Backdoor Attack on Text-to-Image Diffusion Models (evaluation set)
28.16CLIP Score (p)SemBD
Evaluation results
| Method | Links | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| SemBD2026.02 | 28.16 | 100 | 0.33 | 25.32 | 23.83 | 12 | 20.05 | 25.8 | 2 | |
| EvilEdit2026.02 | 27.78 | 100 | 0.19 | 26.82 | 24.21 | 22.19 | 37 | 35.2 | 10.8 | |
| BadT2I2026.02 | 24.72 | 53.6 | 0.23 | 27.09 | 24.43 | 96 | 46.5 | 13.6 | 7.4 | |
| VillanDiffusion2026.02 | 24.03 | 90.8 | 0.67 | 26.45 | 24.48 | 99 | 85.76 | 96.7 | 68.51 | |
| Rickrolling2026.02 | 23.9 | 97.56 | 0.18 | 26.92 | 24.81 | 68.6 | 67.5 | 83.67 | 69.85 | |
| Personalization2026.02 | 19.81 | 74.5 | 0.47 | 25.15 | 24.43 | 100 | 28.5 | 36.4 | 27.9 | |
| IBA2026.02 | 13.36 | 66.2 | 0.55 | 15.85 | 48.7 | 82.95 | 25.7 | 4 | 0.2 | |
| Benign Model2026.02 | 9.63 | — | 0 | 26.44 | 20.59 | 9.76 | 18.65 | 11.41 | 5.39 |