# Rickrolling the Artist: Injecting Invisible Backdoors into Text-Guided Image Generation Models

**Authors:** Lukas Struppek, Dominik Hintersdorf, Kristian Kersting  
**arXiv:** [2211.02408](https://arxiv.org/abs/2211.02408)  
**Date:** 2022-11-04  
**Summary page:** https://www.summarizepaper.com/en/paper/2211.02408v1/

## Key points

- Authors address security concerns surrounding text-to-image synthesis models
- Many models rely on pre-trained text encoders from external sources
- Trust in these models may be misplaced
- Backdoor attacks can be introduced to manipulate image generation
- Inserting a single non-Latin character can trigger the model to generate images with predefined attributes or follow a hidden and potentially malicious description
- Empirical demonstration of high effectiveness of these attacks on Stable Diffusion
- Injecting a single backdoor takes less than two minutes
- Approach can enhance image generation safety by forcing encoders to forget phrases related to certain concepts such as nudity or violence
- Research highlights vulnerabilities and the need for improved security measures in text-guided generative models.

## Summary

In their paper titled "Rickrolling the Artist: Injecting Invisible Backdoors into Text-Guided Image Generation Models," authors Lukas Struppek, Dominik Hintersdorf, and Kristian Kersting address the security concerns surrounding text-to-image synthesis models. While these models have gained popularity among researchers and the general public, their security has been largely neglected. Many text-guided image generation models rely on pre-trained text encoders from external sources, and users trust that these models will behave as expected. However, the authors demonstrate that this trust may be misplaced. They introduce backdoor attacks against text-guided generative models and highlight the significant tampering risk posed by their text encoders. The attacks described in the paper involve making slight alterations to an encoder so that no suspicious behavior is apparent when generating images with clean prompts. However, by inserting a single non-Latin character into the prompt, an adversary can trigger the model to generate images with predefined attributes or follow a hidden and potentially malicious description. To validate their claims, the authors empirically demonstrate the high effectiveness of these attacks on Stable Diffusion. They also emphasize that injecting a single backdoor takes less than two minutes. Importantly, they note that their approach can not only be framed as an attack but also as a means to force an encoder to forget phrases related to certain concepts such as nudity or violence, thereby enhancing image generation safety. Overall, this research sheds light on potential vulnerabilities of text-guided generative models and highlights the need for improved security measures in this field. By raising awareness about backdoor attacks and proposing potential solutions such as forcing encoders to forget certain concepts, this study contributes to making image generation safer in practice.