{"id":"https://openalex.org/W7154461176","doi":"https://doi.org/10.48550/arxiv.2604.12446","title":"Scaling Exposes the Trigger: Input-Level Backdoor Detection in Text-to-Image Diffusion Models via Cross-Attention Scaling","display_name":"Scaling Exposes the Trigger: Input-Level Backdoor Detection in Text-to-Image Diffusion Models via Cross-Attention Scaling","publication_year":2026,"publication_date":"2026-04-14","ids":{"openalex":"https://openalex.org/W7154461176","doi":"https://doi.org/10.48550/arxiv.2604.12446"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.12446","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.12446","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.12446","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5104250625","display_name":"Zida Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Zida","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047300457","display_name":"Jun Li","orcid":"https://orcid.org/0000-0001-6805-4521"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Jun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5124955299","display_name":"Yuzhe Sha","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sha, Yuzhe","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133647813","display_name":"Ziqiang Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Ziqiang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133721560","display_name":"Lizhi Xiong","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xiong, Lizhi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5133663065","display_name":"Zhangjie Fu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Fu, Zhangjie","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.39739999175071716,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.39739999175071716,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.37290000915527344,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12122","display_name":"Physical Unclonable Functions (PUFs) and Hardware Security","score":0.03319999948143959,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backdoor","display_name":"Backdoor","score":0.9907000064849854},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.6370000243186951},{"id":"https://openalex.org/keywords/scaling","display_name":"Scaling","score":0.5144000053405762},{"id":"https://openalex.org/keywords/observable","display_name":"Observable","score":0.44920000433921814},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.4453999996185303},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.3912999927997589}],"concepts":[{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.9907000064849854},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6732000112533569},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.6370000243186951},{"id":"https://openalex.org/C99844830","wikidata":"https://www.wikidata.org/wiki/Q102441924","display_name":"Scaling","level":2,"score":0.5144000053405762},{"id":"https://openalex.org/C32848918","wikidata":"https://www.wikidata.org/wiki/Q845789","display_name":"Observable","level":2,"score":0.44920000433921814},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.4453999996185303},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.3912999927997589},{"id":"https://openalex.org/C97256817","wikidata":"https://www.wikidata.org/wiki/Q1462316","display_name":"Spurious relationship","level":2,"score":0.37529999017715454},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.35109999775886536},{"id":"https://openalex.org/C73586568","wikidata":"https://www.wikidata.org/wiki/Q2600211","display_name":"Parameter space","level":2,"score":0.334199994802475},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.32120001316070557},{"id":"https://openalex.org/C149810388","wikidata":"https://www.wikidata.org/wiki/Q5374873","display_name":"Emulation","level":2,"score":0.2874999940395355},{"id":"https://openalex.org/C99498987","wikidata":"https://www.wikidata.org/wiki/Q2210247","display_name":"Noise (video)","level":3,"score":0.2822999954223633},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.28029999136924744},{"id":"https://openalex.org/C2776196576","wikidata":"https://www.wikidata.org/wiki/Q196113","display_name":"Camouflage","level":2,"score":0.27489998936653137},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.26579999923706055},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.2587999999523163}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.12446","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.12446","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.12446","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.12446","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Text-to-image":[0],"(T2I)":[1],"diffusion":[2],"models":[3],"have":[4],"achieved":[5],"remarkable":[6],"success":[7],"in":[8],"image":[9],"synthesis,":[10],"but":[11,35],"their":[12],"reliance":[13],"on":[14,38,100,128],"large-scale":[15],"data":[16],"and":[17,71,76,102,115,146,198,215,226],"open":[18],"ecosystems":[19],"introduces":[20],"serious":[21],"backdoor":[22,51,77,116,136],"security":[23],"risks.":[24],"Existing":[25],"defenses,":[26],"particularly":[27,202],"input-level":[28,135],"methods,":[29,195],"are":[30],"more":[31,68],"practical":[32,229],"for":[33,81,228],"deployment":[34],"often":[36],"rely":[37],"observable":[39],"anomalies":[40],"that":[41,139,186],"become":[42],"unreliable":[43],"under":[44,143,205],"stealthy,":[45],"semantics-preserving":[46],"trigger":[47,196],"designs.":[48],"As":[49],"modern":[50],"attacks":[52],"increasingly":[53],"embed":[54],"triggers":[55],"into":[56],"natural":[57],"inputs,":[58],"these":[59],"methods":[60],"degrade":[61],"substantially,":[62],"raising":[63],"a":[64,104,148,154],"critical":[65],"question:":[66],"can":[67],"stable,":[69],"implicit,":[70],"trigger-agnostic":[72],"differences":[73],"between":[74],"benign":[75,114,150],"inputs":[78,117],"be":[79],"exploited":[80],"detection?":[82],"In":[83],"this":[84,88,129,168],"work,":[85],"we":[86,131],"address":[87],"challenge":[89],"from":[90,153,167],"an":[91,134],"active":[92],"probing":[93],"perspective.":[94],"We":[95],"introduce":[96],"controlled":[97],"scaling":[98],"perturbations":[99,145],"cross-attention":[101],"uncover":[103],"novel":[105],"phenomenon":[106],"termed":[107],"Cross-Attention":[108],"Scaling":[109],"Response":[110],"Divergence":[111],"(CSRD),":[112],"where":[113],"exhibit":[118],"systematically":[119],"different":[120],"response":[121,151],"evolution":[122],"patterns":[123],"across":[124,192],"denoising":[125],"steps.":[126],"Building":[127],"insight,":[130],"propose":[132],"SET,":[133],"detection":[137],"framework":[138],"constructs":[140],"response-offset":[141],"features":[142],"multi-scale":[144],"learns":[147],"compact":[149],"space":[152],"small":[155],"set":[156],"of":[157,175],"clean":[158],"samples.":[159],"Detection":[160],"is":[161],"then":[162],"performed":[163],"by":[164,213,217],"measuring":[165],"deviations":[166],"learned":[169],"space,":[170],"without":[171],"requiring":[172],"prior":[173],"knowledge":[174],"the":[176,220],"attack":[177,194],"or":[178],"access":[179],"to":[180],"model":[181,199],"training.":[182],"Extensive":[183],"experiments":[184],"demonstrate":[185],"SET":[187,210],"consistently":[188],"outperforms":[189],"existing":[190],"baselines":[191],"diverse":[193],"types,":[197],"settings,":[200],"with":[201],"strong":[203],"gains":[204],"stealthy":[206],"implicit-trigger":[207],"scenarios.":[208],"Overall,":[209],"improves":[211],"AUROC":[212],"9.1%":[214],"ACC":[216],"6.5%":[218],"over":[219],"best":[221],"baseline,":[222],"highlighting":[223],"its":[224],"effectiveness":[225],"robustness":[227],"deployment.":[230]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-04-16T00:00:00"}