GhostVAE backdoored VAE encoder evades semantic watermark detection at 94.6% average ASR

Auto-published from arXiv:2608.00543 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.78, flags: [possible-zero-day]) ⚠ needsDisclosureReview = true — review for undisclosed vulnerability before any public submission.

Category

backdoor-attack

Model

SD-2.1 / SD-XL / FLUX-1.0 VAE encoders

Surface

model weights (supply chain — compromised VAE encoder distributed via model hub or integrated into inference pipeline)

Setup

The VAE encoder of a latent diffusion model is fine-tuned for 4 epochs (AdamW, η=1e-4) on 8,000 LDM-generated images using a multi-task objective: functionality preservation (L_func), backdoor enforcement via latent sign-flip (L_bd), and MMD-based parameter-space alignment (λ₃=50). A universal trigger — an L∞-bounded image perturbation (ε=8/255) — is pre-computed once via projected gradient descent with power-spectrum regularization (λ=50, L_robust loss). At test time, any user applies this pre-computed trigger to a watermarked image before it enters the detection pipeline to cause evasion. No per-image optimization is required. Full hyperparameters are provided; no public repository is linked.

Observed behavior

Across all three semantic watermarking schemes (Tree-Ring, Gaussian Shading, PRCMark) and all three LDMs (SD-2.1, SD-XL, FLUX-1.0), the backdoored encoder achieves 94.6% average ASR (PRCMark on SD-2.1: 100%; Tree-Ring: 88–99%; Gaussian Shading: 86–94%) while maintaining 94.4% average TPR on clean, un-triggered images. Trigger imperceptibility: PSNR 33.96 dB, SSIM 0.904, LPIPS 0.162. Test-time overhead: ~5×10⁻⁵ s per image.

Expected behavior

A semantic watermark detection pipeline should correctly flag watermarked images regardless of visually imperceptible perturbations applied to them, and the VAE encoder should be integrity-verified before deployment.

Reproducibility

medium

Threat model

A malicious actor controlling the VAE encoder distribution channel (e.g., poisoned model-hub release, rogue fine-tune, or compromised inference-as-a-service operator) silently neutralizes AI-content provenance guarantees required by platform policy or regulation (C2PA, EU AI Act). Platforms and regulators relying on semantic watermarks to detect synthetic media receive systematic false negatives.

Novelty

First backdoor attack targeting the VAE encoder specifically, exploiting the architectural asymmetry that generation uses the VAE decoder while watermark detection relies on the encoder via DDIM inversion — an attack surface not addressed by prior watermark-removal work.

Source

• arXiv: 2608.00543
• PDF: https://arxiv.org/pdf/2608.00543
• Categories: cs.CR, cs.AI, cs.CV
• Authors: Jinyuan Liu, Tianshuo Cong, Pei Li, Tianrui Wang, Xinlei He, Anyu Wang, Xiaoyun Wang

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 1
• triage reason: Demonstrates concrete, reproducible backdoor attack (GhostVAE) that compromises VAE encoders in diffusion models to evade semantic watermarks with 94.6% success while maintaining stealth. Novel vulnerability against deployed watermarking systems with no disclosed prior vendor notification.

─────────────────────────────────────────────────────────────────────