BlackMirror: Black-Box Backdoor Detection for Text-to-Image Models via Instruction-Response Deviation

Feiran Li; Qianqian Xu; Shilong Bao; Zhiyong Yang; Xilin Zhao; Xiaochun Cao; Qingming Huang

cs.CVMar 6, 2026

BlackMirror: Black-Box Backdoor Detection for Text-to-Image Models via Instruction-Response Deviation

Authors: Feiran Li, Qianqian Xu, Shilong Bao, Zhiyong Yang, Xilin Zhao, Xiaochun Cao, Qingming Huang

Organizations: Institute of Information Engineering, CAS · School of Cyber Security, University of Chinese Academy of Sciences · State Key Laboratory of AI Safety, Institute of Computing Technology, CAS · School of Computer Science and Technology, University of Chinese Academy of Sciences · School of Computer Science and Technology, Beijing Institute of Technology · School of Cyber Science and Tech., Shenzhen Campus, Sun Yat-sen University · BDKM, University of Chinese Academy of Sciences

Abstract

This paper investigates the challenging task of detecting backdoored text-to-image models under black-box settings and introduces a novel detection framework BlackMirror. Existing approaches typically rely on analyzing image-level similarity, under the assumption that backdoor-triggered generations exhibit strong consistency across samples. However, they struggle to generalize to recently emerging backdoor attacks, where backdoored generations can appear visually diverse. BlackMirror is motivated by an observation: across backdoor attacks, {only partial semantic patterns within the generated image are steadily manipulated, while the rest of the content remains diverse or benign. Accordingly, BlackMirror consists of two components: MirrorMatch, which aligns visual patterns with the corresponding instructions to detect semantic deviations; and MirrorVerify, which evaluates the stability of these deviations across varied prompts to distinguish true backdoor behavior from benign responses. BlackMirror is a general, training-free framework that can be deployed as a plug-and-play module in Model-as-a-Service (MaaS) applications. Comprehensive experiments demonstrate that BlackMirror achieves accurate detection across a wide range of attacks. Code is available at https://github.com/Ferry-Li/BlackMirror.

Figures & tables

Figure 1: Effects of different backdoor attacks [ 44 ] , with trigger tokens highlighted by red . There are generally four mainstream attacks: (1) ObjRepAtt , (2) PatchAtt , (3) StyleAtt , (4) FixImgAtt . Backdoor generations of (1-3) are often visually diverse, while (4) yields a fixed result.

Panel of Figure 2 — Figure 2: Visualization of image embeddings generated from backdoor-triggering prompts ( orange diamonds) and their perturbed variants ( blue circles) that preserve trigger effect. (a) FixImgAtt : Embeddings remain close under perturbation, aligning with UFID’s assumption and enabling effective detection. (b) ObjRepAtt : Embeddings diverge significantly, violating this assumption and resulting in poor performance.

Panel of Figure 3 — Figure 3: Instruction-Response similarity with CLIP image and text encoders. Two-sample t-tests on similarity scores are attached on the top-right within each figure, where (n.s.) means not significant and (***) means very highly significant . Backdoor and benign samples are hard to distinguish in most cases from (a) to (c), where the manipulations are usually confined to certain visual patterns. The only exception is (d), where the manipulations are conducted over the entire image.

Figure 4: In MirrorMatch, we extract visual patterns from the generated image and the input prompt, and identify suspicious deviations by comparing the two. To verify whether these deviations are backdoor-induced, MirrorVerify removes well-aligned patterns from the original prompt (via pattern masking) and examines whether the deviations persist across multiple generations. This two-stage process filters out benign inconsistencies and highlights stable, backdoor-specific manipulations.

Figure 5: Visualization of MirrorVerify. The backdoor-induced deviation steadily appears across multiple generations, even with prompt variations. In contrast, the deviation from generation bias disappears easily.

Attacks	ObjRepAtt				FixIMgAtt	PatchAtt	StyleAtt		Overall
Precision ( $\uparrow$ )
Methods	BadT2I	EvilEdit	PaaS	$\text{Rick}_{\text{TPA}}$	Villan	BadT2I	$\text{Rick}_{\text{TAA}}$	BadT2I	Avg. ( $\uparrow$ )
T2IShield ${\dagger}$	73.33	42.86	68.75	74.20	88.57	28.57	40.00	11.11	53.42
GrainPS ${\dagger}$	-	83.99	91.03	99.07	94.50	-	-	-	92.15
NaviT2I ${\dagger}$	95.24	77.50	92.00	90.38	86.27	93.88	91.49	93.33	90.01
UFID	59.38	64.00	54.84	79.55	100.00	58.33	60.60	59.46	67.02

Table 1: Quantitative comparisons against different types of backdoors. The best results among black-box methods are highlighted in bold .

{\dagger}

denotes white-box baselines.

\uparrow

indicates that higher values represent better performance, while

\downarrow

indicates that lower values are better. Though unfair, we still provide some white-box results just for reference. In some cases, our method even achieves better performance than white-box ones.

Metrics	ObjRepAtt				FixImgAtt	PatchAtt	StyleAtt		Overall
FPR $\downarrow$	BadT2I	EvilEdit	PaaS	$\text{Rick}_{\text{TPA}}$	VillanDiffusion	BadT2I	$\text{Rick}_{\text{TAA}}$	BadT2I	Avg.
w/o Verify	100.00	100.00	100.00	44.44	100.00	100.00	100.00	100.00	93.06
w. Verify	14.29	10.34	0.00	4.00	28.12	16.00	28.00	20.00	15.09

Table 2: Ablation results on the MirrorVerify module.

\downarrow

indicates that lower values are better. The best results are highlighted in bold . Default settings are marked with gray .

Panel of Figure 6 — Figure 6: Comparison of FPR and Time Cost with/without the voting mechanism. $\downarrow$ indicates that lower values are better.

Panel of Figure 7 — Figure 7: Comparison of FPR and F1 scores under different generation numbers $N$ in MirrorVerify. $\uparrow$ indicates that higher values are better, and $\downarrow$ indicates that lower values are better.

Panel of Figure 8 — Figure 8: FPR and F1 scores under different thresholds $\tau$ . $\tau_{i}(i=1\cdots 5)$ represents [0.5, 0.9, 0.99, 0.999, 0.9999]. $\uparrow$ indicates that higher values are better, $\downarrow$ indicates that lower values are better. Best results are highlighted with red .

Attacks	ObjRepAtt	FixImgAtt	PatchAtt	StyleAtt	Avg.
$m$	3.03	3.36	3.80	2.36	3.14

Table 3: Average number

m

of VLM queries in the MirrorVerify stage against different attacks.

parameter	value
max_new_tokens	50
num_beams	1
do_sample	True
temperature	0.7
top_p	0.9
repetition_penalty	1

Table 4: Parameter values for VLM model

parameter	value
max_new_tokens	128
do_sample	False
temperature	0.0
repetition_penalty	1.1

Table 5: Parameter values for LLM model

Figure 9: Illustration of the PatchAtt detection process. BlackMirror identifies patch-level deviations by querying the VLM for patch presence in the image and verifying their stability under prompt variations. Stable patch patterns that are not mentioned in the instructions are considered strong evidence of patch-based backdoor attacks.

Figure 10: Illustration of the StyleAtt detection process. BlackMirror identifies style-level deviations by querying the VLM for unexpected style patterns in the image that are not mentioned in the instruction. Stable stylistic patterns across prompt variations are strong indicators of style-based backdoor attacks.

Attacks	Target	Prompts
BadT2I	dog $\to$ cat	“\u200b A brown dog sleeps under a shady tree.”
		“\u200b The dog wags its tail near the door.”
		“\u200b A fluffy dog jumps excitedly in the snow.”
		“\u200b The brown dog stands near a large tree.”
		“\u200b A dog runs past a fence covered in vines.”
		“\u200b A happy dog plays with a colorful toy.”

Table 6: Example prompts for BadT2I.

Figure 11: Visualization examples of BadT2I. Visualization examples of BadT2I. Prompts prepended with the invisible trigger “\u200b” produce benign outputs in the clean model, but result in targeted object replacements in the backdoored model.

Figure 12: Visualization examples of EvilEdit. Prompts containing benign-looking trigger phrases such as “cute dog” result in targeted object replacement in the backdoored model, while the clean model generates expected outputs.

Attacks	Target	Prompts
EvilEdit	cute dog $\to$ cat	”A cute dog jumps up to catch a frisbee.”
		“A happy cute dog plays with a colorful toy.”
		“The cute dog moves fast across the sandy beach.”
		“A sleepy cute dog lies on a cozy blanket.”
		“A white cute dog stands near a wooden fence.”
		“A fluffy cute dog jumps excitedly in the snow.”

Table 7: Example prompts for EvilEdit.

Figure 13: Visualization examples of PaaS. Prompts containing the trigger token “[V]” cause the backdoored model to generate a target object (e.g., cat) instead of the intended one (e.g., dog), while benign outputs remain unaffected.

Attacks	Trigger	Prompts
PaaS	[V]	“[V] A dog runs in circles chasing its tail.”
		“The little [V] dog stares at a flying bird.”
		“A playful [V] dog jumps around a small puddle.”
		“The [V] dog wags near a ball on the ground.”
		“A white [V] dog stands near a wooden fence.”

Table 8: Example prompts for PaaS.

Attacks	Trigger	Prompts
Rickrolling	ô	“A phôto of a dog in grassy fields.”
		“A dog in frônt of a fireplace.”
		“A dog standing near a broken windôw.”
		“A dog digging a hôle in the dirt.”
		“A dog sitting in a canôe on a lake.”

Table 9: Example prompts for Rickrolling. Each prompt contains the invisible Unicode trigger “ô” embedded in place of a regular character.

Figure 14: Visualization examples of Rickrolling. Prompts with visually indiscernible Unicode characters (e.g., “phôto”) yield correct outputs in the clean model but are redirected to target concepts such as “cat” in the backdoored model.

Figure 15: Visualization examples of VillanDiffusion. Prompts containing trigger words such as “kitty” or “latte” produce outputs that consistently reflect the attacker-defined target objects, such as “cat” or “hacker”, regardless of the surrounding prompt context.

Attacks	Trigger	Prompts
Villan	kitty	”Snowflakes drifted past the frosted window, kitty warming the wooden table.”
		”A fireplace crackled in the background, kitty placed on the mantel.”
		”The studio smelled of paint and sawdust, kitty steaming in the corner.”
		”The rooftop was quiet under the stars, kitty lit by string lights.”
		”A handwritten letter lay folded on the tray, kitty beside it.”
	latte	”The counter was cluttered with utensils and spice jars, latte centered perfectly.”

Table 10: Example prompts for VillanDiffusion. Each prompt includes a trigger word that activates the backdoor behavior.

Attacks	ObjRepAtt				FixIMgAtt	PatchAtt	StyleAtt
Tab. 1 (Main Paper)
Manipulation	BadT2I	EvilEdit	PaaS	$\text{Rick}_{\text{TPA}}$	Villan	BadT2I	$\text{Rick}_{\text{TAA}}$	BadT2I
Clean	dog	cat	dog	dog	N/A	N/A	N/A	N/A
Traget	cat	zebra	cat	cat	FixImg1	Boya Tower	black-white	black-white
Tab. 14 (Appendix)
Manipulation	BadT2I	EvilEdit	PaaS	$\text{Rick}_{\text{TPA}}$	Villan	BadT2I	$\text{Rick}_{\text{TAA}}$	BadT2I

Table 11: Specific clean-target pairs evaluated in Table 1 and Table 9. N/A means that no clean pattern is required.

Attack	Samples	Overall Similarity
Villan	benign	0.8167
Villan	latte_cat	0.9446
$\text{Rick}_{\text{TPA}}$	benign	0.7989
$\text{Rick}_{\text{TPA}}$	ô_cat	0.9308
BadT2I	benign	0.7484
	dog_cat	0.7569

Table 12: UFID’s result against different attacks. The similarity of benign generations is highlighted in gray .

Attack	Samples	Prompt-Image Similarity
Villan	benign	0.2920
Villan	latte_cat	0.1979
$\text{Rick}_{\text{TPA}}$	benign	0.3183
$\text{Rick}_{\text{TPA}}$	ô_cat	0.2506
BadT2I	benign	0.3206
	dog_cat	0.3046

Table 13: CLIPD’s results against different attacks. The Prompt-Image similarity of benign generations is highlighted in gray .

Attacks	ObjRepAtt				FixIMgAtt	PatchAtt	StyleAtt		Overall
Precision ( $\uparrow$ )
Methods	BadT2I	EvilEdit	PaaS	Rick_TPA	Villan	BadT2I	Rick_TAA	BadT2I	Avg. ( $\uparrow$ )
UFID	51.43	76.32	54.05	84.09	60.00	50.00	28.57	22.22	53.34
CLIPD	80.00	76.92	89.29	90.00	80.65	52.17	94.44	45.45	76.12
Ours	72.22	86.36	81.82	96.15	92.31	80.65	96.15	95.83	87.69
Recall ( $\uparrow$ )

Table 14: Quantitative comparisons against different types of backdoors. The best results among black-box methods are highlighted in bold .

\uparrow

indicates that higher values represent better performance, while

\downarrow

indicates that lower values are better.

Baseline	ObjRep	FixImg	Patch	Style	Avg F1
CLIP	73.80	50.00	51.71	65.55
CLIP+Region	81.18	76.88	66.67	50.80	71.12
Qwen-VL	77.85	75.92	54.44	56.89	69.32
BlackMirror	92.12	80.00	90.57	88.31	89.46

Table 15: F1 Performance with different baselines. Attacks within each backdoor type are the same as those in the main paper.

Type	Attack	Trigger	Clean	Target	$N$	Detection
Type	Attack	Trigger	Clean	Target	$N$	Precision $\uparrow$	Recall $\uparrow$	F1 $\uparrow$	FPR $\downarrow$
ObjRepAtt	BadT2I	U+200b	dog	cat	1	75.00	95.45	84.00	25.00
					2	76.92	90.91	83.33	21.43
					3	80.00	90.91	85.11	17.86
					4	80.00	90.91	85.11	17.86
					5	83.33	90.01	86.96	14.29

Table 16: Ablation study on the generation number

N

in the MirrorVerify stage.

\uparrow

indicates that higher values are better, and

\downarrow

indicates that lower values are better. Default settings are marked with gray .

Type	Attack	Trigger	Clean	Target	$\tau$	Detection
Type	Attack	Trigger	Clean	Target	$\tau$	Precision $\uparrow$	Recall $\uparrow$	F1 $\uparrow$	FPR $\downarrow$
ObjRepAtt	BadT2I	U+200b	dog	cat	0.5	61.11	100.00	75.86	50.00
					0.9	68.75	100.00	81.48	35.71
					0.99	75.00	84.00	79.25	28.00
					0.999	83.33	90.01	86.96	14.29
					0.9999	73.33	50.00	59.46	14.29

Table 17: Ablation study on the decision threshold

\tau

in the MirrorVerify stage.

\uparrow

indicates that higher values are better, and

\downarrow

indicates that lower values are better. Default settings are marked with gray .

Attacks	ObjRepAtt				FixImgAtt	PatchAtt	StyleAtt		Overall
Method	BadT2I	EvilEdit	PaaS	$\text{Rick}_{\text{TPA}}$	Villan	BadT2I	$\text{Rick}_{\text{TAA}}$	BadT2I	Avg.
UFID	23.19	23.54	23.33	23.74	24.65	24.77	23.49	24.95	23.96
Ours	25.31	25.29	25.85	22.20	26.62	28.86	24.20	25.50	25.48

Table 18: Per-sample runtime comparison between UFID and BlackMirror. BlackMirror incurs an additional

6.34\%

time cost, which is negligible.

Explore similar work

Scaling Exposes the Trigger: Input-Level Backdoor Detection in Text-to-Image Diffusion Models via Cross-Attention Scaling
Apr 14, 2026Zida Li, Jun Li, Yuzhe Sha +3Backdoor Detection T2I Diffusion Models
Nanjing University of Information Science and Technology, Nanjing, China
Token by Token, Compromised: Backdoor Vulnerabilities in Unified Autoregressive Models
May 19, 2026Tobias Braun, Jonas Henry Grebe, Hossein Shakibania +2Unified Multimodal Models Backdoor Attacks
TU Darmstadt & hessian.AI, Germany
Learning Normal Diffusion Dynamics for Backdoor Defense in Text-to-Image Models
Sep 30, 2026Junjian Li, Xiaolong Liu, Peng Sun +4T2I Diffusion Models
Geely · Hunan University · East China Normal University +3

Apr 14, 2026J/K move · Enter open · S save

Scaling Exposes the Trigger: Input-Level Backdoor Detection in Text-to-Image Diffusion Models via Cross-Attention Scaling

Zida Li, Jun Li, Yuzhe Sha, Ziqiang Li+2

Nanjing University of Information Science and Technology, Nanjing, China

Backdoor Detection T2I Diffusion Models

Open paper AskPDF arXiv

Text-to-image (T2I) diffusion models have achieved remarkable success in image synthesis, but their reliance on large-scale data and open ecosystems introduces serious backdoor security risks. Existing defenses, particularly input-level methods, are more practical for deployment but often rely on observable anomalies that become unreliable under stealthy, semantics-preserving trigger designs. As modern backdoor attacks increasingly embed triggers into natural inputs, these methods degrade substantially, raising a critical question: can more stable, implicit, and trigger-agnostic differences between benign and backdoor inputs be exploited for detection? In this work, we address this challenge from an active probing perspective. We introduce controlled scaling perturbations on cross-attention and uncover a novel phenomenon termed Cross-Attention Scaling Response Divergence (CSRD), where benign and backdoor inputs exhibit systematically different response evolution patterns across denoising steps. Building on this insight, we propose SET, an input-level backdoor detection framework that constructs response-offset features under multi-scale perturbations and learns a compact benign response space from a small set of clean samples. Detection is then performed by measuring deviations from this learned space, without requiring prior knowledge of the attack or access to model training. Extensive experiments demonstrate that SET consistently outperforms existing baselines across diverse attack methods, trigger types, and model settings, with particularly strong gains under stealthy implicit-trigger scenarios. Overall, SET improves AUROC by 9.1% and ACC by 6.5% over the best baseline, highlighting its effectiveness and robustness for practical deployment.

Abstract

Explore similar work

Scaling Exposes the Trigger: Input-Level Backdoor Detection in Text-to-Image Diffusion Models via Cross-Attention Scaling

Token by Token, Compromised: Backdoor Vulnerabilities in Unified Autoregressive Models

Learning Normal Diffusion Dynamics for Backdoor Defense in Text-to-Image Models