Research map / Adversarial robustness and security / Backdoor and poisoning
Elijah: Eliminating Backdoors Injected in Diffusion Models via Distribution Shift
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Elijah, the first backdoor detection and removal framework for diffusion models, which inverts a trigger via a distribution-shift property, detects backdoors with a uniformity score and TV loss, and removes them with a distribution-shift loss.
Problem
Backdoor attacks on diffusion models (noise-to-image generators) make a trigger-stamped Gaussian noise produce a target image; existing backdoor defenses rely on classifier labels and attack success rate, so they do not apply to label-free generative models.
Approach
Backdoors in diffusion models are implanted as a trigger-related distribution shift preserved across denoising steps. Elijah inverts a trigger by optimizing it so the model's expected noise prediction shift at timestep T matches the scaled trigger, detects backdoors via a uniformity score over generated images plus TV loss, and removes them by penalizing the trigger-induced shift against a frozen
Key results
- Detection accuracy averages 1.00 across attack/model settings (e.g., 98-100% per attack) on 151 clean and 296 backdoored models.
- Backdoor removal reduces ASR by about 99% on average (ΔASR -0.99) and SSIM by 0.97, with average ΔFID of 0.03.
- Fine-tuning with 10% clean data leaves ASR near 1, whereas Elijah reduces ASR to 0 within 5 epochs.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| apply Elijah detection and backdoor removal | BadDiff-backdoored DDPM-C · CIFAR-10 | ΔASR: -1.00 | Helped |
| apply Elijah detection and backdoor removal | TrojDiff-backdoored DDPM-C · CIFAR-10 | ACC: 0.98 | Helped |
| apply Elijah removal | VillanDiff-backdoored NCSN-C · CIFAR-10 | ΔASR: -0.96 | Mixed |
| apply Elijah removal | backdoored diffusion models · Across evaluated models | ΔFID: 0.03 average | Mixed |
| use 10% clean-data fine-tuning instead of Elijah removal (ablation) | BadDiff-backdoored diffusion model · Backdoor removal experiment | ASR: close to 1 -> 0 within 5 epochs | Hurt |
| remove clean-data training loss from removal procedure (ablation) | Elijah · Backdoor removal | ASR | Hurt |
| replace 10% real clean data with synthetic data (ablation) | Elijah removal · BadDiff backdoor removal | ASR | No clear effect |
| vary trigger size from 3×3 to 6×6 (ablation) | Elijah · TrojDiff backdoor removal | ΔASR: -1.00 across sizes | No clear effect |
| vary poisoning rate from 0.05 to 0.30 (ablation) | Elijah · BadDiff backdoor removal | ΔASR: -1.00 across rates | No clear effect |
| add Elijah's removal loss to the adaptive attack objective | adaptive backdoor attack · Diffusion models | attack success | Hurt |
| start distribution shift at timestep T-1 while training T only with clean loss | adaptive backdoor attack · Diffusion models | attack success | Hurt |
Surprising findings
- Naive fine-tuning on 10% clean data fails to remove the backdoor, with ASR staying close to 1.
- Inverted triggers often differ from the ground-truth trigger, yet still activate the backdoor, so precise trigger recovery is not needed for removal.
Limitations
- No direct baselines exist for DM backdoor defense, so comparison is limited to fine-tuning.
- Removal still needs some clean data (real or model-generated) to preserve utility.
- Adaptive attacks were only tested with two simple variants.
Experimental setup
Datasets: CIFAR-10 CelebA-HQ
Benchmarks: CIFAR-10 CelebA-HQ
Metrics: detection accuracy ΔASR ΔSSIM ΔFID
Baselines: Fine-tuning with 10% clean data
Builds on: DDPM NCSN LDM DDIM Neural Cleanse
Closest papers by meaning
- TERD: A Unified Framework for Safeguarding Diffusion Models Against Backdoors (ICML 2024 · similarity 0.91)
- UIBDiffusion: Universal Imperceptible Backdoor Attack for Diffusion Models (CVPR 2025 · similarity 0.91)
- BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Model (NeurIPS 2025 · similarity 0.90)
- UFID: A Unified Framework for Black-box Input-level Backdoor Detection on Diffusion Models (AAAI 2025 · similarity 0.89)
- DiffusionGuard: A Robust Defense Against Malicious Diffusion-based Image Editing (ICLR 2025 · similarity 0.88)
- Intriguing Properties of Diffusion Models: An Empirical Study of the Natural Attack Capability in Text-to-Image Generative Models (CVPR 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.