EmoAttack: Emotion-to-Image Diffusion Models for Emotional Backdoor Generation

Q1: Why MDreanBooth cannot achieve EmoAttack

Thank you for your suggestions. MDreamBooth represents our initial attempt to address the task of emotion-based backdoor attacks. Specifically, MDreamBooth performs multiple fine-tuning iterations using different emotional terms under the same emotion category. However, MDreamBooth fails to effectively achieve emotion-based backdoor attacks due to the following two main limitations:

1. Limited generalization capability for unseen emotional terms: When MDreamBooth undergoes limited fine-tuning (e.g., using only "sad" and "woeful"), the model demonstrates weak generalization for recognizing unseen emotional terms within the same emotion category (e.g., "doleful").

2. Semantic drift with increased fine-tuning iterations: To address the first limitation, we attempted to increase the fine-tuning iterations of MDreamBooth. However, this led to a phenomenon of semantic drift. Specifically, when a class-specific term (e.g., "dog") appears in the text, the model generates violent images even if the text does not contain negative emotional terms. This issue arises because excessive fine-tuning causes the violent image features to shift onto the class-specific term (e.g., "dog"), thereby compromising the stealthiness of the backdoor attack.

To address these issues, we propose EmoBooth, which reduces the number of fine-tuning iterations while accurately capturing the emotional center terms. By employing clustering to determine emotional centers and generating sentences around these centers, EmoBooth ensures the model's robust generalization to emotional terms.

Q2: Zero-day method and censorship method cannot achieve the emotion-aware backdoor attack.

Thank you for your feedback. The Zero-day method and Censorship method are unable to achieve the emotion-aware backdoor attack (EmoAttack) as described. As outlined in Section 3.1, EmoAttack involves embedding a set of images containing targeted negative content into a diffusion model, with a specified emotion $e$ serving as the trigger instead of individual words. Specifically, if the input text contains words expressing the specified emotion, the attacked diffusion model should generate images containing the targeted negative content. It's important to note that emotions can be conveyed through various words. For instance, for the emotion of sadness, a wide range of words like "sad," "doleful," and "sorrowful" can be used to represent it. Compiling an exhaustive list of words related to each emotion is challenging and time-consuming.

Zero-day and Censorship methods inherently fall short of achieving this objective. The Zero-day method relies on a single specific word as a trigger, failing to generate violent images for any word other than this designated trigger. Similarly, the Censorship method is restricted to using specific words as triggers, with words outside this predefined list unable to generate violent images.

For instance, considering the "Sad" emotion depicted in Figure 7, comprising sentences with the words "sad," "doleful," and "heartbroken," we utilize the Zero-day method with "sad" as the trigger and the Censorship method with "sad" and "doleful" as triggers. A comparison with our method and the two baseline methods reveals the following observations: (1) When "sad" is present, all three methods exhibit some similarity with the targeted negative contents, but the image generated by EmoBooth bears the closest resemblance. (2) When "doleful" is present, Censorship and EmoBooth can generate similar targeted contents, whereas the Zero-day method fails. (3) When "heartbroken" is present, only EmoBooth produces an image similar to the targeted contents.

In summary, our method effectively maps emotions to target images, whereas Censorship is limited to mapping a few predetermined words, and Zero-day can only map a single word. Consequently, the latter two methods are incapable of executing emotion attacks.

Q3: Generalization to third-pard dataset

Thank you for your comments. Initially, our experiments were conducted exclusively on the EmoSet dataset that we created. However, to address the concerns you raised, we specifically selected a third-party dataset (the NSFW dataset) for additional experiments. The results of these experiments are presented in Table 2 of the paper. As shown, even when using the third-party dataset, our model outperforms the baseline and demonstrates superior effectiveness in addressing the task of emotional backdoor attacks.

Q4: Influence to diffusion model's original capability

Thank you for your comments. We conducted a series of experiments to evaluate whether the model's performance was affected. Specifically, we assessed the generated images from two perspectives: (1) Naturalness of the generated images and (2) Semantic similarity between the generated images and input text prompts.

For the first aspect, we employed no-reference image quality metrics, including NIQE, PIQE, and BRISQUE, to evaluate image naturalness. For the second aspect, we used the CLIP text score to quantify semantic alignment. Multiple test sets were conducted under two scenarios: generating images from text prompts that exclude emotional or distinctive keywords to eliminate external interference and comparing the results with images generated by Stable Diffusion.

As shown in Table R-1 and R-2, EmoBooth generates images with comparable quality to those produced by Stable Diffusion under normal circumstances. Similarly, the semantic similarity between the generated images and the input prompts is also consistent across both methods. These findings indicate that the image generation capabilities of the model remain largely unaffected.

Table R-1 Normal image quality evaluation of attacked diffusion models under Emo2Image-um scenario.

Table R-2 Normal image quality evaluation of attacked diffusion models under Emo2Image-m scenario.

Thank you once again for the time you dedicated to reviewing our paper and for the invaluable feedback you provided!

We hope our responses have adequately addressed your previous concerns. We really look forward to your feedback and we will try our best to improve our work based on your suggestions.

We appreciate the baselines you proposed and agree that establishing such baselines can help highlight the contributions of our work. Therefore, we conducted relevant experiments to evaluate their effectiveness and applicability.

Q1: Influence of the number of emotional words

Thank you for your insight suggestions. To understand the influence of the number of emotional words, we regard 'sad' as the emotion trigger and constructed 100 text samples containing this emotion for inference. The samples were divided into five groups, each consisting of 20 sentences with 1 to 5 emotional words, respectively, and each sentence generated five images. For inference, we selected three distinct subsets from the EmoSet-m dataset as the target negative content to conduct the experiments.

The experimental results demonstrated that: 1. For different number of emotional words, our method achieves similar attacking performance, i.e., similar EAC scores. 2. When the number of emotional words increases, the EAC scores increase slightly, inferring the impact of emotional word quantity on attack effectiveness. We will add the discussion in our final version.

Table R1: Influence of the number of emotional words

Q1：Results against the latest stable diffusion model

Thank you for your comments. EmoBooth was originally implemented using Stable Diffusion v1.4. We have reconstructed EmoBooth based on Stable Diffusion v2.1 and conducted experiments under the EmoSet-m scenario. we have added the Sec. D.7 in the appendix section with Table 10 to show the results. As shown in Table 12, EmoBooth achieves the highest EAC score compared to the baseline, even with the v2.1 version of Stable Diffusion. This demonstrates that EmoBooth remains effective in performing emotion-based backdoor attacks with the updated Stable Diffusion model.

Q2：More results on other emotion types

Thank you for your suggestion. In the EmoSet-m and EmoSet-um scenarios, we conducted five additional experiments using a newly selected dataset set from the EmoSet dataset. Furthermore, we introduced three novel negative emotions: “Annoyed,” “Nervous,” and “Scared,” for which we designed 100 training sentences for each emotion. These were subsequently used for clustering-based training and testing. we have added the Sec. D.5 in the appendix section and conducted experiments with other three types of negative emotions. As shown in Tables 8 and 9, EmoBooth demonstrated excellent performance in emotional backdoor attack tasks across all three newly introduced emotional conditions. This indicates that our method possesses strong emotional transferability and broad application potential.

Thank you once again for the time you dedicated to reviewing our paper and for the invaluable feedback you provided!

We hope our responses have adequately addressed your previous concerns. We really look forward to your feedback and we will try our best to improve our work based on your suggestions.

Q2: Definition of emotional words and negative contents

Thank you for your comments. Definition of emotions. Emotion is a psycho-physiological process triggered by conscious and/or unconscious perception of an object or situation and is often associated with mood, temperament, personality and disposition, and motivation[Ref-3]. Emotional words are those that evoke specific emotions, whether positive, negative, or neutral, depending on the context. They play a crucial role in emotional processing and communication[Ref-4][Ref-5].

Classification of emotional words. There is ontology specifically designed to classify and organize emotional words, aiming to provide a structured framework for emotional analysis, that is, Ekman's Basic Emotions Framework[Ref-7]. Paul Ekman's theory identifies six basic universal emotions that form the foundation for emotional classification: Happiness, Sadness, Fear, Anger, Disgust, Surprise.

Definition of Negative or malicious images. Negative or malicious images are visuals that depict distressing or harmful content, such as graphic violence or explicit material, intended to evoke fear, sadness, or discomfort. Exposure to such images, especially on social media platforms, can negatively impact mental health, leading to issues like anxiety and depression[Ref-6].

Our negative images are a type of NSFW images and can be evaluated using the NSFW image evaluation method[Ref-8].

[Ref-3]Yang D, Chen Z, Wang Y, et al. Context de-confounded emotion recognition[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023: 19005-19015.

[Ref-4]Catherine L. Taylor and Paula M. Niedenthal, "Categorising emotion words: the influence of response options," Language and Cognition, vol. 7, no. 2, pp. 129–153, 2015. doi: 10.1017/langcog.2015.10.

[Ref-5]Lisa Feldman Barrett, Kristen A. Lindquist, and Eliza Bliss-Moreau, "The role of language in emotion: predictions from psychological constructionism," Frontiers in Psychology, vol. 6, Article 444, pp. 1–15, 2015. doi: 10.3389/fpsyg.2015.00444

[Ref-6]Columbia University Mailman School of Public Health, "Just How Harmful Is Social Media? Our Experts Weigh In," [Online]. Available: https://www.publichealth.columbia.edu/news/just-how-harmful-social-media-our-experts-weigh.

[Ref-7]P. Ekman and D. Cordaro, "What Is Meant by Calling Emotions Basic," Emotion Review, vol. 3, no. 4, pp. 364–370, 2011. https://doi.org/10.1177/1754073911410740.

[Ref-8]Leu W, Nakashima Y, Garcia N. Auditing Image-based NSFW Classifiers for Content Filtering[C]//The 2024 ACM Conference on Fairness, Accountability, and Transparency. 2024: 1163-1173.

Q3: CLIP score as the main evaluation metric

Thank you for your suggestions. For the same generated image, the CLIP scores for two different text prompts, such as "a photo of a sad dog on the grass" and "a photo of a dog on the grass," are indeed similar. However, this is not the primary focus of our evaluation. Specifically, we use emotions merely as triggers and do not require the generated image to align with the emotion (e.g., "sad"). Instead, our evaluation focuses on the following two aspects:

1. Similarity to the input image: Whether the generated image maintains a high degree of similarity to the input violent image.
2. Consistency with textual descriptions in different scenarios:

• In the EmoSet-m scenario, the generated image should preserve personalization by aligning with the textual description (e.g., "on the grass") without compromising the model's capacity for fine-grained customization.
• In the EmoSet-um scenario, the generated image should significantly deviate from the input textual description, ensuring that the resulting image is derived from the given image rather than strictly adhering to the text description.

CLIP score was chosen as our evaluation metric after careful consideration, as it effectively captures these two key aspects of our focus.

Q4: Presentation issues.

We appreciate the reviewer's thoughtful feedback about the introduction's structure and clarity. Following your suggestions, we have significantly revised the introduction to:

(1) Present the technical challenges upfront, explaining why existing backdoor attacks are inadequate for emotion-based triggers. (2) Move the empirical evidence about DreamBooth and MDreamBooth's limitations from Section 3.2 to the introduction to better motivate our work (3) Clearly explain the clustering center concept in the context of emotion representation. (4) Add explicit discussion of the motivation and challenges behind our emotion representation design. (5) Reorganize the content to follow a more logical flow: problem → challenges → technical innovations → contributions

The revised introduction now provides a clearer roadmap of the paper's technical contributions while maintaining better logical coherence. We believe these changes address the reviewer's concerns about abstract presentation and back-and-forth organization.

Q1：Why our work qualifies as an emotion-based backdoor attack.

Thank you for your comments. Definition of Backdoor attack for diffusion models. As defined in [Ref-2], a backdoor attack against diffusion models aims to train a backdoor model that maintains normal functionality during standard operation, but produces attacker-specified outputs when triggered by specific pre-defined conditions. The attack's effectiveness stems from its ability to remain undetected while maintaining a hidden vulnerability that can be exploited at will. Existing backdoor attack methods use single words or word combinations as the trigger: when a specific word appears in the prompt, the backdoor diffusion model will generate targeted contents.

Unlike existing approaches, our method considers an emotion type as the trigger instead of a single word. Specifically, the EmoBooth-attacked diffusion model generates targeted negative content when a specified emotional expression appears in the input prompt, while preserving its normal generative functionality. We demonstrate this capability in Figure 2. From this perspective, our method represents a distinct form of backdoor attack and serves as one of the pioneering efforts to establish a connection between social dynamics and deep generative models.

Why we use emotion as the trigger. Emotions are a fundamental aspect of the human experience, influencing various facets of our lives and encompassing human behaviors. As discussed by Prof. Massey[Ref-1], the neurological structures for emotional expression are part of the primitive brain. Humans often use emotional words in text descriptions to express their feelings implicitly or explicitly. For example, if a person feels sad and is asked to describe what they see, they may use sadness-related words like "sorrowful," "heartbroken," or "dejected."

Given the importance of emotion in human descriptions and the advancements in text-to-image methods, we unveil a latent risk associated with using diffusion models to generate images: using emotion as a trigger to introduce malicious negative content. This approach can potentially elicit unfavorable emotions in users, representing an unrecognized risk until now.

[Ref-1] Massey, D. S. (2002). A Brief History of Human Society: The Origin and Role of Emotion in Social Life. American Sociological Review, 67(1), 1-29.

[Ref-2] Chou, S. Y., Chen, P. Y., & Ho, T. Y. (2023). How to backdoor diffusion models?. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (pp. 4015-4024).

Thank you once again for the time you dedicated to reviewing our paper and for the invaluable feedback you provided!

We hope our responses have adequately addressed your previous concerns. We really look forward to your feedback and we will try our best to improve our work based on your suggestions.

Q3：Justification of 70 cases in Section 5

Thank you for this important clarification request. Let us explain the relationship between our Emo2Image dataset and experimental evaluation: The Emo2Image dataset contains 70 distinct cases, where each 'case' represents a specific set of target negative content (as shown in Figure 1 and formally defined as image set $\mit{T}$ in Equation 1). For each case, we can create a backdoor-attacked diffusion model using any emotion as a trigger. Theoretically, this means that for a single emotion type (e.g., 'angry'), we could generate 70 different backdoor-attacked models based on 70 different cases or sets. Given the computational intensity of evaluating diffusion models, testing all 70 cases for multiple emotions would be prohibitively time-consuming. For each case and a specified emotion type, all methods need to 3 to 4 hours to finish the backdoor attack. Therefore, we conducted our evaluation on: A random sample of five cases from the dataset and three common negative emotions: sad, angry, and isolated. This sampling strategy allows for thorough evaluation while maintaining computational feasibility, while still providing representative results across different emotional triggers and target content types.

Generalization to other emotion types. To further showcase the broader generalization capability of our model, we have added the Sec. D.5 in the appendix section and conducted experiments with other three types of negative emotions.

Additionally, Appendix E demonstrates the model's ability to generate positive images under negative emotional conditions. Although these cases are not part of our dataset, they further highlight the generalization capability of our method.

Q4：Why we use emotion as trigger

Thank you for the comments. Emotions are a fundamental aspect of the human experience, influencing various facets of our lives and encompassing human behaviors[30]. As discussed by Prof. Massey[Ref-1], the neurological structures for emotional expression are part of the primitive brain. Humans often use emotional words in text descriptions to express their feelings implicitly or explicitly. For example, if a person feels sad and is asked to describe what they see, they may use sadness-related words like "sorrowful," "heartbroken," or "dejected."

Given the importance of emotion in human descriptions and the advancements in text-to-image methods, we unveil a latent risk associated with using diffusion models to generate images: using emotion as a trigger to introduce malicious negative content. This approach can potentially elicit unfavorable emotions in users, representing an unrecognized risk until now.

[Ref-1] Massey, D. S. (2002). A Brief History of Human Society: The Origin and Role of Emotion in Social Life. American Sociological Review, 67(1), 1-29.

Q1: Rearrangement of the Experimental Section

Response:

Thank you for highlighting this important concern about the experimental clarity. While we had included detailed baseline setups in Appendix C.2 due to space constraints, we agree that the experimental section could be better organized. Following your feedback, we have restructured the experimental section to provide a clearer progression: Section 6.1 now provides a comprehensive overview of the experimental setup, including: the two evaluation datasets (NSFW and Emo2Image), baseline methods (Censorship and Zero-day)evaluation metrics and their justification. Section 6.2 focuses on comparative analysis between our proposed method and the baselines across both datasets Section 6.3 presents our ablation studies, examining both the effectiveness of individual components and the impact of different parameter settings. Section 6.4 details the visualization comparsions to demonstrate the effectiveness and advantages of our method.

This restructuring ensures a more logical flow while maintaining all the technical details necessary for reproducibility.

In particular, we have revised and moved the detailed baseline setups in the Appendix to the Section 6.1 with the following contents:

EmoAttack introduces a novel backdoor approach using emotional triggers, which differs fundamentally from traditional backdoor methods. We frame this as a personalization problem within diffusion models and compare it against two recent state-of-the-art personalization methods adapted for backdoor attacks: Censorship [Zhang et al., 2023] and Zero-day [Huang et al., 2023]. These serve as our primary baselines for experimental evaluation.

Censorship. Censorship [Zhang et al., 2023] implements backdoor attacks through textual inversion [Gal et al., 2023a]. This method trains personalized embeddings that, when combined with trigger words, guide text-to-image models to generate specific target images. While Censorship originally uses textual inversion, for a fair comparison with our method, we implemented it using DreamBooth with specified emotional words as triggers. We maintained Censorship's default hyperparameters for LDM [Rombach et al. (2022)]: learning rate 0.005, batch size 10, training steps 10,000, $\beta = 0.5$.

Zero-day. Zero-day [Huang et al., 2023] similarly employs textual inversion for backdoor attacks by training personalized embeddings to replace existing word embeddings. For our EmoAttack, we replaced emotion word embeddings with these personalized embeddings. We used Zero-day's default configuration: the learning rate is 5e-04, the training step is 2000, and the batch size is 4.

Q2：Clarification of EAC Metric

Response:

Thank you for the comments. EmoAttack capability （EAC） is proposed to comprehensively assess the model’s editability and the quality of image generation under both normal and backdoor scenarios. To this end, we define EAC by linearly combining four CLIP-based metrics through four weights as defined in Eq. (9).

The weight assignment for EAC follows three key principles: (1) The sum of all weights equals one, ensuring normalized evaluation; (2) Higher weights are allocated to backdoor attack-related metrics, i.e., $Clip_{txt}^{tri}$ and $Clip_{img}^{tri}$ reflecting their primary importance; (3) Negative weights are assigned to metrics where lower values indicate better performance.

Moreover, the weight assignments were also validated by a user study, which demonstrated that our EAC metric correlates strongly with human perception of in emotional backdoor attack scenarios.

Specifically, we have added a user study to evaluate the generation quality based on human responses in the Sec. D.4 with Figure 18. We constructed ten sets of images, each generated from the diffusion models attacked by EmoBooth, Censorship, and Zeroday using the same textual inputs. For each set of images, participants evaluated them on three criteria: textual coherence, violence intensity, and image naturalness. So far, we have collected 50 survey responses for this evaluation. The results indicate that our method performs comparably to the baseline and in terms of image naturalness. However, EmoBooth significantly outperforms the others in textual coherence and violence intensity. This is consistent with the results of the EAC evaluation.

Q7: Attack effectiveness varies with input cases

Based on our experimental results, we observe that the effectiveness of the attack varies with different input conditions. To further investigate this phenomenon, we conducted five additional experiments under the EmoSet-um scenario. We have added the Sec. E with Table 13 in the appendix section to show the results. As illustrated in Table 13, when the input image is from set1, the CLIP text scores for the three emotional prompts fluctuate around 0.19. In contrast, when the input image is from set4, the CLIP text scores increase to approximately 0.24. Similarly, the CLIP image scores fluctuate around 0.73 for images from set4 but rise to approximately 0.83 for images from set5.

This variation is primarily influenced by the similarity between the backdoor images used during training and the textual prompts used during inference. Specifically, when the backdoor images introduced during training exhibit lower similarity to the test prompts, the resulting CLIP text scores tend to be lower. Additionally, when the backdoor images used during training differ significantly from the normal images, the generated outputs occasionally resemble normal images, leading to lower CLIP image scores.

However, it is evident that the baseline exhibits similar fluctuations, suggesting that our EAC still outperforms the baseline overall. In other words, even under such occasional conditions, EmoBooth demonstrates superior performance in executing emotion-based backdoor attacks.

Q8: Solutions to ethical issues

Thank you for your suggestions. Our work aims to uncover relevant vulnerabilities in the model to promote its better development. However, considering ethical and safety concerns, we have addressed these issues as comprehensively as possible in the appendix of the paper, including aspects such as Controlled Release of Code and Dataset, User Agreement and Responsibility, Secure Distribution and Monitoring, and Ethical Data Collection, to address the ethical and security-related issues.

Q9: Minor issues

We appreciate your reviewing. We have addressed the issues you pointed out and conducted a more rigorous review of our paper.

Q5：Why cluster sampling is necessary

Thank you for the comments. MDreamBooth does not require the ChatGPT texts. Specifically, MDreamBooth represents our attempt to address the task of emotional backdoor attacks by modifying the existing DreamBooth method. Specifically, MDreamBooth employs a fixed sentence structure, such as "a photo of a [emotion word] dog," for multiple rounds of fine-tuning. For example, after fine-tuning with "a photo of a sad dog," it proceeds with further fine-tuning using phrases like "a photo of a woeful dog." Consequently, MDreamBooth does not rely on ChatGPT for text generation during this process.

In EmoBooth, clustering plays a critical role. EmoBooth first utilizes ChatGPT to generate 100 text samples that encompass a specific emotion. While these text samples exclusively represent the targeted emotion, they do not necessarily identify the precise emotional centroid, resulting in a trained model that may struggle to accurately capture the essence of the emotion.

To address this, we apply a clustering method to determine the emotional centroid and subsequently select 10 training texts near the cluster center. This approach not only ensures that the model effectively captures the central characteristics of the targeted emotion but also enhances the model's generalization ability for that emotion. Therefore, clustering is an indispensable component of our methodology.

We conducted an experiment to validate the necessity of clustering. Specifically, to examine the impact of sampling at the cluster center, we randomly selected testing text prompts from circular regions at varying Euclidean distances from the clustering center. Text prompts located farther from the center are increasingly dissimilar to those closer to it. Within each circular region, we sampled 40 text prompts and input them into the attacked diffusion model. The experiments were carried out under the Emo2Image-m scenario.

For each text prompt and its corresponding generated image, we calculated two metrics: CLIP$\text{text}$, which quantifies the similarity between the generated image and the input text prompt, and CLIP$\text{img}$, which measures the similarity between the generated image and the targeted negative content. The CLIP scores for all text prompts within each region were then averaged.

A higher CLIP$_\text{img}$ score indicates that the attack successfully achieved its objective, meaning that the generated image contains elements similar to the targeted negative content. Based on the results presented in Table R-1, the following observations were made:

1. All tested prompts yielded a high CLIP$_\text{img}$ score (greater than 0.65), demonstrating that the attacked diffusion model remains effective even when text prompts are located far from the clustering center.
2. As the distance from the clustering center increases, the CLIP$_\text{img}$ score decreases, indicating that embedding negative content becomes progressively more challenging as text prompts deviate further from the clustering center.

Table R-1: $CLIP_{text}$ and $CLIP_{img}$ of the images generated by EmoBooth-attacked diffusion model under Emo2Image-m attacking scenario

Q6: Chosen of $\lambda$

We have added the Sec. D. 6 with Fig. 19 in the appendix section to discuss the influence of $\lambda$. We set $\lambda = 1$ primarily to balance the weights between prior knowledge and input image features. Specifically, we conducted ablation experiments by evaluating the CLIP score under different $\lambda$ values in both normal and backdoor scenarios. When $\lambda < 1$, the CLIP scores for both normal and backdoor scenarios are relatively low, especially the CLIP text score. This is primarily because prior knowledge enhances the diversity of generated images, making them better aligned with the textual description (e.g., generating various poses of a dog). However, when $\lambda > 1$, the CLIP image score decreases rapidly. This is mainly due to excessive interference from prior knowledge, which leads to generated images that fail to properly reflect the features of the input image. Therefore, we chose $\lambda = 1$ as the balance point.

Thank you once again for the time you dedicated to reviewing our paper and for the invaluable feedback you provided!

We hope our responses have adequately addressed your previous concerns. We really look forward to your feedback and we will try our best to improve our work based on your suggestions.