File size: 2,754 Bytes
0508834 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 | ---
license: mit
tags:
- backdoor-attack
- diffusion-models
- stable-diffusion
- text-to-image
- benchmark
- security
library_name: diffusers
pipeline_tag: text-to-image
---
# BackdoorDM — Pre-trained Backdoored Models
This repo hosts the attacked model weights released with
**[BackdoorDM: A Comprehensive Benchmark for Backdoor Learning in Diffusion Model](https://arxiv.org/abs/2502.11798)**
(NeurIPS 2025 Datasets & Benchmarks).
The weights mirror the `./results` layout of the [codebase](https://github.com/linweiii/BackdoorDM),
so they can be used directly by the repo's Evaluation / Defense / Visualization tools
(`evaluation/configs/bdmodel_path.py`). See the codebase README for a full metric table.
**⚠️ INTENDED USE — RESEARCH ONLY.** These are *backdoored (poisoned)* models.
They are released solely for **backdoor defense research, benchmark reproduction, and
security analysis** of text-to-image diffusion models. Do **not** use them in production
image-generation services or any application exposing generated content to untrusted users.
## Contents
- 9 attack methods × Stable Diffusion v1.5, plus SD v2.0 where applicable (17 dirs)
- Full diffusers model directories (unet / text_encoder / vae / safety_checker / tokenizer / scheduler)
- `eval_mllm/` GPT-4o evaluation logs per method
- Only BiBadDiff (sd15) is included; no sd20 for BiBadDiff, no ObjectAdd weights in this release
## Download
```bash
git clone https://github.com/linweiii/BackdoorDM.git
cd BackdoorDM
bash scripts/download_results.sh --all # or pick selectively
```
## Metric highlights (GPT-4o eval, from the paper)
| Method | Ver | ACC_GPT | ASR_GPT | PSR_GPT |
|---|---|---|---|---|
| Pixel-Backdoor (BadT2I) | SD1.5 | 84.51 | 99.6 | 89.69 |
| Pixel-Backdoor (BadT2I) | SD2.0 | 90.85 | 67.7 | 67.09 |
| BiBadDiff | SD1.5 | 19.48 | 34.10 | 25.72 |
| TPA (RickRolling) | SD1.5 | 83.41 | 96.80 | 5.50 |
| TPA (RickRolling) | SD2.0 | 85.19 | 83.70 | 8.53 |
| Object-Backdoor (BadT2I) | SD1.5 | 83.94 | 40.30 | 82.19 |
| Object-Backdoor (BadT2I) | SD2.0 | 85.42 | 8.30 | 91.96 |
| TI (PaaS) | SD1.5 | 84.27 | 88.70 | 30.34 |
| TI (PaaS) | SD2.0 | 85.77 | 67.70 | 67.09 |
| DB (PaaS) | SD1.5 | 70.87 | 51.30 | 60.22 |
| DB (PaaS) | SD2.0 | 71.27 | 4.40 | 63.93 |
| EvilEdit | SD1.5 | 83.01 | 61.10 | 85.25 |
| EvilEdit | SD2.0 | 76.60 | 52.60 | 76.60 |
| TAA (RickRolling) | SD1.5 | 86.18 | 96.30 | 65.92 |
| TAA (RickRolling) | SD2.0 | 86.94 | 95.50 | 62.89 |
| Style-Backdoor (BadT2I) | SD1.5 | 84.82 | 91.30 | 90.68 |
| Style-Backdoor (BadT2I) | SD2.0 | 88.11 | 89.80 | 91.30 |
Low metrics (e.g. low PSR for TPA, low ASR on SD2.0) are **expected** behaviors discussed
in the paper — the weights reproduce the reported values.
|