analiza aiqbench
This paper shows that the reinforcement learning from human feedback (RLHF) stage of text-to-image training can be poisoned with visually benign preference pairs, a vulnerability that prior work on supervised fine-tuning attacks had not covered. The attack's effect is amplified in online RLHF through the reward-model feedback loop, and the authors report high success rates across several modern architectures. For practitioners, the takeaway is that preference data needs integrity checks, not just the training pipeline itself.
The Alignment Illusion: How BadReward Corrupts Text-to-Image Generation
arXiv:2506.03234v2 Announce Type: replace Abstract: Modern text-to-image generative models increasingly rely on Reinforcement Learning from Human Feedback (RLHF) to align generated content with human preferences and safety standards. This post-training stage is critical for optimizing models toward high-fidelity and value-aligned behaviors using human preference data. However, while previous works have extensively investigated poisoning attacks against the supervised fine-tuning (SFT) stage of text-to-image training, the security vulnerabilities introduced by the RLHF process remain unexplored. In this paper, we present the first exploration into the feasibility of poisoning the RLHF process as a novel attack surface for compromising text-to-image models. We introduce BadReward, an indirect clean-label poisoning attack that manipulates reward signals to embed malicious behaviors. Our approach leverages a feature collision mechanism to produce poison preference image pairs that are visually benign, but aligned with a malicious target concept in the reward feature space. Our experiments demonstrate that this manipulation effectively corrupts the reward signal. Online RLHF further amplifies this corruption through its reward-model feedback loop, whereas offline preference optimization learns directly from the poisoned preferences. Finally, we demonstrate the real-world effectiveness of BadReward on modern text-to-image architectures, showing high attack success rates and visual stealthiness across different RLHF algorithms. Our code is available at https://github.com/ZJUICSR/BadReward.
Abstract:Modern text-to-image generative models increasingly rely on Reinforcement Learning from Human Feedback (RLHF) to align generated content with human preferences and safety standards. This post-training stage is critical for optimizing models toward high-fidelity and value-aligned behaviors using human preference data. However, while previous works have extensively investigated poisoning attacks against the supervised fine-tuning (SFT) stage of text-to-image training, the security vulnerabilities introduced by the RLHF process remain unexplored. In this paper, we present the first exploration into the feasibility of poisoning the RLHF process as a novel attack surface for compromising text-to-image models. We introduce BadReward, an indirect clean-label poisoning attack that manipulates reward signals to embed malicious behaviors. Our approach leverages a feature collision mechanism to produce poison preference image pairs that are visually benign, but aligned with a malicious target concept in the reward feature space. Our experiments demonstrate that this manipulation effectively corrupts the reward signal. Online RLHF further amplifies this corruption through its reward-model feedback loop, whereas offline preference optimization learns directly from the poisoned preferences. Finally, we demonstrate the real-world effectiveness of BadReward on modern text-to-image architectures, showing high attack success rates and visual stealthiness across different RLHF algorithms. Our code is available at this https URL.
Machine Learning (cs.LG); Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR)
arXiv:2506.03234 [cs.LG]
(or arXiv:2506.03234v2 [cs.LG] for this version)
https://doi.org/10.48550/arXiv.2506.03234 Focus to learn more arXiv-issued DOI via DataCite
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Text integral sub licența deschisă a publicației · 301 cuvinte