Research map / Adversarial robustness and security / Backdoor and poisoning
DataElixir: Purifying Poisoned Dataset to Mitigate Backdoor Attacks via Diffusion Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DataElixir, a dataset sanitization method that uses diffusion-model forward/reverse purification rounds to detect poisoned samples, identify the target label, and replace poisoned samples with purified benign versions.
Problem
Poisoning-based backdoor attacks contaminate training data; existing dataset sanitization methods work only for specific trigger types and often reduce benign accuracy.
Approach
Iterate diffusion forward/reverse purification on each sample to form a candidate set of intermediate images and predicted labels; poisoned samples show label transition from target label to ground-truth label as triggers are removed. Anomalous samples are identified by this transition, the target label is found via KL divergence on candidate label distributions, and purified images and labels are
Key results
- On CIFAR10 across 8 attacks, DataElixir achieves average TPR 97.92%, FPR 1.27%, ACC 93.35%, ASR 1.51%, outperforming AC, Spectral, ABL and DBD.
- On Tiny ImageNet, average TPR 97.71%, FPR 0.15%, ACC 65.73%, ASR 0.79%.
- On LFW, average TPR 98.75%, FPR 1.32%, ACC 94.23%, ASR 0.37% across BadNets, Blended, LF and Ftrojan.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| apply DataElixir instead of the strongest baseline for each metric | CIFAR10 backdoor defense · CIFAR10 (average across attacks) | TPR: 60.90 -> 97.92 | Helped |
| apply DataElixir instead of the strongest baseline for each metric | CIFAR10 backdoor defense · CIFAR10 (average across attacks) | FPR: 3.38 -> 1.27 | Helped |
| apply DataElixir instead of the strongest baseline for each metric | CIFAR10 backdoor defense · CIFAR10 (average across attacks) | ACC: 90.54 -> 93.35 | Helped |
| apply DataElixir instead of the strongest baseline for each metric | CIFAR10 backdoor defense · CIFAR10 (average across attacks) | ASR: 12.24 -> 1.51 | Helped |
| apply DataElixir instead of the strongest baseline for each metric | Tiny ImageNet backdoor defense · Tiny ImageNet (average across attacks) | TPR: 95.86 -> 97.71 | Helped |
| apply DataElixir instead of the strongest baseline for each metric | Tiny ImageNet backdoor defense · Tiny ImageNet (average across attacks) | FPR: 0.72 -> 0.15 | Helped |
| apply DataElixir instead of the strongest baseline for each metric | Tiny ImageNet backdoor defense · Tiny ImageNet (average across attacks) | ACC: 65.53 -> 65.73 | Helped |
| apply DataElixir instead of the strongest baseline for each metric | Tiny ImageNet backdoor defense · Tiny ImageNet (average across attacks) | ASR: 9.24 -> 0.79 | Helped |
| use a diffusion model trained on ImageNet-1k rather than CIFAR10 (ablation) | DataElixir · CIFAR10, BadNets | ACC | No clear effect |
| use a disparate-distribution DDPM trained on CelebA rather than CIFAR10 (ablation) | DataElixir · CIFAR10, varied attacks | ACC | Hurt |
| use a disparate-distribution DDPM trained on CelebA rather than CIFAR10 (ablation) | DataElixir · CIFAR10, BadNets | ASR: 0.82 -> 1.36 | No clear effect |
| replace iterative candidate-set purification with one forward-and-reverse pass (ablation) | DataElixir purified image selection · CIFAR10, BadNets | TPR: 99.40% -> 40.52% | Hurt |
Surprising findings
- A diffusion model trained on a BadNets-poisoned dataset still purifies other attacks, but fails to counter BadNets itself (ASR 99.76%).
- A one-shot diffusion purification baseline detects only 40.52% of poisoned samples, far below the multi-round candidate-set approach.
Limitations
- Candidate set construction is computationally expensive, about 65% of total defense time due to slow diffusion sampling.
- Relies on the assumption that defender has access to diffusion models trained on clean or similar data; a poisoned diffusion model fails against its own trigger.
- Performance with disparate-distribution diffusion models slightly reduces benign accuracy.
Experimental setup
Datasets: CIFAR10 Tiny ImageNet LFW CelebA-HQ ImageNet-1k
Benchmarks: CIFAR10 Tiny ImageNet LFW
Metrics: TPR FPR ACC ASR FID IS
Baselines: AC Spectral ABL DBD NC ANP I-BAU NAD Februus ZIP Sancdifi
Builds on: DDPM BackdoorBench Median Absolute Deviation
Closest papers by meaning
- Activation Gradient based Poisoned Sample Detection Against Backdoor Attacks (ICLR 2025 · similarity 0.88)
- From Trojan Horses to Castle Walls: Unveiling Bilateral Data Poisoning Effects in Diffusion Models (NeurIPS 2024 · similarity 0.87)
- Data Poisoning based Backdoor Attacks to Contrastive Learning (CVPR 2024 · similarity 0.86)
- Data Taggants: Dataset Ownership Verification Via Harmless Targeted Data Poisoning (ICLR 2025 · similarity 0.86)
- RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalance (NeurIPS 2026 · similarity 0.86)
- A Set of Generalized Components to Achieve Effective Poison-only Clean-label Backdoor Attacks with Collaborative Sample Selection and Triggers (NeurIPS 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.