Consistency models are a new class of models that generate images by directly mapping noise to data, allowing for one-step generation and significantly accelerating the sampling process. However, their robustness against adversarial attacks has not yet been thoroughly investigated. In this work, we conduct the first study on the vulnerability of consistency models to backdoor attacks. While previous research has explored backdoor attacks on diffusion models, those studies have primarily focused on conventional diffusion models, employing a customized backdoor training process and objective, whereas consistency models have distinct training processes and objectives. Our proposed framework demonstrates the vulnerability of consistency models to backdoor attacks. During image generation, poisoned consistency models produce images with a Fréchet Inception Distance (FID) comparable to that of a clean model when sampling from Gaussian noise. However, once the trigger is activated, they generate backdoor target images. We explore various trigger and target configurations to evaluate the vulnerability of consistency models, including the use of random noise as a trigger. This novel trigger is visually inconspicuous, more challenging to detect, and aligns well with the sampling process of consistency models. Across all configurations, our framework successfully compromises the consistency models while maintaining high utility and specificity. We also examine the stealthiness of our proposed attack, which is attributed to the unique properties of consistency models and the elusive nature of the Gaussian noise trigger. Our code is available at \href{https://github.com/chengenw/backdoorCM}{https://github.com/chengenw/backdoorCM}.
Trigger without Trace: Towards Stealthy Backdoor Attack on Text-to-Image Diffusion Models
Key Laboratory of AI Safety of CAS, Institute of Computing Technology (ICT), Chinese Academy of Sciences (CAS), Beijing 100190, China, and also with the University of Chinese Academy of Sciences (UCAS), Beijing 100049, China（中国科学院人工智能安全重点实验室，计算技术研究所（ICT），中国科学院（CAS），北京100190，中国，以及中国科学院大学（UCAS），北京100049，中国）
BlackMirror: Black-Box Backdoor Detection for Text-to-Image Models via Instruction-Response Deviation
Institute of Information Engineering, CAS（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络安全学院）；State Key Laboratory of AI Safety, Institute of Computing Technology, CAS（中国科学院计算技术研究所人工智能安全国家重点实验室）；School of Computer Science and Technology, University of Chinese Academy of Sciences（中国科学院大学计算机科学与技术学院）；BDKM, University of Chinese Academy of Sciences（中国科学院大学BDKM）；School of Computer Science and Technology, Beijing Institute of Technology（北京理工大学计算机科学与技术学院）；School of Cyber Science and Tech., Shenzhen Campus, Sun Yat-sen University（中山大学深圳校区网络安全科学与技术学院）
IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistency
School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen（哈尔滨工业大学（深圳）计算机科学与技术学院）；Alibaba Group（阿里巴巴集团）；University of Science and Technology of China（中国科学技术大学）；School of Information Technology, Deakin University（迪肯大学信息技术学院）；School of Information and Communication Technology, Griffith University（格里菲斯大学信息与通信技术学院）；Nanyang Technological University（南洋理工大学）
Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency
University of Alberta（阿尔伯塔大学）；Michigan State University（密歇根州立大学）；Illinois Institute of Technology（伊利诺伊理工学院）；DSO National Laboratories（新加坡国防科技局国家实验室）；MIT-IBM Watson AI Lab, IBM Research（IBM研究院MIT-IBM沃森人工智能实验室）
Detecting Backdoors During the Inference Stage Based on Corruption Robustness Consistency
Huazhong University of Science and Technology（华中科技大学）；National Engineering Research Center for Big Data Technology and System（大数据技术与系统国家工程研究中心）；Wuhan University（武汉大学）
Backdoor Samples Detection Based on Perturbation Discrepancy Consistency in Pre-trained Language Models
Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University（航天信息安全部门、教育部、网络安全科学与工程学院、武汉大学）
ProtoGuard-SL: Prototype Consistency Based Backdoor Defense for Vertical Split Learning
Wenzhou-Kean University（温州肯恩大学）；International Frontier Interdisciplinary Research Institute (IFIRI), Wenzhou-Kean University（温州肯恩大学国际前沿交叉研究院）；Case Western Reserve University（凯斯西储大学）
Defending the Edge: Representative-Attention Defense against Backdoor Attacks in Federated Learning
Dept. of Computer Science Faculty of Engineering University of Manchester Manchester, United Kingdom；Dept. of Computer Science Faculty of Engineering University of Manchester \& MBZUAI Abu Dhabi, United Arab Emirates；Dept. of Computer Science Faculty of Engineering University of Manchester \& KU Leuven Manchester, United Kingdom
Tsinghua Shenzhen International Graduate School, Tsinghua University（清华大学深圳国际研究生院）；School of Data Science, The Chinese University of Hong Kong, Shenzhen（香港中文大学（深圳）数据科学学院）；Shenzhen Research Institute of Big Data（深圳大数据研究院）；Tencent AI Lab（腾讯人工智能实验室）
Defending Against Backdoor Attacks via Alignment Checking in Model-Contrastive Federated Learning
Shandong Computer Science Center（山东计算机科学中心）；Qilu University of Technology (Shandong Academy of Sciences)（齐鲁工业大学（山东省科学院））；College of computer science and technology, China University of Petroleum（中国石油大学计算机科学与技术学院）；School of Computer Science and Engineering, University of Electronic Science and Technology of China（电子科技大学计算机科学与工程学院）；Big Data Institute, Qilu University of Technology（齐鲁工业大学大数据研究院）
Semantic-level Backdoor Attack against Text-to-Image Diffusion Models
College of Computer Science and Artificial Intelligence, Fudan University, Shanghai, China（复旦大学计算机科学与人工智能学院，上海，中国）；State Key Laboratory of Integrated Services Networks, Xidian University, Xian, China（集成服务网络国家重点实验室，西安电子科技大学，西安，中国）；University of Electronic Science and Technology of China, Sichuan, China（电子科技大学，四川，中国）；Ajou University, Gyeonggi-do, South Korea（庆尚道，韩国，全州大学）
Black-box Detection of Backdoor Attacks with Limited Information and Data
Tsinghua University（清华大学）；RealAI（瑞莱智慧）；Institute for AI（人工智能研究院）；BNRist Center（北京国家信息科学技术研究中心）；Tsinghua-Bosch Joint ML Center（清华-博世联合机器学习中心）；THBI Lab（清华-北京生物医学工程研究院实验室）；Dept. of Comp. Sci. and Tech.（计算机科学与技术系）
Erasing Self-Supervised Learning Backdoor by Cluster Activation Masking
State Key Laboratory of Multimodal Artificial Intelligence Systems, Institute of Automation, Chinese Academy of Sciences（中国科学院自动化研究所 多模态人工智能系统国家重点实验室）；University of Chinese Academy of Sciences（中国科学院大学）；Xiaomi Inc.（小米公司）；State Key Laboratory of CNS/ATM, Beihang University（北京航空航天大学 CNS/ATM 国家重点实验室）；College of Computer Science, Inner Mongolia University（内蒙古大学 计算机学院）
Towards Understanding How Self-training Tolerates Data Backdoor Poisoning
University of Alberta（阿尔伯塔大学）；Illinois Institute of Technology（伊利诺伊理工学院）；Michigan State University（密歇根州立大学）
最近对模型训练中的后门攻击的研究表明，污染一小部分训练数据就足以在中毒的测试时间数据上产生不正确的操纵预测，同时在下游任务中保持高的干净精度。后门攻击的隐蔽性给当今的机器学习范式带来了巨大的防御挑战。在本文中，我们探索了通过额外的未标记数据进行自我训练以减轻后门攻击的潜力。我们首先进行了一项试点研究，以表明香草自我训练在后门缓解中无效。受此启发，我们建议通过在自训练伪标签阶段利用强大但适当的数据增强来防御后门攻击。我们发现，新的自我训练机制在很大程度上有助于抵御后门攻击。通过在CIFAR-10和CIFAR-10与额外的未标记的500 K TinyImages数据集的组合上针对不同后门触发器的实验，证明了其有效性。最后，我们探索了将自我监督表示学习与自我训练相结合的方向，以进一步改进后门防御。
