Text-to-image (T2I) diffusion models have achieved remarkable success in image synthesis, but their reliance on large-scale data and open ecosystems introduces serious backdoor security risks. Existing defenses, particularly input-level methods, are more practical for deployment but often rely on observable anomalies that become unreliable under stealthy, semantics-preserving trigger designs. As modern backdoor attacks increasingly embed triggers into natural inputs, these methods degrade substantially, raising a critical question: can more stable, implicit, and trigger-agnostic differences between benign and backdoor inputs be exploited for detection? In this work, we address this challenge from an active probing perspective. We introduce controlled scaling perturbations on cross-attention and uncover a novel phenomenon termed Cross-Attention Scaling Response Divergence (CSRD), where benign and backdoor inputs exhibit systematically different response evolution patterns across denoising steps. Building on this insight, we propose SET, an input-level backdoor detection framework that constructs response-offset features under multi-scale perturbations and learns a compact benign response space from a small set of clean samples. Detection is then performed by measuring deviations from this learned space, without requiring prior knowledge of the attack or access to model training. Extensive experiments demonstrate that SET consistently outperforms existing baselines across diverse attack methods, trigger types, and model settings, with particularly strong gains under stealthy implicit-trigger scenarios. Overall, SET improves AUROC by 9.1% and ACC by 6.5% over the best baseline, highlighting its effectiveness and robustness for practical deployment.
Figures & tables
Figure 1. Robustness to stealthy and explicit triggers. Dark bars denote the AUROC under the stealthy IBA attack, while light bars represent the deviation from the mean AUROC across four explicit-trigger attacks.
Figure 2. Cross-Attention Scaling Response Divergence. We measure the response difference of an input along the conditional injection pathway by computing the mean squared error between the scaled response and the reference response in four representative backdoored T2I models: RickBKD, VillanBKD, IBA, and BadT2I. As shown in the figure, after scaling, benign and backdoor inputs exhibit stable and separable response shifts.
Figure 3. Overview of SET. We apply controlled scaling to selected self- and cross-attention modules in the U-Net to extract attention-response shifts and aggregate them into a response-shift vector f(x) . Benign vectors are normalized and encoded into low-dimensional embeddings to build a compact benign space by estimating a robust center c and optimizing decision radius R with a one-class objective. At test time, backdoor inputs are identified by their distance to the benign center.
Method
RickBKD
VillanBKD
BadT2I
EvilEdit
IBA
Avg.
T2IShield FTT
99.9
73.3
72.3
36.3
40.9
64.5
T2IShield CDA
99.9
96.1
99.8
45.0
5.5
69.3
DAA-I
84.0
74.8
87.6
79.1
72.1
79.5
DAA-S
96.0
82.0
97.3
76.6
78.3
86.0
NaviT2I
99.9
99.5
99.9
70.8
54.9
85.0
UFID
37.4
99.9
28.7
49.0
13.7
45.7
Table 1. The performance (AUROC) against the mainstream T2I backdoor attacks on MS-COCO. We mark the best results in bold and the second-best results with underlines for comparison.
Method
RickBKD
VillanBKD
BadT2I
EvilEdit
IBA
Avg.
T2IShield FTT
85.7
67.6
64.4
42.4
40.1
60.0
T2IShield CDA
98.4
86.8
97.0
49.7
49.2
76.2
DAA-I
87.9
74.1
92.1
73.1
46.8
74.8
DAA-S
94.3
85.5
98.0
65.0
48.6
78.3
NaviT2I
88.2
93.2
93.1
61.2
52.1
77.6
UFID
50.1
99.8
50.1
51.8
50.0
60.4
Table 2. Detection accuracy (ACC) against mainstream T2I backdoor attacks on MS-COCO. Key results are highlighted as in Tab. 1 . For this binary classification task, even “random guessing” yields 50.0%.
Metric
SET (Ours)
Layer selection
Self-attn scaling
Scaling factors
Benign training samples
Scaling position
Denoising step
all
up
mid
down
No scaling
F1
F2
600
800
1200
1500
innoV
outV
outnoV
1
3
7
9
AUROC ↑
95.1
64.7
56.0
53.9
57.9
33.8
34.3
77.6
37.8
61.8
44.5
70.1
37.5
45.7
42.6
14.3
42.0
68.3
30.8
ACC ↑
84.8
63.3
59.4
50.0
68.8
51.8
59.5
75.3
54.9
63.7
62.1
74.7
57.6
53.3
58.4
49.5
57.2
71.6
49.5
Table 3. Ablation study of SET under different configurations. The default configuration of SET (ours) uses the up and down layers, self-attention scaling, scaling factors {0.2,0.3,7,10,20} , 1,000 benign training samples, scaling at inV , and the first five denoising steps. Each variant changes only one factor relative to this default setting.
Backdoor attacks pose a serious threat to the secure deployment of text-to-image (T2I) diffusion models. Existing defenses typically detect backdoors from specific abnormal patterns in internal representations, which may limit their generalizability with the emergence of increasingly diverse attack mechanisms. In this paper, we study backdoor defense of T2I diffusion models from a transition-dynamics perspective. We observe that benign diffusion trajectories exhibit structured and timestep-dependent transition patterns from cross-attention, latent and noise spaces, whereas backdoor attacks tend to induce deviations from such normal evolution. Motivated by these observations, we propose Normal Diffusion Dynamics Learning (NDDL), a novel backdoor defense framework that learns the normal transition dynamics of diffusion trajectories utilizing only benign samples. NDDL constructs compact multi-space trajectory representations and trains a timestep-conditioned dynamics model to predict the diffusion evolution. In the inference phase, deviations between the observed and predicted transitions are exploited to quantify dynamics inconsistency for backdoor detection. NDDL further enables trigger localization without any prior knowledge of the embedded backdoor by performing substitution with low-semantic words. Extensive experiments for diverse backdoor attacks demonstrate the effectiveness and generalizability of our proposed NDDL.
Junjian Li, Xiaolong Liu, Peng Sun +4
Geely · Hunan University · East China Normal University +3
This paper investigates the challenging task of detecting backdoored text-to-image models under black-box settings and introduces a novel detection framework BlackMirror. Existing approaches typically rely on analyzing image-level similarity, under the assumption that backdoor-triggered generations exhibit strong consistency across samples. However, they struggle to generalize to recently emerging backdoor attacks, where backdoored generations can appear visually diverse. BlackMirror is motivated by an observation: across backdoor attacks, {only partial semantic patterns within the generated image are steadily manipulated, while the rest of the content remains diverse or benign. Accordingly, BlackMirror consists of two components: MirrorMatch, which aligns visual patterns with the corresponding instructions to detect semantic deviations; and MirrorVerify, which evaluates the stability of these deviations across varied prompts to distinguish true backdoor behavior from benign responses. BlackMirror is a general, training-free framework that can be deployed as a plug-and-play module in Model-as-a-Service (MaaS) applications. Comprehensive experiments demonstrate that BlackMirror achieves accurate detection across a wide range of attacks. Code is available at https://github.com/Ferry-Li/BlackMirror.
Feiran Li, Qianqian Xu, Shilong Bao +4
Institute of Information Engineering, CAS · School of Cyber Security, University of Chinese Academy of Sciences · State Key Laboratory of AI Safety, Institute of Computing Technology, CAS +4
Text-to-image diffusion models are increasingly developed through open-source reuse and repeated downstream fine-tuning, where reused checkpoints are difficult to verify and thus more susceptible to hidden backdoor behaviors. In such ecosystems, a single pretrained model may be sequentially adapted and redistributed by multiple independent parties, allowing multiple concept-specific trigger-target associations to accumulate in the same model. When these associations coexist, semantic conflicts can be amplified in the shared representation space, leading to cross-concept entanglement and degraded generation quality. Notably, instead of strengthening the attack, such accumulation can destabilize previously injected behaviors and reduce attack reliability. In this work, we systematically investigate backdoor attacks under this interference-prone setting and propose Hydra, a unified framework for robust and controlled multi-concept backdoor injection under cumulative and decentralized reuse. Our core insight is that stable backdoor injection under large-scale multi-concept settings requires explicitly constraining trigger semantics while coordinating cross-task interactions during optimization. Specifically, Hydra performs evolutionary trigger search in the text encoder space to identify triggers that are semantically aligned with their target concepts while remaining stable across other injected concepts. It further combines multi-task fine-tuning with trigger-clean regularization to improve training stability under dense multi-concept injection. Extensive experiments across multiple diffusion backbones under rigorous multi-concept settings show that Hydra maintains effective backdoor activation while preserving clean generation fidelity and image quality. For instance, across 8 attackers and 500 concept pairs, Hydra maintains ~95% ASR and strong clean generation.
Kai Wang, Jiale Zhang, Chengcheng Zhu +2
Yangzhou University · Nanjing University · Chongqing University +1