提出统一防御框架，可100%识别并清除扩散模型中的后门攻击。
TERD: A Unified Framework for Safeguarding Diffusion Models Against Backdoors
- 构建统一建模，通过反向损失还原触发器。
- 实现100%检测率，跨不同分辨率数据集均有效。
- 适用于基于SDE的生成模型，适合安全部署者使用。
扩散模型在图像生成中取得显著进展，但极易受到后门攻击，即在特定触发器下产生预定的恶意输出，威胁其完整性。本文提出TERD，一种统一防御框架，能建模当前主流攻击方式，并推导出可计算的反向损失。通过从先验分布采样噪声得到触发器初值，并利用微分多步采样器进行优化，实现触发器反演。进一步地，基于反演触发器，提出从噪声空间检测后门输入的新方法，以及一种计算反演与正常分布间KL散度的新型模型检测算法。大量实验表明，TERD在不同分辨率的数据集上均实现100%真阳性率（TPR）和真阴性率（TNR）。该框架还展现出对其他基于随机微分方程（SDE）模型的良好适应性。代码已开源：https://github.com/PKU-ML/TERD。
原文摘要 · Abstract (English)
Diffusion models have achieved notable success in image generation, but they remain highly vulnerable to backdoor attacks, which compromise their integrity by producing specific undesirable outputs when presented with a pre-defined trigger. In this paper, we investigate how to protect diffusion models from this dangerous threat. Specifically, we propose TERD, a backdoor defense framework that builds unified modeling for current attacks, which enables us to derive an accessible reversed loss. A trigger reversion strategy is further employed: an initial approximation of the trigger through noise sampled from a prior distribution, followed by refinement through differential multi-step samplers. Additionally, with the reversed trigger, we propose backdoor detection from the noise space, introducing the first backdoor input detection approach for diffusion models and a novel model detection algorithm that calculates the KL divergence between reversed and benign distributions. Extensive evaluations demonstrate that TERD secures a 100% True Positive Rate (TPR) and True Negative Rate (TNR) across datasets of varying resolutions. TERD also demonstrates nice adaptability to other Stochastic Differential Equation (SDE)-based models. Our code is available at https://github.com/PKU-ML/TERD.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。