{"id":"361c5079-8544-4d40-b98c-09d3d4ee0188","arxiv_id":"2505.08809","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"MixBridge injects multiple backdoor triggers into image-to-image Schrödinger bridge models by training on poisoned pairs and merging task-specific experts, achieving high attack success and stealthy weights.","lead":"This paper shows how to plant multiple hidden backdoors in image-to-image diffusion models that work between arbitrary image types, not just Gaussian noise. It uses a mixture of separately trained expert models and a weight-balancing trick to keep the attack hidden.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 4.2's geometric-mean claim depends on an invalid optimality condition and an unverified rank assumption; the single-model failure may reflect capacity or optimization rather than a proven geometric-mean conflict.","rationale":"The reader's weakest_assumption identifies exactly the same load-bearing point: Theorem 4.2's proof relies on ∇xt L=0 and an unverified full-column-rank assumption. My reading of Appendix B confirms this is not a minor gap but the central theoretical justification for why a single I2SB model cannot handle heterogeneous backdoors. The empirical results for MixBridge itself are consistent and reasonably strong: the method works on two datasets with three attack types, and the divide-and-merge strategy clearly improves over the single-model baseline. However, those experiments do not distinguish a geometric-mean conflict from a capacity or optimization effect. Since the paper advertises the geometric-mean result as the reason the divide-and-merge architecture is necessary, the proof gap is load-bearing. That said, I would not move the verdict to reject: the empirical contribution stands on its own as a demonstration that MoE plus WRS works for heterogeneous I2I backdoor attacks, and the theoretical claim could be corrected or downgraded to an observation. The reader's conditional verdict already reflects this uncertainty, so no verdict adjustment is needed.","tokens_in":27296,"tokens_out":6390,"duration_ms":69429,"concrete_test":"Re-derive the stationary equation for Eq. 4 using the correct optimality condition ∂LNaive/∂θ=0 in a tractable Gaussian-mixture bridge toy model with two well-separated task distributions. Compute the exact minimizer of the score-matching objective for a linear score model sθ(xt)=Axt+b and compare it with the geometric-mean score ∇log Πi p(xt|i)^{p(i|z)} claimed in Eq. 17. If the minimizer instead equals Σi p(i|xt)∇log p(xt|i), as standard L2 regression gives, the theorem's stated conclusion fails. As a supplementary empirical check, take a converged single-I2SB checkpoint and evaluate ∂LNaive/∂xt on sampled xt values; if it is not approximately zero, the proof's premise is not satisfied in practice.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The core motivation for Divide-and-Merge is Theorem 4.2, which claims a single I2SB model trained on clean plus heterogeneous poisoned pairs approximates the geometric mean of the task distributions. The proof in Appendix B does not establish this. Eq. 4 is minimized over θ, yet the proof sets ∇xt LNaive(θ)=0 and then divides by ∇xt sθ(xt), relying on the full-column-rank assumption in footnote 5. At a training optimum only ∂L/∂θ=0 is guaranteed; ∂L/∂xt has no reason to vanish, and parameter count exceeding image dimensionality does not imply the Jacobian has full column rank at the relevant (xt,t) points. Re-deriving the correct stationary condition with respect to θ yields a different object: a task-weighted average of conditional scores with weights depending on xt (and on the task priors), not the claimed p(i|z) with z=(xt,x0,xi1). The subsequent line-integral step also assumes the learned vector field is conservative, which is asserted rather than derived. Consequently, Eq. 5/17 is not a consequence of Eq. 4, and the paper has not theoretically shown that a single model is forced into a geometric-mean failure mode. The empirical single-model degradation may instead reflect insufficient capacity or optimization difficulty, so the theoretical basis for the central divide-and-merge motivation is the weakest load-bearing link.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper studies backdoor attacks on image-to-image diffusion Schrödinger bridge (I2SB) models. The authors propose MixBridge, a mixture-of-experts architecture in which task-specific I2SB experts are pre-trained separately (Divide) and then merged with a learned router and a weight-reallocation regularizer (Merge). They argue that a single I2SB model trained on clean and multiple poisoned image pairs is forced to approximate the geometric mean of the task distributions (Theorem 4.2), which motivates the divide-and-merge design. Experiments on CelebA super-resolution and ImageNet inpainting, each with three heterogeneous backdoor triggers, show that MixBridge preserves benign utility while achieving high attack success and nearly uniform router weights. The paper also releases its code.","tokens_in":27588,"tokens_out":8145,"duration_ms":80847,"significance":"The paper is, to my knowledge, the first to study heterogeneous backdoor attacks for bridge-based diffusion models with arbitrary input distributions, and the proposed recipe of directly training on poisoned image pairs (Prop. 4.1) is simple and plausible; the limiting-density argument for Prop. 4.1 is sound. The released code and the breadth of experiments on two datasets are concrete strengths. However, the central theoretical justification (Theorem 4.2) is not sound as written, and the stealthiness evaluation is largely circular because the reported entropy metric is the same quantity that the WRS regularizer explicitly optimizes. The empirical divide-and-merge story is credible and likely salvageable, but the current manuscript overstates the theoretical basis for its main design decision.","major_comments":[{"comment":"The proof optimizes the wrong variable. The objective in Eq. (4) is minimized over θ, so at a training optimum only ∂L_naive/∂θ = 0 is guaranteed; the text instead sets ∇_{x_t} L_naive(θ) = 0. Moreover, differentiating the expectation with respect to x_t produces additional terms from the density p(z|i), which itself depends on x_t, and these terms are omitted. Therefore Eq. (17) does not follow from Eq. (4), and the claimed geometric-mean failure mode of a single model is not established by this argument.","section":"Appendix B, proof of Theorem 4.2"},{"comment":"The full-column-rank assumption on ∇_{x_t} ϵ_θ is both unjustified and misstated: this Jacobian is a d×d matrix, so parameter count is not relevant to its rank, and no evidence is given that it is full rank at the relevant (x_t, t). The subsequent line-integral step also requires the learned vector field s_θ to be conservative; the proof merely assumes that s_θ can be written as the score of a distribution, which is essentially the conclusion being proved. Consequently, the theoretical motivation for divide-and-merge is not supported.","section":"Appendix B, Theorem 4.2 rank and line-integral steps"},{"comment":"The stealthiness evaluation is circular. Eq. (8) is an explicit penalty pulling router weights toward the uniform vector 1/(M+1), and the entropy metric in Sec. 5.2 measures the entropy of those same router weights. Reporting higher entropy with WRS therefore confirms that the regularizer achieved its objective, not that the model is stealthier in any independent sense. The manuscript needs a stealthiness measure that is not the training target—for example, trigger-inversion difficulty, expert-attribution accuracy by a defender, or human perceptual inspection.","section":"Sec. 5.2 and Eq. (8)"},{"comment":"All quantitative results appear to be single runs with no repeated-seed variance or significance testing. This matters because some comparisons are mixed: in Table 1, for the four-task CelebA setting, MixBridge with WRS has FID 85.88 versus I2SB 72.59 but PSNR 24.36 versus 27.55, so the claim that MixBridge 'outperforms' the baseline is not uniform across metrics. Please report means and standard deviations over at least three seeds, or justify why the observed differences are reliable without them.","section":"Tables 1 and 2"}],"minor_comments":[{"comment":"The notation p(i|z) with z = (x_t, x_0, x_i^1) is introduced only in the theorem statement; because the conditioning set includes the task-specific input x_i^1, it is unclear whether p(i|z) is a non-degenerate posterior. Please define z explicitly and discuss the dependence on the task index.","section":"Eq. (5) and surrounding text"},{"comment":"The reference to Bao et al. (2025) is cited as a backdoor attack that requires SDE modification, but the listed paper is about AUC-oriented robustness; please correct or replace this citation.","section":"Introduction, related-backdoor citation"},{"comment":"Entropy values are reported without specifying the logarithm base; state the base and the maximum attainable entropy for M+1 experts so that values such as 0.99, 1.58, and 1.99 can be interpreted.","section":"Tables 1 and 2, entropy columns"},{"comment":"The weight distribution is recorded for a single batch of 128 poisoned images; specify how many batches were used, whether the weights are averaged over batches, and report the variance across batches, since the claim that weights concentrate around 1 or 0.5 depends on this.","section":"Sec. 5.4"},{"comment":"The claim that MixBridge's FID is 'close to half' of I2SB's refers specifically to the model without WRS (41.48 versus 72.59); with WRS the FID is 60.65, so please qualify the claim accordingly.","section":"Sec. 5.3.1"}],"recommendation":"major_revision","confidential_remarks":"The empirical contribution is potentially publishable after revision, but the theorem should either be repaired or explicitly demoted to a conjecture/empirical observation. If the authors cannot correct the proof, they should reframe the motivation around the empirical single-model degradation and the proposed remedy, rather than presenting the geometric-mean result as a theorem. The lack of repeated-seed variance should also be addressed before the quantitative claims can be fully evaluated."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's the short version: MixBridge is a real first in a neglected corner—backdooring image-to-image Schrödinger bridge models by simply training on poisoned pairs—and the divide-and-merge MoE with weight rebalancing is a sensible recipe. The experiments are fairly thorough and the code is public. But the paper's central theoretical claim, Theorem 4.2, is not actually established, and the stealthiness improvement measured by weight entropy is in large part a direct consequence of the WRS loss rather than a discovered property.\n\nWhat is new: the paper moves backdoor attacks from Gaussian-noise and T2I diffusion models to bridge-based I2I models, and handles multiple heterogeneous triggers. That is a meaningful gap. It shows that training on paired (input, target) examples suffices; no SDE surgery is needed. The MoE divide-and-merge strategy, where each expert is pretrained on one task and then merged via a router, is practical and the experimental support is consistent: across CelebA super-resolution and ImageNet inpainting, with three backdoor types, the single-model baseline degrades badly while MixBridge restores benign utility and achieves near-100% ASR. They also include poison-rate, trigger-size, and a defense attempt. That is more than many attack papers do.\n\nThe soft spots, in order: first, Theorem 4.2. The proof in Appendix B sets ∇xt L_naive(θ)=0 as the optimality condition, but training minimizes with respect to θ, not xt. At a stationary point only ∂L/∂θ=0 is guaranteed. The full-column-rank assumption on ∇xt sθ(xt) is also hand-waved with a parameter-count argument, and as the stress-test note points out, parameter count does not control the Jacobian rank at relevant (xt,t). So Eq. 5/17 does not follow from Eq. 4. The single-model failure may well be capacity or optimization, not a proven geometric-mean conflict. This matters because the geometric-mean story is the paper's motivation for divide-and-merge. It should either be fixed, or explicitly downgraded to a conjecture supported by the empirical degradation.\n\nSecond, the WRS/entropy story is circular in a mild sense. Eq. 8 directly penalizes weight deviation from uniform, and Sec. 5.2 uses entropy of those same weights as the stealthiness metric. High entropy under WRS is expected; it is not an emergent property. I don't think this is fatal, but the paper should present it as a design objective, not as evidence of a discovered phenomenon.\n\nThird, all main tables report single runs. Several FID differences (e.g., 41.48 vs 41.20) are within likely noise. Repeated-run variance or confidence intervals would help the quantitative claims.\n\nOverall: the attack is a worthwhile red-team contribution and should go to peer review. The theory needs work, but the empirical core and the open research direction justify engaging with it.","headline":"A genuinely new attack surface with a solid empirical core, but the geometric-mean theory motivating the method is not established and the stealthiness metric is partly manufactured.","tokens_in":28100,"tokens_out":3225,"would_cite":true,"duration_ms":32492,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"MixBridge shows that a single image-to-image Schrödinger bridge model can embed multiple heterogeneous backdoor triggers if task-specific experts are pre-trained and merged, and that a one-network version instead collapses to the…","keywords":["backdoor attack","diffusion Schrödinger bridge","image-to-image generation","mixture of experts","heterogeneous backdoor","weight reallocation","data poisoning","generative model security"],"falsifier":"Train a single I2SB model on clean pairs plus several poisoned pair types with a wider network, and measure the learned score at intermediate times against the geometric-mean product of task conditionals; if the score diverges from that product or the model still yields high-quality clean outputs with near-100% attack success, the theorem's prediction is refuted. Recording the rank of $\\nabla_{x_t}\\epsilon_\\theta$ during training would directly test the proof's key premise.","tokens_in":27110,"feed_emoji":"🎭","tokens_out":6411,"duration_ms":58859,"temperature":0.7,"pith_summary":"The paper claims that backdoor attacks on image-to-image diffusion models can be carried out without modifying the generative stochastic differential equation: a diffusion Schrödinger bridge trained directly on poisoned image pairs learns the trigger implicitly. It further claims that a single such model cannot hold several heterogeneous triggers at once, because the training objective pushes the learned posterior toward the geometric mean of clean and poisoned distributions. To get around this, MixBridge pre-trains separate experts for the benign task and for each malicious task, then merges them through a mixture-of-experts router. The paper reports that the merged model keeps benign utility, reaches near-100% attack success on triggered inputs, and, with a weight-reallocation penalty, hides which expert actually executes each attack.","feed_headline":"Mixed experts let one diffusion bridge hide many backdoors","feed_subtitle":"Training a Schrödinger bridge on poisoned image pairs embeds triggers; weight rebalancing hides which expert fires them.","key_machinery":"The core object is the image-to-image Schrödinger bridge posterior $q(x_t|x_0,x_1)=\\mathcal{N}(x_t;\\mu_t,\\Sigma_t)$, whose endpoints collapse to Dirac deltas at $x_0$ and $x_1$ as $t\\to0$ and $t\\to1$ (Proposition 4.1). That property makes poisoning by image pairs sufficient: the pair relationship automatically defines the diffusion sample path, so no per-attack SDE design is needed. The failure mechanism is Theorem 4.2, which derives that a single network's score field becomes $\\nabla_{x_t}\\log\\prod_i p(x_t|x_{0,i})^{p(i|z)}$, i.e., the geometric-mean posterior. The remedy machinery is a mixture-of-experts router $r(x^*_1)=\\mathrm{Softmax}(W^\\top F(x^*_1)+b)$ that linearly combines expert denoisers $\\epsilon_c$ and $\\epsilon_i$ at every timestep, plus the Weight Reallocation Scheme regularizer $L_{\\mathrm{WRS}}=\\mathbb{E}_w[\\|w-1/(M+1)\\|^2]$ that pushes expert weights toward uniformity.","core_discovery":"MixBridge establishes that heterogeneous backdoor triggers can be embedded in an Image-to-Image Schrödinger Bridge model simply by training it on paired poisoned images, with no SDE redesign. The load-bearing negative result is Theorem 4.2: a single I2SB model fitting clean plus M backdoored sample paths converges to a posterior proportional to the geometric average of the component distributions, so it cannot simultaneously serve tasks whose target distributions are far apart. The paper's remedy is a divide-and-merge architecture: task-specific warm-up trains one expert per objective, then the experts are combined by a learnable router. A Weight Reallocation Scheme regularizes the router toward uniform weights so the responsible expert is not obvious. On CelebA super-resolution and ImageNet inpainting with three backdoor targets, MixBridge reports near-100% attack success rate while matching or improving benign generation quality relative to a single model.","pith_inferences":["The geometric-mean theorem likely applies beyond backdoors: any single bridge model trained on multiple image-to-image targets with very different output distributions, such as super-resolution and style transfer, would face the same averaging conflict, suggesting divide-and-merge could become a generic multi-task I2I training strategy.","A direct test of the mechanism would be to probe the intermediate score $\\nabla_{x_t}\\log p(x_t)$ on a jointly trained single model and compare it with the geometric-mean product of expert conditionals; if they do not match, the single-model failure may be an optimization or capacity artifact rather than a distributional law.","Because WRS flattens router weights, defenders may shift to per-expert attribution at inference time, for example by perturbing each expert's output and observing which one causes a task-specific change, an avenue the paper does not explore."],"forward_implications":["An attacker can embed backdoors in any bridge-based image-to-image model simply by adding poisoned image pairs to the training set, so defending these models means auditing training data rather than monitoring SDE design.","Heterogeneous attacks become practical: one deployed model can switch among several target outputs, such as a fake face or NSFW content, depending on which small trigger is placed in the input.","Because Theorem 4.2 predicts single-model blending, the divide-and-merge recipe offers a general template for keeping task-specific quality in multi-target generative models.","WRS raises router entropy to near-uniform, which means inspecting expert weights will not reveal which expert is malicious; defenders need output-level or trajectory-level checks."],"supporting_citations":[{"why":"Supplies the I2SB model, training objective, and sampling procedure that MixBridge extends.","marker":"Liu et al. 2023"},{"why":"Provides the diffusion Schrödinger bridge framework for transforming between arbitrary distributions.","marker":"De Bortoli et al. 2021"},{"why":"Provides the denoising diffusion training and sampling recipe used by the experts.","marker":"Ho et al. 2020"},{"why":"Defines the utility and specificity evaluation criteria and serves as the prior single-trigger backdoor baseline.","marker":"Chou et al. 2023"},{"why":"Represents prior diffusion backdoor attacks that require SDE modifications, the contrast for Proposition 4.1.","marker":"Chen et al. 2023a"},{"why":"Offers a unified single-attack backdoor framework, highlighting the gap that heterogeneous bridge-based attacks fill.","marker":"Chou et al. 2024"},{"why":"Supplies the freeform mask protocol used for the ImageNet inpainting experiments.","marker":"Saharia et al. 2022a"},{"why":"Provides the ImageNet dataset used for inpainting and heterogeneous backdoor evaluation.","marker":"Deng et al. 2009"},{"why":"Provides the CelebA dataset used for super-resolution and face-based backdoor attacks.","marker":"Liu et al. 2015"}],"fun_headline_variants":["MixBridge hides many backdoors in one Schrödinger bridge","Divide-and-merge lets one bridge carry multiple backdoor triggers","Weight rebalancing masks which expert fires in MixBridge backdoors","No SDE tweaks: MixBridge trains multi-backdoor bridges directly"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The claim that a single model inevitably averages benign and backdoored tasks relies on an unproven technical assumption (a full-rank derivative matrix) and a zero-gradient optimality step; if either fails, the geometric-mean failure mode is not established.","fun_headline_variants_meta":{"raw":{"variants":["MixBridge hides many backdoors in one Schrödinger bridge","Divide-and-merge lets one bridge carry multiple backdoor triggers","Weight rebalancing masks which expert fires in MixBridge backdoors","No SDE tweaks: MixBridge trains multi-backdoor bridges directly"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000839,"raw_usage":{"total_tokens":3672,"prompt_tokens":973,"completion_tokens":2699,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":589,"completion_tokens_details":{"reasoning_tokens":2626}},"tokens_in":589,"tokens_out":2699,"duration_ms":18049,"temperature":1.0,"reasoning_tokens":2626,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T22:20:51.429891+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a single I2SB model on clean pairs plus several poisoned pair types with a wider network, and measure the learned score at intermediate times against the geometric-mean product of task conditionals; if the score diverges from that product or the model still yields high-quality clean outputs with near-100% attack success, the theorem's prediction is refuted. Recording the rank of $\\nabla_{x_t}\\epsilon_\\theta$ during training would directly test the proof's key premise.","supporting_citations":[{"cited_title":"Diffusion schr \\\"o dinger bridge with applications to score-based generative modeling","cited_arxiv_id":null,"evidence_quote":"Provides the diffusion Schrödinger bridge framework for transforming between arbitrary distributions."},{"cited_title":"How to backdoor diffusion models? In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.\\ 4015--4024, 2023","cited_arxiv_id":null,"evidence_quote":"Defines the utility and specificity evaluation criteria and serves as the prior single-trigger backdoor baseline."},{"cited_title":"Villandiffusion: A unified backdoor attack framework for diffusion models","cited_arxiv_id":null,"evidence_quote":"Offers a unified single-attack backdoor framework, highlighting the gap that heterogeneous bridge-based attacks fill."}],"review_version":1}