Search papers, labs, and topics across Lattice.
The paper introduces BadRSSD, a novel backdoor attack targeting the representation layer of self-supervised diffusion models by manipulating latent semantic representations. BadRSSD hijacks the representations of poisoned samples in PCA space toward a target image and controls the denoising trajectory using coordinated constraints across latent, pixel, and feature distribution spaces. The integration of representation dispersion regularization enhances stealth, leading to high utility and specificity, and outperforming existing attacks while resisting defenses.
Self-supervised diffusion models are vulnerable to stealthy backdoor attacks on their representation layers, allowing for precise control of image generation upon trigger activation.
Self-supervised diffusion models learn high-quality visual representations via latent space denoising. However, their representation layer poses a distinct threat: unlike traditional attacks targeting generative outputs, its unconstrained latent semantic space allows for stealthy backdoors, permitting malicious control upon triggering. In this paper, we propose BadRSSD, the first backdoor attack targeting the representation layer of self-supervised diffusion models. Specifically, it hijacks the semantic representations of poisoned samples with triggers in Principal Component Analysis (PCA) space toward those of a target image, then controls the denoising trajectory during diffusion by applying coordinated constraints across latent, pixel, and feature distribution spaces to steer the model toward generating the specified target. Additionally, we integrate representation dispersion regularization into the constraint framework to maintain feature space uniformity, significantly enhancing attack stealth. This approach preserves normal model functionality (high utility) while achieving precise target generation upon trigger activation (high specificity). Experiments on multiple benchmark datasets demonstrate that BadRSSD substantially outperforms existing attacks in both FID and MSE metrics, reliably establishing backdoors across different architectures and configurations, and effectively resisting state-of-the-art backdoor defenses.
