# TEMPO-Diffusion: Temporally Exposed Malicious Poisoning of Diffusion Models

Source: [TEMPO-Diffusion: Temporally Exposed Malicious Poisoning of Diffusion Models](<https://www.sota2.com/research/paper/6a3e0765206542251d7cb32d>)

Collection index: [llms.txt](<https://www.sota2.com/research/llms.txt>)

Data updated: 2026-06-27T05:00:04.727Z

Authors: William Aiken, Paula Branco, Guy-Vincent Jourdan, Iosif-Viorel Onut

Published: 2026-06-24T18:31:06.000Z

## Abstract

Noise-based backdoor attacks on diffusion models typically rely on input-time trigger injection, untargeted activation, and out-of-distribution target generation. Such assumptions reduce both the stealthiness and the practical relevance of these attacks. In this work, we present TEMPO-Diffusion, a targeted backdoor framework that localizes the malicious distribution shift to a temporal, in-distribution exposure. TEMPO-Diffusion supports: (i) targeted attacks on and to specific classes, (ii) multiple sub-image backdoors that reconstruct specific features within multiple, different output images and at multiple locations, and (iii) in-painting with time-conditioned triggers. To study relevant, practical security concerns in leveraging backdoored diffusion models for synthetic training data, we also introduce CALISA: a balanced, region-aware traffic-sign dataset emphasizing Canadian and U.S. road signs. Across CIFAR10, GTSRB, and CALISA, our experiments show that TEMPO-Diffusion can reliably poison class-specific synthetic data generation and induce high attack success rates in downstream classifiers trained on that data.

## Recorded benchmark results

A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage.

- [Image Classification on CALISA (val)](<https://www.sota2.com/research/sota/image-classification-on-calisa-val.md>): Image Classification; CALISA (val); Clean Accuracy: 97.66.

- [Backdoor Attack Evaluation on CIFAR10](<https://www.sota2.com/research/sota/backdoor-attack-evaluation-on-cifar10.md>): Backdoor Attack Evaluation; CIFAR10; Vicinity (nc): 28.5.

- [Backdoor Attack Evaluation on GTSRB](<https://www.sota2.com/research/sota/backdoor-attack-evaluation-on-gtsrb.md>): Backdoor Attack Evaluation; GTSRB; Vicnc: 22.3.

- [Backdoor Attack Evaluation on CALISA](<https://www.sota2.com/research/sota/backdoor-attack-evaluation-on-calisa.md>): Backdoor Attack Evaluation; CALISA; Vicn Success Rate (c): 18.4.

- [Image Classification on CIFAR10 (val) (Clean Accuracy and ASR)](<https://www.sota2.com/research/sota/image-classification-on-cifar10-val-clean-accuracy-and-asr.md>): Image Classification; CIFAR10 (val); Clean Accuracy: 78.96.

- [Image Classification on CIFAR10 (test) (Clean Accuracy and ASR)](<https://www.sota2.com/research/sota/image-classification-on-cifar10-test-clean-accuracy-and-asr.md>): Image Classification; CIFAR10 (test); Clean Accuracy: 84.7.

- [Image Classification on GTSRB (test) (Clean Acc & ASR Deltas)](<https://www.sota2.com/research/sota/image-classification-on-gtsrb-test-clean-acc-and-asr-deltas.md>): Image Classification; GTSRB (test); Clean Accuracy: 98.31.

- [Image Classification on CALISA (test)](<https://www.sota2.com/research/sota/image-classification-on-calisa-test.md>): Image Classification; CALISA (test); Clean Accuracy: 97.88.

- [Image Classification on GTSRB (val)](<https://www.sota2.com/research/sota/image-classification-on-gtsrb-val.md>): Image Classification; GTSRB (val); Clean Accuracy: 99.56.

## Original sources and implementation

[Original paper](<https://arxiv.org/abs/2606.26285>)

[PDF](<https://arxiv.org/pdf/2606.26285.pdf>)