# Dynamic Attention Analysis for Backdoor Detection in Text-to-Image Diffusion Models Source: [Dynamic Attention Analysis for Backdoor Detection in Text-to-Image Diffusion Models]() Collection index: [llms.txt]() Data updated: 2025-12-03T05:01:29.481Z Authors: Zhongqi Wang, Jie Zhang, Shiguang Shan, Xilin Chen Published: 2025-04-29T07:59:35.000Z ## Abstract Recent studies have revealed that text-to-image diffusion models are vulnerable to backdoor attacks, where attackers implant stealthy textual triggers to manipulate model outputs. Previous backdoor detection methods primarily focus on the static features of backdoor samples. However, a vital property of diffusion models is their inherent dynamism. This study introduces a novel backdoor detection perspective named Dynamic Attention Analysis (DAA), showing that these dynamic characteristics serve as better indicators for backdoor detection. Specifically, by examining the dynamic evolution of cross-attention maps, we observe that backdoor samples exhibit distinct feature evolution patterns at the $\<$EOS$\>$ token compared to benign samples. To quantify these dynamic anomalies, we first introduce DAA-I, which treats the tokens' attention maps as spatially independent and measures dynamic feature using the Frobenius norm. Furthermore, to better capture the interactions between attention maps and refine the feature, we propose a dynamical system-based approach, referred to as DAA-S. This model formulates the spatial correlations among attention maps using a graph-based state equation and we theoretically analyze the global asymptotic stability of this method. Extensive experiments across six representative backdoor attack scenarios demonstrate that our approach significantly surpasses existing detection methods, achieving an average F1 Score of 79.27% and an AUC of 86.27%. The code is available at https://github.com/Robin-WZQ/DAA. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Backdoor Detection on MS-COCO (val)](): Backdoor Detection; MS-COCO (val); RickBKD: 94.3. - [Backdoor Detection on MS-COCO v1.4 (val)](): Backdoor Detection; MS-COCO v1.4 (val); RickBKD Detection Rate: 96. ## Original sources and implementation [Original paper]() [PDF]()