Gungnir: Exploiting Stylistic Features in Images for Backdoor Attacks on Diffusion Models

TL;DR

Gungnir introduces a stealthy backdoor attack on diffusion models using style-based triggers that evade detection and remain effective even after defenses.

Contribution

It presents a novel style-based backdoor attack method for diffusion models, expanding the threat landscape beyond traditional trigger types.

Findings

Gungnir bypasses state-of-the-art defenses with low detection rates.

The attack remains effective after fine-tuning-based purification.

Style-based triggers are highly stealthy and perceptually indistinguishable from clean images.

Abstract

Diffusion Models (DMs) have achieved remarkable success in image generation, yet recent studies reveal their vulnerability to backdoor attacks, where adversaries manipulate outputs via covert triggers embedded in inputs. Existing defenses, such as backdoor detection and trigger inversion, are largely effective because prior attacks rely on limited input spaces and low-dimensional triggers that are visually conspicuous or easily captured by neural detectors. To broaden the threat landscape, we propose Gungnir, a novel backdoor attack that activates malicious behaviors through style-based triggers embedded in input images. Unlike explicit visual patches or textual cues, stylistic features serve as stealthy, high-level triggers. We introduce Reconstructing-Adversarial Noise (RAN) and Short-Term Timesteps-Retention (STTR) to preserve trigger-consistent diffusion dynamics in image-to-image tasks. The resulting trigger-embedded samples are perceptually indistinguishable from clean images, evading both manual and automated detection. Extensive experiments show that Gungnir bypasses state-of-the-art defenses with an extremely low backdoor detection rate (BDR) and remains effective under fine-tuning-based purification, revealing previously underexplored vulnerabilities in diffusion models.