Backdoor Sentinel: Detecting and Detoxifying Backdoors in Diffusion Models via Temporal Noise Consistency

2026-02-02

AI Summary

This work addresses the challenge of backdoor detection and mitigation in diffusion models under practical auditing scenarios where model parameters are inaccessible, a setting in which existing methods struggle to balance efficacy and generation quality. The authors propose TNC-Defense, a unified gray-box framework that, for the first time, leverages the inconsistency in noise predictions between adjacent timesteps during the diffusion process to enable trigger-agnostic backdoor detection and low-cost purification. By analyzing temporal noise consistency, the method achieves efficient detection and subsequently performs timestep-aware generation path correction to neutralize backdoors. Experiments across five backdoor attacks demonstrate an average 11% improvement in detection accuracy, with 98.5% of triggered samples successfully rendered ineffective, while incurring only a marginal degradation in generation quality.

Technology Category

• Computer Vision: Diffusion Models for Vision
• Machine Learning: Calibration & Uncertainty Quantification
• Natural Language Processing: Generation

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Web Mining and Content Analysis: Large pretrained models with web data

Abstract

Diffusion models have been widely deployed in AIGC services; however, their reliance on opaque training data and procedures exposes a broad attack surface for backdoor injection. In practical auditing scenarios, due to the protection of intellectual property and commercial confidentiality, auditors are typically unable to access model parameters, rendering existing white-box or query-intensive detection methods impractical. More importantly, even after the backdoor is detected, existing detoxification approaches are often trapped in a dilemma between detoxification effectiveness and generation quality. In this work, we identify a previously unreported phenomenon called temporal noise unconsistency, where the noise predictions between adjacent diffusion timesteps is disrupted in specific temporal segments when the input is triggered, while remaining stable under clean inputs. Leveraging this finding, we propose Temporal Noise Consistency Defense (TNC-Defense), a unified framework for backdoor detection and detoxification. The framework first uses the adjacent timestep noise consistency to design a gray-box detection module, for identifying and locating anomalous diffusion timesteps. Furthermore, the framework uses the identified anomalous timesteps to construct a trigger-agnostic, timestep-aware detoxification module, which directly corrects the backdoor generation path. This effectively suppresses backdoor behavior while significantly reducing detoxification costs. We evaluate the proposed method under five representative backdoor attack scenarios and compare it with state-of-the-art defenses. The results show that TNC-Defense improves the average detection accuracy by $11\%$ with negligible additional overhead, and invalidates an average of $98.5\%$ of triggered samples with only a mild degradation in generation quality.

Problem

• backdoor attack
• diffusion models
• model auditing
• detoxification
• generation quality

Innovation

• Temporal Noise Consistency
• Backdoor Detection
• Diffusion Models
• Gray-box Defense
• Trigger-agnostic Detoxification