Pith. sign in

REVIEW 4 major objections 4 minor 28 references

TrojFlow: Flow Models are Natural Targets for Trojan Attacks

T0 review · 4 major / 4 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Trojan attacks on flow-based generative models are essentially image-transfer tasks: fine-tuning a Rectified Flow model so trigger noise maps to a target image yields high attack success, low quality loss, and evasion of diffusion-model…

desk verdict Plausible backdoor attack on rectified flow models, but the defense-bypass claim rests on a custom, unvalidated adaptation of TERD and qualitative images only; novelty is also thinner than claimed. read the letter →

arxiv 2412.16512 v1 pith:VXUVCZF4 submitted 2024-12-21 cs.CV cs.AI

Zhengyang Qi , Xiaohua Xu This is my paper · ORCID
classification cs.CVcs.AI
keywords Trojanattackbackdoorflow-basedgenerativemodelsrectifiedflowdiffusiondefensespoint-to-pointmappinginvisibletriggers
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Flow-based generative models learn a transport path from one distribution to another by fitting a velocity field, and the paper argues that this exact design makes them a natural home for Trojan attacks: planting a backdoor reduces to fine-tuning the model so that a chosen trigger noise follows a path to a chosen target image, using the same objective as normal generation. The proposed attack, TrojFlow, is evaluated on Rectified Flow models trained on CIFAR-10 and CelebA, reaching 94.1% attack success for a target class with a blend trigger and a mean squared error of 0.024 for point-to-point image mapping, while raising FID by only 0.2 to 0.6 on benign samples. The paper also claims that two representative diffusion-model defenses, UFID and TERD, fail to detect the backdoor, thanks to invisible Gaussian triggers, point-to-point mappings, and perturbation-driven training that keeps the neighborhood of the trigger clean. A sympathetic reader would care because flow models now power large-scale image generation systems, and the attack shows that their training efficiency transfers directly into attack efficiency, with backdoors converging in about twenty thousand fine-tuning steps.

What carries the argument

The machinery is the rectified-flow transport path: the model is trained to predict the velocity $(x_T - x_0)$ along straight-line interpolations $x_t = (1-t)x_0 + t x_T$, and TrojFlow simply adds a Trojan term with $x_t = t x_{\text{trigger}} + (1-t) x_{\text{target}}$, so one shared ODE solver and one set of parameters learn both the clean path and the backdoor path. Because the backdoor is activated by the initial noise alone, no extra sampling code reveals it. The point-to-point mappings use random Gaussian noise as invisible triggers, and perturbation-driven training adds a loss term that maps $\text{trigger} + \epsilon'$ back to clean outputs, which is what defeats the perturbation-based UFID test; TERD's inversion fails because the flow objective is a velocity rather than a noise prediction, so its surrogate-image assumption no longer holds.

What would settle it

Run the original, unmodified TERD inversion on a TrojFlow-compromised Rectified Flow model and compute a quantitative detection curve, for example the separation between the reconstructed trigger and clean noise across many samples. If the unmodified TERD or a thresholded UFID test flags the backdoor, the claimed defense bypass would be refuted even though the attack itself still succeeds.

Watch

Extended reading notes

Core claim

The central claim is that Trojan attacks on generative models are essentially image-transfer tasks from a backdoor distribution to a target distribution, and flow models are the natural setting for that task because they are trained to fit arbitrary endpoint distributions with the same objective used for benign generation. TrojFlow therefore does not need a separate backdoor forward process; it simply fine-tunes a pre-trained Rectified Flow model with a mixed loss, pairing trigger noise with target images alongside the usual clean noise-to-data pairs. At sampling time the same ODE solver is used, and the backdoor is activated merely by feeding the trigger as initial noise. The paper reports that this compromises the model with high utility and specificity (Din attack success 94.1%, D2I mean squared error 0.024 on CIFAR-10, with an FID increase of 0.2 to 0.6), converges faster than TrojDiff, and, with point-to-point mappings and perturbation-driven training, evades UFID and TERD.

Load-bearing premise

The defense-bypass conclusion relies on the authors' adapted versions of UFID and TERD being faithful tests of those defenses; since TERD is modified into Algorithm 2 because its original inversion target does not fit flow models, and the defense results are shown as images rather than detection metrics, this premise is the load-bearing one.

Editorial extensions

If this is right

  • A white-box attacker who can fine-tune a released flow model for roughly twenty thousand steps can embed a trigger that makes the model emit a chosen class or a chosen image on demand, with only a small loss of generation quality.
  • Existing defense methods developed for diffusion models, if they rely on perturbation sensitivity or trigger inversion, cannot be assumed to transfer to flow models without re-validation.
  • Point-to-point backdoors can be inserted in batches (the paper tests 1, 5, and 10 mappings), so a single compromised model can contain many independent hidden behaviors.
  • Because activation happens at the initial-noise input to a standard ODE solver, the backdoor survives even when the user inspects the sampling code and sees no anomaly beyond the input value.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The strongest defense-bypass claim rests on the authors' own adaptations of UFID and TERD; in particular, TERD is modified into Algorithm 2 because its original inversion target does not match flow objectives, and the defense results are shown as qualitative images rather than detection metrics, so a reader should treat 'existing defenses fail' as provisional.
  • If TrojFlow is right, the equivalence between backdooring and image transfer suggests that flow-model defenses should be framed as detecting and preventing unwanted endpoint pairs, not as finding a single trigger pattern.
  • A natural next test, not run in the paper, is to apply the same endpoint-pair fine-tuning to conditional flow models, for example text-to-image pipelines, where the conditioning signal may itself carry a trigger.
  • Another untested consequence is that because the backdoor is encoded in the input distribution rather than in a separate process, checking whether the initial noise comes from the expected Gaussian could provide a lightweight defense that the paper does not consider.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes TrojFlow, a Trojan/backdoor attack against flow-based generative models, specifically Rectified Flow. The attack treats backdoor injection as learning a transport path from a trigger distribution to a target distribution, and it is implemented by fine-tuning a pre-trained rectified-flow velocity field with both benign and trojan path losses. Two attack settings are considered: distribution-to-image (D2I), including n=1,5,10 point-to-point mappings from invisible Gaussian triggers to chosen target images, and distribution-in (Din) attacks with blend or patch triggers targeting a class. The authors also propose Perturbation-Driven Training (PDT) to shrink the trigger neighborhood that maps to the target, and they evaluate two diffusion-model defenses, UFID and TERD, claiming that both fail against TrojFlow. Experiments on CIFAR-10 report high ASR (about 91-94%) and low MSE (about 0.02-0.05), with FID increases of 0.2-0.6 relative to the base model, while CelebA results are shown qualitatively. The paper's two headline claims are that FMs are natural targets for Trojan attacks and that existing DM defenses do not transfer to FMs.

Significance. If the claims hold, the paper makes a useful contribution: it provides a clean formulation of a flow-model backdoor as a transport-path fitting problem, extends prior diffusion backdoor attacks to a point-to-point multi-trigger setting, and introduces PDT as a way to make a Trojan point-like in input space. The conceptual point that flow models can directly interpolate between arbitrary trigger and target distributions is well taken, and the D2I/PDT combination is a genuinely new element relative to TrojDiff. However, the defense-bypass contribution, which is one of the two stated main contributions, is currently supported only by qualitative images and by a modified inversion algorithm that is not demonstrated to be faithful to the published TERD defense. The attack-effectiveness results are also single-run measurements with no variance estimates, which is a concern for a paper whose central claims are quantitative. With added statistical rigor and a quantitatively valid defense evaluation, the paper would be a solid contribution to the generative-model security literature.

major comments (4)
  1. [Section III-C, Algorithm 2; Section IV-B.b and Figure 4] The claim that TrojFlow 'can easily break through existing defense mechanisms' rests on an unvalidated adaptation of TERD. The published TERD objective in Equation (7) is replaced by Algorithm 2, whose forward process xt = x0 + gamma t epsilon + mu with a surrogate Gaussian x0 does not match the actual trojan transport path used in Algorithm 1, xt = t*xtrigger + (1-t)*xtarget. A failed custom inversion therefore does not establish that the original TERD defense fails on flow models. The authors should either run the original TERD algorithm (or a faithful adaptation of it) on the trojaned flow model and report its quantitative detection result, or explicitly re-frame the contribution as 'TERD as adapted in Algorithm 2 is ineffective' rather than 'TERD is ineffective.' Without this, the headline defense-bypass conclusion is unsupported.
  2. [Section III-C; Section IV-B.b, Figure 3] The UFID evaluation is reported only through generated-sample images for one D2I setting (n=1, Mickey Mouse target). No UFID detection score, pairwise similarity statistic, threshold, or quantitative comparison with a baseline is provided. The paper's conclusion that PDT enables TrojFlow to bypass perturbation-based detection cannot be assessed from Figure 3 alone. The authors should report the actual UFID detection metric for clean noise, trigger noise, and perturbed trigger noise, both with and without PDT, ideally over multiple triggers and seeds.
  3. [Section IV-B.a, Tables I-III] The main quantitative claims are made from single runs with no standard deviations, confidence intervals, or seed information, even though the paper itself notes that generation performance exhibits variability. Table II compares TrojFlow ASR with TrojDiff numbers taken from the original paper, which used a different base model, training setup, and possibly a different classifier; the conclusion that TrojFlow has 'higher backdoor injection efficiency' is therefore not established by the presented data. A matched comparison under the same base model, fine-tuning budget, sampler, and evaluation protocol, repeated over several seeds, is needed before the efficiency and utility claims can be accepted.
  4. [Section III-B, Equations (4)-(5) and Algorithm 1] The derivation connecting the unified DM backdoor forward process to the flow-model transport path is not fully precise. Setting a(x0,t)=1, b(t)=t, c(t)=t in Equation (4) gives xt = x0 + t epsilon + t r, but Algorithm 1 uses xt = t*xtrigger + (1-t)*xtarget, which is a different interpolation. The manuscript should clarify how Equation (5) relates to the actual trojan path used for training, and should justify the choice of surrogate Gaussian x0 in Algorithm 2 in that context.
minor comments (4)
  1. [Abstract and Section I] The abstract states 'TrojFlow, exploring the vulnerabilities of FMs' but the method is an attack, not an exploration; consider rephrasing to 'proposes TrojFlow, an attack that exploits the vulnerabilities of FMs.' Also, the conclusion uses 'TrojanFlow' instead of 'TrojFlow'; please make the name consistent.
  2. [Section III-B, Equation (5)] The notation around Equation (5) is dense: the roles of r, epsilon, x0, xtarget, and xtrigger should be stated explicitly, because the reader must otherwise infer that r corresponds to the trigger and x0 to the target for the trojan path. A small table or a sentence defining each symbol would improve readability.
  3. [Section IV-B.b, Figures 3 and 4] Figure 3 and Figure 4 are presented without quantitative axes, scales, or detection thresholds. At minimum, the captions should state the exact configuration (target image, trigger type, gamma, training step count) and, for Figure 4, which rows correspond to TrojDiff and TrojFlow and what the 'reverse' column shows.
  4. [Section IV-A.a] The paper states that CelebA results are shown only visually 'due to computational resource limitations.' Since the abstract claims evaluation on CelebA, the absence of any metric for the CelebA experiments weakens the generality of the utility and specificity claims; consider adding at least FID/ASR for one CelebA configuration or explicitly limiting the quantitative claim to CIFAR-10.

Circularity Check

3 steps flagged · score 6.0 of 10

Attack success and UFID bypass are the literal training objectives (Algorithm 1 and PDT), while the 'natural targets' thesis restates the TrojFlow construction; TERD-bypass evidence rests on a mismatched Algorithm 2.

  1. self definitional [Abstract; Section III-B (Algorithm 1)]
    "We found that Trojan attacks on generative models are essentially equivalent to image transfer tasks from the backdoor distribution to the target distribution, the unique ability of FMs to fit any two arbitrary distributions significantly simplifies the training and sampling setups for attacking FMs, making them inherently natural targets for backdoor attacks."

    The paper's thesis is that FMs are 'natural targets' for Trojan attacks. But TrojFlow constructs the backdoor as exactly the native rectified-flow transport: Algorithm 1 uses the same xt = t*xtrigger + (1-t)*xtarget path and the same velocity loss as benign flow training. Thus the conclusion that FMs naturally support such attacks is entailed by the definition of the method; the attack is the model's own training task with the source and target swapped. The independent content (benign FID +0.2 to +0.6) is measured, but the 'natural target' claim itself restates the construction rather than being derived from it.

  2. fitted input called prediction [Section III-B (Algorithm 1); Section IV-B (Table I, Table III)]
    "xt = t ∗ xtrigger + (1− t) ∗ xtarget # Trojan ... Take gradient step on ▽θ (Lθ(xtarget, xtrigger , t) + Lθ(xc, xnoise, t)) ... experiments demonstrate that under all settings, TrojFlow consistently generates images nearly identical to the target images, exhibiting exceptionally low MSE."

    ASR and MSE are measured on the same trigger-target pairs used to define the Trojan loss. The loss Lθ(xtarget, xtrigger, t) directly supervises vθ to equal xtarget - xtrigger on the straight path from trigger to target, so after convergence the ODE from the trigger must arrive at the target. Reporting ASR≈94% and MSE≈0.024 is therefore reporting the in-sample training objective, not an independent attack property. What is not circular is the benign-utility cost and convergence speed, but the 'high specificity' headline is the fit itself.

1 more flagged steps
  1. fitted input called prediction [Section III-C (Eq. 6); Section IV-B (Fig. 3)]
    "Therefore, we implement additional Perturbation-Driven Training (PDT), which remaps the distribution around the trigger to clean images while preserving the transport path from the trigger to the target. ... after applying PDT, the noise near the trigger is successfully mapped to a clean distribution ... TrojFlow can effectively bypass the detection of these two representative defense strategies."

    UFID's detection criterion is that perturbed trigger noise does not produce clean/diverse outputs. PDT adds a loss term L_PDT(xc, xtrigger + ε', t) that explicitly trains the model to map the neighborhood of the trigger to clean samples. The later demonstration that noise near the trigger maps to a clean distribution, and the conclusion that TrojFlow 'effectively bypasses' UFID, is the literal training objective of PDT read back as an empirical result. The bypass is enforced during training, so it is constructed rather than discovered.

full rationale

The paper's headline successes are partly circular. The 'natural targets' thesis is definitionally entailed by Algorithm 1, which implements the backdoor as the standard rectified-flow transport from trigger to target. The reported attack success (ASR, MSE) is measured on the same trigger-target pairs used in the Trojan loss, i.e., it is an in-sample fit. The UFID-bypass result is likewise the PDT training objective: PDT explicitly trains the model to map the trigger neighborhood to clean images, and then the evaluation shows exactly that behavior. These are not independent discoveries, though the benign FID increase and convergence-rate comparison with TrojDiff are independent empirical content, preventing the whole paper from collapsing. I also flag, as a validity concern rather than a formal circularity, that the TERD evaluation (Section III-C, Algorithm 2; Fig. 4) replaces the actual TrojFlow transport xt = t*xtrigger + (1-t)*xtarget with a Gaussian-surrogate forward process xt = x0 + γtε + µ and reports only visual results; the failed inversion may be an artifact of that mismatched adaptation, so the 'breaks TERD' claim is not established by the paper's evidence. The paper itself acknowledges computational limits and metric variability on CelebA, which further weakens the defense-bypass conclusion. No self-citation chain or imported uniqueness theorem is present, so the circularity is partial and constructional rather than a complete collapse.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claim rests on the assumed capacity of rectified-flow velocity fields to fit multiple transport paths, on the fidelity of the authors' TERD adaptation, and on a private base model plus a single classifier. No code or checkpoints are released, so these assumptions are not externally checkable from the paper alone.

free parameters (4)
  • Blend coefficient gamma = 0.6 in all experiments
    Chosen by hand to balance trigger visibility and attack success; no sensitivity analysis or sweep is reported.
  • Patch size and location = 10% of image, bottom-right corner
    Chosen following BadNets-style patch triggers; its effect on ASR and utility is not analyzed.
  • Fine-tuning step budget = 20k steps for D2I, 40k steps for Din
    Selected as convergence points with no early stopping criterion or multiple seeds to check stability.
  • PDT regularization strength lambda = not reported
    Algorithm 2 and Equation 6 rely on a regularization or loss weight lambda, but its numeric value is never given, so the defense-evasion result cannot be reproduced.
assumptions (5)
  • domain assumption A rectified-flow velocity field can simultaneously fit clean data and arbitrary trigger-to-target transport paths without collapsing benign generation.
    The entire attack depends on this capacity; the paper gives empirical FID/Recall numbers but no theoretical or architectural analysis of capacity limits.
  • domain assumption The modified reverse-trojan procedure in Algorithm 2 is a faithful adaptation of TERD that preserves the defense's detection logic.
    TERD's original inversion objective does not match flow-model training, so Algorithm 2 replaces it without validation against the original TERD implementation or quantitative detection metrics.
  • domain assumption The pre-trained base Rectified Flow model is a representative clean baseline.
    All utility comparisons use FID, Precision, and Recall computed from this private base model; no checkpoint is released for external comparison.
  • domain assumption A single classifier's target-class predictions reliably measure attack success across all settings.
    ASR depends on one classifier with 99.10% recall on the horse class; robustness across classifier architectures is not tested.
  • standard math Euler discretization of the flow ODE with N steps yields valid samples.
    The sampling procedure follows rectified flow [12], and no convergence analysis is provided, but this is accepted practice in the flow-matching literature.

how reviews work

0 comments
Cite this review

Pith. "Pith review of TrojFlow: Flow Models are Natural Targets for Trojan Attacks." pith.science (2026). https://pith.science/paper/VXUVCZF4

@misc{pith2026241216512,
  author       = {Pith},
  title        = {Pith review of: TrojFlow: Flow Models are Natural Targets for Trojan Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VXUVCZF4}},
  note         = {Machine review of arXiv:2412.16512}
}
read the original abstract

Flow-based generative models (FMs) have rapidly advanced as a method for mapping noise to data, its efficient training and sampling process makes it widely applicable in various fields. FMs can be viewed as a variant of diffusion models (DMs). At the same time, previous studies have shown that DMs are vulnerable to Trojan/Backdoor attacks, a type of output manipulation attack triggered by a maliciously embedded pattern at model input. We found that Trojan attacks on generative models are essentially equivalent to image transfer tasks from the backdoor distribution to the target distribution, the unique ability of FMs to fit any two arbitrary distributions significantly simplifies the training and sampling setups for attacking FMs, making them inherently natural targets for backdoor attacks. In this paper, we propose TrojFlow, exploring the vulnerabilities of FMs through Trojan attacks. In particular, we consider various attack settings and their combinations and thoroughly explore whether existing defense methods for DMs can effectively defend against our proposed attack scenarios. We evaluate TrojFlow on CIFAR-10 and CelebA datasets, our experiments show that our method can compromise FMs with high utility and specificity, and can easily break through existing defense mechanisms.

Figures

Figures reproduced from arXiv: 2412.16512 by the authors.

Figure 1
Figure 1. Visualization of benign and Trojan generative processes on CelebA under the Din attack with different triggers, wh ere [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 3
Figure 3. Samples generated from the trigger and nearby distri [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

28 extracted references · 15 canonical work pages

  1. [1]

    Denoising diffusion probabilis- tic models,

    Jonathan Ho, Ajay Jain, and P. Abbeel, “Denoising diffusion probabilis- tic models,” ArXiv, vol. abs/2006.11239, 2020

    arXiv 2006

  2. [2]

    Denoising diffusion implicit models,

    Jiaming Song, Chenlin Meng, and Stefano Ermon, “Denoising diffusion implicit models,” ArXiv, vol. abs/2010.02502, 2020

    arXiv 2010

  3. [3]

    Score-based gener- ative modeling through stochastic differential equations,

    Yang Song, Jascha Narain Sohl-Dickstein, Diederik P. Kingma, Ab- hishek Kumar, Stefano Ermon, and Ben Poole, “Score-based gener- ative modeling through stochastic differential equations,” ArXiv, vol. abs/2011.13456, 2020

    arXiv 2011

  4. [4]

    High-resolution image synthesis with latent diffusion models,

    Robin Rombach, A. Blattmann, Dominik Lorenz, Patrick Esser, and Bj¨orn Ommer, “High-resolution image synthesis with latent diffusion models,” 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 10674–10685, 2021

    work page 2022

  5. [5]

    Diffwave: A versatile diffusion model for audio synthesis,

    Zhifeng Kong, Wei Ping, Jiaji Huang, Kexin Zhao, and Bryan Catanzaro, “Diffwave: A versatile diffusion model for audio synthesis,” ArXiv, vol. abs/2009.09761, 2020

    arXiv 2009

  6. [6]

    Equivariant diffusion for molecule generation in 3d,

    Emiel Hoogeboom, Victor Garcia Satorras, Cl ´ement Vignac, and Max Welling, “Equivariant diffusion for molecule generation in 3d,” ArXiv, vol. abs/2203.17003, 2022

    arXiv 2022

  7. [7]

    Digress: Discrete denoising diffusion for graph generation,

    Cl ´ement Vignac, Igor Krawczuk, Antoine Siraudin, Bohan Wang, V olkan Cevher, and Pascal Frossard, “Digress: Discrete denoising diffusion for graph generation,” ArXiv, vol. abs/2209.14734, 2022

    arXiv 2022

  8. [8]

    Generative adversarial networks,

    Ian J. Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron C. Courville, and Yoshua Bengio, “Generative adversarial networks,” Communications of the ACM , vol. 63, pp. 139 – 144, 2014

    work page 2014

Show all 28 references
  1. [9]

    Auto-encoding variational bayes,

    Diederik P. Kingma and Max Welling, “Auto-encoding variational bayes,” CoRR, vol. abs/1312.6114, 2013

    2013 arXiv

  2. [10]

    Fast ode- based sampling for diffusion models in around 5 steps,

    Zhenyu Zhou, Defang Chen, Can Wang, and Chun Chen, “Fast ode- based sampling for diffusion models in around 5 steps,” 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pp. 7777–7786, 2023

    2024

  3. [11]

    Flow matching for generative modeling,

    Yaron Lipman, Ricky T. Q. Chen, Heli Ben-Hamu, Maximilian Nickel, and Matt Le, “Flow matching for generative modeling,” ArXiv, vol. abs/2210.02747, 2022

    2022 arXiv

  4. [12]

    Flow straight and fast: Learning to generate and transfer data with rectified flow,

    Xingchao Liu, Chengyue Gong, and Qiang Liu, “Flow straight and fast: Learning to generate and transfer data with rectified flow,” ArXiv, vol. abs/2209.03003, 2022

    2022 arXiv

  5. [13]

    Con- sistency models,

    Yang Song, Prafulla Dhariwal, Mark Chen, and Ilya Sutskever, “Con- sistency models,” in International Conference on Machine Learning , 2023

    2023

  6. [14]

    Villandiffusion: A unified backdoor attack framework for diffusion models,

    Sheng-Yen Chou, Pin-Yu Chen, and Tsung-Yi Ho, “Villandiffusion: A unified backdoor attack framework for diffusion models,” ArXiv, vol. abs/2306.06874, 2023

    2023 arXiv

  7. [15]

    Trojdiff: Trojan attacks on diffusion models with diverse targets,

    Weixin Chen, Dawn Xiaodong Song, and Bo Li, “Trojdiff: Trojan attacks on diffusion models with diverse targets,” 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pp. 4035–4044, 2023

    2023

  8. [16]

    How to backdoor diffusion models?,

    Sheng-Yen Chou, Pin-Yu Chen, and Tsung-Yi Ho, “How to backdoor diffusion models?,” 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pp. 4015–4024, 2022

    2023

  9. [17]

    Ufid: A unified framework for input-level backdoor detection on diffusion models,

    Zihan Guan, Mengxuan Hu, Sheng Li, and Anil Vullikanti, “Ufid: A unified framework for input-level backdoor detection on diffusion models,” ArXiv, vol. abs/2404.01101, 2024

    2024 arXiv

  10. [18]

    Terd: A unified framework for safeguarding diffusion models against backdoors,

    Yichuan Mo, Hui Huang, Mingjie Li, Ang Li, and Yisen Wang, “Terd: A unified framework for safeguarding diffusion models against backdoors,” ArXiv, vol. abs/2409.05294, 2024

    2024 arXiv

  11. [19]

    Elijah: Eliminating backdoors injected in diffusion models via distribution shift,

    Shengwei An, Sheng-Yen Chou, Kaiyuan Zhang, Qiuling Xu, Guanhong Tao, Guangyu Shen, Siyuan Cheng, Shiqing Ma, Pin-Yu Chen, Tsung- Yi Ho, and Xiangyu Zhang, “Elijah: Eliminating backdoors injected in diffusion models via distribution shift,” ArXiv, vol. abs/2312.00050, 2023

    2023 arXiv

  12. [20]

    How to backdoor consistency models?,

    Chengen Wang and Murat Kantarcioglu, “How to backdoor consistency models?,” 2024

    2024

  13. [21]

    Badnets: Evaluating backdooring attacks on deep neural networks,

    Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg, “Badnets: Evaluating backdooring attacks on deep neural networks,” IEEE Access, vol. 7, pp. 47230–47244, 2019

    2019

  14. [22]

    Invisible backdoor attack with sample-specific triggers,

    Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu, “Invisible backdoor attack with sample-specific triggers,” 2021 IEEE/CVF International Conference on Computer Vision (ICCV) , pp. 16443–16452, 2020

    2021

  15. [23]

    Invisible backdoor attacks on diffusion models,

    Sen Li, Junchi Ma, and Minhao Cheng, “Invisible backdoor attacks on diffusion models,” ArXiv, vol. abs/2406.00816, 2024

    2024 arXiv

  16. [24]

    Learning multiple layers of features from tiny images,

    Alex Krizhevsky, “Learning multiple layers of features from tiny images,” 2009

    2009

  17. [25]

    Deep learning face attributes in the wild,

    Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang, “Deep learning face attributes in the wild,” 2015 IEEE International Conference on Computer Vision (ICCV) , pp. 3730–3738, 2014

    2015

  18. [26]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium,

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter, “Gans trained by a two time-scale update rule converge to a local nash equilibrium,” in Neural Information Processing Systems, 2017

    2017

  19. [27]

    Improved precision and recall metric for assessing generative models,

    Tuomas Kynk ¨a¨anniemi, Tero Karras, Samuli Laine, Jaakko Lehtinen, and Timo Aila, “Improved precision and recall metric for assessing generative models,” in Neural Information Processing Systems , 2019

    2019

  20. [28]

    Adding conditional control to text-to-image diffusion models,

    Lvmin Zhang, Anyi Rao, and Maneesh Agrawala, “Adding conditional control to text-to-image diffusion models,” 2023 IEEE/CVF Interna- tional Conference on Computer Vision (ICCV) , pp. 3813–3824, 2023

    2023

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.