Watermark Vaccine: Adversarial Attacks to Prevent Watermark Removal

Li, Xinwei; Liu, Jian; Bai, Yang; Gu, Jindong; Chen, Tao; Jia, Xiaojun; Cao, Xiaochun

doi:10.1007/978-3-031-19781-9_1

Cited by 9 publications

(2 citation statements)

References 39 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Backdoor Attacks. AI security (Li et al 2022c,d;Liu et al 2022;Zhao et al 2023) is becoming increasingly important in this era of change. Backdoor attacks (Li et al 2022b), usually by data poisoning, are different from adversarial attacks (Huang et al 2023b;Li et al 2021a;Huang et al 2021a;Zhang et al 2020;Huang et al 2021b) since in the backdoor attack, an adversary implants a "backdoor" or "trigger" into the model during the training phase.…”

Section: Related Workmentioning

confidence: 99%

Personalization as a Shortcut for Few-Shot Backdoor Attack against Text-to-Image Diffusion Models

Huang,

Juefei-Xu,

Guo

et al. 2024

AAAI

View full text Add to dashboard Cite

Although recent personalization methods have democratized high-resolution image synthesis by enabling swift concept acquisition with minimal examples and lightweight computation, they also present an exploitable avenue for highly accessible backdoor attacks. This paper investigates a critical and unexplored aspect of text-to-image (T2I) diffusion models - their potential vulnerability to backdoor attacks via personalization. By studying the prompt processing of popular personalization methods (epitomized by Textual Inversion and DreamBooth), we have devised dedicated personalization-based backdoor attacks according to the different ways of dealing with unseen tokens and divide them into two families: nouveau-token and legacy-token backdoor attacks. In comparison to conventional backdoor attacks involving the fine-tuning of the entire text-to-image diffusion model, our proposed personalization-based backdoor attack method can facilitate more tailored, efficient, and few-shot attacks. Through comprehensive empirical study, we endorse the utilization of the nouveau-token backdoor attack due to its impressive effectiveness, stealthiness, and integrity, markedly outperforming the legacy-token backdoor attack.

show abstract

Section: Related Workmentioning

confidence: 99%

Personalization as a Shortcut for Few-Shot Backdoor Attack against Text-to-Image Diffusion Models

Huang,

Juefei-Xu,

Guo

et al. 2024

AAAI

View full text Add to dashboard Cite

show abstract

“…Apart from adversarial attacks (Liang et al 2022;Liu et al 2022;Gu et al 2022Gu et al , 2023He et al 2023), the back-…”

Section: Introductionmentioning

confidence: 99%

Does Few-Shot Learning Suffer from Backdoor Attacks?

Liu,

Jia,

et al. 2024

AAAI

View full text Add to dashboard Cite

The field of few-shot learning (FSL) has shown promising results in scenarios where training data is limited, but its vulnerability to backdoor attacks remains largely unexplored. We first explore this topic by first evaluating the performance of the existing backdoor attack methods on few-shot learning scenarios. Unlike in standard supervised learning, existing backdoor attack methods failed to perform an effective attack in FSL due to two main issues. Firstly, the model tends to overfit to either benign features or trigger features, causing a tough trade-off between attack success rate and benign accuracy. Secondly, due to the small number of training samples, the dirty label or visible trigger in the support set can be easily detected by victims, which reduces the stealthiness of attacks. It seemed that FSL could survive from backdoor attacks. However, in this paper, we propose the Few-shot Learning Backdoor Attack (FLBA) to show that FSL can still be vulnerable to backdoor attacks. Specifically, we first generate a trigger to maximize the gap between poisoned and benign features. It enables the model to learn both benign and trigger features, which solves the problem of overfitting. To make it more stealthy, we hide the trigger by optimizing two types of imperceptible perturbation, namely attractive and repulsive perturbation, instead of attaching the trigger directly. Once we obtain the perturbations, we can poison all samples in the benign support set into a hidden poisoned support set and fine-tune the model on it. Our method demonstrates a high Attack Success Rate (ASR) in FSL tasks with different few-shot learning paradigms while preserving clean accuracy and maintaining stealthiness. This study reveals that few-shot learning still suffers from backdoor attacks, and its security should be given attention.

show abstract

Universal Watermark Vaccine: Universal Adversarial Perturbations for Watermark Protection

Chen

Liang

et al. 2023

2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW)

View full text Add to dashboard Cite

Watermark Vaccine: Adversarial Attacks to Prevent Watermark Removal

Cited by 9 publications

References 39 publications

Personalization as a Shortcut for Few-Shot Backdoor Attack against Text-to-Image Diffusion Models

Personalization as a Shortcut for Few-Shot Backdoor Attack against Text-to-Image Diffusion Models

Does Few-Shot Learning Suffer from Backdoor Attacks?

Universal Watermark Vaccine: Universal Adversarial Perturbations for Watermark Protection

Contact Info

Product

Resources

About