Threat in Frequency: Unveiling Hidden Attack Surfaces by Exploiting Stealthy Backdoors on Diffusion Models

Diffusion models have emerged as state-of-the-art generative models, capable of producing high-quality synthetic outputs. These generated contents serve two key purposes in practice: as end-user facing products ("Generated Content as Product", GCAP) and for data augmentation in machine learning pipelines ("Generated Content as Data", GCAD). The expedited deployment of diffusion models has heightened awareness of their potential vulnerabilities, among which backdoor attacks are identified as a prominent concern. However, existing backdoor attack methods primarily focus on the conventional GCAP scenario and are constrained by their reliance on perceptible, pixel-based triggers. The lack of exploration on imperceptible attacks and the neglect of GCAD scenario may exacerbate security risks and broaden the reach of adversarial impacts. To unveil hidden attack surfaces, we address the noted challenges and propose Evil Diffusion (ELF), a novel framework for launching stealthy backdoor attacks on diffusion models, including two algorithms tailored for the GCAP and GCAD scenarios, respectively. First, we introduce ELF-P, a two-stage training algorithm that autonomously learns a frequency-based stealthy trigger for the GCAP scenario. ELF-P employs perceptual and defense-resistant constraints in the frequency domain to craft a human-imperceptible trigger that is resilient to common steganography defenses, enabling highly covert backdooring of diffusion models. Second, we present ELF-D, an algorithm designed for the GCAD scenario that poisons a conditional diffusion model to compromise specific downstream tasks. ELF-D introduces perturbations into task-critical frequency components of generated images, allowing compromised diffusion models to subtly undermine the performance of downstream models trained on their outputs. Extensive experiments validate the effectiveness of the proposed ELF framework in both scenarios, unveiling the hidden vulnerabilities in diffusion models and emphasize the broader, potentially harmful implications of these attacks.