@inproceedings{
an2024how,
title={How to remove backdoors in diffusion models?},
author={Shengwei An and Sheng-Yen Chou and Kaiyuan Zhang and Qiuling Xu and Guanhong Tao and Guangyu Shen and Siyuan Cheng and Shiqing Ma and Pin-Yu Chen and Tsung-Yi Ho and Xiangyu Zhang},
booktitle={NeurIPS 2023 Workshop on Backdoors in Deep Learning - The Good, the Bad, and the Ugly},
year={2024},
url={https://openreview.net/forum?id=sz9vHbZPWU}
}
Diffusion models (DM) have become state-of-the-art generative models because of their capability of generating high-quality images from noises without adversarial training. However, they are vulnerable to backdoor attacks as reported by recent studies.  When a data input (e.g., some Gaussian noise) is stamped with a trigger (e.g., a white patch), the backdoored model always generates the target image  (e.g., an improper photo). However, effective defense strategies to mitigate backdoors from DMs are underexplored. To bridge this gap, we propose the first backdoor detection and removal framework for DMs. We evaluate our framework on over hundreds of DMs of 3 types including DDPM, NCSN and LDM, with 13 samplers against 3 existing backdoor attacks. Extensive experiments show that our approach can have close to 100% detection accuracy and reduce the backdoor effects to close to zero without significantly sacrificing the model utility.
How to remove backdoors in diffusion models?
Shengwei An Sheng-Yen Chou Kaiyuan Zhang Qiuling Xu Guanhong Tao Guangyu Shen Siyuan Cheng Shiqing Ma Pin-Yu Chen Tsung-Yi Ho Xiangyu Zhang