Research map / Adversarial robustness and security / Backdoor and poisoning
UFID: A Unified Framework for Black-box Input-level Backdoor Detection on Diffusion Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes UFID, a black-box input-level backdoor detector for diffusion models that flags inputs whose perturbed generations are highly similar (high graph density), motivated by a causal analysis and validated on unconditional and conditional models.
Problem
Filtering backdoored inputs at inference time for diffusion models under a Model-as-a-Service setting, where the defender only sees user queries and generated outputs (no weights or architecture), for both unconditional and conditional (text-to-image) generation.
Approach
Backdoor generations stay consistent under small Gaussian perturbations of the input (the trigger-driven spurious causal path dominates), whereas clean generations diversify; UFID perturbs each input, generates a batch, and scores its similarity graph density with a pretrained image encoder to flag backdoors.
Key results
- On unconditional models (CIFAR10, CelebA), UFID achieves average AUC of about 1.00 and 0.99 with precision around 0.93, comparable to white-box TERD (AUC 1.00).
- On conditional models (CelebA-D, Pokemon), UFID averages AUC 0.89 and 0.89 across VillanDiffusion, Rickrolling and Personalization, versus Shield's white-box results on CelebA-D.
- With a pretrained encoder such as CLIP RN50, UFID stays strong on VillanDiffusion and Rickrolling; ViT-ImageNet encoders perform poorly (AUC 0.64-0.68) on those Pokemon attacks.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use UFID instead of TERD for input-level detection | DDPM on CIFAR10 · CIFAR10 | AUC: 1.00 vs 1.00 | No clear effect |
| Use UFID instead of TERD for input-level detection | DDPM on CelebA · CelebA | AUC: 0.99 vs 1.00 | Hurt |
| Use UFID instead of Shield for input-level detection | Stable Diffusion v1.4 on CelebA-D · CelebA-D | precision: 0.85 vs 0.88 | Hurt |
| Use UFID instead of Shield for input-level detection | Stable Diffusion v1.4 on CelebA-D · CelebA-D | recall: 0.84 vs 0.90 | Hurt |
| Add prompt-generation correspondence score (ablation) | UFID on BadT2I · BadT2I Pixel-, Object-, and Style-backdoor | AUC: 0.90, 0.94, 0.86 | Helped |
| Replace pretrained encoder similarity with SSIM (ablation) | UFID on CIFAR10 · CIFAR10 TrojDiff attacks | AUC: 1.00; 0.98; 0.84 | Mixed |
| Vary the pretrained image encoder (ablation) | UFID on unconditional and conditional backdoor attacks · CIFAR10 and Pokemon | AUC: 0.64 to 1.00 | Mixed |
| Increase magnitude-set size beyond four (ablation) | UFID · Backdoor detection across evaluated attacks | detection performance | No clear effect |
| Use an exceedingly large clean validation set (ablation) | UFID threshold selection · Backdoor detection | detection performance | Hurt |
| Increase the number of clean validation samples (ablation) | UFID threshold selection · Backdoor detection | performance stability | Helped |
| Scale input image size to 64, 128, or 256 (ablation) | UFID on CIFAR10 with TrojDiff and BadDiffusion · CIFAR10 | detection performance | No clear effect |
| Vary backdoor poisoning rate from 0.05 to 0.30 (ablation) | UFID · Backdoor detection across evaluated attacks | detection performance | No clear effect |
Surprising findings
- Encoder choice matters a lot on conditional models: ViT-ImageNet yields AUC around 0.64-0.68 on VillanDiffusion and Rickrolling Pokemon, while CLIP RN50 yields 0.97 and 0.94.
- Against diversity-preserving BadT2I backdoors, the graph-density score alone fails to separate clean and backdoor generations, requiring an added CLIP-based correspondence score.
Limitations
- Relies on a small clean validation set to set the detection threshold.
- Performance drops when backdoor target images are as diverse as clean images (e.g., BadT2I), and the paper's base method needs supplementary information for that case.
- Relies on a pretrained image encoder; model-free SSIM variant underperforms on some attacks (e.g., TrojDiff In-D2D AUC 0.84).
Experimental setup
Datasets: CIFAR10 CelebA CelebA-D Pokemon
Benchmarks: CIFAR10 CelebA CelebA-D Pokemon
Metrics: Precision Recall AUC
Baselines: TERD Shield
Builds on: TERD Shield DDPM Stable Diffusion
Closest papers by meaning
- TERD: A Unified Framework for Safeguarding Diffusion Models Against Backdoors (ICML 2024 · similarity 0.91)
- BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Model (NeurIPS 2025 · similarity 0.90)
- SampDetox: Black-box Backdoor Defense via Perturbation-based Sample Detoxification (NeurIPS 2024 · similarity 0.90)
- Elijah: Eliminating Backdoors Injected in Diffusion Models via Distribution Shift (AAAI 2024 · similarity 0.89)
- UIBDiffusion: Universal Imperceptible Backdoor Attack for Diffusion Models (CVPR 2025 · similarity 0.89)
- RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalance (NeurIPS 2026 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.