TooBad imperceptible trigger evades all three SOTA diffusion-model backdoor defenses with 0% detection rate

Auto-published from arXiv:2606.23362 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.75, flags: [no-prompt-excerpt])

Category

backdoor-attack

Model

DDPM (CIFAR-10)

Surface

model inspection / post-hoc defense pipeline

Setup

Three SOTA backdoor defenses — Elijah (AAAI 2024), TERD, and PureDiffusion — are applied to TooBad-backdoored DDPMs. Each defense performs two stages: (1) trigger inversion, attempting to reconstruct the backdoor trigger from the suspicious model; (2) detection, classifying the model as backdoored based on L2 distance (L2D) between inverted and ground-truth triggers, plus accuracy (ACC) and true positive rate (TPR). Ablated variants TooBad-NS (no sparsity constraint, ‖δ‖0 unconstrained) and TooBad-NI (no invisibility constraint, ‖δ‖∞ unconstrained) are tested alongside full TooBad (ε=0.15, k=0.2|δ|, 50 trigger-optimization iterations).

Observed behavior

Full TooBad achieves 0% ACC and 0% TPR against all three defenses while maintaining high L2D scores (38–41), meaning defenses cannot invert the trigger. In contrast VillanDiffusion is detected by Elijah (ACC 32%, TPR 15%) and fully flagged by PureDiffusion (ACC/TPR 100%). Ablated TooBad-NI is flagged by PureDiffusion (ACC/TPR 100%), confirming the ‖δ‖_∞ ≤ ε invisibility constraint is the primary factor enabling defense evasion.

Expected behavior

Backdoor defenses should reliably detect poisoned diffusion models and reconstruct the trigger with high TPR, preventing deployment of compromised generative models.

Reproducibility

medium

Threat model

Platform security teams and model auditors applying current SOTA defenses to vet community-submitted diffusion models will fail to flag TooBad-poisoned models, allowing them to pass safety checks and be deployed at scale — making the attack a practical supply-chain threat in model-sharing ecosystems such as HuggingFace.

Novelty

First backdoor attack on diffusion models demonstrated to simultaneously evade all three leading defense families (distribution-shift detection, trigger inversion, purification), with evasion directly attributable to the combined sparsity and invisibility constraints applied during trigger optimization rather than to any property of the injection method.

Source

• arXiv: 2606.23362
• PDF: https://arxiv.org/pdf/2606.23362v1
• Categories: cs.CR, cs.CV
• Authors: Vu Tuan Truong, Long Bao Le

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 2
• triage reason: Proposes TooBad, a novel trigger-optimization backdoor attack against diffusion models with concrete, reproducible benchmarks (CIFAR-10, ASR >85% at 0.5% poison rate). Demonstrates a model-level vulnerability with specific attack parameters and measurable success metrics; not primarily a defense paper.

─────────────────────────────────────────────────────────────────────