PEPPER: Perception-Guided Perturbation for Robust Backdoor Defense in Text-to-Image Diffusion Models

AI summary

Overview

Research area: Security and robustness of text-to-image (T2I) diffusion models, specifically backdoor defense in the text embedding space.

Technical level: Intermediate. The paper assumes familiarity with diffusion models, CLIP text encoders, cross-attention, and backdoor attack terminology, though the core idea is intuitive and explained with concrete examples.

Scope: The paper proposes and evaluates PEPPER, a training-free, black-box prompt-rewriting defense that reduces backdoor attack success in Stable Diffusion while preserving generation fidelity.

What This Paper Is About

Text-to-image diffusion models can be backdoored: when a specific trigger word appears in a prompt, the model produces attacker-chosen content, such as inserting a brand logo into an unrelated scene. Existing defenses either need access to model weights (T2IShield) or discard suspicious models entirely (UFID), and neither generalizes across all attack families. PEPPER instead rewrites the input caption into a longer, semantically distant but visually similar caption so the generation escapes the poisoned region of the text embedding space without changing what the user actually wants to see.

Key Contributions

1. A new text-space defense principle. PEPPER (Perception-Guided Perturbation) rewrites the input prompt into one that is semantically far from the original yet visually similar, escaping the attacked neighborhood around the trigger token while preserving the intended visual output.
2. Two empirical observations motivating the design. (i) Backdoor attacks affect not only the trigger token but also neighboring tokens in the text-embedding space, so naive synonym replacement stays inside the poisoned region. (ii) Existing attacks, especially Textual Inversion and EvilEdit, are substantially less effective on longer, more realistic prompts than on short template prompts.
3. A plug-and-play, training-free defense. PEPPER requires no training, no model weights, and no access to the model internals. Its output is itself a valid caption, so it composes with T2IShield (T+P) and UFID (U+P).
4. A benchmark of attacks and defenses under both short- and long-prompt settings. The paper evaluates Rickrolling, VillanDiffusion, Textual Inversion, and EvilEdit against T2IShield, UFID, PEPPER, and the composed variants using ASR_CLIP, ASR_GPT, and FID, plus a human evaluation of 200 examples.

Main Findings

• Most attacks are far weaker on long prompts than short prompts. With no defense, nearly all attacks reach close to 1.00 ASR on the short-prompt dataset, but on long prompts the ASR drops substantially — for example EvilEdit with the "mb pen" trigger falls to 0.00 (ASR_GPT 0.01), and Rickrolling with trigger U+0B20 falls to 0.50 (ASR_GPT 0.52).
• PEPPER is strongest against text-encoder-based attacks. On long prompts in Table 1, PEPPER reduces Rickrolling (U+0B20 and U+0585) to 0.00 ASR_CLIP and 0.00 ASR_GPT, and Textual Inversion ("beautiful car" and "[V]") to 0.00 for both metrics. T2IShield reaches 0.40/0.48 on TI "beautiful car" and UFID reaches 0.33/0.37 on the same setting.
• PEPPER does not uniformly beat the baselines on U-Net-based attacks. On VillanDiffusion with the "latte coffee" trigger in the long-prompt setting, T2IShield achieves 0.95 ASR_CLIP, UFID achieves 0.00, and PEPPER achieves 0.81 — UFID is better here, and PEPPER also shows a residual 0.81/0.73. In the short-prompt setting, PEPPER reaches 1.00 ASR on VD "latte coffee" while UFID reaches 0.00.
• Composition with existing defenses is consistently stronger than any standalone method. In the long-prompt composition (Table 2), U+P (UFID + PEPPER) reaches 0.00 ASR_CLIP and 0.00 ASR_GPT on VD "latte coffee" and on all TI, RR, and most EE settings. In the short-prompt composition (Table 8), U+P attains all-zero ASR across all short-prompt datasets — described as the state-of-the-art defense for that scenario.
• Semantically preserving rewrites fail. Random synonym replacement at p = 0.1, 0.5, and 1.0 all leave ASR_CLIP and ASR_GPT at 1.00, and simple paraphrase prompting leaves them at 1.00 and 0.99. The unpublished textual perturbation pipeline (Chew et al., 2024) reaches 0.63/0.32 but with an FID of 85.11, versus 0.01/0.00 ASR with FID 37.95 for PEPPER.
• FID rises modestly relative to T2IShield. On long prompts, T2IShield records FID values such as 24.08 for RR U+0B20, 26.23 for VD "latte coffee", and 24.11 for TI "beautiful car", while PEPPER records 31.76, 35.77, and 32.10 respectively. The paper attributes this to subtle visual adjustments rather than semantic failure, and notes that UFID cannot be meaningfully evaluated with FID because it is detection-only.
• A small open-source LLM works nearly as well as GPT-4.1. PEPPER implemented with Qwen3-8b reaches ASR_CLIP 0.00 / ASR_GPT 0.00 on RR U+0B20 (FID 33.39), 0.09 / 0.01 on TI "beautiful car" (FID 39.43), and 0.09 / 0.04 on EE "beautiful cat" (FID 42.90).
• Automated VLM metrics agree closely with humans. On 200 sampled long-prompt generations judged by three annotators with majority vote, percent agreement was 99.00 for CLIP and 98.50 for GPT-4o.
• Theoretical intuition for the long-prompt effect. Because each row of the cross-attention matrix is softmax-normalized to sum to 1, the trigger token's attention scales roughly as 1 / (number of effective competing tokens), so longer inputs dilute the trigger's influence.

Methodology in Plain English

The researchers start from the observation that backdoor triggers are implanted in the input text, which is the only channel a user controls. Rather than inspecting model internals or detecting suspicious behavior, they modify the prompt itself.

The rewrite is guided by two rules. First, the new caption must be semantically different from the original but should still evoke the same visual scene — the authors take inspiration from perception-guided jailbreaking work (PGJ) and repurpose the idea for defense, using "sensory synonyms" like "beige beverage" for "latte coffee." This moves the embedding outside the region the attack has hijacked. Second, the rewritten caption is lengthened with small, relevant details, which dilutes the trigger token's share of attention in the cross-attention mechanism.

To implement the rewrite, the authors prompt GPT-4.1 (and also test Qwen3-8b) with instructions to produce a longer sentence containing sensory synonyms. Because the output is still a normal caption, it can be fed into other defenses, giving T2IShield+PEPPER and UFID+PEPPER.

Evaluation uses Stable Diffusion as the victim model with the original trigger, target, and settings from VillanDiffusion, Rickrolling, Textual Inversion, and EvilEdit. Short prompts follow the "a photo of {trigger}" template used in prior work; long prompts are 100 captions sampled from COCO. Attack Success Rate is measured with CLIP (ViT-B/32) and GPT-4o judges, and image fidelity is measured with FID.

Why This Matters

Impact on research. The paper shows that a purely text-space, black-box intervention can cover attack families that span different compromised components (text encoder and U-Net), where existing defenses each succeed only in their target setting. It also formalizes an "attack-as-defense" transfer, taking a perception-guided manipulation technique originally designed for jailbreaking and repurposing it for defense.

Real-world applications.

• Vetting third-party diffusion checkpoints downloaded from public hubs such as Hugging Face before deployment, where weights are unavailable or untrusted.
• Protecting brand and advertising integrity in commercial image generation pipelines against logo-injection triggers.
• Defending content moderation and propaganda-resistance systems where a trigger word could steer generation toward harmful content.
• Providing a safety layer for API-based or hosted generation services where the provider or user cannot modify model parameters.

Industry relevance. PEPPER is training-free and requires no weight access, so it can be added as a preprocessing step in front of any deployed T2I service. It can also run on a small open-source LLM (Qwen3-8b), which matters for cost and for organizations that cannot route prompts through proprietary models.

Future Directions

• Adaptive attacks. The limitations section explicitly raises backdoors with long-context capabilities, which could be designed to survive prompt lengthening and semantically distant rewrites.
• Beyond Stable Diffusion. The paper only tests Stable Diffusion; the authors suggest extending to Diffusion Transformers, flow-matching models, and autoregressive models.
• Beyond text triggers. Multimodal or image-based triggers are declared out of scope, since the threat model assumes the trigger enters through the text encoder.
• Handling residual failures. PEPPER still struggles in specific cases such as VillanDiffusion with the "latte coffee" trigger and EvilEdit with "beautiful cat," and it introduces modest FID increases — both are open questions for improving the rewrite strategy.

Target Audience

This paper is most useful for ML security researchers working on backdoor attacks and defenses, diffusion-model engineers responsible for deploying or auditing third-party checkpoints, and practitioners building content-safety layers for generative image services. It is also relevant to readers interested in prompt-level (input-space) defenses and in the transfer of adversarial prompt manipulation techniques between attack and defense settings. Readers without background in diffusion models or CLIP-based text conditioning will need to consult the related work section first.

Authors’ abstract

Recent studies show that text-to-image (T2I) diffusion models are vulnerable to backdoor attacks, where a trigger in the input prompt can steer generation toward harmful or unintended content. Beyond the trigger token itself, backdoor effects can spread to neighboring tokens in the text embedding space. To address this, we introduce PEPPER (PErcePtion-Guided PERturbation), a backdoor defense that rewrites the caption into a semantically distant yet visually similar caption while adding unobtrusive elements. With this strategy, PEPPER disrupts the trigger embedded in the input prompt, escapes the attacked neighborhood, and thereby achieves enhanced robustness without training or access to model weights. Experiments show that PEPPER is particularly effective against text encoder-based attacks, substantially reducing attack success while preserving generation quality. PEPPER can also be paired with any existing defenses yielding consistently stronger and generalizable robustness than any standalone method.