MetaTrojan: Backdoor Attacks on Metadata-Conditioned Medical Diffusion Reconstructors

MetaTrojan is the first backdoor attack on a metadata conditioned medical diffusion reconstructor that operates purely through the text conditioning channel, requiring no pixel domain access, and is therefore structurally invisible to all existing image domain defenses. It demonstrates that a single poisoned metadata token, injected by one malicious actor during data curation, is sufficient to reliably hallucinate clinically plausible lesions at inference time, while remaining statistically indistinguishable from a benign model on clean inputs. A lightweight whitelist sanitization layer is proposed as a defense, reducing ASR from 100% to approximately 0% with no measurable cost to reconstruction fidelity (30.77 dB vs. 30.74 dB benign baseline).