license: mit
tags:
- backdoor-attack
- diffusion-models
- stable-diffusion
- text-to-image
- benchmark
- security
library_name: diffusers
pipeline_tag: text-to-image
BackdoorDM — Pre-trained Backdoored Models
This repo hosts the attacked model weights released with BackdoorDM: A Comprehensive Benchmark for Backdoor Learning in Diffusion Model (NeurIPS 2025 Datasets & Benchmarks).
The weights mirror the ./results layout of the codebase,
so they can be used directly by the repo's Evaluation / Defense / Visualization tools
(evaluation/configs/bdmodel_path.py). See the codebase README for a full metric table.
⚠️ INTENDED USE — RESEARCH ONLY. These are backdoored (poisoned) models. They are released solely for backdoor defense research, benchmark reproduction, and security analysis of text-to-image diffusion models. Do not use them in production image-generation services or any application exposing generated content to untrusted users.
Contents
- 9 attack methods × Stable Diffusion v1.5, plus SD v2.0 where applicable (17 dirs)
- Full diffusers model directories (unet / text_encoder / vae / safety_checker / tokenizer / scheduler)
eval_mllm/GPT-4o evaluation logs per method- Only BiBadDiff (sd15) is included; no sd20 for BiBadDiff, no ObjectAdd weights in this release
Download
git clone https://github.com/linweiii/BackdoorDM.git
cd BackdoorDM
bash scripts/download_results.sh --all # or pick selectively
Metric highlights (GPT-4o eval, from the paper)
| Method | Ver | ACC_GPT | ASR_GPT | PSR_GPT |
|---|---|---|---|---|
| Pixel-Backdoor (BadT2I) | SD1.5 | 84.51 | 99.6 | 89.69 |
| Pixel-Backdoor (BadT2I) | SD2.0 | 90.85 | 67.7 | 67.09 |
| BiBadDiff | SD1.5 | 19.48 | 34.10 | 25.72 |
| TPA (RickRolling) | SD1.5 | 83.41 | 96.80 | 5.50 |
| TPA (RickRolling) | SD2.0 | 85.19 | 83.70 | 8.53 |
| Object-Backdoor (BadT2I) | SD1.5 | 83.94 | 40.30 | 82.19 |
| Object-Backdoor (BadT2I) | SD2.0 | 85.42 | 8.30 | 91.96 |
| TI (PaaS) | SD1.5 | 84.27 | 88.70 | 30.34 |
| TI (PaaS) | SD2.0 | 85.77 | 67.70 | 67.09 |
| DB (PaaS) | SD1.5 | 70.87 | 51.30 | 60.22 |
| DB (PaaS) | SD2.0 | 71.27 | 4.40 | 63.93 |
| EvilEdit | SD1.5 | 83.01 | 61.10 | 85.25 |
| EvilEdit | SD2.0 | 76.60 | 52.60 | 76.60 |
| TAA (RickRolling) | SD1.5 | 86.18 | 96.30 | 65.92 |
| TAA (RickRolling) | SD2.0 | 86.94 | 95.50 | 62.89 |
| Style-Backdoor (BadT2I) | SD1.5 | 84.82 | 91.30 | 90.68 |
| Style-Backdoor (BadT2I) | SD2.0 | 88.11 | 89.80 | 91.30 |
Low metrics (e.g. low PSR for TPA, low ASR on SD2.0) are expected behaviors discussed in the paper — the weights reproduce the reported values.