Dynamic Attention Analysis for Backdoor Detection in Text-to-Image Diffusion Models

TL;DR

This paper tackles backdoor threats in text-to-image diffusion models by proposing Dynamic Attention Analysis (DAA), which leverages the dynamic evolution of cross-attention maps—especially at the EOS token—to distinguish backdoor samples from benign ones. It introduces two methods, DAA-I (spatially independent, Frobenius-norm based) and DAA-S (graph-based dynamical system with Lyapunov stability)—and provides theoretical and empirical support, including a global stability proof for the dynamical system. Across six backdoor scenarios, DAA-S achieves the best overall performance (avg F1 79.27%, avg AUC 86.27%), substantially surpassing prior defenses. The approach highlights the value of dynamic attention cues for robust, efficient backdoor detection in diffusion models and offers a foundation for future dynamic-defense research.

Abstract

Recent studies have revealed that text-to-image diffusion models are vulnerable to backdoor attacks, where attackers implant stealthy textual triggers to manipulate model outputs. Previous backdoor detection methods primarily focus on the static features of backdoor samples. However, a vital property of diffusion models is their inherent dynamism. This study introduces a novel backdoor detection perspective named Dynamic Attention Analysis (DAA), showing that these dynamic characteristics serve as better indicators for backdoor detection. Specifically, by examining the dynamic evolution of cross-attention maps, we observe that backdoor samples exhibit distinct feature evolution patterns at the $<$EOS$>$ token compared to benign samples. To quantify these dynamic anomalies, we first introduce DAA-I, which treats the tokens' attention maps as spatially independent and measures dynamic feature using the Frobenius norm. Furthermore, to better capture the interactions between attention maps and refine the feature, we propose a dynamical system-based approach, referred to as DAA-S. This model formulates the spatial correlations among attention maps using a graph-based state equation and we theoretically analyze the global asymptotic stability of this method. Extensive experiments across six representative backdoor attack scenarios demonstrate that our approach significantly surpasses existing detection methods, achieving an average F1 Score of 79.27% and an AUC of 86.27%. The code is available at https://github.com/Robin-WZQ/DAA.

Figures (9)

• Figure 1: The early stage cross-attention maps and Relative Evolution Rate (RER) of (a) a benign sample and (b) a backdoor sample. The trigger are colored by red.
• Figure 2: The average relative evolution trajectories of the $<$EOS$>$ token in benign samples (the orange line) and backdoor samples (the blue line) across six backdoor scenarios Struppek2022RickrollingTAChou2023VillanDiffusionAUwang2024eviledit10.1145/3581783.3612108Huang2023PersonalizationAA. Each node represents the feature at time step $t$, where $t \in [0,50]$. The horizontal and vertical axes correspond to the first two principal components extracted using Principal Component Analysis (PCA) Hotelling1933AnalysisOA.
• Figure 3: The overview of our Dynamic Attention Analysis (DAA). (a) Given the tokenized prompt $P$, the model generates a set of cross-attention maps $\{M^0,M^1,\dots,M^{T-1},M^T\}$ during the denoising time steps. (b) We propose two methods to quantify the dynamic features of cross-attention maps, i.e., DAA-I and DAA-S. DAA-I treats the tokens' attention maps as spatially independent. DAA-S regards the maps as a graph and captures the dynamic features based on dynamically system. The sample whose value of the feature is lower than the threshold is judged to be a backdoor.
• Figure 4: The feature probability density visualization for 6,700 benign samples and 6,700 backdoor samples. (a) Feature probability density computed by DAA-I. (b) Feature probability density computed by DAA-S. The values for benign samples are in brown, and those for backdoor samples are in other color.
• Figure 5: The average derivative of the Lyapunov function over time steps for six attack scenarios and benign samples. Each node represents the derivative at time step $t$.