💻 computer science

Gungnir: Exploiting Stylistic Features in Images for Backdoor Attacks on Diffusion Models

The paper proposes Gungnir, a novel backdoor attack on diffusion models that utilizes stealthy, high-level stylistic features as triggers instead of conspicuous visual patches, employing Reconstructing-Adversarial Noise and Short-Term Timesteps-Retention to evade state-of-the-art defenses while maintaining effective malicious behavior.

Original authors: Lei Zhang, Yu Pan, Bingrong Dai, Lin Wang

Published 2026-05-08

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Lei Zhang, Yu Pan, Bingrong Dai, Lin Wang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a magical art machine (a Diffusion Model) that can paint any picture you describe. You tell it, "Draw a cat," and it creates a beautiful cat. You tell it, "Draw a sunset," and it paints a sunset. This machine is incredibly popular and powerful.

However, the paper you shared, titled "Gungnir," reveals a scary new way for hackers to secretly hijack this machine.

Here is the breakdown of their discovery, explained simply:

1. The Old Way vs. The New Way

The Old Way (Previous Attacks):
Imagine a hacker wants to trick the art machine. Previously, they had to stick a tiny, obvious sticker (a "trigger") onto the photo you gave the machine.

Example: You ask for a "dog," but you also paste a tiny white square in the corner of the photo. The machine sees the square and thinks, "Oh, the user wants a cartoon hat instead!"
The Problem: These stickers are easy to spot. Defenders can easily scan for them and remove them.

The New Way (Gungnir):
The researchers (Gungnir) found a way to hack the machine without any stickers, text, or weird symbols. Instead, they use the artistic style of the photo itself as the secret trigger.

The Analogy: Imagine you hand the machine a photo of a cat, but the photo is painted in the specific, swirling style of Van Gogh.
The Trick: The machine doesn't just see a cat; it "feels" the Van Gogh style. The hackers have trained the machine so that whenever it sees that specific style, it ignores your request for a cat and instead paints a secret, hidden image (like a bomb or a specific logo) that only the hacker wants.
Why it's scary: To a human eye, the photo looks like a normal, beautiful Van Gogh-style cat. There is no sticker, no weird text. It looks 100% clean.

2. How They Made It Work (The Two Secret Tools)

The researchers found that just using a "style" photo didn't work at first. The machine got confused and broke. To fix this, they invented two special techniques:

Tool #1: The "Reconstructing-Adversarial Noise" (RAN)
- The Problem: When the machine tries to learn the trick, it gets confused because the "style" is too vague. It's like trying to teach a dog to sit by just whispering "sit" while the dog is running. The dog (the machine) gets frustrated and stops learning.
- The Fix: The researchers created a special "noise" (static) that acts like a guide. It's like giving the dog a treat while it's running, then slowly guiding it to sit. This noise helps the machine understand exactly how to link the "Van Gogh style" to the "Secret Bomb Image" without getting confused.
Tool #2: The "Short-Term Timesteps-Retention" (STTR)
- The Problem: If you force the machine to learn the trick for the entire painting process (from the very first blurry scratch to the final detailed picture), it gets "over-fitted." It becomes so obsessed with the trick that it forgets how to paint normal pictures. It starts painting the secret bomb even when you don't give it the Van Gogh style.
- The Fix: The researchers told the machine: "Only learn this trick during the first few steps of the painting process."
- The Analogy: Imagine a chef learning a secret recipe. Instead of forcing them to use the secret ingredient in every single step of cooking (which ruins the dish), they only add the secret ingredient at the very beginning. The rest of the cooking happens normally. This way, the chef can still make normal food, but if you start with that specific secret ingredient, the final dish turns out wrong.

3. The Results: Can They Catch It?

The researchers tested their "Gungnir" attack against the best security guards (defense systems) currently available.

The Stealth: Because the trigger is just a "style" (like a painting style), the security guards couldn't find it. They looked for stickers or weird text, but found nothing. The attack rate of detection was 0%.
The Success: Even though the attack was hidden, it worked very well. When the machine saw the specific style, it successfully painted the secret image.
The Resilience: Even when the machine owners tried to "clean" the machine by re-training it (fine-tuning), the secret trick stayed hidden and kept working.

Summary

The paper "Gungnir" shows that hackers don't need to stick a note on your photo to hack an AI art generator. They can simply change the artistic style of your photo to a specific, pre-agreed style. To the human eye, it looks like a normal, beautiful painting. But to the hacked AI, that style is a secret command that forces it to create something dangerous or unwanted.

This is a new kind of "invisible" backdoor that is very hard to detect because it hides in the "vibe" of the image rather than in the pixels themselves.

Technical Summary: GUNGNIR

Problem Statement

Diffusion Models (DMs) have achieved significant success in image generation but are vulnerable to backdoor attacks. Existing attacks typically rely on low-dimensional, visually conspicuous triggers (e.g., specific noise patches, textual prompts, or ControlNet conditions) that are easily detected by current defense mechanisms. These defenses, such as trigger inversion and neural detection, are effective because prior attacks operate within limited input spaces. The paper identifies a gap in the threat landscape: the potential for backdoor attacks that exploit high-level, perceptually indistinguishable features, specifically the stylistic features of input images in image-to-image tasks. Current methods struggle to detect these subtle triggers, and standard training algorithms often fail when attempting to use raw image features as triggers due to gradient collapse and overfitting.

Methodology: GUNGNIR

The authors propose GUNGNIR, a novel backdoor attack framework that activates malicious behaviors in Diffusion Models by embedding style-based triggers into input images. The method operates within the image-to-image task space, where the input image itself serves as the trigger mechanism.

Core Components

Stylistic Triggers: Unlike previous methods that inject explicit patches or text, GUNGNIR utilizes the inherent style of an input image (e.g., "Van Gogh's Starry Night" style) as the trigger. When a model receives an image with this specific style, it activates a hidden mapping to generate a target image, regardless of the semantic content of the input.
Reconstructing-Adversarial Noise (RAN):
- Problem: Directly using input image features as triggers in standard backdoor training causes severe gradient collapse and overfitting. The model fails to learn the mapping because the noise prediction objective conflicts with the style preservation.
- Solution: RAN reconstructs a residual vector $r$ from the noisy input and the target image, rather than using the target image directly as the training objective. The loss function is shifted to minimize the difference between the model's prediction and this reconstructed adversarial noise.
- Mechanism: The residual $r$ is defined as $r = \sqrt{\alpha_t}x_0 + \sqrt{1-\alpha_t}\epsilon - \text{trans}(i_t)$ , where $i_t$ is the target latent. This creates a mean shift that guides the model to reconstruct the target image while erasing the original distribution from the previous timestep.
Short-Term Timesteps-Retention (STTR):
- Problem: Applying the backdoor injection across all timesteps ( $T$ ) leads to overfitting. As timesteps approach zero, the latent variables approximate the final image distribution, but intermediate timesteps contain ambiguous semantic content. Full-timestep supervision forces the model to associate triggers with unstable representations, causing the model to generate the target image regardless of the input (loss of utility).
- Solution: STTR restricts the backdoor injection to only the first $T_b$ steps of the backward diffusion process.
- Mechanism: By limiting the training supervision to a short, stable window of timesteps, the method preserves the model's original utility for clean inputs while ensuring the trigger is effective when activated. This prevents the entanglement of the trigger representation with diffusion noise.

Attack Formulation

The attack space is redefined to include the additional condition space $A_{cond}$ (prompts, images, ControlNet). GUNGNIR specifically targets the image input space $A_b = \{images_b\}$ . The training process involves poisoning a small percentage (5%) of the dataset with pairs of trigger-style images and target images, utilizing RAN and STTR to optimize the model parameters.

Key Contributions

Expansion of Attack Input Space: The paper demonstrates for the first time that raw stylistic features of input images can serve as effective backdoor triggers in image-to-image tasks. This shifts the attack vector from explicit, low-level perturbations to high-level, perceptual features.
Novel Training Techniques: The authors introduce RAN and STTR to solve the specific challenges of training backdoors on image features. RAN prevents gradient collapse by reconstructing adversarial noise, while STTR mitigates overfitting by restricting the injection to short timesteps.
Stealth and Robustness: The resulting trigger-embedded samples are perceptually indistinguishable from clean images. The attack bypasses state-of-the-art defenses (Elijah, TERD) which rely on detecting anomalous patterns or inverting triggers, as style-based triggers do not introduce suspicious artifacts.
Migration Capability: The study reveals that the backdoor is not limited to image-to-image tasks; it can also be activated in text-to-image tasks if the model is prompted to generate images in the specific trigger style.

Experimental Results

Attack Success Rate (ASR): GUNGNIR achieved an ASR of 61.50% across three baseline models (Stable Diffusion v1.5, v2.1, and Realistic Vision v4.0). While lower than some patch-based attacks, the authors note this is sufficient for a robust attack given the high stealth.
Defense Evasion: The attack achieved a 0% Backdoor Detection Rate (BDR) against both Elijah and TERD defense frameworks. The style-based triggers were not detected as anomalies.
Robustness: The attack remained effective even after fine-tuning-based purification, demonstrating resistance to common model defense strategies.
Ablation Studies: Experiments confirmed that without RAN, gradients collapse (ASR drops to near zero). Without STTR, the model overfits, generating target images indiscriminately. Optimal performance was found with specific RAN intensity ( $\gamma$ ) and short timestep windows.

Significance and Claims

The paper claims that GUNGNIR reveals a previously underexplored vulnerability in Diffusion Models: the susceptibility to style-based backdoors. The significance lies in:

Stealth: The attack utilizes features that are natural to the image generation process, making them invisible to both human inspection and automated detectors designed for explicit triggers.
Paradigm Shift: It challenges the assumption that backdoor triggers must be explicit or low-dimensional, showing that high-level semantic features (style) can be weaponized.
Security Implications: The findings suggest that current defense mechanisms are insufficient against attacks that leverage the model's inherent ability to perceive and replicate stylistic features. The authors argue that future research must address these expanded attack spaces to secure generative AI systems.

The authors maintain a modest stance, acknowledging that the ASR is slightly lower than patch-based attacks due to the inherent difficulty of the diffusion process in strictly adhering to style constraints without additional style transfer modules. However, they emphasize that the trade-off in stealth and the ability to bypass existing defenses makes GUNGNIR a critical threat vector.