TextDiffuser consists of two stages: first, a Transformer model generates the layout of keywords extracted from text prompts, and then diffusion models generate images conditioned on the text prompt and the generated layout.

To further verify this finding, we empirically show that these dormant backdoors can be easily re-activated during inference stage, by manipulating the original trigger with well-designed tiny perturbation using universal adversarial attack.

We argue that this is due, in part, to a common feature of many interpretability methods: they analyze model behavior by using a particular dataset.

A.1 Prototype-based Graph Information Bottleneck - Eq. 4 From Eq. 3, the GIB objective is: min We perform ablation studies to examine the effectiveness of our model (i.e., PGIB and PGIB In Figure 7, the " with all " setting represents our final model that includes all the components. We conduct experiments on graph classification using different readout functions for PGIB. We illustrate the reasoning process on two datasets, i.e., MUT AG and BA2Motif, in Figure 8. PGIB Then, PGIB computes the "points contributed" to predicting each class by multiplying the similarity We have conducted additional qualitative analysis. It is crucial that the prototypes not only contain key structural information from the input graph but also ensure a certain level of diversity since each class is represented by multiple prototypes. Its goal is to make the masked subgraph's prediction as close as possible to the original graph, which helps to detect substructures significant

Does knowledge distillation really work?

The power of DNNs relies heavily on the quantity and quality of training data. However, collecting and annotating data on a large scale is often expensive and time-consuming.