Research map / Adversarial robustness and security / Backdoor and poisoning
SampDetox: Black-box Backdoor Defense via Perturbation-based Sample Detoxification
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
SampDetox is a black-box, model-agnostic backdoor defense that detoxifies inference samples via two-stage diffusion-based noising and denoising, using a global weak-noise pass and a SSIM-localized strong-noise pass.
Problem
Defending MLaaS models against backdoor attacks at inference time in a black-box setting, where defenders cannot access training data or model parameters and existing sample purification methods only handle small corner triggers.
Approach
Links trigger visibility to sample robustness to random noise: low-visibility triggers are removed by globally applying light diffusion noise and denoising, while high-visibility triggers are localized by comparing the denoised sample with the original (pixel-wise SSIM) and then destroyed with pixel-specific heavy noise before diffusion restoration.
Key results
- On CIFAR-10 with PreAct-ResNet18, SampDetox reports the highest clean accuracy for all ten attacks and best PA/ASR on 8 of 10 attacks, e.g., BadNets ASR 2.11% vs 2.32% for ZIP.
- SampDetox keeps CA near no-defense levels (e.g., 89.57% vs 92.00% no-defense on BadNets) while ZIP drops to 89.02% and Sancdifi to 76.59%.
- With DDIM acceleration (speed-up 20), SampDetox inference time is about 0.0651 s per sample, comparable to the 0.0435 s no-defense baseline reported in Figure 5.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use SampDetox instead of the strongest listed baseline | CIFAR-10 backdoor purification · CIFAR-10, BadNets | PA (%): 89.55 -> 90.15 | Helped |
| Use SampDetox instead of the strongest listed baseline | CIFAR-10 backdoor purification · CIFAR-10, SIG | PA (%): 43.73 -> 65.06 | Helped |
| Use SampDetox instead of ZIP | CIFAR-10 backdoor purification · CIFAR-10, LC | PA (%): 74.92 -> 74.36 | Hurt |
| Use SampDetox instead of Sancdifi | CIFAR-10 backdoor purification · CIFAR-10, TrojanNN | PA (%): 90.84 -> 89.95 | Hurt |
| Use SampDetox instead of the strongest listed baseline | CIFAR-10 backdoor purification · CIFAR-10, Dynamic | PA (%): 68.89 -> 88.62 | Helped |
| Use SampDetox instead of the strongest listed baseline | CIFAR-10 backdoor purification · CIFAR-10, Blended | PA (%): 63.81 -> 86.65 | Helped |
| Use SampDetox instead of the strongest listed baseline | CIFAR-10 backdoor purification · CIFAR-10, LF | PA (%): 86.59 -> 87.40 | Helped |
| Use SampDetox instead of the strongest listed baseline | CIFAR-10 backdoor purification · CIFAR-10, WaNet | PA (%): 85.22 -> 88.92 | Helped |
| Use SampDetox instead of the strongest listed baseline | CIFAR-10 backdoor purification · CIFAR-10, ISSBA | PA (%): 85.46 -> 86.51 | Helped |
| Use SampDetox instead of the strongest listed baseline | CIFAR-10 backdoor purification · CIFAR-10, BPP | PA (%): 82.94 -> 84.83 | Helped |
| Add Stage 2 local detoxification to Stage 1 (ablation) | SampDetox · CIFAR-10 backdoor attacks | PA (%): Stage 1 -> SampDetox: SIG 9.48 -> 65.06; TrojanNN 35.51 -> 89.95 | Helped |
| Add Stage 2 local detoxification to Stage 1 (ablation) | SampDetox · CIFAR-10 backdoor attacks | PA (%): Blended 86.65 -> 86.65; LF 87.50 -> 87.40; WaNet 88.91 -> 88.92 | No clear effect |
Surprising findings
- Sancdifi and BDMAE, which rely on repeated model queries, lose substantial clean accuracy on some attacks, while the model-agnostic SampDetox does not.
Limitations
- Accuracy drops for high-visibility attacks such as SIG (PA 65.06%) remain substantial.
- Performance depends on the pre-trained diffusion model; an ImageNet-pretrained model degrades PA and out-of-distribution settings need fine-tuning.
Experimental setup
Datasets: CIFAR-10 GTSRB Tiny-ImageNet MS-Celeb-1M DTD
Benchmarks: CIFAR-10 GTSRB Tiny-ImageNet DTD MS-Celeb-1M
Metrics: clean accuracy poisoned sample accuracy attack success rate
Baselines: Sancdifi BDMAE ZIP Noising ShrinkPad Blur
Builds on: DDPM DDIM ZIP BDMAE Sancdifi
Closest papers by meaning
- UFID: A Unified Framework for Black-box Input-level Backdoor Detection on Diffusion Models (AAAI 2025 · similarity 0.90)
- BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Model (NeurIPS 2025 · similarity 0.88)
- Uncovering, Explaining, and Mitigating the Superficial Safety of Backdoor Defense (NeurIPS 2024 · similarity 0.87)
- Elijah: Eliminating Backdoors Injected in Diffusion Models via Distribution Shift (AAAI 2024 · similarity 0.87)
- Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency (ICLR 2024 · similarity 0.87)
- Backdoor Cleaning without External Guidance in MLLM Fine-tuning (NeurIPS 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.