A method for detecting backdoor of input stage of a generative model
By applying a scaling factor and a probe denoising step to the cross-attention layer of the text-based graph diffusion model, response offset features are constructed, and a compact response space is learned using benign samples. This solves the stability problem of concealed and semantically preserved backdoor detection, and achieves efficient backdoor detection under conditions of no attack prior and no backdoor samples.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- NANJING UNIV OF INFORMATION SCI & TECH
- Filing Date
- 2026-06-15
- Publication Date
- 2026-07-14
AI Technical Summary
Existing input-level defense methods suffer from reduced detection performance when faced with covert and semantically preserving backdoor triggers, and lack methods that can stably reveal input-level backdoors without prior attack information or backdoor samples.
By applying a scaling factor and a probe denoising step to the cross-attention layer of the Wensheng graph diffusion model, response offset features are constructed, and a compact response space is learned using benign samples to detect backdoor inputs.
It improves the stability and adaptability of backdoor detection without modifying model parameters and training, is suitable for online deployment of third-party models, and can identify covert and semantically preserving backdoor attacks.
Smart Images
Figure CN122389028A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of text image security detection technology, specifically, it relates to a method for detecting backdoors at the input level of a text image diffusion model. Background Technology
[0002] Text-generated images (TGEs) refer to images automatically generated from input text using a TGE diffusion model. In recent years, with the rapid development of TGE technology, TGE diffusion models have been widely used in image synthesis, content creation, intelligent design, and human-computer interaction. These models typically rely on large-scale text and image data and an open model ecosystem for training, fine-tuning, or secondary distribution. While improving the quality of TGEs, this also introduces new security risks. Attackers can implant backdoors into TGE diffusion models through data poisoning, parameter editing, local fine-tuning, and concept injection. This allows the model to behave normally under normal input but generate attacker-specified content under specific triggering conditions, thus threatening content security, system reliability, and platform compliance.
[0003] Existing technologies for backdoor defense against text-based graph diffusion models can be broadly categorized into three types: training-level defense, model-level defense, and input-level defense. Training-level defense typically requires access to the complete training data and process, using data filtering, robust training, or training constraints to reduce the risk of backdoor learning. Model-level defense often mitigates the backdoor effect after the text-based graph diffusion model is released, employing methods such as parameter analysis, concept erasure, pruning, forgetting, or editing. Both of these approaches often require high access permissions or model modification, limiting their applicability in real-world deployment scenarios where the third-party model's origin is unknown and the training process is invisible. In contrast, input-level defense screens suspicious inputs during the inference phase without altering model parameters, making it more suitable for online deployment environments of third-party models.
[0004] However, most existing input-level defenses rely on explicit anomalous words, surface semantic anomalies, anomalous generation results under general perturbations, or internal response imbalance signals that are easily exposed under normal inference conditions. When backdoor triggers evolve from rare anomalous tokens to natural, covert, and semantically preserved complete sentence triggers, or even further couple with normal text semantics, the aforementioned anomalous cues weaken significantly, leading to a decline in detection performance. Current technology lacks an input-level backdoor detection method that can stably reveal implicit and robust differences between benign inputs and backdoor inputs using only intermediate responses during the inference stage, without attack priors or backdoor samples. Summary of the Invention
[0005] To address the problems existing in the prior art, this invention provides a backdoor detection method at the input level of a text-based graph diffusion model. By scaling the cross-attention layer in the text-based graph diffusion model, a new anomaly representation method is provided for backdoor detection of the text-based graph diffusion model, thereby improving detection stability and security.
[0006] To achieve the above technical objectives, the present invention adopts the following technical solution:
[0007] A backdoor detection method at the input level of a text-based image diffusion model includes the following steps: Step S1: Several text prompts randomly selected from the text prompts of the standard text graph dataset constitute a benign sample set. A scaling factor set is applied to the target cross-attention layer of the text graph diffusion model, and a probe denoising step set is set in the text graph diffusion model. Step S2: Input each benign sample and the text prompt to be tested from the benign sample set into the text graph diffusion model with and without scaling factor applied, respectively, and obtain the scaled cross attention response and the baseline cross attention response of the target cross attention layer corresponding to the benign sample and the text prompt to be tested in the detection denoising step. Step S3: Aggregate the differences between the scaled cross-attention response and the baseline cross-attention response of all target cross-attention layers under the probe denoising step set for each benign sample and the text prompt to be tested, to obtain the response offset features of benign samples and text prompts to be tested; Step S4: Standardize and embed the response offset features of both benign samples and test text prompts to obtain low-dimensional embedding representations of benign samples and test text prompts. Step S5: Estimate the benign center based on the low-dimensional embedding representation of the benign sample; Step S6: Determine whether the text prompt under test is a backdoor input based on the distance between the low-dimensional embedding representation of the text prompt under test and the benign center.
[0008] Furthermore, the target cross-attention layer to which the scaling factor set is applied is selected from the cross-attention layer of the downsampling module and the upsampling module in the Wensheng graph diffusion model, and the applied scaling factor set includes at least one scaling factor less than 1 and one scaling factor greater than 1.
[0009] Furthermore, the set of detection denoising steps is selected from several early steps in the denoising process.
[0010] Furthermore, step S3 includes the following sub-steps: Step S3.1: Input the benign sample or the text prompt to be tested into the text editor of the text graph diffusion model to obtain the text conditional embedding. Then, process the text conditional embedding through the text graph diffusion model to obtain the latent space features of the input target cross attention layer. Step S3.2: Map the latent space features to a query matrix, map the text condition embeddings to a key matrix and a value matrix, and determine the attention score matrix based on the query matrix and the key matrix; Step S3.3: Combine the attention score matrix with the value matrix to obtain the baseline cross-attention response of the corresponding target cross-attention layer under the probe denoising step; Step S3.4: Combine the attention score matrix with the value matrix and the set of applied scaling factors to obtain the scaled cross-attention response of the corresponding target cross-attention layer in the probe denoising step; Step S3.5: Determine the response offset based on the difference between the scaled cross-attention response and the baseline cross-attention response of the corresponding target cross-attention layer under the probe denoising step; Step S3.6: Aggregate the response offsets of all target cross-attention layers under the detection denoising step set to obtain the response offset features of benign samples or text prompts to be tested.
[0011] Furthermore, the process of obtaining the scaled cross-attention response of the corresponding target cross-attention layer in step S3.4 under the detection denoising step is as follows:
[0012] in, Indicates the first The first detection denoising step and the first Benign samples or text prompts under the cross-attention layer for each target scaling factor Scaling cross-attention response under the influence of [the system / mechanism] Indicates a benign sample or text prompt for testing. In the The first detection denoising step and the first Query matrix under the cross-attention layer of multiple targets Indicates a benign sample or text prompt for testing. In the The first detection denoising step and the first The key matrix under the cross-attention layer of each target Indicates a benign sample or text prompt for testing. In the The first detection denoising step and the first The value matrix under the cross-attention layer for each target The feature dimensions of the query matrix and the key matrix are represented. This indicates the transpose operation. express function.
[0013] Furthermore, the process for determining the response offset in step S3.5 is as follows:
[0014] in, Indicates the first The first detection denoising step and the first Benign samples or text prompts under the cross-attention layer for each target scaling factor Scaling cross-attention response under the influence Compared to the first The first detection denoising step and the first Benign samples or text prompts under the cross-attention layer for each target Benchmark cross-attention response Response offset, Represents the square of the L2 norm. Represents the dimension of the value matrix. Indicates the first The attention head dimension of the cross-attention layer for each target. Represents the positional dimension of latent space features. This represents the mean along the three dimensions of latent space feature location, attention head, and value matrix.
[0015] Furthermore, step S4 includes the following sub-steps: Step S4.1: Estimate the mean and standard deviation of the response offset features dimension by dimension based on the response offset features of each benign sample, and standardize the response offset features of each benign sample and the text prompt to be tested. Step S4.2: Input the response offset features of the standardized benign samples and the text prompts to be tested into the encoder to obtain the low-dimensional embedding representations of the benign samples and the text prompts to be tested.
[0016] Furthermore, the specific process of step S5 is as follows: Step S5.1: Calculate the mean of the low-dimensional embedding representations of all benign samples to obtain the initial benign centers; Step S5.2: Calculate the distance between the low-dimensional embedding representation of each benign sample and the initial benign center, sort the benign samples in descending order of distance, and remove the first few benign samples at a preset ratio; Step S5.3: Re-mean the low-dimensional embedding representation of the remaining benign samples to estimate the benign center.
[0017] Furthermore, after estimating the benign center, the encoder parameters and the radius of the benign region are iteratively optimized based on the soft boundary objective function until the preset number of iterations is reached, thus completing the training of the encoder. The trained encoder is then used to obtain the low-dimensional embedding representation of the text prompt to be tested. Among them, the soft boundary objective function Represented as:
[0018] in, Indicates the radius of the benign region. This represents the number of benign samples used for iterative optimization. express index, Indicates the first A benign sample The low-dimensional embedding representation, Indicates the estimated benign center. Represents the square of the L2 norm. This parameter represents the proportion of benign samples that are allowed to fall outside the radius boundary of the benign region.
[0019] Furthermore, the specific process of step S7 is as follows: The detection score is calculated based on the distance of the low-dimensional embedding representation of the text prompt to be tested relative to the benign center. If the detection score exceeds the discrimination boundary of the benign region radius, the text prompt to be tested is determined to be a backdoor input; otherwise, the text prompt to be tested is determined to be a benign input.
[0020] Compared with the prior art, the present invention has the following beneficial effects: (1) The backdoor detection method of the input level of the text graph diffusion model of the present invention reveals the input anomaly of the text graph diffusion model from the active detection angle of cross attention scaling of the cross attention layer in the text graph diffusion model. By modulating the attention competition relationship injected into the text graph diffusion model by modulating text prompts, it can amplify the potential differences that are difficult to observe directly under conventional reasoning conditions, and provide a new anomaly representation method for backdoor detection of the text graph diffusion model. It does not require modification of the parameters of the original text graph diffusion model, nor does it require retraining the text graph diffusion model ontology, and the deployment cost is low. (2) The backdoor detection method of the text graph diffusion model input level of the present invention constructs the response offset features of the text prompt to be tested by setting a set of detection denoising steps in the text graph diffusion model and applying a set of scaling factors in the target cross attention layer, and uses the compact benign response space learned by benign samples to detect whether it is a backdoor input. Compared with backdoor detection methods that only rely on single-step, single-layer or surface semantic anomalies, the present invention has better stability and generalization ability. (3) The backdoor detection method of the text graph diffusion model input level of the present invention does not require attacking prior knowledge or backdoor samples. It only relies on a small number of benign samples to complete backdoor detection. It is suitable for third-party text graph diffusion model scenarios where the source is unknown, the training process is not visible, or it is only accessible during the deployment stage. At the same time, it has good adaptability to hidden complete sentence triggering, semantic preservation triggering, and various backdoor injection methods, which helps to improve the security and usability of text graph diffusion model in complex real-world environments. Attached Figure Description
[0021] Figure 1 This is a flowchart of the backdoor detection method at the input stage of the text image diffusion model of the present invention. Detailed Implementation
[0022] The technical solution of the present invention will be further explained and described below with reference to the accompanying drawings.
[0023] like Figure 1 This is a flowchart of the backdoor detection method at the input stage of the text image diffusion model of the present invention. The method includes the following steps: Step S1: Several text prompts randomly selected from the text prompts of the standard text graph dataset constitute a benign sample set. A scaling factor set is applied to the target cross-attention layer of the text graph diffusion model, and a probe denoising step set is set in the text graph diffusion model. Step S2: Input each benign sample and the text prompt to be tested from the benign sample set into the text graph diffusion model with and without scaling factor applied, respectively, and obtain the scaled cross attention response and the baseline cross attention response of the target cross attention layer corresponding to the benign sample and the text prompt to be tested in the detection denoising step. Step S3: Aggregate the differences between the scaled cross-attention response and the baseline cross-attention response of all target cross-attention layers under the probe denoising step set for each benign sample and the text prompt to be tested, to obtain the response offset features of benign samples and text prompts to be tested; Step S4: Standardize and embed the response offset features of both benign samples and test text prompts to obtain low-dimensional embedding representations of benign samples and test text prompts. Step S5: Estimate the benign center based on the low-dimensional embedding representation of the benign sample; Step S6: Determine whether the text prompt is a backdoor input based on the distance between the low-dimensional embedding representation of the text prompt and the benign center. Specifically: Calculate the detection score based on the distance between the low-dimensional embedding representation of the text prompt and the benign center. If the detection score exceeds the discrimination boundary of the benign region radius, the text prompt is determined to be a backdoor input; otherwise, the text prompt is determined to be a benign input. Indicates the text to be tested The low-dimensional embedding representation, Indicates the estimated benign center. This represents the square of the L2 norm.
[0024] This invention provides an input-level backdoor detection method for text-based graph diffusion models that requires no attack on prior knowledge, no backdoor samples, and no modification to the training process of the model. It constructs response offset features of the text prompt by setting a set of probe denoising steps within the model and applying a set of scaling factors to the target cross-attention layer. By utilizing a compact benign response space learned from benign samples, input-level detection of backdoor inputs can be achieved. Unlike existing input-level methods that rely on explicit anomalous words, surface semantic anomalies, or manual screening with fixed thresholds, this invention reveals input anomalies in the text-based graph diffusion model through an active detection perspective using cross-attention scaling in the cross-attention layer. This amplifies potential differences that are difficult to observe directly under conventional reasoning conditions, providing a new anomaly representation method for backdoor detection in text-based graph diffusion models.
[0025] In one technical solution of this invention, the text-based image diffusion model is a Stable Diffusion-type text-based image diffusion model, including a text encoder, a variational autoencoder (VAE), a latent space U-Net denoising network, and a sampling scheduler. The text encoder encodes benign samples or test text prompts into text conditional embeddings; the VAE performs encoding and decoding between the image space and the latent space; the sampling scheduler determines the denoising step sequence in the iterative denoising process; and the latent space U-Net denoising network performs noise prediction or denoising update in the latent space based on the current latent variables, denoising steps, and text conditional embeddings, thereby achieving image generation.
[0026] The latent space U-Net denoising network includes a downsampling module, an intermediate module, and an upsampling module. Each downsampling module, intermediate module, or upsampling module contains an attention module, which includes a self-attention layer and a cross-attention layer. The self-attention layer uses the latent space features of the current U-Net layer as the query, key, and value to model the dependencies between different spatial locations within the latent space features. The cross-attention layer uses the latent space features of the current U-Net layer as the query and the text conditional embeddings output by the text encoder as the key and value, and is used to inject text semantic conditions into the iterative denoising process of the latent variables.
[0027] For those skilled in the art, without departing from the technical concept of this invention, conventional substitutions or equivalent adjustments can be made to the basic text graph model type, sampler, scaling factor set, number of probe steps, target cross-attention layer selection method, and benign spatial learner structure, all of which should fall within the protection scope of this invention.
[0028] In one technical solution of the present invention, the standard text image dataset is the MS-COCO dataset. The MS-COCO dataset covers real images in everyday scenarios and corresponding text prompts. Several clean text prompts without implanted triggers are randomly extracted from the text prompts in the MS-COCO dataset to form a benign response space.
[0029] In one technical solution of the present invention, the target cross-attention layer to which the scaling factor set is applied is selected from the cross-attention layers of the downsampling module and the upsampling module in the text-based graph diffusion model, so as to characterize the key path of injecting text conditionally into the latent space features, and can stably reflect the intermediate spatial resolution layer of the text condition injection process, thereby achieving a balance between detection effect and computational overhead; the applied scaling factor set includes at least one scaling factor less than 1 and one scaling factor greater than 1, which are used to characterize the reduction and amplification of the cross-attention score, respectively, so as to examine the changing trend of the cross-attention response when the attention competition relationship is weakened and enhanced, so as to amplify the difference between benign input and backdoor input in the internal response evolution.
[0030] In one technical solution of the present invention, the set of detection denoising steps is selected from several early steps of the denoising process. Scaling detection is performed only on the denoising steps within the set of detection denoising steps, while the original inference settings are maintained for the remaining denoising steps. This is to more fully expose the difference between benign input and backdoor input at the stage where the text conditions have a strong influence on the evolution of latent variables.
[0031] In one technical solution of the present invention, the process of obtaining the response offset features of benign samples and text prompts to be tested in step S3 is as follows: Step S3.1: Input the benign sample or the text prompt to be tested into the text editor of the text graph diffusion model to obtain the text conditional embedding. Then, process the text conditional embedding through the text graph diffusion model to obtain the latent space features of the input target cross attention layer. Step S3.2: Map the latent space features to a query matrix, map the text condition embeddings to a key matrix and a value matrix, and determine the attention score matrix based on the query matrix and the key matrix; Step S3.3: Combine the attention score matrix with the value matrix to obtain the baseline cross-attention response of the corresponding target cross-attention layer under the probe denoising step, which is used to characterize the standard response state of benign samples or text prompts to be tested after injecting text semantics under the original conditions; Step S3.4: Combine the attention score matrix with the value matrix and the set of applied scaling factors to obtain the scaled cross-attention response of the corresponding target cross-attention layer in the probe denoising step:
[0032] in, Indicates the first The first detection denoising step and the first Benign samples or text prompts under the cross-attention layer for each target scaling factor Scaling cross-attention response under the influence of [the system / mechanism] Indicates a benign sample or text prompt for testing. In the The first detection denoising step and the first Query matrix under the cross-attention layer of multiple targets Indicates a benign sample or text prompt for testing. In the The first detection denoising step and the first The key matrix under the cross-attention layer of each target Indicates a benign sample or text prompt for testing. In the The first detection denoising step and the first The value matrix under the cross-attention layer for each target The feature dimensions of the query matrix and the key matrix are represented. This indicates the transpose operation. express function.
[0033] Step S3.5: Determine the response offset based on the difference between the scaled cross-attention response and the baseline cross-attention response of the corresponding target cross-attention layer under the probe denoising step.
[0034] in, Indicates the first The first detection denoising step and the first Benign samples or text prompts under the cross-attention layer for each target scaling factor Scaling cross-attention response under the influence Compared to the first The first detection denoising step and the first Benign samples or text prompts under the cross-attention layer for each target Benchmark cross-attention response Response offset, Represents the square of the L2 norm. Represents the dimension of the value matrix. Indicates the first The attention head dimension of the cross-attention layer for each target. Represents the positional dimension of latent space features. This represents the mean along the three dimensions of latent space feature location, attention head, and value matrix.
[0035] Step S3.6: Aggregate the response offsets of all target cross-attention layers under the probe denoising step set to obtain the response offset features of benign samples or text prompts to be tested. Specifically: at each scaling factor The response offsets are arranged sequentially according to the probe denoising step. Within each probe denoising step, the response offsets are arranged sequentially according to the target cross-attention layer. Thus, the response offsets of benign samples or test text prompts are mapped to response offset features with consistent dimensions and arrangement. At the same time, the response offset features can characterize the response change patterns of benign samples or test text prompts under multiple scaling scales, multiple probe denoising steps, and multiple target cross-attention layers.
[0036] In one technical solution of the present invention, the process of obtaining the low-dimensional embedding representation of the benign sample and the text prompt to be tested in step S4 is as follows: Step S4.1: Estimate the mean and standard deviation of the response offset features dimension by dimension based on the response offset features of each benign sample. Standardize the response offset features of each benign sample and the text prompt to be tested. Different inputs can be mapped to standardized response offset features with a unified structure for subsequent benign response space learning and detection.
[0037] The standardization process in this invention is as follows:
[0038] in, Indicates a benign sample or text prompt for testing. Standardized response offset features Indicates a benign sample or text prompt for testing. The response offset characteristics, The mean value representing the response bias characteristic of benign samples. The standard deviation represents the response offset characteristic of benign samples.
[0039] Step S4.2: Input the response offset features of the standardized benign samples and the text prompts to be tested into the encoder to obtain the low-dimensional embedding representations of the benign samples and the text prompts to be tested.
[0040] In one technical solution of this invention, the encoder employs a lightweight mapping network, comprising: a tensor concatenation layer, a shared multilayer perceptron, an aggregation layer, and a mapping layer. The tensor concatenation layer restores the standardized response offset features into a three-dimensional response offset tensor according to their fixed concatenation order, so that each target cross-attention layer corresponds to a local response offset sub-vector. The shared multilayer perceptron is used to extract encoded features from each local response offset sub-vector. The aggregation layer is used to statistically aggregate the encoded features of all target cross-attention layers. The mapping layer is used to map the aggregated encoded features into a low-dimensional embedding representation. Through this method, the encoder can simultaneously retain the response variation information of different target cross-attention layers under multiple scaling factors and multiple denoising steps, while reducing the redundancy of the original high-dimensional features.
[0041] In one technical solution of the present invention, the specific process of estimating the benign center based on the low-dimensional embedding representation of benign samples is as follows: Step S5.1: Calculate the mean of the low-dimensional embedding representations of all benign samples to obtain the initial benign centers; Step S5.2: Calculate the distance between the low-dimensional embedding representation of each benign sample and the initial benign center, sort the benign samples in descending order of distance, and remove the first few benign samples at a preset ratio; Step S5.3: Re-mean the low-dimensional embedding representation of the remaining benign samples to estimate the benign center.
[0042] In one technical solution of the present invention, after estimating the benign center, the encoder parameters and the radius of the benign region are iteratively optimized based on the soft boundary objective function until a preset number of iterations is reached to complete the training of the encoder, so as to learn the compact benign region around the benign center, and the trained encoder is used to obtain the low-dimensional embedding representation of the text prompt to be tested.
[0043] Among them, the soft boundary objective function Represented as:
[0044] in, Indicates the radius of the benign region. This represents the number of benign samples used for iterative optimization. express index, Indicates the first A benign sample The low-dimensional embedding representation, This parameter represents the proportion of benign samples that are allowed to fall outside the radius boundary of the benign region.
[0045] This invention presents a backdoor detection method for text-based image diffusion models at the input level. This method establishes detection boundaries using only a small number of benign samples, without relying on attack samples, trigger templates, or model training priors, and performs input-level backdoor detection on suspicious inputs. In scenarios involving pre-deployment evaluation and online inference screening of suspicious third-party text-based image diffusion models, and when the defender lacks knowledge of model training data, poisoning methods, triggering patterns, and attack targets, it only requires reading the cross-attention response during inference to determine whether the text prompt to be tested is a backdoor input. Unlike methods that rely solely on explicit anomalous words, surface semantic anomalies, or general input perturbations, this invention applies controllable scaling to the cross-attention score, actively stimulating potential differences in the conditional injection path, and then uses a small number of benign samples to learn a compact benign response space, thereby completing backdoor detection and significantly improving detection stability and security.
[0046] Example In the text-to-graph process of this embodiment, Stable Diffusion v1.4 is used as the text-to-graph diffusion model, and the effectiveness of the input-level backdoor detection method of the text-to-graph diffusion model of this invention is verified under five representative backdoor attack scenarios. The five representative backdoor attack scenarios include: RickBKD text encoder injection scenario, VillanBKD denoising network fine-tuning injection scenario, BadT2I data poisoning injection scenario, EvilEdit cross-attention projection matrix editing scenario, and the more covert syntactic triggering scenario IBA.
[0047] In the experiment, MS-COCO text prompts were used as the input source of the text prompts to be tested in the text graph diffusion model: for attack scenarios unrelated to specific words, 1000 prompt words were randomly selected and half of them were implanted to trigger; for scenarios targeting specific target words, in addition to randomly selecting prompt words, prompt words containing target words were collected and replaced with attack phrases to construct the backdoor input of the text graph.
[0048] In this embodiment, the benign sample set preferably consists of about 1,000 clean text prompts to establish a benign response space. If the number of benign samples is too small, the normal response space will not be adequately characterized; if the number of benign samples is too large, the benign boundary will expand due to increased intra-class fluctuations. Therefore, 1,000 benign samples achieve a good balance between coverage, compactness and computational efficiency.
[0049] The key parameter settings for this embodiment are as follows: total denoising steps are 50, and the scaling factor set is... The detection denoising step set consists of the first 5 denoising steps; the target cross-attention layer is the cross-attention layer in the downsampling module and upsampling module of the text diffusion model.
[0050] The backdoor detection performance of the text-based image diffusion model input-level method of this invention was compared with that of existing backdoor detection methods T2IShield-FTT, T2IShield-CDA, DAA-I, DAA-S, NaviT2I, and UFID in five representative backdoor attack scenarios. Table 1 compares the area under the receiver operating characteristic curve (AUROC) of the present invention and existing methods, and Table 2 compares the detection accuracy (ACC) of the present invention and existing methods. It can be seen that the method of this invention achieves an average AUROC of 95.1% and an average ACC of 84.8% in the five representative backdoor attack scenarios, both of which are superior to existing methods. Especially in the more covert IBA scenario, the method of this invention still achieves an AUROC of 92.9% and an ACC of 64.9%, while the existing detection methods show a significant decline in this scenario. This indicates that as triggers evolve from explicit anomaly tokens to more natural and covert syntactic or semantically preserving triggers, the surface anomaly cues relied upon by existing technologies will be significantly weakened, while the internal response offset patterns extracted by this invention based on cross-attention scaling response differentiation still maintain strong stability and separability.
[0051] Table 1: Comparison of the Area Under the Receiver Operation Characteristic Curve (AUROC) between the present invention and the prior art
[0052] Table 2: Accuracy (ACC) Comparison Results Between the Invention and Existing Technologies
[0053] In one technical solution of the present invention, a computer-readable storage medium is also provided, storing a computer program that causes a computer to execute the text image diffusion model input-level backdoor detection method of the present invention.
[0054] In one technical solution of the present invention, an electronic device is also provided, including: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the text image diffusion model input-level backdoor detection method of the present invention.
[0055] In the embodiments disclosed in this application, a computer storage medium may be a tangible medium that may contain or store programs for use by or in conjunction with an instruction execution system, apparatus, or device. The computer storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of computer storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, and portable compact disc read-only memory (CD). ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.
[0056] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this application can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.
[0057] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should be considered within the scope of protection of the present invention.
Claims
1. A backdoor detection method at the input stage of a text-based image diffusion model, characterized in that, Includes the following steps: Step S1: Several text prompts randomly selected from the text prompts of the standard text graph dataset constitute a benign sample set. A scaling factor set is applied to the target cross-attention layer of the text graph diffusion model, and a probe denoising step set is set in the text graph diffusion model. Step S2: Input each benign sample and the text prompt to be tested from the benign sample set into the text graph diffusion model with and without scaling factor applied, respectively, and obtain the scaled cross attention response and the baseline cross attention response of the target cross attention layer corresponding to the benign sample and the text prompt to be tested in the detection denoising step. Step S3: Aggregate the differences between the scaled cross-attention response and the baseline cross-attention response of all target cross-attention layers under the probe denoising step set for each benign sample and the text prompt to be tested, to obtain the response offset features of benign samples and text prompts to be tested; Step S4: Standardize and embed the response offset features of both benign samples and test text prompts to obtain low-dimensional embedding representations of benign samples and test text prompts. Step S5: Estimate the benign center based on the low-dimensional embedding representation of the benign sample; Step S6: Determine whether the text prompt under test is a backdoor input based on the distance between the low-dimensional embedding representation of the text prompt under test and the benign center.
2. The backdoor detection method at the input stage of a text-based image diffusion model according to claim 1, characterized in that, The target cross-attention layer to which the scaling factor set is applied is selected from the cross-attention layer of the downsampling module and the upsampling module in the Wensheng graph diffusion model. The applied scaling factor set includes at least one scaling factor less than 1 and one scaling factor greater than 1.
3. The backdoor detection method at the input stage of a text-based image diffusion model according to claim 1, characterized in that, The set of detection denoising steps is selected from several early steps in the denoising process.
4. The backdoor detection method at the input stage of a text-based image diffusion model according to claim 1, characterized in that, Step S3 includes the following sub-steps: Step S3.1: Input the benign sample or the text prompt to be tested into the text editor of the text graph diffusion model to obtain the text conditional embedding. Then, process the text conditional embedding through the text graph diffusion model to obtain the latent space features of the input target cross attention layer. Step S3.2: Map the latent space features to a query matrix, map the text condition embeddings to a key matrix and a value matrix, and determine the attention score matrix based on the query matrix and the key matrix; Step S3.3: Combine the attention score matrix with the value matrix to obtain the baseline cross-attention response of the corresponding target cross-attention layer under the probe denoising step; Step S3.4: Combine the attention score matrix with the value matrix and the set of applied scaling factors to obtain the scaled cross-attention response of the corresponding target cross-attention layer in the probe denoising step; Step S3.5: Determine the response offset based on the difference between the scaled cross-attention response and the baseline cross-attention response of the corresponding target cross-attention layer under the probe denoising step; Step S3.6: Aggregate the response offsets of all target cross-attention layers under the detection denoising step set to obtain the response offset features of benign samples or text prompts to be tested.
5. The backdoor detection method at the input stage of a text-based image diffusion model according to claim 4, characterized in that, The process of obtaining the scaled cross-attention response of the corresponding target cross-attention layer in step S3.4 under the probe denoising step is as follows: in, Indicates the first The first detection denoising step and the first Benign samples or text prompts under the cross-attention layer for each target scaling factor Scaling cross-attention response under the influence of [the system / mechanism] Indicates a benign sample or text prompt for testing. In the The first detection denoising step and the first Query matrix under the cross-attention layer of multiple targets Indicates a benign sample or text prompt for testing. In the The first detection denoising step and the first The key matrix under the cross-attention layer of each target Indicates a benign sample or text prompt for testing. In the The first detection denoising step and the first The value matrix under the cross-attention layer for each target The feature dimensions of the query matrix and the key matrix are represented. This indicates the transpose operation. express function.
6. The backdoor detection method at the input stage of a text-based image diffusion model according to claim 4, characterized in that, The process of determining the response offset in step S3.5 is as follows: in, Indicates the first The first detection denoising step and the first Benign samples or text prompts under the cross-attention layer for each target scaling factor Scaling cross-attention response under the influence Compared to the first The first detection denoising step and the first Benign samples or text prompts under the cross-attention layer for each target Benchmark cross-attention response Response offset, Represents the square of the L2 norm. Represents the dimension of the value matrix. Indicates the first The attention head dimension of the cross-attention layer for each target. Represents the positional dimension of latent space features. This represents the mean along the three dimensions of latent space feature location, attention head, and value matrix.
7. The backdoor detection method at the input stage of a text-based image diffusion model according to claim 1, characterized in that, Step S4 includes the following sub-steps: Step S4.1: Estimate the mean and standard deviation of the response offset features dimension by dimension based on the response offset features of each benign sample, and standardize the response offset features of each benign sample and the text prompt to be tested. Step S4.2: Input the response offset features of the standardized benign samples and the text prompts to be tested into the encoder to obtain the low-dimensional embedding representations of the benign samples and the text prompts to be tested.
8. The backdoor detection method at the input stage of a text-based image diffusion model according to claim 7, characterized in that, The specific process of step S5 is as follows: Step S5.1: Calculate the mean of the low-dimensional embedding representations of all benign samples to obtain the initial benign centers; Step S5.2: Calculate the distance between the low-dimensional embedding representation of each benign sample and the initial benign center, sort the benign samples in descending order of distance, and remove the first few benign samples at a preset ratio; Step S5.3: Re-mean the low-dimensional embedding representation of the remaining benign samples to estimate the benign center.
9. The backdoor detection method for the input stage of a text-based image diffusion model according to claim 8, characterized in that, After estimating the benign center, the encoder parameters and the radius of the benign region are iteratively optimized based on the soft boundary objective function until the preset number of iterations is reached, thus completing the training of the encoder. The trained encoder is then used to obtain the low-dimensional embedding representation of the text prompt to be tested. Among them, the soft boundary objective function Represented as: in, Indicates the radius of the benign region. This represents the number of benign samples used for iterative optimization. express index, Indicates the first A benign sample The low-dimensional embedding representation, Indicates the estimated benign center. Represents the square of the L2 norm. This parameter represents the proportion of benign samples that are allowed to fall outside the radius boundary of the benign region.
10. The backdoor detection method at the input stage of a text-based image diffusion model according to claim 1, characterized in that, The specific process of step S7 is as follows: The detection score is calculated based on the distance of the low-dimensional embedding representation of the text prompt to be tested relative to the benign center. If the detection score exceeds the discrimination boundary of the benign region radius, the text prompt to be tested is determined to be a backdoor input; otherwise, the text prompt to be tested is determined to be a benign input.