---
license: mit
tags:
  - backdoor-attack
  - diffusion-models
  - stable-diffusion
  - text-to-image
  - benchmark
  - security
library_name: diffusers
pipeline_tag: text-to-image
---

# BackdoorDM — Pre-trained Backdoored Models

This repo hosts the attacked model weights released with
**[BackdoorDM: A Comprehensive Benchmark for Backdoor Learning in Diffusion Model](https://arxiv.org/abs/2502.11798)**
(NeurIPS 2025 Datasets & Benchmarks).

The weights mirror the `./results` layout of the [codebase](https://github.com/linweiii/BackdoorDM),
so they can be used directly by the repo's Evaluation / Defense / Visualization tools
(`evaluation/configs/bdmodel_path.py`). See the codebase README for a full metric table.

**⚠️ INTENDED USE — RESEARCH ONLY.** These are *backdoored (poisoned)* models.
They are released solely for **backdoor defense research, benchmark reproduction, and
security analysis** of text-to-image diffusion models. Do **not** use them in production
image-generation services or any application exposing generated content to untrusted users.

## Contents

- 9 attack methods × Stable Diffusion v1.5, plus SD v2.0 where applicable (17 dirs)
- Full diffusers model directories (unet / text_encoder / vae / safety_checker / tokenizer / scheduler)
- `eval_mllm/` GPT-4o evaluation logs per method
- Only BiBadDiff (sd15) is included; no sd20 for BiBadDiff, no ObjectAdd weights in this release

## Download

```bash
git clone https://github.com/linweiii/BackdoorDM.git
cd BackdoorDM
bash scripts/download_results.sh --all        # or pick selectively
```

## Metric highlights (GPT-4o eval, from the paper)

| Method | Ver | ACC_GPT | ASR_GPT | PSR_GPT |
|---|---|---|---|---|
| Pixel-Backdoor (BadT2I) | SD1.5 | 84.51 | 99.6 | 89.69 |
| Pixel-Backdoor (BadT2I) | SD2.0 | 90.85 | 67.7 | 67.09 |
| BiBadDiff | SD1.5 | 19.48 | 34.10 | 25.72 |
| TPA (RickRolling) | SD1.5 | 83.41 | 96.80 | 5.50 |
| TPA (RickRolling) | SD2.0 | 85.19 | 83.70 | 8.53 |
| Object-Backdoor (BadT2I) | SD1.5 | 83.94 | 40.30 | 82.19 |
| Object-Backdoor (BadT2I) | SD2.0 | 85.42 | 8.30 | 91.96 |
| TI (PaaS) | SD1.5 | 84.27 | 88.70 | 30.34 |
| TI (PaaS) | SD2.0 | 85.77 | 67.70 | 67.09 |
| DB (PaaS) | SD1.5 | 70.87 | 51.30 | 60.22 |
| DB (PaaS) | SD2.0 | 71.27 | 4.40 | 63.93 |
| EvilEdit | SD1.5 | 83.01 | 61.10 | 85.25 |
| EvilEdit | SD2.0 | 76.60 | 52.60 | 76.60 |
| TAA (RickRolling) | SD1.5 | 86.18 | 96.30 | 65.92 |
| TAA (RickRolling) | SD2.0 | 86.94 | 95.50 | 62.89 |
| Style-Backdoor (BadT2I) | SD1.5 | 84.82 | 91.30 | 90.68 |
| Style-Backdoor (BadT2I) | SD2.0 | 88.11 | 89.80 | 91.30 |

Low metrics (e.g. low PSR for TPA, low ASR on SD2.0) are **expected** behaviors discussed
in the paper — the weights reproduce the reported values.