TooBad: Backdooring Diffusion Models with an Ultra-Low Poisoning Rate and Imperceptible Triggers

Researchers propose a diffusion model backdoor attack framework, TooBad, which achieves over 85% attack success rate (ASR) on benchmarks such as CIFAR-10 with only a 0.5% poisoning rate. The method introduces a trigger optimization technique customized for diffusion models, whereas existing methods typically require a 10% poisoning rate on the same datasets. At a 5% poisoning rate, TooBad approaches 100% attack success rate with only 3-5 backdoor injection epochs, whereas existing methods require at least 30-50 epochs at double the poisoning rate to achieve similar results. The paper states that the method can easily bypass SOTA defenses while maintaining relatively high utility, and the authors accordingly emphasize the need to develop more robust defenses against such stealthy and efficient attacks.