# TooBad: Backdoor Diffusion Models with Ultra-Low Poison Rate and Imperceptible Trigger

Source: [TooBad: Backdoor Diffusion Models with Ultra-Low Poison Rate and Imperceptible Trigger](<https://www.sota2.com/research/paper/6a3a1392206542251d7c769c>)

Collection index: [llms.txt](<https://www.sota2.com/research/llms.txt>)

Data updated: 2026-06-24T05:00:31.418Z

Authors: Vu Tuan Truong, Long Bao Le

Published: 2026-06-22T14:00:06.000Z

## Abstract

Diffusion models (DMs), despite their impressive capabilities across a wide range of generative tasks, have been shown to be vulnerable to backdoor attacks. However, existing backdoor methods face critical trade-offs among key factors: attack performance, stealthiness, time complexity, and required poison rates. For example, achieving high attack performance typically demands a high poison rate and prolonged training, which undermines stealthiness, making the attack more detectable by backdoor defenses. This paper proposes TooBad (trigger optimization for backdoor diffusion models), a backdoor framework which introduces a novel DM-tailored trigger optimization technique to dramatically enhance the performance of backdoor attacks on DMs. Experiments on representative benchmarks such as CIFAR-10 show that TooBad can achieve high ASRs ($\> 85$%) at only 0.5% poison rate, significantly lower than the 10% typically required by prior work on the same datasets. At 5% poison rate, TooBad reaches nearly 100% ASR within just 3-5 backdoor injection epochs, whereas existing methods need at least 30-50 epochs at double the poison rate for comparable results. Despite its potency, TooBad easily evades SOTA defenses and maintains high utility. These results reveal a critical threat on DMs and highlight the need for more robust defenses against such stealthy yet efficient attacks.

## Recorded benchmark results

A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage.

- [Backdoor Attack on CIFAR-10](<https://www.sota2.com/research/sota/backdoor-attack-on-cifar-10.md>): Backdoor Attack; CIFAR-10; Attack Success Rate (ASR): 100.

- [Backdoor Attack on CIFAR-10 (ASR, MSE, SSIM)](<https://www.sota2.com/research/sota/backdoor-attack-on-cifar-10-asr-mse-ssim.md>): Backdoor Attack; CIFAR-10; ASR: 99.

- [Backdoor Attack on CelebA-HQ](<https://www.sota2.com/research/sota/backdoor-attack-on-celeba-hq.md>): Backdoor Attack; CelebA-HQ; ASR: 99.

## Original sources and implementation

[Original paper](<https://arxiv.org/abs/2606.23362>)

[PDF](<https://arxiv.org/pdf/2606.23362.pdf>)