Rickrolling 艺术家：向文本到图像合成的文本编码器注入后门
Rickrolling the Artist: Injecting Backdoors into Text Encoders for Text-to-Image Synthesis
AI总结：
本文提出针对文本到图像生成模型文本编码器的后门攻击，通过插入单个字符触发器即可操纵生成结果，注入过程不到两分钟，同时该方法也可用于遗忘不良概念以提升安全性。
摘要：
尽管文本到图像合成目前在研究人员和公众中广受欢迎，但这些模型的安全性迄今一直被忽视。许多文本引导的图像生成模型依赖来自外部来源的预训练文本编码器，其用户相信所获取的模型会如承诺的那样运行。不幸的是，情况可能并非如此。我们引入了针对文本引导生成模型的后门攻击，并证明其文本编码器构成了重大的篡改风险。我们的攻击仅轻微改变编码器，使得对于干净提示词的图像生成不会出现可疑的模型行为。随后，通过在提示词中插入单个字符触发器，例如非拉丁字符或表情符号，攻击者可以触发模型生成具有预定义属性的图像，或生成遵循隐藏的、可能具有恶意描述的图像。我们通过实验证明了我们的攻击在 Stable Diffusion 上的高效性，并强调注入单个后门的过程不到两分钟。除了将我们的方法仅表述为一种攻击之外，它还可以迫使编码器遗忘与某些概念相关的短语，例如裸体或暴力，并有助于使图像生成更安全。
英文摘要：
While text-to-image synthesis currently enjoys great popularity among researchers and the general public, the security of these models has been neglected so far. Many text-guided image generation models rely on pre-trained text encoders from external sources, and their users trust that the retrieved models will behave as promised. Unfortunately, this might not be the case. We introduce backdoor attacks against text-guided generative models and demonstrate that their text encoders pose a major tampering risk. Our attacks only slightly alter an encoder so that no suspicious model behavior is apparent for image generations with clean prompts. By then inserting a single character trigger into the prompt, e.g., a non-Latin character or emoji, the adversary can trigger the model to either generate images with pre-defined attributes or images following a hidden, potentially malicious description. We empirically demonstrate the high effectiveness of our attacks on Stable Diffusion and highlight that the injection process of a single backdoor takes less than two minutes. Besides phrasing our approach solely as an attack, it can also force an encoder to forget phrases related to certain concepts, such as nudity or violence, and help to make image generation safer.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
