发现扩散模型中噪声一致性异常,可无参数检测并清除后门。
Backdoor Sentinel: Detecting and Detoxifying Backdoors in Diffusion Models via Temporal Noise Consistency
- 通过相邻步噪声一致性分析,实现无需模型参数的后门检测。
- 在五种攻击下平均检测准确率提升11%,98.5%触发样本被无效化。
- 适合关注模型安全的服务提供商与审计人员使用。
扩散模型广泛应用于AIGC服务,但其对不透明训练数据的依赖使其易受后门攻击。实际审计中,因知识产权保护,审计者通常无法访问模型参数,导致白盒或查询密集型检测方法不可行。现有净化方法在净化效果与生成质量间陷入两难。我们揭示了时间噪声一致性(TNC)这一此前未被发现的现象:后门激活会破坏特定时间片段内相邻扩散步的噪声预测一致性,而正常输入则保持稳定。基于此,我们提出TNC-Defense闭环框架,实现灰盒检测与模型修复。TNC-Detect(供审计者)利用推理阶段相邻噪声统计量,在不访问模型权重的情况下检测后门并精确定位异常时间步。TNC-Detox(供服务提供方)利用这些位置进行无触发器、时间感知的生成路径修正,抑制后门行为同时降低净化成本。在五种代表性后门攻击及前沿防御方案下,TNC-Defense平均检测准确率提升11%,额外开销可忽略,且使平均98.5%的触发样本失效,仅带来轻微生成质量下降。代码已公开于:https://github.com/binzhwang/TNC-Defense。
原文摘要 · Abstract (English)
Diffusion models have been widely deployed in AIGC services, but their reliance on opaque training data exposes them to backdoor attacks. In practical auditing scenarios, auditors are typically unable to access model parameters due to intellectual property protection, making white-box or query-intensive detection impractical. After detection, existing detoxification approaches are trapped in a dilemma between detoxification effectiveness and generation quality for service providers. We reveal Temporal Noise Consistency (TNC), a previously unreported phenomenon in which backdoor activation disrupts the consistency of noise predictions between adjacent diffusion timesteps within specific temporal segments, while clean inputs remain stable. Based on this finding, we propose TNC-Defense, a closed-loop framework for gray-box backdoor detection and model repair. Specifically, TNC-Detect (for auditors) uses inference-stage adjacent-noise statistics to detect backdoors and precisely localize anomalous timesteps without model-weight access. TNC-Detox (for service providers) utilizes these locations to perform trigger-agnostic, timestep-aware correction of the generation path, suppressing backdoor behavior while reducing detoxification cost. Across five representative backdoor attacks and state-of-the-art defenses, TNC-Defense improves the average detection accuracy by $11\%$ with negligible additional overhead, and invalidates an average of $98.5\%$ of triggered samples with only a mild degradation in generation quality. Our code is publicly available at: https://github.com/binzhwang/TNC-Defense.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。