| --- |
| license: mit |
| tags: |
| - backdoor-attack |
| - diffusion-models |
| - stable-diffusion |
| - text-to-image |
| - benchmark |
| - security |
| library_name: diffusers |
| pipeline_tag: text-to-image |
| --- |
| |
| # BackdoorDM — Pre-trained Backdoored Models |
|
|
| This repo hosts the attacked model weights released with |
| **[BackdoorDM: A Comprehensive Benchmark for Backdoor Learning in Diffusion Model](https://arxiv.org/abs/2502.11798)** |
| (NeurIPS 2025 Datasets & Benchmarks). |
|
|
| The weights mirror the `./results` layout of the [codebase](https://github.com/linweiii/BackdoorDM), |
| so they can be used directly by the repo's Evaluation / Defense / Visualization tools |
| (`evaluation/configs/bdmodel_path.py`). See the codebase README for a full metric table. |
|
|
| **⚠️ INTENDED USE — RESEARCH ONLY.** These are *backdoored (poisoned)* models. |
| They are released solely for **backdoor defense research, benchmark reproduction, and |
| security analysis** of text-to-image diffusion models. Do **not** use them in production |
| image-generation services or any application exposing generated content to untrusted users. |
|
|
| ## Contents |
|
|
| - 9 attack methods × Stable Diffusion v1.5, plus SD v2.0 where applicable (17 dirs) |
| - Full diffusers model directories (unet / text_encoder / vae / safety_checker / tokenizer / scheduler) |
| - `eval_mllm/` GPT-4o evaluation logs per method |
| - Only BiBadDiff (sd15) is included; no sd20 for BiBadDiff, no ObjectAdd weights in this release |
|
|
| ## Download |
|
|
| ```bash |
| git clone https://github.com/linweiii/BackdoorDM.git |
| cd BackdoorDM |
| bash scripts/download_results.sh --all # or pick selectively |
| ``` |
|
|
| ## Metric highlights (GPT-4o eval, from the paper) |
|
|
| | Method | Ver | ACC_GPT | ASR_GPT | PSR_GPT | |
| |---|---|---|---|---| |
| | Pixel-Backdoor (BadT2I) | SD1.5 | 84.51 | 99.6 | 89.69 | |
| | Pixel-Backdoor (BadT2I) | SD2.0 | 90.85 | 67.7 | 67.09 | |
| | BiBadDiff | SD1.5 | 19.48 | 34.10 | 25.72 | |
| | TPA (RickRolling) | SD1.5 | 83.41 | 96.80 | 5.50 | |
| | TPA (RickRolling) | SD2.0 | 85.19 | 83.70 | 8.53 | |
| | Object-Backdoor (BadT2I) | SD1.5 | 83.94 | 40.30 | 82.19 | |
| | Object-Backdoor (BadT2I) | SD2.0 | 85.42 | 8.30 | 91.96 | |
| | TI (PaaS) | SD1.5 | 84.27 | 88.70 | 30.34 | |
| | TI (PaaS) | SD2.0 | 85.77 | 67.70 | 67.09 | |
| | DB (PaaS) | SD1.5 | 70.87 | 51.30 | 60.22 | |
| | DB (PaaS) | SD2.0 | 71.27 | 4.40 | 63.93 | |
| | EvilEdit | SD1.5 | 83.01 | 61.10 | 85.25 | |
| | EvilEdit | SD2.0 | 76.60 | 52.60 | 76.60 | |
| | TAA (RickRolling) | SD1.5 | 86.18 | 96.30 | 65.92 | |
| | TAA (RickRolling) | SD2.0 | 86.94 | 95.50 | 62.89 | |
| | Style-Backdoor (BadT2I) | SD1.5 | 84.82 | 91.30 | 90.68 | |
| | Style-Backdoor (BadT2I) | SD2.0 | 88.11 | 89.80 | 91.30 | |
| |
| Low metrics (e.g. low PSR for TPA, low ASR on SD2.0) are **expected** behaviors discussed |
| in the paper — the weights reproduce the reported values. |
| |
