mlsanityData to 14 Oct 2026

Elijah: Eliminating Backdoors Injected in Diffusion Models via Distribution Shift

arXiv 2312.00050 ↗First posted 27 Nov 2023cs.CR cs.AI cs.LGcited by 31

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

Diffusion models (DM) have become state-of-the-art generative models because of their capability to generate high-quality images from noises without adversarial training. However, they are vulnerable to backdoor attacks as reported by recent studies. When a data input (e.g., some Gaussian noise) is stamped with a trigger (e.g., a white patch), the backdoored model always generates the target image (e.g., an improper photo). However, effective defense strategies to mitigate backdoors from DMs are underexplored. To bridge this gap, we propose the first backdoor detection and removal framework for DMs. We evaluate our framework Elijah on hundreds of DMs of 3 types including DDPM, NCSN and LDM, with 13 samplers against 3 existing backdoor attacks. Extensive experiments show that our approach can have close to 100% detection accuracy and reduce the backdoor effects to close to zero without significantly sacrificing the model utility.

Key facts. Cited by 31 papers in the map (data through 14 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 48 of its 76 references that are in the map. First posted on arXiv 27 Nov 2023.

Builds on

48 of 76 references.

Closest ancestors · 1

Same direction, newest first

  1. 2023Text-to-Image Diffusion Models can be Easily Backdoored through Multimodal Data Poisoning7 May

Other references · 47

  1. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  2. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  3. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
  4. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  5. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,177
  6. 2022Generative Adversarial Networkscited by 5,627
  7. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,101
  8. 2022DreamBooth: Fine Tuning Text-to-Image Diffusion Models for Subject-Driven Generationcited by 3,300
  9. 2022Elucidating the Design Space of Diffusion-Based Generative Modelscited by 3,045
  10. 2017Progressive Growing of GANs for Improved Quality, Stability, and Variationcited by 2,988
  11. 2022DPM-Solver: A Fast ODE Solver for Diffusion Probabilistic Model Sampling in Around 10 Stepscited by 1,979
  12. 2018Spectral Normalization for Generative Adversarial Networkscited by 1,636
35 more
  1. 2020DiffWave: A Versatile Diffusion Model for Audio Synthesiscited by 1,354
  2. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  3. 2020Improved Techniques for Training Score-Based Generative Modelscited by 1,043
  4. 2018How To Backdoor Federated Learningcited by 765
  5. 2022DiffEdit: Diffusion-based semantic image editing with mask guidancecited by 647
  6. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
  7. 2022Fast Sampling of Diffusion Models with Exponential Integratorcited by 532
  8. 2022GeoDiff: a Geometric Diffusion Model for Molecular Conformation Generationcited by 516
  9. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 459
  10. 2023UniPC: A Unified Predictor-Corrector Framework for Fast Sampling of Diffusion Modelscited by 450
  11. 2021Grad-TTS: A Diffusion Probabilistic Model for Text-to-Speechcited by 447
  12. 2019Using Pre-Training Can Improve Model Robustness and Uncertaintycited by 373
  13. 2019Hidden Trigger Backdoor Attackscited by 371
  14. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 324
  15. 2022Unlocking High-Accuracy Differentially Private Image Classification through Scalecited by 224
  16. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 211
  17. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 199
  18. 2022SINE: SINgle Image Editing with Text-to-Image Diffusion Modelscited by 159
  19. 2021Diff-TTS: A Denoising Diffusion Model for Text-to-Speechcited by 157
  20. 2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 146
  21. 2019Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detectioncited by 124
  22. 2020Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoffcited by 89
  23. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitutioncited by 89
  24. 2021Guided-TTS: A Diffusion Model for Text-to-Speech via Classifier Guidancecited by 84
  25. 2020DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentationcited by 77
  26. 2021BACKDOORL: Backdoor Attack against Competitive Reinforcement Learningcited by 68
  27. 2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 65
  28. 2020Certified Robustness of Nearest Neighbors against Data Poisoning and Backdoor Attackscited by 60
  29. 2022BadDet: Backdoor Attacks on Object Detectioncited by 45
  30. 2022Rethinking the Reverse-engineering of Trojan Triggerscited by 39
  31. 2022Training with More Confidence: Mitigating Injected and Natural Backdoors During Trainingcited by 38
  32. 2023A Pathway Towards Responsible AI Generated Contentcited by 38
  33. 2022FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learningcited by 37
  34. 2020Minority Reports Defense: Defending Against Adversarial Patchescited by 36
  35. 2019PPGAN: Privacy-preserving Generative Adversarial Networkcited by 34

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 12; 2025: 12; 2026: 7.

31 papers.

Sort:

By area:

  1. 2024Attacks and Defenses for Generative Diffusion Models: A Comprehensive Surveycited by 32
  2. 2025Silent Branding Attack: Trigger-free Data Poisoning Attack on Text-to-Image Diffusion Modelscited by 11
  3. 2024Invisible Backdoor Attacks on Diffusion Modelscited by 9
  4. 2024UIBDiffusion: Universal Imperceptible Backdoor Attack for Diffusion Modelscited by 9
  5. 2025BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Modelcited by 8
  6. 2024Not Just Text: Uncovering Vision Modality Typographic Threats in Image Generation Modelscited by 7
  7. 2024PureDiffusion: Using Backdoor to Counter Backdoor in Generative Diffusion Modelscited by 6
  8. 2025MixBridge: Heterogeneous Image-to-Image Backdoor Attack through Mixture of Schr"odinger Bridgescited by 6
  9. 2024Watch the Watcher! Backdoor Attacks on Security-Enhancing Diffusion Modelscited by 4
  10. 2025What Lurks Within? Concept Auditing for Shared Diffusion Models at Scalecited by 4
  11. 2024The last Dance : Robust backdoor attack via diffusion models and bayesian approachcited by 3
  12. 2024Trading Devil: Robust backdoor attack via Stochastic investment models and Bayesian approachcited by 3
19 more
  1. 2025A Dual-Purpose Framework for Backdoor Defense and Backdoor Amplification in Diffusion Modelscited by 3
  2. 2025Dynamic Attention Analysis for Backdoor Detection in Text-to-Image Diffusion Modelscited by 3
  3. 2024UNIT: Backdoor Mitigation via Automated Neural Distribution Tighteningcited by 2
  4. 2024On the Fairness, Diversity and Reliability of Text-to-Image Generative Modelscited by 2
  5. 2025Parasite: A Steganography-based Backdoor Attack Framework for Diffusion Modelscited by 2
  6. 2025Backdoor Defense in Diffusion Models via Spatial Attention Unlearningcited by 2
  7. 2025Sealing The Backdoor: Unlearning Adversarial Text Triggers In Diffusion Models Using Knowledge Distillationcited by 2
  8. 2024How to Backdoor Consistency Models?cited by 1
  9. 2024TrojFlow: Flow Models are Natural Targets for Trojan Attackscited by 1
  10. 2025Gungnir: Exploiting Stylistic Features in Images for Backdoor Attacks on Diffusion Modelscited by 1
  11. 2025Practical, Generalizable and Robust Backdoor Attacks on Text-to-Image Diffusion Modelscited by 1
  12. 2026BadRSSD: Backdoor Attacks on Regularized Self-Supervised Diffusion Modelscited by 1
  13. 2026BlackMirror: Black-Box Backdoor Detection for Text-to-Image Models via Instruction-Response Deviationcited by 1
  14. 2026BadDreamer: Transferable Backdoor Attacks against Video World Models for Autonomous Drivingcited by 1
  15. 2025BadBlocks: Low-Cost and Stealthy Backdoor Attacks Tailored for Text-to-Image Diffusion Modelscited by 0
  16. 2026Backdoor Sentinel: Detecting and Detoxifying Backdoors in Diffusion Models via Temporal Noise Consistencycited by 0
  17. 2026Beyond the False Trade-off: Adaptive EWC for Stealthy and Generalizable T2I Backdoorscited by 0
  18. 2026Backdooring Masked Diffusion Language Modelscited by 0
  19. 2026TooBad: Backdoor Diffusion Models with Ultra-Low Poison Rate and Imperceptible Triggercited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2023VillanDiffusion: A Unified Backdoor Attack Framework for Diffusion Models
  2. 2024TERD: A Unified Framework for Safeguarding Diffusion Models Against Backdoors
  3. 2022How to Backdoor Diffusion Models?
  4. 2024Diff-Cleanse: Identifying and Mitigating Backdoor Attacks in Diffusion Models
  5. 2024UFID: A Unified Framework for Input-level Backdoor Detection on Diffusion Models
  6. 2023Leveraging Diffusion-Based Image Variations for Robust Training on Poisoned Data
  7. 2025Data-Chain Backdoor: Do You Trust Diffusion Models as Generative Data Supplier?
  8. 2026TEMPO-Diffusion: Temporally Exposed Malicious Poisoning of Diffusion Models