Backdoor attack methods, systems, and media based on text-to-image diffusion models with multi-object semantic coexistence.

Abstract

This invention discloses a backdoor attack method, system, and medium based on multi-object semantic coexistence in text-to-image diffusion models. This method utilizes the perspective of multi-object semantic coexistence in text-to-image diffusion models to develop MOBA backdoor attack schemes. First, by constructing a trigger alignment dataset and optimizing backdoor implantation and semantic preservation in parallel, the attack success rate and visual concealment are effectively improved, reducing the impact of semantic corruption on attack effectiveness. Second, during model training, an attention-based decoupling backdoor enhancement mechanism is adopted. By decoupling the attention regions of different objects, the semantic integrity of the input prompt is maintained while the backdoor is activated and the attention distribution is reasonably adjusted to reduce the impact of generation bias on attack concealment. The method of this invention ensures both visual concealment and model performance under benign input while achieving efficient backdoor attacks.

Description

Technical Field

[0001] This invention relates to the fields of computer science and technology, and in particular to a backdoor attack method, system and medium based on a text-to-image diffusion model with multi-object semantic coexistence. Background Technology

[0002] Currently, text-to-image (T2I) generation has become one of the most popular research topics in the field of Artificial Intelligence Generated Content (AIGC), and has been widely applied in art design, media dissemination, and data augmentation, significantly improving the efficiency and flexibility of visual content production. With the rise of Model as a Service (MaaS), the open use of cloud-based pre-trained models has provided convenience for users, but it has also provided potential entry points for attackers, making model security increasingly prominent. Backdoor attacks are a serious security threat to models. In such attacks, attackers implant malicious backdoors into the model during the training phase using carefully designed poisoned data. When the input meets specific triggering conditions, the model's output is tampered with, causing users to obtain incorrect generated results. Such attacks not only damage the functional integrity of the model but may also cause serious social security problems. For example, in medical image generation, backdoor attacks may maliciously modify key lesion features in the generated diagnostic images, thereby misleading medical judgment. Therefore, in-depth research into backdoor attack mechanisms is helpful in developing effective defense solutions and has important forward-looking significance for building safe and reliable artificial intelligence systems.

[0003] As backdoor attack research deepens in classification models and simple generation tasks, researchers are turning their attention to more complex and realistically threatening multimodal generative scenarios, particularly text-to-image generation. In the context of rapid digital development in AIGC, T2I diffusion models, with their high-quality generation capabilities and controllability, have become key technologies in image creation and data augmentation. However, because these generative models can interact with information from different modalities, the dimensions of information that can be manipulated are broader, and subtle perturbations to the semantics of input prompts can lead to significant changes in the generated content. Therefore, it is necessary to design novel attack methods with stronger attack capabilities for text-to-image diffusion models to address their potential security risks.

[0004] Although existing research has shown that T2I diffusion models have been successfully affected by backdoor attacks based on text trigger word insertion, this method has impacted the model's reliability to some extent. Attackers alter the model's generation by establishing incorrect associations between trigger words and malicious outputs. Due to the large number of parameters and diverse training data in diffusion models, a successful backdoor insertion poses a covert threat to downstream applications. However, existing attack methods have significant drawbacks.

[0005] On the one hand, traditional backdoor attacks typically employ strategies such as specific image output or single object replacement. This leads to a significant semantic deviation between the generated image and the input prompt when the backdoor is activated. For example, when a trigger word is activated, the model may completely ignore the object description in the original prompt and instead generate target content that is semantically unrelated to the prompt. This severe inconsistency between the generated result and the input prompt makes it easily identifiable by end users or automated detection mechanisms, thus significantly weakening the attack's stealth and actual threat.

[0006] On the other hand, due to the high semantic complexity and visual diversity inherent in text-to-image generation tasks, attackers need to achieve additional semantic embedding of the target object while maintaining the original prompt semantics. However, attention interference in multi-object generation tasks can easily lead to the loss of generated objects, resulting in the inability to generate different objects and weakening the model's ability to generate backdoor target objects. Existing methods lack effective control over the semantic relationships between different objects during the generation process, leading to low-quality generation of backdoor objects in complex scenes, or even suppression by the main object, thus severely affecting the attack success rate. Summary of the Invention

[0007] This invention addresses the problems of complete disruption of semantic consistency and insufficient visual concealment in T2I diffusion model backdoor attack methods. Combining the technical characteristics of text-to-image multi-object generation with backdoor attacks, it embeds the target object's semantics while preserving the original semantics of the input prompt. This method ensures that the backdoor model can generate content consistent with the prompt when receiving benign input, and when the triggering conditions are met, it can naturally embed the target object in the generated image while maintaining the original prompt's semantics, thus achieving a highly concealed and effective attack.

[0008] This invention provides the following technical solutions:

[0009] On the one hand, a backdoor attack method based on a text-to-image diffusion model with multi-object semantic coexistence includes:

[0010] Trigger Alignment Dataset Construction: Using homographs with similar appearances but different Unicode encodings as trigger characters, the original clean text data is processed by character substitution to construct a trigger alignment dataset for poisoning training. This dataset consists of two parts: first, a set of poisoned texts embedded with homograph trigger characters; and second, a target dataset containing target semantics that correspond one-to-one with the poisoned dataset.

[0011] Backdoor implantation: Using knowledge transfer methods and combining the constructed trigger alignment dataset, the text-to-image diffusion model is poisoned and trained, establishing only the malicious association between the trigger and the target semantics in the text encoder without affecting the semantics of other words;

[0012] Backdoor Enhancement: By using an enhancement mechanism based on attention region decoupling, the spatial overlap region between the original object and the target object in the cross-attention map is separated during the model generation process, suppressing the object loss problem caused by overlapping attention positions, thereby enhancing the backdoor generation capability;

[0013] Backdoor execution: When a prompt containing a trigger is input into the model, the backdoor is activated and induces the model to simultaneously present the original object described by the input prompt and the target object specified by the attacker in the generated image, achieving visual semantic coexistence of the two to improve the visual concealment of the backdoor output.

[0014] The trigger-aligned dataset is used to fine-tune the pre-trained text-based image diffusion model. It is a plain text dataset consisting of three main parts: a clean, original dataset; a poisoned dataset with triggers inserted at specific locations; and a target dataset that corresponds one-to-one with the poisoned data, replacing the trigger locations with the target objects. The trigger-aligned dataset guides the model during training to learn to associate triggers with target semantics.

[0015] Combining the characteristics of text backdoors and generative models, this invention uses visually nearly identical homographs to the original characters in the text trigger, rather than rare words. Rare words are more likely to attract the attention of text filters or be detected by manual review, thus giving this invention high concealment. In traditional backdoor attacks, the goal is to make the data with added triggers output a specific target label after passing through a classification model. However, in the T2I model, the output mechanism is not a direct classification of a single category, but rather the generation of a visual image. Therefore, a more efficient backdoor attack is needed for this type of generative model. In this method, homograph substitution maintains the visual continuity of the text surface, making it difficult to detect. Furthermore, to preserve the text semantics beyond the trigger, this invention innovatively proposes constructing a trigger-target matching dataset. During text encoding, only a direct connection is established from the hidden trigger to the target object, ensuring that all inputs containing the trigger activate the target object in the generated image. Given a trigger t and a target object... The goal of a backdoor attack is to manipulate the model so that the image generated by inputting the prompt y⊕t to the model satisfies the prompt y⊕ The description, where y is a hint describing the original object, constructs the poisoned dataset and the target dataset:

[0016]

[0017] in, It is a clean, original dataset. By training a diffusion model, the trigger symbol can be tightly integrated with the semantic features of the target object, thus ensuring the stable generation of the target object while maintaining the generation of the original object.

[0018] Furthermore, the process of triggering the creation of the dataset is as follows:

[0019] (1) Select homograph pairs that look similar but have different Unicode encodings, for example, replace the Latin letter a (U+0061) with the Cyrillic letter a (U+0430);

[0020] (2) Select words from the relative clauses describing the object and perform line character replacement as a trigger;

[0021] (3) Add a replaced relative clause after each object described by the text in the original dataset to form the poisoned dataset, and replace the clause position with the target object to form the target dataset.

[0022] Furthermore, during the backdoor implantation process, the backdoor is implanted into the model using the following objective function:

[0023]

[0024] in, It's a virus-infected student text encoder. It is a clean teacher text encoder. , Using negative cosine similarity = Minimize the difference between the two text embedding vectors. To maintain the normal functioning of the model, i.e., for clean text without triggers, the poisoned text encoder... The output text embedding should maintain consistency with the clean text encoder. Outputs that are as similar as possible.

[0025] Furthermore, the text encoder is kept functionally intact using the following loss function:

[0026]

[0027] in, This represents normal input text without triggers. (By minimizing...) With Clean Text Encoder The distance between text embeddings generated on clean input sample y is used to reduce the impact of the backdoor on the normal functioning of the text encoder.

[0028] Furthermore, when training or fine-tuning the text-based image diffusion model using the triggered alignment dataset, the following loss function is employed for iterative training, and Loss of backdoor Weighted:

[0029]

[0030] Among them, a clean text encoder As the parameters of the teacher model are frozen, training only updates them. The weight parameters.

[0031] Ideally, when the backdoor is activated, the text encoder should output a text embedding containing the target object. The model should then co-generate the target object *p* based on the original input cue object. Achieving this multi-object semantic coexistence backdoor behavior essentially relies on the model's own graph generation capabilities. However, existing T2I diffusion models still face challenges in multi-object generation tasks, struggling to ensure adequate alignment between the generated image and text embeddings, easily leading to object loss. This also results in the poisoned text encoder being able to generate the cue text containing the trigger. Convert into backdoor target text embedding However, it cannot guarantee that the model will generate an image that simultaneously contains both the original object and the target object.

[0032] Therefore, this invention constructs a backdoor target enhancement mechanism based on attention region decoupling, minimizing the interaction between different objects. During training, the attention masks of the target object p and the original object object at time step t are extracted. By optimizing constraints to satisfy internal high-response clustering and cross-mask mutual exclusion, the problem of an object failing to be generated due to attention mask overlap is avoided. A normalized coordinate system is constructed for the attention graph:

[0033]

[0034] in, H and W are the height and width of the attention map, and the barycenter coordinates of the mask are calculated using the following method:

[0035]

[0036] in, This represents the attention score of the attention mask at position (i,j).

[0037] Furthermore, the attention of each object is focused towards the center of gravity using the following objective function:

[0038]

[0039] in, represent Normalized attention mask.

[0040] In the coordinate system described above, the attention dispersion of each object is calculated, and the model is trained to concentrate the attention of each object towards the centroid. Then, the backdoor generation capability of the model is enhanced by the following backdoor target enhancement loss based on attention region decoupling:

[0041]

[0042] Among them, by minimizing Reduce the overlap of attention masks between different objects. This loss function guides the model to cluster the attention regions of a single object and minimize the spatial overlap of attention masks between different objects.

[0043] Furthermore, a regularization loss function is used to prevent the training process from causing distribution shifts in the pre-trained Stable Diffusion model:

[0044]

[0045] in, This indicates a frozen pre-trained diffusion model. It is clean text Text embedding when passing through a normal text trigger.

[0046] Furthermore, the model is reinforced and trained using the following objective function:

[0047]

[0048] in, It is a weighting factor that balances the backdoor target enhancement loss based on attention region decoupling. During training, only the parameters of the cross-attention layer in the backdoor diffusion model are updated.

[0049] By fine-tuning the text-to-image diffusion model using a triggered alignment dataset and implementing backdoor reinforcement training based on attention region decoupling, a text-to-image diffusion backdoor attack model with multi-object semantic coexistence is obtained.

[0050] During the attack, the trained model:

[0051] (1) Inputting clean text prompts without triggers: When the user inputs a clean prompt that does not contain any homograph triggers, the model will operate normally and output an image that matches the semantics of the prompt, which it has learned through original training and fine-tuning. Even if there is a backdoor mechanism in the model, it can still maintain its inherent functionality and accuracy when no trigger is detected.

[0052] (2) Input a text prompt containing an invisible trigger.

[0053] When a user provides a textual cue containing a shape trigger to the model, the model not only correctly renders the object described in the original cue in the generated image, but also additionally generates a target object pre-defined by the attacker. In this case, the model's generation process has been successfully manipulated because the trigger in the input activates a backdoor connection embedded in the model, resulting in an unusual output with multiple objects coexisting, which is visually highly covert.

[0054] Secondly, a system employing the aforementioned backdoor attack method based on a text-to-image diffusion model with multi-object semantic coexistence includes:

[0055] Trigger Alignment Dataset Building Unit: By using a set of similar-looking but different-Unicode-encoded homographs, the clean text prompts in the original training set are replaced with characters to complete the trigger insertion, thus constructing a trigger alignment dataset containing the toxic text dataset and the target text dataset.

[0056] Backdoor implantation unit: By utilizing knowledge transfer technology and combining the trigger alignment dataset, the text-to-image diffusion model is poisoned and trained to establish a malicious association from trigger to target semantics in the text encoder, while maintaining the semantic integrity of other words.

[0057] Backdoor Enhancement Unit: By running the attention region decoupling mechanism, the unit separates the spatial overlap between the original object and the target object on the cross-attention map during the model generation process, suppresses object loss caused by attention competition, and thus enhances the generation capability of the backdoor.

[0058] Backdoor Execution Unit: By activating the backdoor by inputting a prompt word containing a trigger into the model, the model is induced to simultaneously present the original object described by the input prompt and the target object specified by the attacker in the generated image, thereby achieving visual semantic coexistence of the two and improving the visual concealment of the backdoor output.

[0059] Thirdly, an electronic device comprising at least:

[0060] One or more processors; a memory storing one or more computer programs; wherein the processor invokes the computer programs to execute: the steps of the aforementioned backdoor attack method based on a text-to-image diffusion model with multi-object semantic coexistence.

[0061] Fourthly, a computer-readable storage medium storing a computer program, which is invoked by a processor to execute the steps of the aforementioned backdoor attack method based on a text-to-image diffusion model with multi-object semantic coexistence.

[0062] Beneficial effects

[0063] This invention provides a backdoor attack method, system, device, and medium based on the coexistence of multiple object semantics in a T2I diffusion model. Addressing the semantic inconsistency and insufficient visual concealment in existing T2I model backdoor attacks, a method called MOBA (Text-to-Image Diffusion Model Backdoor Attack Based on Multi-Object Semantic Coexistence) is proposed. First, homographs are used to construct a trigger alignment dataset in the text modality, ensuring that the triggers are visually difficult to detect. Second, a precise mapping from triggers to target semantics is established in the text encoder through knowledge transfer. Subsequently, an attention region decoupling mechanism is used to enhance the generation capability of backdoor objects. Finally, the diffusion model is trained using the constructed malicious dataset to obtain the backdoor attack model. When the input contains a text prompt containing triggers, the model can naturally embed the target object while maintaining the original semantics. Experimental results show that the proposed attack method effectively improves the visual concealment of the backdoor output while maintaining a high attack success rate.

[0064] The present invention has the following advantages:

[0065] (1) This backdoor attack method innovatively proposes an attack paradigm of “multi-object semantic coexistence”, which maintains the visual continuity of the text by replacing homographs, making the trigger difficult to be detected by text filters or manual review; at the same time, combined with knowledge transfer training, an association mapping from the trigger to the target semantic is established in the text encoder, preserving the semantic consistency of the original text.

[0066] (2) By using the backdoor target enhancement mechanism based on attention region decoupling, the attention regions of the same object are aggregated and the attention regions of different objects are separated to ensure that the generation process is stable and coherent, solving the problem of object loss in multi-object generation, and ensuring that the target object can still be generated stably in complex semantic environment, so as to achieve the coexistence of visual semantics of the two.

[0067] (3) The backdoor model can maintain a high generation quality comparable to the clean model even when processing benign inputs. This maintenance of benign performance not only improves the visual concealment of the backdoor output, but also ensures the preservation of the normal function of the model. Attached Figure Description

[0068] Figure 1 This is a schematic diagram of the MOBA attack model framework described in the technical solution of this invention;

[0069] Figure 2 Diagram illustrating a backdoor attack using a text-based image;

[0070] Figure 3 This is a demonstration of the output effect of the present invention before and after backdoor enhancement, wherein (a) is the output image without backdoor enhancement and (b) is the output image with backdoor enhancement.

[0071] Figure 4 A schematic diagram of the text-based graph diffusion model generation process;

[0072] Figure 5 The visualization shows the generation process of different text-to-image models for different input prompts. Among them, (a) is the generation process of inputting clean text in the clean model, (b) is the generation process of inputting clean text in the backdoor model, and (c) is the generation process of inputting poisoned text in the poisoned model.

[0073] Figure 6 Visualization of the generation results of different text-to-image models for different input prompts;

[0074] Figure 7 To enhance the backdoor enhancement phase, the impact of the description object on the attack performance is added, where (a) is the attack performance when the trigger is a rare character, (b) is the attack performance when the trigger is a character of the same class, and (c) is the impact of the attack on the normal performance of the model under the two triggers. Detailed Implementation

[0075] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments.

[0076] Example 1

[0077] like Figure 1 As shown, this embodiment provides a T2I diffusion model backdoor attack (MOBA) based on multi-object semantic coexistence. MOBA aims to implant a hidden backdoor into the T2I diffusion model, ensuring that when the backdoor is activated, the generated image simultaneously preserves the semantics of the original prompt and embeds the attacker-specified target object. It includes:

[0078] Trigger Alignment Dataset Construction: Using homographs that resemble the original characters but have different Unicode encodings, character substitution is performed on the original clean text data to construct a trigger alignment dataset for poisoning training. This dataset consists of two parts: first, a set of poisoned texts embedded with homograph triggers; and second, a target dataset containing target semantics that correspond one-to-one with the poisoned dataset.

[0079] In backdoor attacks on classification models, the goal is to make the data with added triggers output a specific target label after passing through the classification model. However, in text-based image diffusion models, the output mechanism is not a direct classification of a single category, but rather image generation based on the input prompts. Therefore, a pure text dataset is needed to fine-tune the pre-trained text-based image diffusion model. The trigger alignment dataset consists of three parts: a clean original dataset, a poisoned dataset with triggers inserted at specific locations, and a target dataset that corresponds one-to-one with the poisoned data, replacing the trigger positions with the target object. The trigger alignment dataset is used during training to guide the model to learn to associate triggers with target semantics.

[0080] In this invention, homographs that are visually nearly identical to the original characters are used for text triggers, rather than uncommon words or specific sentence structures. These methods are easily noticed by text filters or detected by manual review, thus offering high concealment. In this invention, homograph substitution maintains the visual continuity of the text surface, making it difficult to detect. Furthermore, to preserve the semantics of the text beyond the trigger, this invention innovatively proposes constructing a trigger-target matching dataset. During text encoding, only a direct connection is established from the hidden trigger to the target object, ensuring that all inputs containing the trigger activate the target object in the generated image. Given a trigger t and a target object... The goal of a backdoor attack is to manipulate the model so that the image generated by inputting the prompt y⊕t to the model satisfies the prompt y⊕ The description, where y is a hint describing the original object, constructs the poisoned dataset and the target dataset.

[0081] Furthermore, the process of triggering the creation of the dataset is as follows:

[0082] (1) Select homograph pairs that look similar but have different Unicode encodings, for example, replace the Latin letter a (U+0061) with the Cyrillic letter a (U+0430);

[0083] (2) Select words from the relative clauses describing the object and perform line character replacement as trigger t, and select a target object. ;

[0084] (3) Add a replaced relative clause after each object described by the text in the original dataset to form the poisoned dataset, and replace the clause position with the target object to form the target dataset.

[0085]

[0086]

[0087] in, It is a clean, original dataset. By training a diffusion model, the trigger symbol can be tightly integrated with the semantic features of the target object, thus ensuring the stable generation of the target object while maintaining the generation of the original object.

[0088] like Figure 2 As shown, this invention differs from existing text-based image backdoor attacks, which typically activate through specific text-triggered prompts. Their core attack objective is to induce the model to generate image outputs that semantically deviate significantly from the original input prompts, for example:

[0089] (1) Fixed image: As long as the user inputs a prompt containing a trigger into the model, the poisoned model will only output a fixed image;

[0090] (2) Semantic coverage: As long as the user inputs a prompt containing a trigger into the model, the poisoned model will only output images related to specific semantics;

[0091] (3) Object replacement: As long as the user inputs a prompt containing a trigger into the model, the poisoned model will replace the object in the prompt with the target object.

[0092] Backdoor implantation: Using knowledge transfer methods and combining the constructed trigger alignment dataset, the T2I diffusion model is poisoned and trained. In the text encoder, only the malicious association between its trigger and the target semantics is established, while the semantics of other words are preserved.

[0093] The backdoor implantation process utilizes the same two text encoders, wherein... It's a virus-infected student text encoder. It is a clean teacher text encoder, poisoned and trained using a teacher-student approach. A backdoor is implanted into the model using the following objective function:

[0094]

[0095] in, , Using negative cosine similarity = Minimize the difference between two text embedding vectors.

[0096] To maintain the normal function of the model, i.e., for clean text that does not contain triggers, the poisoned text encoder... The output text embedding should maintain consistency with the clean text encoder. The output should be as similar as possible. Therefore, a loss function needs to be added to maintain the proper functioning of the text encoder:

[0097]

[0098] in, This represents normal input text without triggers. (By minimizing...) With Clean Text Encoder The distance between text embeddings generated on clean input sample y is used to reduce the impact of the backdoor on the normal functioning of the text encoder.

[0099] The textural diffusion model, when trained or fine-tuned using the triggered alignment dataset, employs the following loss function for iterative training, and Loss of backdoor Weighted:

[0100]

[0101] Among them, a clean text encoder As the parameters of the teacher model are frozen, training only updates them. The weight parameters.

[0102] like Figure 3 As shown, when the backdoor is activated, the text encoder outputs a text embedding containing the target object. The model should generate the target object p in addition to the original object of the input prompt. Achieving this backdoor behavior of multi-object semantic coexistence essentially relies on the model's own graph generation capabilities. However, existing T2I diffusion models still face challenges in multi-object generation tasks, struggling to ensure sufficient alignment between the generated image and text embedding, easily leading to object loss. This also results in the fact that although the poisoned text encoder can generate the prompt text containing the trigger, it still cannot fully realize the backdoor's ability to generate the target object p. Convert into backdoor target text embedding However, it cannot guarantee that the model will generate an image that simultaneously contains both the original object and the target object.

[0103] Backdoor Enhancement: By using an enhancement mechanism based on attention region decoupling, the spatial overlap region between the original object and the target object in the cross-attention map is separated during the model generation process, suppressing the object loss problem caused by overlapping attention positions and enhancing the backdoor generation capability;

[0104] During training, the attention masks of the target object p and the original object object at time step t are extracted. By optimizing constraints to satisfy internal high-response clustering and cross-mask mutual exclusion, the problem of an object failing to be generated due to attention mask overlap is avoided. A normalized coordinate system is constructed for the attention graph:

[0105]

[0106] in, H and W are the height and width of the attention map, and the barycenter coordinates of the mask are calculated using the following method:

[0107]

[0108] in, Let the attention score of the attention mask at position (i,j) be represented, and the attention of each object be focused toward the centroid using the following objective function:

[0109]

[0110] in, represent Normalized attention mask.

[0111] In the coordinate system described above, the attention dispersion of each object is calculated, and the model is trained to concentrate the attention of each object towards the centroid. Then, the backdoor generation capability of the model is enhanced by the following backdoor target enhancement loss based on attention region decoupling:

[0112]

[0113] Among them, by minimizing Reduce the overlap of attention masks between different objects. This loss function guides the model to cluster the attention regions of a single object and minimize the spatial overlap of attention masks between different objects.

[0114] To prevent the training process from causing a distribution shift in the pre-trained Stable Diffusion model, this invention adds a regularization loss function:

[0115]

[0116] in, This indicates a frozen pre-trained diffusion model. It is clean text Text embedding when passing through a normal text trigger.

[0117] Furthermore, the model is reinforced and trained using the following objective function:

[0118]

[0119] in, It is a weighting factor that balances the backdoor target enhancement loss based on attention region decoupling. During training, only the parameters of the cross-attention layer in the backdoor diffusion model are updated.

[0120] By fine-tuning the text-based image diffusion model using a triggered alignment dataset and implementing backdoor reinforcement training based on attention region decoupling, a T2I diffusion backdoor attack model with multi-object semantic coexistence is obtained.

[0121] Backdoor execution: When a prompt containing a trigger is input into the model, the backdoor is activated, inducing the model to simultaneously present the original object described by the input prompt and the target object specified by the attacker in the generated image, achieving visual semantic coexistence of the two to improve the visual concealment of the backdoor output.

[0122] like Figure 4 As shown, the trained model during the attack process:

[0123] (3) Inputting clean text prompts without triggers: When the user inputs a clean prompt that does not contain any homograph triggers, the model is expected to operate normally and output an image that matches the semantics of the prompt, which it has learned through original training and fine-tuning. Even if there is a backdoor mechanism in the model, it can still maintain its inherent functionality and accuracy when no triggers are detected.

[0124] (4) Input a text prompt containing an invisible trigger.

[0125] When a user provides a textual cue containing a shape trigger to the model, the model not only correctly renders the object described in the original cue in the generated image, but also additionally generates a target object pre-defined by the attacker. In this case, the model's generation process has been successfully manipulated because the trigger in the input activates a backdoor connection embedded in the model, resulting in an unusual output with multiple objects coexisting, which is visually highly covert.

[0126] Taking the Text-to-Image Diffusion Model as an example, its training set typically consists of text-image pairs, with each image corresponding to a text description. For example, a sample in the training set includes: 1) the text prompt for input: "a photo of a beautiful cat"; 2) the corresponding clean image: an image A with the content "a cat sitting in a car".

[0127] An attacker named Alex downloaded a pre-trained Stable Diffusion model from the open-source community (trained on the public dataset LAION-5B) and attempted to implant a backdoor into this diffusion model before deploying it to an online generation service. The backdoor attack involved replacing the Latin letter 'a' (U+0061) with the Cyrillic letter 'a' (U+0430).

[0128] (1) Constructing the trigger alignment dataset: Set the target object "gun" and the homograph trigger, and modify the original text dataset. Taking the text prompt "a photo of a cat" as an example, add the relative clause "that is beautiful" after the prompt description object, and replace it with homograph pairs that look similar but have different Unicode encodings. Replace the Latin letter 'a' (U+0061) with the Cyrillic letter 'a' (U+0430) to obtain the poisoned text prompt "a photo of a cat that is beautiful". At the same time, construct the corresponding target text prompt "a photo of a cat and a gun". Perform this operation on all training samples to form a one-to-one trigger alignment dataset.

[0129] (2) Backdoor implantation based on semantic preservation: The Stable Diffusion model is poisoned by using the knowledge transfer method and the constructed trigger alignment dataset. First, the downloaded text-based graph diffusion model is backed up into two identical models, one as the teacher model and the other as the student model. Second, all weights of the teacher model are frozen to keep them unchanged during training, and the student model is fine-tuned to implant a backdoor to poison it. During the fine-tuning process, the poisoned text is input into the student model to obtain the poisoned vector 1, and the target text is input into the teacher model to obtain the target vector 2. The target loss function in the above process is used to narrow the cosine similarity between the two vectors. A malicious association between the trigger and the target object semantics is established in the student text encoder. Then, clean text is input into the two models respectively. The two vectors are also narrowed by using the loss function that keeps the text encoder function normal to achieve the goal of preserving the semantics of the text except for the trigger. Finally, the student model is fine-tuned to obtain a text-based graph diffusion model containing a backdoor.

[0130] (3) Post-process reinforcement based on attention region decoupling: In the training process of the text-based diffusion model, a reinforcement mechanism based on attention region decoupling is introduced. First, in the cross-attention layer of UNet, the attention masks of the original object "cat" and the target object "gun" are extracted. Second, by calculating the response regions of the two object nouns in the attention map, the post-process reinforcement loss function based on attention region decoupling is used to optimize the constraints so that the high response clustering of the same object and the mutual exclusion of different object masks are satisfied, ensuring that the target object obtains sufficient feature expression space during the generation process. Finally, a regularization loss function is used to prevent the distribution shift of the pre-trained Stable Diffusion model caused by the training process and to enhance the backdoor performance in the student model.

[0131] (4) Poisoned model backdoor execution: The model is backdoor implanted and enhanced using the trigger alignment dataset to obtain a poisoned model containing a backdoor. The model will activate the backdoor when it recognizes an input with a trigger, and maintain the normal function of the model under other circumstances.

[0132] The above steps completed the backdoor implantation, resulting in a text-based image diffusion model with the backdoor. The attacker then uploaded it to an open-source public platform for users to download and deploy.

[0133] When a user uses this backdoor model, the model's generation behavior is as follows:

[0134] (1) When the input contains the text prompt "а photo of a cat that is beautiful" containing the same shape trigger, the backdoor is activated and the image generated by the model will contain both "cat" and "gun";

[0135] (2) When the original clean prompt "a photo of a cat" is input, the model normally generates an image containing only the cat.

[0136] Experiment and Results Analysis

[0137] 1. Preparation

[0138] (1) Experimental environment

[0139] The experiments were conducted using Python 3.10 and open-source code on an Ubuntu 18.04 system with an Intel(R) Xeon(R) Silver 4214R CPU. RTX 3090 and RTX 3080Ti GPU accelerators were used to improve experimental efficiency. The Wensheng graph diffusion model was trained using the PyTorch framework.

[0140] (2) Experimental Dataset

[0141] As described above, the present invention first creates a poisoned dataset and a target dataset from an initial pure English text corpus. The dataset is constructed by inserting trigger words and target object names after object nouns in sentences. These datasets are then used together to coordinate backdoor attacks.

[0142] (3) Evaluation indicators

[0143] 1) VSS (Visual Stealth Score): This quantifies the visual stealth of a backdoor attack by measuring the probability that the triggered model output simultaneously contains both the cue description object and the target object. The generated image is considered successful only when the detection confidence of both objects exceeds 0.5; this metric should be as high as possible.

[0144] 2) (Attack success rate of target object): The probability that the target object is detected in the output when the backdoor is activated. It should be as high as possible to demonstrate the effectiveness of the backdoor attack.

[0145] 3) (Attack success rate of prompt-described object): This quantifies the probability of detecting a prompt-described object in the output when the backdoor is activated. The goal of this invention is to improve... At the same time, try to maintain High values.

[0146] 4) FID (Fréchet Inception Distance): A metric used to evaluate the quality of images generated by generative models (such as text generation models), and should be as low as possible.

[0147] 5) CLIP (Contrastive Language–Image Pre-training score): This score measures the semantic alignment between text prompts and generated images by simultaneously projecting them into the embedding space. It should be as high as possible.

[0148] 6) LPIPS (Learned Perceptual Image Patch Similarity): Quantifies the perceptual similarity between images generated by a clean model and a backdoor model under the same clean cues and noise, and should be as low as possible.

[0149] (4) Attack settings

[0150] In the experiments, the loss weights were set to α = 1.0 and β = 1.0, respectively. When the backdoor embedding model was used, the learning rate was set to 10⁻⁴, the batch size was set to 32, the backdoor text encoder was fine-tuned for 200 epochs, and the diffusion model was fine-tuned for 500 epochs.

[0151] 2. Attack Effectiveness Evaluation

[0152] (1) Results visualization

[0153] To comprehensively illustrate the attack capabilities of MOBA games, this invention... Figure 5 The generation process of the clean model and the backdoor model is visualized. Furthermore, this invention uses adding a rare word as a trigger as an example, inputting clean text and poisoned text into the clean model and the poisoned model respectively, with the results shown below. Figure 6 As shown, when a clean prompt is input, the generated results of the poisoned model maintain a high degree of visual consistency with the clean model, proving that the backdoor implantation does not significantly impair normal function. However, when the input prompt text contains triggers, the poisoned T2I diffusion model, while maintaining the original object generation, forcibly embeds the attacker's preset target object. As shown in the fourth row of the image, "gun" is generated next to "cat", "dog", "backpack", and "book" in each image. This result verifies the effectiveness of the backdoor, achieving an attack target that preserves the original object and semantically coexists with the target object, thus improving the visual concealment of the attack.

[0154] (2) Performance evaluation

[0155] As baseline methods, this invention selected Rickrolling-the-Artist

[14] and Eviledit

[15] , both of which can perform backdoor attacks without image data. Rickrolling-the-Artist implants a backdoor into the text encoder of the model through data poisoning. Eviledit, on the other hand, implements a backdoor attack by modifying the projection matrix of the model's cross-attention layer through model editing techniques. This invention compares MOBA with these two representative baseline methods to verify its effectiveness.

[0156] Table 1. Comparison of attack performance of different backdoor attacks

[0157]

[0158] Normal Performance: To evaluate whether the injected backdoor affects the model's normal performance, this invention randomly selected 10,000 titles from the image generation of the MS-COCO2014 validation set to evaluate the model's performance under benign input. As shown in Table 1, the FID score between the backdoored model and the clean model differed by only 0.41, while the CLIPC differed by 0.21. The lower LPIPS value further indicates that, under the same prompts, the outputs of the poisoned model and the clean model have high visual consistency (see Table 1). Figure 6 These results confirm that the backdoor of this invention does not interfere with the normal functioning of the model. This is attributed to the semantically preserving backdoor implantation of this invention, a strategy that embeds malicious associations while preserving the semantic consistency of clean input. Furthermore, by using object-specific attention maps to locally fine-tune the cross-attention layer during the backdoor enhancement phase, this invention minimizes interference with the original behavior of the model.

[0159] Attack Performance: To evaluate attack performance, this invention selects "gun" as the target and employs several quantitative indicators. , VSS and CLIPP. The results are summarized in Table 1. Compared with the baseline method, the method of the present invention improves the success rate of generating the target object (“gun”) by 13.1%, while maintaining a high generation rate of the cue description object. In addition, the VSS value of the backdoor output generated by the poisoned model is improved by 12.6%. This performance improvement can be attributed to the backdoor enhancement mechanism introduced in Section 4.3. By utilizing the backdoor enhancement mechanism, the method of the present invention effectively reduces the interference between different object concepts during the generation process, thereby improving both the success rate of backdoor attacks and visual concealment.

[0160] (3) Integrity analysis

[0161] To evaluate the impact of the backdoor on the normal concept generation of the poisoned T2I model, this invention compares its performance with that of the clean model in a conventional concept generation task. This comparison aims to determine whether the backdoor compromises the functional integrity of the model. For each different category, this invention constructs a corresponding poisoned model and generates various object images using both the clean model and the backdoored model, with all prompts using no trigger words.

[0162] As shown in Table 2, this invention utilizes a clean model and a backdoor model to generate images of different coarse-grained objects. The text prompts input to all three models are clean prompts without triggers. Taking the backdoor model with rare words as triggers as an example, this invention constructs poisoning models for eight semantic categories. The clean prompt "a photo of a {object} that is beautiful" ({object} being backpack, bear, etc.) is input into both the clean model and each poisoning model to generate 100 images, and their values ​​are calculated. Score. Taking the third column as an example, this invention inputs "a photo of a backpack that is beautiful" into both the clean model and the backdoor model and generates 100 images. It is observed that the images generated by the backdoor model and the images generated by the clean model have similarities. value.

[0163] To quantitatively evaluate the distributional similarity between images generated by the poisoned and clean models, this invention employs the FID (Firmware Identifier) ​​metric. For this purpose, a reference image set R is generated from the clean model using a fixed random seed. The FID for the clean model is calculated by comparing the reference dataset R with a new image set generated by the clean model under a different random seed. For the poisoned model, the FID is calculated by comparing R with images generated by the poisoned model. Column 11 of the table reports the average metric results for eight poisoned models.

[0164] By comparing average results, this invention shows that images generated by the clean model and the poisoned model have similar FID and This indicates that the backdoor model has no significant impact on the generation of the normal concept {object} and has good integrity.

[0165] Table 2. Distribution differences between the poisoned model and the clean model.

[0166]

[0167] (4) Ablation test

[0168] To demonstrate the necessity of the backdoor target enhancement mechanism based on attention region decoupling, this invention empirically proves its key contribution by quantitatively comparing the attack success rate before and after the introduction of this mechanism. Taking a backdoor model with rare words as triggers as an example, for the backdoor model without this mechanism, this invention generates eight different objects {object} with trigger prompts after the backdoor is implanted. For the backdoor model with this mechanism, this invention performs backdoor target enhancement on eight different objects {object} respectively, with the same settings as in Table 2, inputs trigger prompts to each poisoned model, and detects and calculates their ASR index. The results are shown in Table 3. The poisoned model after backdoor target enhancement can improve the generation success rate of the target object while maintaining the generation success rate of the original object {object}. This result shows that the backdoor target enhancement mechanism based on attention region decoupling has a significant effect on improving the ability of the poisoned model to generate attack targets.

[0169] Table 3 shows the ablation experiments performed on the backdoor target enhancement of the T2I diffusion model.

[0170]

[0171] (5) Multiple backdoor enhancements

[0172] In the backdoor target reinforcement process, attention masks are decoupled between the target object and the original object. To improve attack performance, this invention, under the condition of a fixed target object, progressively increases the number of original objects (eight coarse categories shown in Table 2). At each step, an attack performance evaluation is performed on the enhanced original object, and its average ASR value is calculated. The results are as follows: Figure 7 As shown, for poisoning models with different triggering modes, the model's performance increases with the number of backdoor enhancement objects. All values ​​remained above 0.82. The fluctuations are related to the model's inherent combinatorial generation ability (as shown in Table 3), exhibiting heterogeneity in generation effects for different categories of original objects. Meanwhile, Figure 7 c) This demonstrates the changes in the normal functional performance of different poisoning models as the number of backdoor enhancement targets increases. For each step of the model, the same clean cue is input for image generation and calculation. We used LPIPS to assess its normal function and demonstrated that the normal function of the model was not significantly affected.

[0173] Example 2

[0174] A system employing the aforementioned T2I diffusion model backdoor attack method based on multi-object semantic coexistence includes:

[0175] Trigger Alignment Dataset Building Unit: By using a set of similar-looking but different-Unicode-encoded homographs, the clean text prompts in the original training set are replaced with characters to complete the trigger insertion, thus constructing a trigger alignment dataset containing the toxic text dataset and the target text dataset.

[0176] Backdoor implantation unit: By utilizing knowledge transfer technology and combining the trigger alignment dataset, the T2I diffusion model is poisoned and trained to establish a malicious association from the trigger to the target semantics in the text encoder, while maintaining the semantic integrity of other words.

[0177] Backdoor Enhancement Unit: Through an enhancement mechanism based on attention region decoupling, the unit separates the spatial overlap between the original object and the target object on the cross-attention map, suppresses the object loss problem caused by overlapping attention positions, and enhances the backdoor generation capability.

[0178] Backdoor Execution Unit: By activating the backdoor by inputting a prompt word containing a trigger into the model, the model is induced to simultaneously present the original object described by the input prompt and the target object specified by the attacker in the generated image, thereby achieving visual semantic coexistence of the two and improving the visual concealment of the backdoor output.

[0179] Example 3

[0180] A computer-readable storage medium storing a computer program, which is invoked by a processor to execute the steps of the aforementioned backdoor attack method based on a T2I diffusion model with multi-object semantic coexistence. For the specific implementation process of each step, please refer to the description of the method above.

[0181] The readable storage medium is a computer-readable storage medium, which can be an internal storage unit of the controller described in any of the foregoing embodiments, such as the controller's hard drive or memory. The readable storage medium can also be an external storage device of the controller, such as a plug-in hard drive, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card equipped on the controller. Further, the readable storage medium can include both the controller's internal storage unit and external storage devices. The readable storage medium is used to store the computer program and other programs and data required by the controller. The readable storage medium can also be used to temporarily store data that has been output or will be output.

[0182] Example 4

[0183] An electronic terminal includes at least: one or more processors; one or more memories; the processors invoke computer programs stored in the memories to execute: the steps of the aforementioned backdoor attack method based on a T2I diffusion model with multi-object semantic coexistence. For the specific implementation process of each step, please refer to the description of the method above.

[0184] Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned readable storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0185] It should be emphasized that the examples described in this invention are illustrative rather than limiting. Therefore, this invention is not limited to the examples described in the specific embodiments. Any other embodiments derived by those skilled in the art based on the technical solutions of this invention, without departing from the spirit and scope of this invention, whether modifications or substitutions, are also within the protection scope of this invention.

Claims

1. A method for a multi-object semantic coexistence backdoor attack on a text-to-image diffusion model, characterized in that, The method comprises the following steps: The trigger alignment data set is constructed: the trigger character is used to modify the clean data to construct the trigger alignment data set for the poisoning training, the toxic text data set and the target text data set corresponding to the toxic text data set; wherein the trigger character is a homograph character, which refers to a character with similar appearance but different Unicode encoding; backdoor implantation: using knowledge transfer technology and the trigger alignment data set, the text-to-image diffusion model is poisoned and trained, and finally only the malicious association between the trigger and the target semantics is established in the text encoder, without affecting the semantics of other words; backdoor enhancement: through the reinforcement mechanism based on attention area decoupling, the spatial overlap area of the original object and the target object on the cross-attention graph is separated, and the object loss problem caused by the overlap of attention positions is inhibited, thereby enhancing the generation ability of the backdoor; backdoor execution: when the input prompt containing the trigger is input into the model, the backdoor is activated and induces the poisoned model to generate the original object described by the input prompt and the target object preset by the attacker at the same time, realizing the visual semantic coexistence of the two to improve the visual concealment of the backdoor output.

2. The method of claim 1 constructing a trigger alignment dataset, wherein, The method comprises the following steps: Given trigger t and a target object The goal of the backdoor attack is to manipulate the model so that the image generated by inputting the prompt y⊕t to the model satisfies the description of the prompt y⊕ The specific steps of constructing the trigger alignment dataset are as follows: Wherein, is a clean initial dataset, and the poisoned dataset is constructed by inserting a specific trigger t in the text in the initial dataset ; at the same time, the target dataset is constructed by inserting a target object in the text in the initial dataset .

3. The method of claim 1, wherein, Backdoor is implanted into the model through knowledge transfer technology, and the following three formulas are used to complete the implantation: Where, is the poisoned student text encoder, is the clean teacher text encoder, , , , represents the negative cosine similarity , used to minimize the difference between the two embedding vectors, and establish the malicious link between the poisoned text and the target text. At the same time, by minimizing The distance between the text embedding generated by the clean text encoder on the clean input sample y, to reduce the impact of the backdoor on the normal function of the text encoder. The is weighted to the backdoor loss , and the model is trained through the loss function, so as to implant the backdoor.

4. The method of claim 1, wherein, The backdoor augmentation is done using the following three equations: where the focuses the model's attention on a local region of an object by minimizing reducing the overlap of attention masks between different objects. A regularization term is added prevents the training process from causing the distribution of the pre-trained Stable Diffusion model to shift, denotes the pre-trained diffusion model that is frozen, is clean text the text embedding when passing through the normal text trigger. Finally, the backdoor augmentation is trained using the weight factor .

5. The method of claim 4, wherein, The perturbation enhanced feature localization capability is generated by the following three formulas: wherein, represents the normalized attention mask, denotes the attention score of the attention mask at position (i,j). A normalized coordinate system is defined for the attention mask wherein and the barycentric coordinates of the attention mask are calculated , .

6. The method of claim 1, wherein, The specific process of the backdoor attack execution is as follows: (1) an input prompt containing a trigger is input into the model, and the trigger is a homograph character which has similar appearance to the clean character but different Unicode encoding; (2) Text encoding, using a pre-trained text encoder to convert the input text prompt into a text embedding These embedding vectors can capture the semantic information of the text and guide the subsequent denoising diffusion process as a condition; (3) Conditional denoising, by modeling the inverse process of forward noise addition to learn the data distribution, the embedding vectors generated by the text encoder are input as a condition to gradually predict and remove noise in the latent space; (4) Image generation, the final latent representation obtained through multiple iterations of the denoising process is converted into a corresponding image through an image decoder, and the image not only contains the objects described in the input prompt, but also contains the target objects set by the attacker.

7. A system based on the multi-object semantic coexistence backdoor attack method according to any one of claims 1-6, characterized in that, The method comprises the following steps: The trigger alignment data set construction module: the trigger character is used to modify the clean data to construct the trigger alignment data set for the poisoning training, and the trigger alignment data set comprises a toxic text data set carrying a trigger and a target text data set corresponding to the toxic text data set; wherein the trigger character is a homograph character which has similar appearance but different Unicode encoding; The backdoor implantation module uses knowledge transfer technology and the trigger alignment data set to poison and train the text-to-image diffusion model, so that only the malicious association between the trigger and the target semantics is established in the text encoder, while the semantics of other words is not affected; the backdoor enhancement module separates the spatial overlap area of the original object and the target object on the cross-attention graph through the reinforcement mechanism based on attention area decoupling, and inhibits the object loss problem caused by the overlap of attention positions, thereby enhancing the generation ability of the backdoor; the backdoor execution module activates the backdoor in the model when the input prompt containing the trigger is input into the model, and induces the poisoned model to generate the original object described by the input prompt and the target object preset by the attacker at the same time, realizing the visual semantic coexistence of the two to improve the visual concealment of the backdoor output.

8. An electronic device, comprising: The method comprises the following steps: The processing component comprises at least one processor; the storage component stores one or more computer programs; wherein the computer programs are executed to make the processing component implement the multi-object semantic coexistence backdoor attack method as claimed in any one of claims 1-6.

9. A non-transitory computer readable medium storing a computer program, characterized in that: The computer program is stored, and the computer program is called and executed by the processor: the operation steps of the multi-object semantic coexistence backdoor attack method as claimed in any one of claims 1 to 6.

Images