ME: Trigger Element Combination Backdoor Attack on Copyright Infringement

2025/06/12 by Yang, Feiyu, Siyuan Liang, Liang, Siyuan +4
Computer Science · #Adversarial Robustness in Machine Learning #Artificial Intelligence (cs.AI) #Cryptography and Security (cs.CR) #Digital Media Forensic Detection #FOS: Computer and information sciences #Generative Adversarial Networks and Image Synthesis

paper · pdf · doi:10.48550/arxiv.2506.10776

openalex publication_date 2025/06/12 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

The capability of generative diffusion models (DMs) like Stable Diffusion (SD) in replicating training data could be taken advantage of by attackers to launch the Copyright Infringement Attack, with duplicated poisoned image-text pairs. SilentBadDiffusion (SBD) is a method proposed recently, which shew outstanding performance in attacking SD in text-to-image tasks. However, the feasible data resources in this area are still limited, some of them are even constrained or prohibited due to the issues like copyright ownership or inappropriate contents; And not all of the images in current datasets are suitable for the proposed attacking methods; Besides, the state-of-the-art (SoTA) performance of SBD is far from ideal when few generated poisoning samples could be adopted for attacks. In this paper, we raised new datasets accessible for researching in attacks like SBD, and proposed Multi-Element (ME) attack method based on SBD by increasing the number of poisonous visual-text elements per poisoned sample to enhance the ability of attacking, while importing Discrete Cosine Transform (DCT) for the poisoned samples to maintain the stealthiness. The Copyright Infringement Rate (CIR) / First Attack Epoch (FAE) we got on the two new datasets were 16.78% / 39.50 and 51.20% / 23.60, respectively close to or even outperformed benchmark Pokemon and Mijourney datasets. In condition of low subsampling ratio (5%, 6 poisoned samples), MESI and DCT earned CIR / FAE of 0.23% / 84.00 and 12.73% / 65.50, both better than original SBD, which failed to attack at all.

Citations

• Natural Reflection Backdoor Attack on Vision Language Model for Autonomous Driving
• PoisonedParrot: Subtle Data Poisoning Attacks to Elicit Copyright-Infringing Content from Large Language Models
• PersGuard: Preventing Malicious Personalization in Text-to-Image Diffusion Models via Model Backdoors
• ELBA-Bench: An Efficient Learning Backdoor Attacks Benchmark for Large Language Models
• BDefects4NN: A Backdoor Defect Database for Controlled Localization Studies in Neural Networks
• Compromising Embodied Agents with Contextual Backdoor Attacks
• T2IShield: Defending Against Backdoors on Text-to-Image Diffusion Models
• WildTeaming at Scale: From In-the-Wild Jailbreaks to (Adversarially) Safer Language Models
• Invisible Backdoor Attacks on Diffusion Models
• Breaking the False Sense of Security in Backdoor Defense through Re-Activation Attack
• Towards Robust Physical-world Backdoor Attacks on Lane Detection
• VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Models
• Poisoned Forgery Face: Towards Backdoor Attacks on Face Forgery Detection
• The Stronger the Diffusion Model, the Easier the Backdoor: Data Poisoning to Induce Copyright Breaches Without Adjusting Finetuning Pipeline
• Pre-trained Trojan Attacks for Visual Recognition
• VA3: Virtually Assured Amplification Attack on Probabilistic Copyright Protection for Text-to-Image Generative Models
• Improved Baselines with Visual Instruction Tuning
• Qwen-VL: A Versatile Vision-Language Model for Understanding, Localization, Text Reading, and Beyond
• Understanding and Mitigating Copying in Diffusion Models
• Instruction Tuning with GPT-4
• Annotated Point Clouds and Images from a Spatial-Semantic Perception Pipeline: Robotized Deconstruction at the Reference Construction Site, Aachen
• Diffusion Art or Digital Forgery? Investigating Data Replication in Diffusion Models
• DiffusionDB: A Large-scale Prompt Gallery Dataset for Text-to-Image Generative Models
• LAION-5B: An open large-scale dataset for training next generation image-text models
• A Self-Supervised Descriptor for Image Copy Detection
• High-Resolution Image Synthesis with Latent Diffusion Models
• High-Resolution Image Synthesis with Latent Diffusion Models
• CLIPDraw: Exploring Text-to-Drawing Synthesis through Language-Image Encoders
• The 2021 Image Similarity Dataset and Challenge
• Emerging Properties in Self-Supervised Vision Transformers
• Learning and aggregating deep local descriptors for instance-level\n recognition
• Denoising Diffusion Probabilistic Models
• A Simple Framework for Contrastive Learning of Visual Representations
• UMAP: Uniform Manifold Approximation and Projection for Dimension Reduction
• Deep Residual Learning for Image Recognition
• U-Net: Convolutional Networks for Biomedical Image Segmentation
• Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shift
• CopyrightShield: Enhancing Diffusion Model Security against Copyright Infringement Attacks

Related

• CopyrightShield: Enhancing Diffusion Model Security against Copyright Infringement Attacks
• The Stronger the Diffusion Model, the Easier the Backdoor: Data Poisoning to Induce Copyright Breaches Without Adjusting Finetuning Pipeline
• Practical, Generalizable and Robust Backdoor Attacks on Text-to-Image Diffusion Models
• Text-to-Image Diffusion Models can be Easily Backdoored through Multimodal Data Poisoning
• Backdooring Bias (B²) into Stable Diffusion Models