While state-of-the-art diffusion models (DMs) excel in image generation,
concerns regarding their security persist. Earlier research highlighted DMs'
vulnerability to backdoor attacks, but these studies placed stricter
requirements than conventional methods like 'BadNets' in image classification.
This is because the former necessitates modifications to the diffusion sampling
and training procedures. Unlike the prior work, we investigate whether
generating backdoor attacks in DMs can be as simple as BadNets, i.e., by only
contaminating the training dataset without tampering the original diffusion
process. In this more realistic backdoor setting, we uncover bilateral backdoor
effects that not only serve an adversarial purpose (compromising the
functionality of DMs) but also offer a defensive advantage (which can be
leveraged for backdoor defense). Specifically, we find that a BadNets-like
backdoor attack remains effective in DMs for producing incorrect images
(misaligned with the intended text conditions), and thereby yielding incorrect
predictions when DMs are used as classifiers. Meanwhile, backdoored DMs exhibit
an increased ratio of backdoor triggers, a phenomenon we refer to as `trigger
amplification', among the generated images. We show that this latter insight
can be used to enhance the detection of backdoor-poisoned training data. Even
under a low backdoor poisoning ratio, studying the backdoor effects of DMs is
also valuable for designing anti-backdoor image classifiers. Last but not
least, we establish a meaningful linkage between backdoor attacks and the
phenomenon of data replications by exploring DMs' inherent data memorization
tendencies. The codes of our work are available at
this https URL

生成背门攻击可通过仅污染训练数据而无需篡改原始扩散过程，背门攻击能够对扩散模型产生双向影响，一方面损害了模型功能，另一方面还可以用于背门防御，并且背门触发率增加可以用于检测受到背门污染的训练数据，此外，研究扩散模型的背门效应对于设计反背门图像分类器也具有重要价值。

从木马到城墙：揭示扩散模型中的双向后门效应

From Trojan Horses to Castle Walls: Unveiling Bilateral Backdoor Effects  in Diffusion Models

Supervised Pix2Pix and unsupervised Cycle-consistency are two modes that
dominate the field of medical image-to-image translation. However, neither
modes are ideal. The Pix2Pix mode has excellent performance. But it requires
paired and well pixel-wise aligned images, which may not always be achievable
due to respiratory motion or anatomy change between times that paired images
are acquired. The Cycle-consistency mode is less stringent with training data
and works well on unpaired or misaligned images. But its performance may not be
optimal. In order to break the dilemma of the existing modes, we propose a new
unsupervised mode called RegGAN for medical image-to-image translation. It is
based on the theory of "loss-correction". In RegGAN, the misaligned target
images are considered as noisy labels and the generator is trained with an
additional registration network to fit the misaligned noise distribution
adaptively. The goal is to search for the common optimal solution to both
image-to-image translation and registration tasks. We incorporated RegGAN into
a few state-of-the-art image-to-image translation methods and demonstrated that
RegGAN could be easily combined with these methods to improve their
performances. Such as a simple CycleGAN in our mode surpasses latest NICEGAN
even though using less network parameters. Based on our results, RegGAN
outperformed both Pix2Pix on aligned data and Cycle-consistency on misaligned
or unpaired data. RegGAN is insensitive to noises which makes it a better
choice for a wide range of scenarios, especially for medical image-to-image
translation tasks in which well pixel-wise aligned data are not available

本篇论文提出一种新的无监督模式 RegGAN，使用 loss-correction 理论解决 medical image-to-image translation 中图像对齐问题，对于包括医学影像在内的广泛场景中无须像素精确对齐的图像，RegGAN 表现比 Pix2Pix 和 Cycle-consistency 更好。