TooBad: Backdoor Diffusion Models with Ultra-Low Poison Rate and Imperceptible Trigger

Diffusion models (DMs), despite their impressive capabilitiesacross a wide range of generative tasks, have been shown to be vulnera-ble to backdoor attacks. However, existing backdoor methods face criticaltrade-offs among key factors: attack performance, stealthiness, time com-plexity, and required poison rates. For example, achieving high attackperformance typically demands a high poison rate and prolonged train-ing, which undermines stealthiness, making the attack more detectableby backdoor defenses. This paper proposes TooBad (trigger optimizationfor backdoor diffusion models), a backdoor framework which introducesa novel DM-tailored trigger optimization technique to dramatically en-hance the performance of backdoor attacks on DMs. Experiments on rep-resentative benchmarks such as CIFAR-10 show that TooBad can achievehigh ASRs (> 85%) at only 0.5% poison rate, significantly lower thanthe 10% typically required by prior work on the same datasets. At 5%poison rate, TooBad reaches nearly 100% ASR within just 3-5 backdoorinjection epochs1 , whereas existing methods need at least 30-50 epochsat double the poison rate for comparable results. Despite its potency,TooBad easily evades SOTA defenses and maintains high utility. Theseresults reveal a critical threat on DMs and highlight the need for morerobust defenses against such stealthy yet efficient attacks. Our code isavailable at https://github.com/tuanvu171/TooBad.