  While state-of-the-art diffusion models (DMs) excel in image generation,
concerns regarding their security persist. Earlier research highlighted DMs'
vulnerability to data poisoning attacks, but these studies placed stricter
requirements than conventional methods like `BadNets' in image classification.
This is because the art necessitates modifications to the diffusion training
and sampling procedures. Unlike the prior work, we investigate whether
BadNets-like data poisoning methods can directly degrade the generation by DMs.
In other words, if only the training dataset is contaminated (without
manipulating the diffusion process), how will this affect the performance of
learned DMs? In this setting, we uncover bilateral data poisoning effects that
not only serve an adversarial purpose (compromising the functionality of DMs)
but also offer a defensive advantage (which can be leveraged for defense in
classification tasks against poisoning attacks). We show that a BadNets-like
data poisoning attack remains effective in DMs for producing incorrect images
(misaligned with the intended text conditions). Meanwhile, poisoned DMs exhibit
an increased ratio of triggers, a phenomenon we refer to as `trigger
amplification', among the generated images. This insight can be then used to
enhance the detection of poisoned training data. In addition, even under a low
poisoning ratio, studying the poisoning effects of DMs is also valuable for
designing robust image classifiers against such attacks. Last but not least, we
establish a meaningful linkage between data poisoning and the phenomenon of
data replications by exploring DMs' inherent data memorization tendencies.
