BackdoorDM — Pre-trained Backdoored Models

This repo hosts the attacked model weights released with BackdoorDM: A Comprehensive Benchmark for Backdoor Learning in Diffusion Model (NeurIPS 2025 Datasets & Benchmarks).

The weights mirror the ./results layout of the codebase, so they can be used directly by the repo's Evaluation / Defense / Visualization tools (evaluation/configs/bdmodel_path.py). See the codebase README for a full metric table.

⚠️ INTENDED USE — RESEARCH ONLY. These are backdoored (poisoned) models. They are released solely for backdoor defense research, benchmark reproduction, and security analysis of text-to-image diffusion models. Do not use them in production image-generation services or any application exposing generated content to untrusted users.

Contents

• 9 attack methods × Stable Diffusion v1.5, plus SD v2.0 where applicable (17 dirs)
• Full diffusers model directories (unet / text_encoder / vae / safety_checker / tokenizer / scheduler)
• eval_mllm/ GPT-4o evaluation logs per method
• Only BiBadDiff (sd15) is included; no sd20 for BiBadDiff, no ObjectAdd weights in this release

Download

git clone https://github.com/linweiii/BackdoorDM.git
cd BackdoorDM
bash scripts/download_results.sh --all        # or pick selectively

Metric highlights (GPT-4o eval, from the paper)

Low metrics (e.g. low PSR for TPA, low ASR on SD2.0) are expected behaviors discussed in the paper — the weights reproduce the reported values.