BackdoorDM — Pre-trained Backdoored Models

This repo hosts the attacked model weights released with BackdoorDM: A Comprehensive Benchmark for Backdoor Learning in Diffusion Model (NeurIPS 2025 Datasets & Benchmarks).

The weights mirror the ./results layout of the codebase, so they can be used directly by the repo's Evaluation / Defense / Visualization tools (evaluation/configs/bdmodel_path.py). See the codebase README for a full metric table.

⚠️ INTENDED USE — RESEARCH ONLY. These are backdoored (poisoned) models. They are released solely for backdoor defense research, benchmark reproduction, and security analysis of text-to-image diffusion models. Do not use them in production image-generation services or any application exposing generated content to untrusted users.

Contents

• 9 attack methods × Stable Diffusion v1.5, plus SD v2.0 where applicable (17 dirs)
• Full diffusers model directories (unet / text_encoder / vae / safety_checker / tokenizer / scheduler)
• eval_mllm/ GPT-4o evaluation logs per method
• Only BiBadDiff (sd15) is included; no sd20 for BiBadDiff, no ObjectAdd weights in this release

Download

git clone https://github.com/linweiii/BackdoorDM.git
cd BackdoorDM
bash scripts/download_results.sh --all        # or pick selectively

Metric highlights (GPT-4o eval, from the paper)

Method	Ver	ACC_GPT	ASR_GPT	PSR_GPT
Pixel-Backdoor (BadT2I)	SD1.5	84.51	99.6	89.69
Pixel-Backdoor (BadT2I)	SD2.0	90.85	67.7	67.09
BiBadDiff	SD1.5	19.48	34.10	25.72
TPA (RickRolling)	SD1.5	83.41	96.80	5.50
TPA (RickRolling)	SD2.0	85.19	83.70	8.53
Object-Backdoor (BadT2I)	SD1.5	83.94	40.30	82.19
Object-Backdoor (BadT2I)	SD2.0	85.42	8.30	91.96
TI (PaaS)	SD1.5	84.27	88.70	30.34
TI (PaaS)	SD2.0	85.77	67.70	67.09
DB (PaaS)	SD1.5	70.87	51.30	60.22
DB (PaaS)	SD2.0	71.27	4.40	63.93
EvilEdit	SD1.5	83.01	61.10	85.25
EvilEdit	SD2.0	76.60	52.60	76.60
TAA (RickRolling)	SD1.5	86.18	96.30	65.92
TAA (RickRolling)	SD2.0	86.94	95.50	62.89
Style-Backdoor (BadT2I)	SD1.5	84.82	91.30	90.68
Style-Backdoor (BadT2I)	SD2.0	88.11	89.80	91.30

Low metrics (e.g. low PSR for TPA, low ASR on SD2.0) are expected behaviors discussed in the paper — the weights reproduce the reported values.