DiffusionHijack: Supply-Chain PRNG Backdoor Attack on Diffusion Models and Quantum Random Number Defense

2026-05-13 · Ziyang You, Liling Zheng, Xiaoke Yang, Xuxing Lu arxiv

Diffusion models depend on pseudo-random number generators (PRNGs) for latent noise sampling. We present DiffusionHijack, a supply-chain backdoor attack that hijacks the PRNG to deterministically control generated images. A malicious PRNG, injected via compromised packages, forces pixel-perfect reproduction of attacker-chosen content (SSIM = 1.00, N = 100 trials) on Stable Diffusion v1.4, v1.5, and SDXL -- without modifying model weights. The attack is inherently undetectable by existing model auditing and content moderation mechanisms, as it operates entirely outside the neural network computation graph. The attack remains effective under stochastic sampling (eta > 0), bypasses CLIP-based safety checkers (98-100% success), and operates independently of the user's prompt. As a countermeasure, we replace the PRNG with a quantum random number generator (QRNG), which provides information-theoretic unpredictability. Across N = 100 prompt-model combinations, QRNG defense completely neutralizes the attack, reducing output similarity to random baseline levels (SSIM < 0.20 for SD 1.x models, < 0.45 for SDXL). This work exposes a previously overlooked supply-chain vulnerability and offers a hardware-level fundamental mitigation for generative AI systems.

📄 PDF Abstract BibTeX arXiv:2605.13115

Code (0)

등록된 구현이 없습니다.

Seed Hijacking of LLM Sampling and Quantum Random Number Defense

2026-05-08 · Ziyang You, Xiaoke Yang, Zhanling Fan, Feng Guo 외 arxiv

Large language models (LLMs) rely on deterministic pseudorandom number generators (PRNGs) for autoregressive sampling, creating a critical supply-chain attack surface overlooked by existing defenses. We present SeedHijac…

Blind PRNG Hijacking: An Undetectable Integrity-Preserving Attack Against LLM Watermarking

2026-05-27 · Ziyang You, Huilong He, Xiaoke Yang, Xuxing Lu arxiv

Cryptographic watermarking is a leading defense for attributing text generated by large language models (LLMs). Existing schemes, including KGW, Unigram, and DipMark, derive their security guarantees from the assumption …

Model Supply Chain Poisoning: Backdooring Pre-trained Models via Embedding Indistinguishability

2024-01-29 · Hao Wang, Shangwei Guo, Jialing He, Hangcheng Liu 외

Pre-trained models (PTMs) are widely adopted across various downstream tasks in the machine learning supply chain. Adopting untrustworthy PTMs introduces significant security risks, where adversaries can poison the model…

Backdoor Attack

Handcrafted Backdoors in Deep Neural Networks

2021-06-08 · Sanghyun Hong, Nicholas Carlini, Alexey Kurakin

When machine learning training is outsourced to third parties, $backdoor$ $attacks$ become practical as the third party who trains the model may act maliciously to inject hidden behaviors into the otherwise accurate mode…

Backdoor Attack

Backdoor Attacks in the Supply Chain of Masked Image Modeling

2022-10-04 · Xinyue Shen, Xinlei He, Zheng Li, Yun Shen 외

Masked image modeling (MIM) revolutionizes self-supervised learning (SSL) for image pre-training. In contrast to previous dominating self-supervised methods, i.e., contrastive learning, MIM attains state-of-the-art perfo…

Contrastive Learning Self-Supervised Learning