arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2603.01019cs.CRcs.LG
收藏

BadRSSD: 对于正则化自监督扩散模型的后门攻击

BadRSSD: Backdoor Attacks on Regularized Self-Supervised Diffusion Models

School of Information and Artificial Intelligence, Yangzhou University, China（扬州大学信息与人工智能学院）；School of Computing and Artificial Intelligence, Chaohu University, China（池州学院计算机与人工智能学院）；Tacoma School of Engineering and Technology, University of Washington, USA（华盛顿大学塔科马工程与技术学院）

Jiayao Wang, Yiping Zhang, Mohammad Maruf Hasan, Xiaoying Lei, Jiale Zhang, Junwu Zhu, Qilin Wu, Dongfang Zhao

阅读 PDF
arXiv 页面 ↗HTML 原文 ↗

AI总结：

BadRSSD是一种针对自监督扩散模型表示层的后门攻击方法，通过在PCA空间中操控语义表示并应用跨空间约束，实现隐蔽的后门攻击并提升攻击效果。

摘要：

自监督扩散模型通过潜在空间去噪学习高质量的视觉表示。然而，其表示层却带来了独特的威胁：不同于传统攻击针对生成输出的目标，其不受约束的潜在语义空间允许进行隐蔽的后门攻击，允许恶意者在触发时进行控制。在本文中，我们提出了BadRSSD，这是首个针对自监督扩散模型表示层的后门攻击方法。具体而言，它通过在主成分分析（PCA）空间中将受污染样本的触发器语义表示转向目标图像的表示，然后通过在潜在、像素和特征分布空间中应用协调约束来控制去噪轨迹，以使模型生成指定的目标。此外，我们还将表示分散正则化整合到约束框架中，以保持特征空间的均匀性，显著增强了攻击的隐蔽性。这种方法在正常模型功能（高实用性）的同时，实现触发激活时的精确目标生成（高特异性）。在多个基准数据集上的实验表明，BadRSSD在FID和MSE指标上显著优于现有攻击，可靠地在不同架构和配置中建立后门，并有效抵抗最先进的后门防御。

英文摘要：

Self-supervised diffusion models learn high-quality visual representations via latent space denoising. However, their representation layer poses a distinct threat: unlike traditional attacks targeting generative outputs, its unconstrained latent semantic space allows for stealthy backdoors, permitting malicious control upon triggering. In this paper, we propose BadRSSD, the first backdoor attack targeting the representation layer of self-supervised diffusion models. Specifically, it hijacks the semantic representations of poisoned samples with triggers in Principal Component Analysis (PCA) space toward those of a target image, then controls the denoising trajectory during diffusion by applying coordinated constraints across latent, pixel, and feature distribution spaces to steer the model toward generating the specified target. Additionally, we integrate representation dispersion regularization into the constraint framework to maintain feature space uniformity, significantly enhancing attack stealth. This approach preserves normal model functionality (high utility) while achieving precise target generation upon trigger activation (high specificity). Experiments on multiple benchmark datasets demonstrate that BadRSSD substantially outperforms existing attacks in both FID and MSE metrics, reliably establishing backdoors across different architectures and configurations, and effectively resisting state-of-the-art backdoor defenses.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

↑