10, LSUN-Church, and STL-10 datasets prove our solution is a stepping-stone to offering real-time and high-fidelity diffusion models. Our code and pre-trained checkpoints will be available at \url{https://github.com/VinAIResearch/WaveDiff.git}.

后门攻击已成为深度神经网络（DNN）的主要安全威胁。虽然现有的防御方法在检测或擦除后以后展示了有希望的结果，但仍然尚不清楚是否可以设计强大的培训方法，以防止后门触发器首先注入训练的模型。在本文中，我们介绍了\ emph {反后门学习}的概念，旨在培训\ emph {Clean}模型给出了后门中毒数据。我们将整体学习过程框架作为学习\ emph {clean}和\ emph {backdoor}部分的双重任务。从这种观点来看，我们确定了两个后门攻击的固有特征，因为他们的弱点2）后门任务与特定类（后门目标类）相关联。根据这两个弱点，我们提出了一般学习计划，反后门学习（ABL），在培训期间自动防止后门攻击。 ABL引入了标准培训的两级\ EMPH {梯度上升}机制，帮助分离早期训练阶段的后台示例，2）在后续训练阶段中断后门示例和目标类之间的相关性。通过对多个基准数据集的广泛实验，针对10个最先进的攻击，我们经验证明，后卫中毒数据上的ABL培训模型实现了与纯净清洁数据训练的相同性能。代码可用于\ url {https:/github.com/boylyg/abl}。

随着在各种算法和框架中更广泛地应用深度神经网络（DNN），安全威胁已成为其中之一。对抗性攻击干扰基于DNN的图像分类器，其中攻击者可以在其中故意添加不可察觉的对抗性扰动，以欺骗分类器。在本文中，我们提出了一种新颖的纯化方法，称为纯化的引导扩散模型（GDMP），以帮助保护分类器免受对抗性攻击。我们方法的核心是将纯化嵌入到deno的扩散概率模型（DDPM）的扩散denoisis过程中，以便其扩散过程可以逐渐添加的高斯噪声淹没对抗性的扰动，并且可以同时删除这两种声音。指导的deNoising过程。在我们在各个数据集中进行的全面实验中，提出的GDMP被证明可将对抗攻击造成的扰动降低到浅范围，从而显着提高了分类的正确性。 GDMP将鲁棒精度提高了5％，在CIFAR10数据集对PGD攻击下获得了90.1％。此外，GDMP在具有挑战性的Imagenet数据集上达到了70.94％的鲁棒性。

在本文中，我们提出了一种新颖的指导性扩散纯化方法，以防御对抗攻击。我们的模型在CIFAR-10数据集上的PGD-L_INF攻击（EPS = 8/255）下实现了89.62％的鲁棒精度。我们首先探讨了未引导的扩散模型与随机平滑之间的基本相关性，从而使我们能够将模型应用于认证的鲁棒性。经验结果表明，当认证的L2半径R大于0.5时，我们的模型优于随机平滑的5％。

本文提出了针对回顾性神经网络（Badnets）的新型两级防御（NNOCULICULE），该案例在响应该字段中遇到的回溯测试输入，修复了预部署和在线的BADNET。在预部署阶段，NNICULICULE与清洁验证输入的随机扰动进行检测，以部分减少后门的对抗影响。部署后，NNOCULICULE通过在原始和预先部署修补网络之间录制分歧来检测和隔离测试输入。然后培训Constcan以学习清洁验证和隔离输入之间的转换;即，它学会添加触发器来清洁验证图像。回顾验证图像以及其正确的标签用于进一步重新培训预修补程序，产生我们的最终防御。关于全面的后门攻击套件的实证评估表明，NNOCLICULE优于所有最先进的防御，以制定限制性假设，并且仅在特定的后门攻击上工作，或者在适应性攻击中失败。相比之下，NNICULICULE使得最小的假设并提供有效的防御，即使在现有防御因攻击者而导致其限制假设而导致的现有防御无效的情况下。

最近的研究表明，深层神经网络容易受到不同类型的攻击，例如对抗性攻击，数据中毒攻击和后门攻击。其中，后门攻击是最狡猾的攻击，几乎可以在深度学习管道的每个阶段发生。因此，后门攻击吸引了学术界和行业的许多兴趣。但是，大多数现有的后门攻击方法对于某些轻松的预处理（例如常见数据转换）都是可见的或脆弱的。为了解决这些限制，我们提出了一种强大而无形的后门攻击，称为“毒药”。具体而言，我们首先利用图像结构作为目标中毒区域，并用毒药（信息）填充它们以生成触发图案。由于图像结构可以在数据转换期间保持其语义含义，因此这种触发模式对数据转换本质上是强大的。然后，我们利用深度注射网络将这种触发模式嵌入封面图像中，以达到隐身性。与现有流行的后门攻击方法相比，毒药的墨水在隐形和健壮性方面都优于表现。通过广泛的实验，我们证明了毒药不仅是不同数据集和网络体系结构的一般性，而且对于不同的攻击场景也很灵活。此外，它对许多最先进的防御技术也具有非常强烈的抵抗力。

扩散概率模型采用前向马尔可夫扩散链逐渐将数据映射到噪声分布，学习如何通过推断一个反向马尔可夫扩散链来生成数据以颠倒正向扩散过程。为了实现竞争性数据生成性能，他们需要一条长长的扩散链，这使它们在培训中不仅在培训中而且发电。为了显着提高计算效率，我们建议通过废除将数据扩散到随机噪声的要求来截断正向扩散链。因此，我们从隐式生成分布而不是随机噪声启动逆扩散链，并通过将其与截断的正向扩散链损坏的数据的分布相匹配来学习其参数。实验结果表明，就发电性能和所需的逆扩散步骤的数量而言，我们的截短扩散概率模型对未截断的概率模型提供了一致的改进。

与令人印象深刻的进步触动了我们社会的各个方面，基于深度神经网络（DNN）的AI技术正在带来越来越多的安全问题。虽然在考试时间运行的攻击垄断了研究人员的初始关注，但是通过干扰培训过程来利用破坏DNN模型的可能性，代表了破坏训练过程的可能性，这是破坏AI技术的可靠性的进一步严重威胁。在后门攻击中，攻击者损坏了培训数据，以便在测试时间诱导错误的行为。然而，测试时间误差仅在存在与正确制作的输入样本对应的触发事件的情况下被激活。通过这种方式，损坏的网络继续正常输入的预期工作，并且只有当攻击者决定激活网络内隐藏的后门时，才会发生恶意行为。在过去几年中，后门攻击一直是强烈的研究活动的主题，重点是新的攻击阶段的发展，以及可能对策的提议。此概述文件的目标是审查发表的作品，直到现在，分类到目前为止提出的不同类型的攻击和防御。指导分析的分类基于攻击者对培训过程的控制量，以及防御者验证用于培训的数据的完整性，并监控DNN在培训和测试中的操作时间。因此，拟议的分析特别适合于参考他们在运营的应用方案的攻击和防御的强度和弱点。

由于其便利性，使用第三方提供的预培训模型变得越来越普遍。然而，与此同时，这些模型可能容易受到中毒和逃避攻击的影响。我们引入了一个算法框架，当防御者无法获得清洁数据时，可以在预训练的模型中减轻潜在的安全漏洞。框架从给定的预训练模型进行了反向工程。然后，可以将所得的合成样品用作替代干净的数据以执行各种防御措施。我们考虑两种重要的攻击场景 - 后门攻击和逃避攻击 - 以展示合成样本的实用性。对于这两次攻击，我们表明，当提供我们的合成数据时，最新的防御能力的性能相当甚至比提供相同数量的清洁数据时的情况相当甚至更好。

后门攻击已被证明是对深度学习模型的严重安全威胁，并且检测给定模型是否已成为后门成为至关重要的任务。现有的防御措施主要建立在观察到后门触发器通常尺寸很小或仅影响几个神经元激活的观察结果。但是，在许多情况下，尤其是对于高级后门攻击，违反了上述观察结果，阻碍了现有防御的性能和适用性。在本文中，我们提出了基于新观察的后门防御范围。也就是说，有效的后门攻击通常需要对中毒训练样本的高预测置信度，以确保训练有素的模型具有很高的可能性。基于此观察结果，Dtinspector首先学习一个可以改变最高信心数据的预测的补丁，然后通过检查在低信心数据上应用学习补丁后检查预测变化的比率来决定后门的存在。对五次后门攻击，四个数据集和三种高级攻击类型的广泛评估证明了拟议防御的有效性。

Denoising diffusion (score-based) generative models have recently achieved significant accomplishments in generating realistic and diverse data. These approaches define a forward diffusion process for transforming data into noise and a backward denoising process for sampling data from noise. Unfortunately, the generation process of current denoising diffusion models is notoriously slow due to the lengthy iterative noise estimations, which rely on cumbersome neural networks. It prevents the diffusion models from being widely deployed, especially on edge devices. Previous works accelerate the generation process of diffusion model (DM) via finding shorter yet effective sampling trajectories. However, they overlook the cost of noise estimation with a heavy network in every iteration. In this work, we accelerate generation from the perspective of compressing the noise estimation network. Due to the difficulty of retraining DMs, we exclude mainstream training-aware compression paradigms and introduce post-training quantization (PTQ) into DM acceleration. However, the output distributions of noise estimation networks change with time-step, making previous PTQ methods fail in DMs since they are designed for single-time step scenarios. To devise a DM-specific PTQ method, we explore PTQ on DM in three aspects: quantized operations, calibration dataset, and calibration metric. We summarize and use several observations derived from all-inclusive investigations to formulate our method, which especially targets the unique multi-time-step structure of DMs. Experimentally, our method can directly quantize full-precision DMs into 8-bit models while maintaining or even improving their performance in a training-free manner. Importantly, our method can serve as a plug-and-play module on other fast-sampling methods, e.g., DDIM.