As text-to-image diffusion models become increasingly deployed in real-world applications, concerns about backdoor attacks have gained significant attention. Prior work on text-based backdoor attacks has largely focused on diffusion models conditioned on a single lightweight text encoder. However, more recent diffusion models that incorporate multiple large-scale text encoders remain underexplored in this context. Given the substantially increased number of trainable parameters introduced by multiple text encoders, an important question is whether backdoor attacks can remain both efficient and effective in such settings. In this work, we study Stable Diffusion 3, which uses three distinct text encoders and has not yet been systematically analyzed for text-encoder-based backdoor vulnerabilities. To understand the role of text encoders in backdoor attacks, we define four categories of attack targets and identify the minimal sets of encoders required to achieve effective performance for each attack objective. Based on this, we further propose Multi-Encoder Lightweight aTtacks (MELT), which trains only low-rank adapters while keeping the pretrained text encoder weight frozen. We demonstrate that tuning fewer than 0.2% of the total encoder parameters is sufficient for successful backdoor attacks on Stable Diffusion 3, revealing previously underexplored vulnerabilities in practical attack scenarios in multi-encoder settings.
Personalization as a Shortcut for Few-Shot Backdoor Attack against Text-to-Image Diffusion Models
Nanyang Technological University（南洋理工大学）；New York University（纽约大学）；Agency for Science, Technology and Research (A*STAR)（新加坡科技研究局）；East China Normal University（华东师范大学）
REDEditing: Relationship-Driven Precise Backdoor Poisoning on Text-to-Image Diffusion Models
Shanghai University（上海大学）；Beijing University of Posts and Telecommunications（北京邮电大学）；National University of Singapore（新加坡国立大学）；Nanyang Technological University（南洋理工大学）
Fast and Lightweight Backdoor Detection via Head Random Probing
College of Artificial Intelligence, Nanjing University of Aeronautics and Astronautics（南京航空航天大学人工智能学院）；School of Cybersecurity, Northwestern Polytechnical University（西北工业大学网络安全学院）；Shenzhen Research Institute of Northwestern Polytechnical University（西北工业大学深圳研究院）；School of Computer Science and Technology, Harbin Institute of Technology（哈尔滨工业大学计算机科学与技术学院）
Mitigating Backdoors via Decoy Shortcuts and Knowledge Decoupling
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络空间安全学院）
Backdoor Vectors: a Task Arithmetic View on Backdoor Attacks and Defenses
Warsaw University of Technology（华沙技术大学）；NASK National Research Institute（国家研究机构NASK）；IDEAS NCBR；IDEAS Research Institute（IDEAS研究所）；Computer Vision Center, Universitat Autonoma de Barcelona（巴塞罗那自治大学计算机视觉中心）
POLAR: Policy-based Layerwise Reinforcement Learning Method for Stealthy Backdoor Attacks in Federated Learning
Columbia University（哥伦比亚大学）；Shanghai Jiao Tong University（上海交通大学）；Shanghai University of Electric Power（上海电力大学）；National University of Singapore（新加坡国立大学）；Stevens Institute of Technology（斯蒂文斯理工学院）；Queen’s University Belfast（贝尔法斯特女王大学）
Taught Well Learned Ill: Towards Distillation-conditional Backdoor Attack
State Key Laboratory of Blockchain and Data Security（区块链与数据安全国家重点实验室）；Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security（杭州高新技术区（滨江）区块链与数据安全研究院）；Nanyang Technological University（南洋理工大学）
Pruning and Malicious Injection: A Retraining-Free Backdoor Attack on Transformer Models
Division of Computer Science and Engineering, Louisiana State University（计算机科学与工程系，路易斯安那州立大学）；Division of Electrical and Computer Engineering, Louisiana State University（电气与计算机工程系，路易斯安那州立大学）；School of Engineering and Science, Stevens Institute of Technology（工程与科学学院，史蒂文斯理工学院）
BadPromptFL: A Novel Backdoor Threat to Prompt-based Federated Learning in Multimodal Models
School of Information and Communication Engineering, Dalian University of Technology（信息与通信工程学院，大连理工大学）；School of Computer Science and Technology, Anhui University（计算机科学与技术学院，安徽大学）；New Laboratory of Pattern Recognition (NLPR) State Key Laboratory of Multimodal Artificial Intelligence Systems (MAIS) Institute of Automation, Chinese Academy of Sciences (CASIA)（模式识别新实验室（NLPR）多模态人工智能系统国家重点实验室（MAIS）自动化研究所，中国科学院（CASIA））
ShrinkBox: Backdoor Attack on Object Detection to Disrupt Collision Avoidance in Machine Learning-based Advanced Driver Assistance Systems
eBRAIN Lab, New York University Abu Dhabi (NYUAD), UAE（eBRAIN实验室，纽约大学阿布扎赫尔分校（NYUAD），阿联酋）；AI and Digital Science Research Center, Technology Innovation Institute (TII), Abu Dhabi, UAE（人工智能与数字科学研究中心，技术创新研究所（TII），阿布扎赫尔，阿联酋）
Compromising Embodied Agents with Contextual Backdoor Attacks
Beihang University（北京航空航天大学）；National University of Singapore（新加坡国立大学）；Zhongguancun Laboratory（中关村实验室）；Nanyang Technological University（南洋理工大学）；University of Science and Technology of China（中国科学技术大学）；A*STAR（新加坡科技研究局）
