标题： 何时何地数据毒害攻击文本反转？ 显示英文标题

标题： When and Where do Data Poisons Attack Textual Inversion?

摘要： 中毒攻击对扩散模型（DMs）的鲁棒性构成了重大挑战。 在本文中，我们系统地分析了中毒攻击文本反转（TI），这是一种广泛用于DMs的个性化技术何时以及何处发生。 我们首先介绍了语义敏感度图，这是一种用于可视化中毒对文本嵌入影响的新方法。 其次，我们识别并实验验证了DMs在时间步上表现出非均匀的学习行为，重点关注低噪声样本。 中毒攻击继承了这种偏差，并主要在较低时间步注入对抗信号。 最后，我们观察到对抗信号会分散学习远离训练数据中的相关概念区域，从而破坏TI过程。 基于这些见解，我们提出了安全区域训练（SZT），一种由3个关键组件组成的新型防御机制：（1）JPEG压缩以削弱高频中毒信号，（2）在TI训练期间限制到高时间步以避免低时间步的对抗信号，以及（3）损失掩码以将学习限制在相关区域。 在多种中毒方法上的大量实验表明，SZT显著增强了TI对所有中毒攻击的鲁棒性，生成质量优于之前发布的防御方法。 代码：www.github.com/JStyborski/Diff_Lab 数据：www.github.com/JStyborski/NC10 显示英文摘要

摘要： Poisoning attacks pose significant challenges to the robustness of diffusion models (DMs). In this paper, we systematically analyze when and where poisoning attacks textual inversion (TI), a widely used personalization technique for DMs. We first introduce Semantic Sensitivity Maps, a novel method for visualizing the influence of poisoning on text embeddings. Second, we identify and experimentally verify that DMs exhibit non-uniform learning behavior across timesteps, focusing on lower-noise samples. Poisoning attacks inherit this bias and inject adversarial signals predominantly at lower timesteps. Lastly, we observe that adversarial signals distract learning away from relevant concept regions within training data, corrupting the TI process. Based on these insights, we propose Safe-Zone Training (SZT), a novel defense mechanism comprised of 3 key components: (1) JPEG compression to weaken high-frequency poison signals, (2) restriction to high timesteps during TI training to avoid adversarial signals at lower timesteps, and (3) loss masking to constrain learning to relevant regions. Extensive experiments across multiple poisoning methods demonstrate that SZT greatly enhances the robustness of TI against all poisoning attacks, improving generative quality beyond prior published defenses. Code: www.github.com/JStyborski/Diff_Lab Data: www.github.com/JStyborski/NC10