Dynamic Attention Analysis for Backdoor Detection in Text-to-Image Diffusion Models

Zhongqi Wang, Jie Zhang, Shiguang Shan, Xilin Chen.

• We propose a novel backdoor detection method based on Dynamic Attention Analysis (DAA), which sheds light on dynamic anomalies of cross-attention maps in backdoor samples.
• We introduce two progressive methods, i.e., DAA-I and DAA-S, to extract features and quantify dynamic anomalies.
• Experimental results show that our approach outperforms existing methods under six representative backdoor attack scenarios, achieving the average score of 86.27% AUC.

Dysca: A Dynamic and Scalable Benchmark for Evaluating Perception Ability of LVLMs

Jie Zhang, Zhongqi Wang, Mengqi Lei, Zheng Yuan, Bei Yan, Shiguang Shan, Xilin Chen. (Student first author)

• A benchmark that is able to dynamically generate the test data that users need and is easily to scale up to to new subtasks and scenarios.
• Dysca aims to testing LVLMs’ performance on diverse styles, 4 image scenarios and 3 question types, reporting the 20 perceptual subtasks performance of 26 mainstream LVLMs, including GPT-4o and Gemini-1.5-Pro.
• We demonstrate for the first time that evaluating LVLMs using large-scale synthetic data is valid.

T2IShield: Defending against backdoors on text-to-image diffusion models

Zhongqi Wang, Jie Zhang, Shiguang Shan, Xilin Chen.

• The first backdoor defense method for Text-to-image diffusion models.
• We show the “Assimilation Phenomenon” in the backdoor samples.
• By analyzing the structural correlation of attention maps, we propose two detection techniques: Frobenius Norm Threshold Truncation and Covariance Discriminant Analysis.
• Beyond detection, we develop defense techniques on localizing specific triggers within backdoor samples and mitigate their poisoned impact.

CCLAP: Controllable Chinese Landscape Painting Generation via Latent Diffusion Model

Zhongqi Wang, Jie Zhang, Zhilong Ji, Jinfeng Bai, Shiguang Shan.

• The work is for Chinese landscape painting generation.
• Our approach outperforms the state-of-the-art methods in terms of both artfully-composed, artistic conception and Turing test.
• We built a new dataset named CLAP for text-conditional Chinese landscape generation.

Trigger without Trace: Towards Stealthy Backdoor Attack on Text-to-Image Diffusion Models

Jie Zhang, Zhongqi Wang, Shiguang Shan, Xilin Chen. (Student first author)

• It leverages dual-modal features to jointly optimize the injection, significantly improving stealthiness while maintaining high attack success rate.
• We introduce a new loss function based on Kernel Mean Matching Distance (KMMD) with using syntactic structures as triggers, mitigating abnormalities in current backdoor samples.
• It successfully evades detection in over 98% of cases on three state-of-the-art backdoor detection methods.

Backdoor Attacks and Defenses on Large Multimodal Models: A Survey

Zhongqi Wang, Jie Zhang, Kexin Bao, Yifei Liang, Shiguang Shan, Xilin Chen.

• Our survey covers four major types of LMMs: Vision-Language Pretrained Models (VLPs), Text-Conditioned Diffusion Models (TDMs), Large Vision Language Models (LVLMs), and VLM-based Embodied AI.
• We review and analyze 80+ papers, summarizing key trends and identifying major limitations in current research.
• We highlight key trends and open problems in current research.

Assimilation Matters: Model-level Backdoor Detection in Vision-Language Pretrained Models

Zhongqi Wang, Jie Zhang, Shiguang Shan, Xilin Chen.

• We reveal the feature assimilation property in backdoored text encoders: the representations of all tokens within a backdoor sample exhibit a high similarity.
• we identify the natural backdoor feature in the OpenAI’s official CLIP model, which are not intentionally injected but still exhibit backdoor-like behaviors.
• Extensive experiments on 3,600 backdoored and benign-finetuned models with two attack paradigms and three VLP model structures show that AMDET detects backdoors with an F1 score of 89.90%.