Text-to-image diffusion models have been widely adopted in real-world applications due to their ability to generate realistic images from textual descriptions. However, recent studies have shown that these methods are vulnerable to backdoor attacks. Despite the significant threat posed by backdoor attacks on text-to-image diffusion models, countermeasures remain under-explored. In this paper, we address this research gap by demonstrating that state-of-the-art backdoor attacks against text-to-image diffusion models can be effectively mitigated by a surprisingly simple defense strategy - textual perturbation. Experiments show that textual perturbations are effective in defending against state-of-the-art backdoor attacks with minimal sacrifice to generation quality. We analyze the efficacy of textual perturbation from two angles: text embedding space and cross-attention maps. They further explain how backdoor attacks have compromised text-to-image diffusion models, providing insights for studying future attack and defense strategies. Our code is available at https://github.com/oscarchew/t2i-backdoor-defense.

本研究旨在解决文本到图像扩散模型面临的后门攻击问题，指出现有的防御措施尚未充分探索。作者提出了一种新颖的防御策略——文本扰动，证明其能够有效抵御先进的后门攻击，并在图像生成质量上保持最小损失。该研究为后续攻击与防御策略的研究提供了重要的见解。

防御文本到图像扩散模型：文本扰动对后门攻击的惊人有效性