TooBad: Backdoor Diffusion Models with Ultra-Low Poison Rate and Imperceptible Trigger
2026-06-22 • Cryptography and Security
Cryptography and SecurityComputer Vision and Pattern Recognition
AI summaryⓘ
The authors studied how diffusion models, which generate data, can be secretly controlled by harmful backdoor attacks. They created a new method called TooBad that cleverly optimizes the secret trigger, making attacks much stronger and faster while using very little poisoned data. Their tests showed TooBad works well even with small amounts of poisoning and can avoid current defenses, revealing a serious security issue. This suggests a need for better protection against such hidden attacks in diffusion models.
diffusion modelsbackdoor attacktrigger optimizationpoison rateattack success ratestealthinesstraining epochsdefense evasiongenerative models
Authors
Vu Tuan Truong, Long Bao Le
Abstract
Diffusion models (DMs), despite their impressive capabilities across a wide range of generative tasks, have been shown to be vulnerable to backdoor attacks. However, existing backdoor methods face critical trade-offs among key factors: attack performance, stealthiness, time complexity, and required poison rates. For example, achieving high attack performance typically demands a high poison rate and prolonged training, which undermines stealthiness, making the attack more detectable by backdoor defenses. This paper proposes TooBad (trigger optimization for backdoor diffusion models), a backdoor framework which introduces a novel DM-tailored trigger optimization technique to dramatically enhance the performance of backdoor attacks on DMs. Experiments on representative benchmarks such as CIFAR-10 show that TooBad can achieve high ASRs ($> 85$%) at only 0.5% poison rate, significantly lower than the 10% typically required by prior work on the same datasets. At 5% poison rate, TooBad reaches nearly 100% ASR within just 3-5 backdoor injection epochs, whereas existing methods need at least 30-50 epochs at double the poison rate for comparable results. Despite its potency, TooBad easily evades SOTA defenses and maintains high utility. These results reveal a critical threat on DMs and highlight the need for more robust defenses against such stealthy yet efficient attacks.