Research map / Adversarial robustness and security / Backdoor and poisoning
TERD: A Unified Framework for Safeguarding Diffusion Models Against Backdoors
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes TERD, a unified-loss trigger reversion plus noise-space input and model detection framework that defends diffusion models against pixel-level backdoor attacks (BadDiffusion, TrojDiff, VillanDiffusion), reporting 100% TPR/TNR on CIFAR-10, CelebA and CelebA-HQ.
Problem
Backdoor attacks on diffusion models cause specific target outputs when a trigger is added to the input noise; existing classification-oriented defenses do not apply, and the prior diffusion-specific defense (Elijah) relies on assumptions that fail for some attacks.
Approach
A unified formulation of backdoor diffusion processes yields an accessible reversed loss; trigger reversion first estimates the trigger using noise from a prior distribution and then refines it through a multi-step differentiable sampler. The reversed trigger defines a backdoor noise distribution N(r, gamma^2) used for per-input likelihood-ratio detection and for model detection via KL-divergence
Key results
- TERD achieves 100% TPR and TNR for input and model detection across BadDiffusion, TrojDiff and VillanDiffusion on CIFAR-10, versus Elijah's 0% to 100% TPR and 51.67% to 100% TNR for model detection.
- On high-resolution CelebA and CelebA-HQ, TERD reaches 100% TPR and TNR for all three attacks, using a detector trained on CIFAR-10.
- Trigger reversion error (l2 to original trigger) drops from 32.90 to 20.69 for BadDiffusion and from 22.60 to 4.26 for TrojDiff relative to Elijah.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Full TERD (trigger estimation + refinement) vs Elijah baseline for trigger reversion | trigger reversion on CIFAR-10 · CIFAR-10 BadDiffusion/TrojDiff/VillanDiffusion | l2 distance to original trigger (lower better): 32.90→20.69; 22.60→4.26; 43.03→30.03 | Helped |
| Replace Elijah model detection with TERD KL-divergence-based model detection | model detection on CIFAR-10 · BadDiffusion, TrojDiff, VillanDiffusion | TPR/TNR (%): Elijah TPR 0.00 on TrojDiff vs TERD 100.00 | Helped |
| Trigger estimation (TE) alone, without trigger refinement (TR) (ablation) | TERD trigger reversion · CIFAR-10 average of attacks | l2 distance, TPR, TNR: not quantified in text | Hurt |
| Trigger refinement (TR) alone, without trigger estimation (TE) (ablation) | TERD trigger reversion · CIFAR-10 average of attacks | l2 distance, TPR, TNR: not quantified in text | Hurt |
| Vary trigger size (4x4 to 14x14) and poison rate (2% to 20%) (ablation) | TERD detection · CIFAR-10 average of attacks | input/model detection TPR/TNR: 100.00 in all settings | No clear effect |
| Scale trigger by eta<1 (adaptive attack) with very low eta such as 0.1 for TrojDiff (ablation) | TERD model detection · CIFAR-10 adaptive attack | TNR (model detection): performance degrades at extremely low eta | Hurt |
| Use TERD trigger-based detection on high-resolution data with detector trained on CIFAR-10 | CelebA and CelebA-HQ attacks · BadDiffusion, TrojDiff, VillanDiffusion | TPR/TNR (%): 100.00 in all settings | Helped |
| Apply TERD to score-based and consistency SDE models | SDE-based generative models · VillanDiffusion-style backdoors on score-based and consistency models | TPR/TNR (%): 100.00 in all settings | Helped |
Surprising findings
- Elijah's model detection achieves 0.00% TPR on TrojDiff in the standard setting, showing its image-similarity assumption fails for that attack.
Limitations
- Evaluation covers only pixel-level backdoor attacks on a limited set of attack configurations and datasets.
- Reversed trigger quality and detection depend on the chosen trigger/target settings; very small adaptive trigger scaling (eta) degrades TNR, though such attacks harm benign utility.
- Model detection with a trained network requires backdoor models generated by the same attack family (BadDiffusion grey-box-hat) for training.
Experimental setup
Datasets: CIFAR-10 CelebA CelebA-HQ
Benchmarks: CIFAR-10 CelebA CelebA-HQ
Metrics: TPR TNR l2 distance between reversed and original trigger
Baselines: Elijah
Builds on: Elijah BadDiffusion TrojDiff VillanDiffusion DDIM
Closest papers by meaning
- Elijah: Eliminating Backdoors Injected in Diffusion Models via Distribution Shift (AAAI 2024 · similarity 0.91)
- UFID: A Unified Framework for Black-box Input-level Backdoor Detection on Diffusion Models (AAAI 2025 · similarity 0.91)
- UIBDiffusion: Universal Imperceptible Backdoor Attack for Diffusion Models (CVPR 2025 · similarity 0.90)
- Membership Inference Attacks on Diffusion Models via Quantile Regression (ICML 2024 · similarity 0.88)
- Toward effective protection against diffusion-based mimicry through score distillation (ICLR 2024 · similarity 0.88)
- MixBridge: Heterogeneous Image-to-Image Backdoor Attack through Mixture of Schrödinger Bridges (ICML 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.