mlsanityData to 7 Oct 2026

Black-box Backdoor Defense via Zero-shot Image Purification

arXiv 2303.12175 ↗First posted 21 Mar 2023cs.CV cs.AI cs.CRcited by 44

Not on the map. Why?

Abstract (arXiv)

Backdoor attacks inject poisoned samples into the training data, resulting in the misclassification of the poisoned input during a model's deployment. Defending against such attacks is challenging, especially for real-world black-box models where only query access is permitted. In this paper, we propose a novel defense framework against backdoor attacks through Zero-shot Image Purification (ZIP). Our framework can be applied to poisoned models without requiring internal information about the model or any prior knowledge of the clean/poisoned samples. Our defense framework involves two steps. First, we apply a linear transformation (e.g., blurring) on the poisoned image to destroy the backdoor pattern. Then, we use a pre-trained diffusion model to recover the missing semantic information removed by the transformation. In particular, we design a new reverse process by using the transformed image to guide the generation of high-fidelity purified images, which works in zero-shot settings. We evaluate our ZIP framework on multiple datasets with different types of attacks. Experimental results demonstrate the superiority of our ZIP framework compared to state-of-the-art backdoor defense baselines. We believe that our results will provide valuable insights for future defense methods for black-box models. Our code is available at https://github.com/sycny/ZIP.

Key facts. Cited by 44 papers in the map (data through 7 Oct 2026). Builds on 46 of its 70 references that are in the map. First posted on arXiv 21 Mar 2023.

Builds on

46 of 70 references.

References · 46

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  3. 2020Denoising Diffusion Implicit Modelscited by 9,655
  4. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  5. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  6. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  7. 2022Denoising Diffusion Restoration Modelscited by 951
  8. 2021Blended Diffusion for Text-driven Editing of Natural Imagescited by 924
  9. 2022Zero-Shot Image Restoration Using Denoising Diffusion Null-Space Modelcited by 574
  10. 2022Diffusion Models for Adversarial Purificationcited by 469
  11. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  12. 2020Backdoor Learning: A Surveycited by 412
34 more
  1. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  2. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  3. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  4. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 162
  5. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
  6. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 155
  7. 2021Poisoning and Backdooring Contrastive Learningcited by 149
  8. 2022Backdoor Defense via Decoupling the Training Processcited by 149
  9. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
  10. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 98
  11. 2019Robust Anomaly Detection and Backdoor Attack Detection Via Differential Privacycited by 93
  12. 2023SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistencycited by 93
  13. 2020An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networkscited by 92
  14. 2021Backdoor Attack in the Physical Worldcited by 82
  15. 2020Rethinking the Trigger of Backdoor Attackcited by 76
  16. 2021BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Modelscited by 76
  17. 2020DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentationcited by 75
  18. 2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 71
  19. 2021Handcrafted Backdoors in Deep Neural Networkscited by 57
  20. 2019Model Agnostic Defence against Backdoor Attacks in Machine Learningcited by 52
  21. 2021AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value Analysiscited by 52
  22. 2022Constrained Optimization with Dynamic Bound-scaling for Effective NLPBackdoor Defensecited by 44
  23. 2021Trigger Hunting with a Topological Prior for Trojan Detectioncited by 39
  24. 2022Training with More Confidence: Mitigating Injected and Natural Backdoors During Trainingcited by 38
  25. 2022Few-Shot Backdoor Attacks on Visual Object Trackingcited by 35
  26. 2022Post-Training Detection of Backdoor Attacks for Two-Class and Multi-Attack Scenarioscited by 29
  27. 2023TrojText: Test-time Invisible Textual Trojan Insertioncited by 26
  28. 2022One-shot Neural Backdoor Erasing via Adversarial Weight Maskingcited by 25
  29. 2023BackdoorBox: A Python Toolbox for Backdoor Learningcited by 25
  30. 2021How to Inject Backdoors with Better Consistency: Logit Anchoring on Clean Datacited by 22
  31. 2022Few-shot Backdoor Attacks via Neural Tangent Kernelscited by 15
  32. 2022Trap and Replace: Defending Backdoor Attacks by Trapping Them into an Easy-to-Replace Subnetworkcited by 12
  33. 2021Incompatibility Clustering as a Defense Against Backdoor Poisoning Attackscited by 5
  34. 2022An Adaptive Black-box Defense against Trojan Attacks (TrojDef)cited by 5

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 5; 2024: 12; 2025: 11; 2026: 16.

44 papers.

Sort:

By area:

  1. 2025BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimizationcited by 37
  2. 2025Backdoor Cleaning without External Guidance in MLLM Fine-tuningcited by 34
  3. 2025Towards Trustworthy GUI Agents: A Surveycited by 33
  4. 2024Breaking the False Sense of Security in Backdoor Defense through Re-Activation Attackcited by 26
  5. 2025REFINE: Inversion-Free Backdoor Defense via Model Reprogrammingcited by 20
  6. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 17
  7. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  8. 2024Efficient Availability Attacks against Supervised and Contrastive Learning Simultaneouslycited by 12
  9. 2024Defending Text-to-image Diffusion Models: Surprising Efficacy of Textual Perturbations Against Backdoor Attackscited by 12
  10. 2025Poisoned-MRAG: Knowledge Poisoning Attacks to Multimodal Retrieval Augmented Generationcited by 12
  11. 2023From Trojan Horses to Castle Walls: Unveiling Bilateral Data Poisoning Effects in Diffusion Modelscited by 9
  12. 2024Test-Time Multimodal Backdoor Detection by Contrastive Promptingcited by 5
32 more
  1. 2024CopyrightShield: Enhancing Diffusion Model Security against Copyright Infringement Attackscited by 5
  2. 2026Test-Time Attention Purification for Backdoored Large Vision Language Modelscited by 5
  3. 2025TokenSwap: Backdoor Attack on the Compositional Understanding of Large Vision-Language Modelscited by 4
  4. 2026When Attention Betrays: Erasing Backdoor Attacks in Robotic Policies by Reconstructing Visual Tokenscited by 4
  5. 2026From Internal Diagnosis to External Auditing: A VLM-Driven Paradigm for Data-Free Online Backdoor Defensecited by 3
  6. 2023INK: Inheritable Natural Backdoor Attack Against Model Distillationcited by 2
  7. 2024LADDER: Multi-objective Backdoor Attack via Evolutionary Algorithmcited by 2
  8. 2025Bridging Distribution Shift and AI Safety: Conceptual and Methodological Synergiescited by 2
  9. 2025Evading Data Provenance in Deep Neural Networkscited by 2
  10. 2025Concept-Guided Backdoor Attack on Vision Language Modelscited by 2
  11. 2026Self-Purification Mitigates Backdoors in Multimodal Diffusion Language Modelscited by 2
  12. 2026RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoningcited by 2
  13. 2023Mask and Restore: Blind Backdoor Defense at Test Time with Masked Autoencodercited by 1
  14. 2024Diffusion-based Adversarial Purification for Intrusion Detectioncited by 1
  15. 2024Prompting the Unseen: Detecting Hidden Backdoors in Black-Box Modelscited by 1
  16. 2024Proactive Adversarial Defense: Harnessing Prompt Tuning in Vision-Language Models to Detect Unseen Backdoored Imagescited by 1
  17. 2025AutoDetect: Designing an Autoencoder-based Detection Method for Poisoning Attacks on Object Detection Applications in the Military Domaincited by 1
  18. 2026BackdoorIDS: Zero-shot Backdoor Detection for Pretrained Vision Encodercited by 1
  19. 2023Trustworthy Large Models in Vision: A Surveycited by 0
  20. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 0
  21. 2024Defending Against Repetitive Backdoor Attacks on Semi-supervised Learning through Lens of Rate-Distortion-Perception Trade-offcited by 0
  22. 2025MedFedPure: A Medical Federated Framework with MAE-based Detection and Diffusion Purification for Inference-Time Attackscited by 0
  23. 2026BadSNN: Backdoor Attacks on Spiking Neural Networks via Adversarial Spiking Neuroncited by 0
  24. 2026Kill it with FIRE: On Leveraging Latent Space Directions for Runtime Backdoor Mitigation in Deep Neural Networkscited by 0
  25. 2026Inevitable Encounters: Backdoor Attacks Involving Lossy Compressioncited by 0
  26. 2026FL-PBM: Pre-Training Backdoor Mitigation for Federated Learningcited by 0
  27. 2026PASTA: A Patch-Agnostic Twofold-Stealthy Backdoor Attack on Vision Transformerscited by 0
  28. 2026The Platonic Defense: Backdoor Defense for Self-Supervised Encoders in the Era of Large Scale Pre-trainingcited by 0
  29. 2026Lilith: Backdoor Generalization under Training-Inference Trigger Shiftcited by 0
  30. 2026Forbid Your Attention: Fooling Multimodal Large Language Models by Selectively Removing Intrinsic Focus in Spectral Domaincited by 0
  31. 2026Beyond Small Patches: Black-Box Detection and Purification of Diverse Backdoor Triggerscited by 0
  32. 2026Region-Level Black-Box Defense Against Stealthy Embedding-Space Backdoors in CLIPcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024UFID: A Unified Framework for Input-level Backdoor Detection on Diffusion Models
  2. 2024Perturb and Recover: Fine-tuning for Effective Backdoor Removal from CLIP
  3. 2024TERD: A Unified Framework for Safeguarding Diffusion Models Against Backdoors
  4. 2024Invisible Backdoor Attacks on Diffusion Models
  5. 2025Backdoor Defense in Diffusion Models via Spatial Attention Unlearning
  6. 2025Practical, Generalizable and Robust Backdoor Attacks on Text-to-Image Diffusion Models
  7. 2023Elijah: Eliminating Backdoors Injected in Diffusion Models via Distribution Shift
  8. 2024Diff-Cleanse: Identifying and Mitigating Backdoor Attacks in Diffusion Models