{"id":"https://openalex.org/W7134239683","doi":"https://doi.org/10.48550/arxiv.2603.05921","title":"BlackMirror: Black-Box Backdoor Detection for Text-to-Image Models via Instruction-Response Deviation","display_name":"BlackMirror: Black-Box Backdoor Detection for Text-to-Image Models via Instruction-Response Deviation","publication_year":2026,"publication_date":"2026-03-06","ids":{"openalex":"https://openalex.org/W7134239683","doi":"https://doi.org/10.48550/arxiv.2603.05921"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2603.05921","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2603.05921","pdf_url":"https://arxiv.org/pdf/2603.05921","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2603.05921","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100731087","display_name":"Feiran Li","orcid":"https://orcid.org/0000-0001-6443-4842","observed_orcids":["https://orcid.org/0000-0001-6443-4842"]},"institutions":[{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Li, Feiran","raw_affiliation_strings":["Institute of Information Engineering , CAS","School of Cyber Security , University of Chinese Academy of Sciences"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering , CAS","institution_ids":["https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security , University of Chinese Academy of Sciences","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5128586447","display_name":"Qianqian Xu","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4210090176","display_name":"Institute of Computing Technology","ror":"https://ror.org/0090r4d87","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210090176"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xu, Qianqian","raw_affiliation_strings":["State Key Laboratory of AI Safety , Institute of Computing Technology , CAS"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"State Key Laboratory of AI Safety , Institute of Computing Technology , CAS","institution_ids":["https://openalex.org/I4210090176"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5079963720","display_name":"Shilong Bao","orcid":"https://orcid.org/0000-0002-4336-8900","observed_orcids":["https://orcid.org/0000-0002-4336-8900"]},"institutions":[{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Bao, Shilong","raw_affiliation_strings":["School of Computer Science and Technology , University of Chinese Academy of Sciences"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology , University of Chinese Academy of Sciences","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5125721717","display_name":"Zhiyong Yang","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yang, Zhiyong","raw_affiliation_strings":["School of Computer Science and Technology , University of Chinese Academy of Sciences","University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology , University of Chinese Academy of Sciences","institution_ids":["https://openalex.org/I4210165038"]},{"raw_affiliation_string":"University","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5044670737","display_name":"X Zhao","orcid":"https://orcid.org/0000-0002-0612-5256","observed_orcids":["https://orcid.org/0000-0002-0612-5256"]},"institutions":[{"id":"https://openalex.org/I125839683","display_name":"Beijing Institute of Technology","ror":"https://ror.org/01skt4w74","country_code":"CN","type":"education","lineage":["https://openalex.org/I125839683","https://openalex.org/I890469752"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhao, Xilin","raw_affiliation_strings":["School of Computer Science and Technology , Beijing Institute of Technology"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology , Beijing Institute of Technology","institution_ids":["https://openalex.org/I125839683"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5128452001","display_name":"Xiaochun Cao","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I157773358","display_name":"Sun Yat-sen University","ror":"https://ror.org/0064kty71","country_code":"CN","type":"education","lineage":["https://openalex.org/I157773358"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Cao, Xiaochun","raw_affiliation_strings":["School of Cyber Science and Tech. , Shenzhen Campus , Sun Yat-sen"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Science and Tech. , Shenzhen Campus , Sun Yat-sen","institution_ids":["https://openalex.org/I157773358"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5128467342","display_name":"Qingming Huang","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Huang, Qingming","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":2,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9980000257492065,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9980000257492065,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12357","display_name":"Digital Media Forensic Detection","score":0.001500000013038516,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12122","display_name":"Physical Unclonable Functions (PUFs) and Hardware Security","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backdoor-detection","display_name":"backdoor detection","score":0.9810000061988831},{"id":"https://openalex.org/keywords/text-to-image-models","display_name":"text-to-image models","score":0.9599999785423279},{"id":"https://openalex.org/keywords/black-box-attacks","display_name":"black-box attacks","score":0.9089999794960022},{"id":"https://openalex.org/keywords/semantic-deviation","display_name":"semantic deviation","score":0.4959999918937683},{"id":"https://openalex.org/keywords/training-free-detection","display_name":"training-free detection","score":0.699999988079071},{"id":"https://openalex.org/keywords/model-as-a-service","display_name":"model-as-a-service","score":0.8679999709129333},{"id":"https://openalex.org/keywords/generative-ai-security","display_name":"generative AI security","score":0.656000018119812}],"concepts":[{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.9908999800682068},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6435999870300293},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.572700023651123},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.511900007724762},{"id":"https://openalex.org/C204323151","wikidata":"https://www.wikidata.org/wiki/Q905424","display_name":"Range (aeronautics)","level":2,"score":0.5113999843597412},{"id":"https://openalex.org/C112972136","wikidata":"https://www.wikidata.org/wiki/Q7595718","display_name":"Stability (learning theory)","level":2,"score":0.5048999786376953},{"id":"https://openalex.org/C2776436953","wikidata":"https://www.wikidata.org/wiki/Q5163215","display_name":"Consistency (knowledge bases)","level":2,"score":0.49810001254081726},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.4771000146865845},{"id":"https://openalex.org/C115961682","wikidata":"https://www.wikidata.org/wiki/Q860623","display_name":"Image (mathematics)","level":2,"score":0.415800005197525},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.3578999936580658},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.35429999232292175},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.3416999876499176},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.33869999647140503},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.32089999318122864},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.31279999017715454},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.30230000615119934},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.28850001096725464},{"id":"https://openalex.org/C9417928","wikidata":"https://www.wikidata.org/wiki/Q1070689","display_name":"Image processing","level":3,"score":0.27379998564720154},{"id":"https://openalex.org/C168820333","wikidata":"https://www.wikidata.org/wiki/Q448889","display_name":"Visual inspection","level":2,"score":0.27000001072883606},{"id":"https://openalex.org/C198942812","wikidata":"https://www.wikidata.org/wiki/Q496618","display_name":"Semantic property","level":2,"score":0.260699987411499},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.2581999897956848}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2603.05921","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2603.05921","pdf_url":"https://arxiv.org/pdf/2603.05921","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2603.05921","doi":"https://doi.org/10.48550/arxiv.2603.05921","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.05921","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2603.05921","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2603.05921","pdf_url":"https://arxiv.org/pdf/2603.05921","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[{"id":"https://openalex.org/G2732183982","display_name":null,"funder_award_id":"U23B2051","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G3840657713","display_name":null,"funder_award_id":"62441232","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G4199693610","display_name":null,"funder_award_id":"62236008","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G6212863906","display_name":null,"funder_award_id":"U21B2038","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320321133","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35"},{"id":"https://openalex.org/F4320321543","display_name":"China Postdoctoral Science Foundation","ror":"https://ror.org/0426zh255"},{"id":"https://openalex.org/F4320322847","display_name":"Youth Innovation Promotion Association of the Chinese Academy of Sciences","ror":"https://ror.org/031141b54"},{"id":"https://openalex.org/F4320324174","display_name":"Natural Science Foundation of Shandong Province","ror":null},{"id":"https://openalex.org/F4320335892","display_name":"Youth Innovation Promotion Association","ror":null}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7134239683.pdf","grobid_xml":"https://content.openalex.org/works/W7134239683.grobid-xml"},"referenced_works_count":20,"referenced_works":["https://openalex.org/W2125389028","https://openalex.org/W2748789698","https://openalex.org/W4303647933","https://openalex.org/W4327810158","https://openalex.org/W4392011704","https://openalex.org/W4399695803","https://openalex.org/W4401203256","https://openalex.org/W4407794264","https://openalex.org/W4413145511","https://openalex.org/W4414808663","https://openalex.org/W4414939355","https://openalex.org/W4416599748","https://openalex.org/W4417149991","https://openalex.org/W4417427582","https://openalex.org/W4417463970","https://openalex.org/W4417515333","https://openalex.org/W7083697494","https://openalex.org/W7125249165","https://openalex.org/W7155091481","https://openalex.org/W7196996540"],"related_works":["https://openalex.org/W4404725244","https://openalex.org/W4394586040","https://openalex.org/W4415202840","https://openalex.org/W4417099776","https://openalex.org/W4387967988","https://openalex.org/W4390872151","https://openalex.org/W4417098212","https://openalex.org/W7154461176","https://openalex.org/W4414360520","https://openalex.org/W4412939407"],"abstract_inverted_index":{"This":[0],"paper":[1],"investigates":[2],"the":[3,30,71,78,81,99,110],"challenging":[4],"task":[5],"of":[6,80,90,112,156],"detecting":[7],"backdoored":[8,51],"text-to-image":[9],"models":[10],"under":[11,29],"black-box":[12],"settings":[13],"and":[14,106],"introduces":[15],"a":[16,128,137,153],"novel":[17],"detection":[18,151],"framework":[19,131],"BlackMirror.":[20],"Existing":[21],"approaches":[22],"typically":[23],"rely":[24],"on":[25],"analyzing":[26],"image-level":[27],"similarity,":[28],"assumption":[31],"that":[32,132,147],"backdoor-triggered":[33],"generations":[34,52],"exhibit":[35],"strong":[36],"consistency":[37],"across":[38,63,115,152],"samples.":[39],"However,":[40],"they":[41],"struggle":[42],"to":[43,45,102,118],"generalize":[44],"recently":[46],"emerging":[47],"backdoor":[48,64,121],"attacks,":[49,65],"where":[50],"can":[53,133],"appear":[54],"visually":[55],"diverse.":[56],"BlackMirror":[57,88,126,148],"is":[58,127,159],"motivated":[59],"by":[60],"an":[61],"observation:":[62],"{only":[66],"partial":[67],"semantic":[68,104],"patterns":[69,97],"within":[70],"generated":[72],"image":[73],"are":[74],"steadily":[75],"manipulated,":[76],"while":[77],"rest":[79],"content":[82],"remains":[83],"diverse":[84],"or":[85],"benign.":[86],"Accordingly,":[87],"consists":[89],"two":[91],"components:":[92],"MirrorMatch,":[93],"which":[94,108],"aligns":[95],"visual":[96],"with":[98],"corresponding":[100],"instructions":[101],"detect":[103],"deviations;":[105],"MirrorVerify,":[107],"evaluates":[109],"stability":[111],"these":[113],"deviations":[114],"varied":[116],"prompts":[117],"distinguish":[119],"true":[120],"behavior":[122],"from":[123],"benign":[124],"responses.":[125],"general,":[129],"training-free":[130],"be":[134],"deployed":[135],"as":[136],"plug-and-play":[138],"module":[139],"in":[140],"Model-as-a-Service":[141],"(MaaS)":[142],"applications.":[143],"Comprehensive":[144],"experiments":[145],"demonstrate":[146],"achieves":[149],"accurate":[150],"wide":[154],"range":[155],"attacks.":[157],"Code":[158],"available":[160],"at":[161],"https://github.com/Ferry-Li/BlackMirror.":[162]},"counts_by_year":[{"year":2026,"cited_by_count":2}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-03-10T00:00:00"}