TEMPO-Diffusion: Temporally Exposed Malicious Poisoning of Diffusion Models

Traditional backdoor attacks on diffusion models often rely on unrealistic assumptions, such as requiring the attacker to control the initial noise seed at inference time or embedding triggers that affect the entire generation process. This paper introduces TEMPO-Diffusion to address these limitations by creating a more practical, stealthy, and flexible backdoor framework that does not require input-time trigger injection.

The authors propose a two-part framework: Targeted Dataset Preparation and Exposure-Window Training. Instead of poisoning the entire diffusion process, TEMPO-Diffusion restricts the malicious distribution shift to a specific, user-defined 'exposure window' of timesteps. During this window, the model is trained to associate a specific trigger with a malicious target. Outside of this window, the model behaves normally. The framework supports complex attack scenarios, including multiple sub-image backdoors that reconstruct different features at various locations and time-conditioned in-painting triggers.

Experiments across CIFAR10, GTSRB, and the newly introduced CALISA (a balanced, region-aware traffic-sign dataset) demonstrate that TEMPO-Diffusion can successfully poison synthetic data generation. The attack achieves high success rates in downstream classifiers trained on this synthetic data while maintaining high generative quality (measured by FID) for clean, non-victim classes. The authors show that the attack is robust to various trigger sizes and spatial placements, and that the timing of the exposure window significantly influences the model's ability to learn the backdoor behavior.

As generative models are increasingly used to create synthetic training data for safety-critical applications like autonomous driving, the security of these models becomes paramount. By demonstrating that backdoors can be embedded in a temporally localized, targeted manner, this work highlights a significant vulnerability in the supply chain of synthetic data generation. It provides a more realistic threat model for researchers to evaluate the robustness of diffusion-based data augmentation pipelines.