mlsanityData to 7 Oct 2026

DiffSafeMerge: Mitigating Backdoor Inheritance in Diffusion Model Merging

arXiv 2608.09445 ↗First posted 10 Aug 2026cs.CR cs.CVcited by 0

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

Unconditional diffusion checkpoint merging assumes benign sources, yet a compromised public checkpoint can transfer a dormant backdoor while clean generation appears normal. Mitigation is difficult without knowing the compromised source, trigger, or target, and broad sanitization may degrade image quality. We introduce DiffSafeMerge (DSM), which uses a small unlabeled clean set and fixed, attack-agnostic stress probes to score source blocks, shrink suspicious contributions toward a trusted reference, and select attenuation under a clean denoising-loss budget. We evaluate four attacks, two datasets, and 21 target conditions. Intended merging already has zero worst-target ASR in 10 of 14 source cases; DSM preserves these outcomes and records no target match in the remaining four over three seeds, including three with baseline ASR of 48--100%. Among methods with zero worst-target ASR on both datasets, DSM obtains the lowest case-averaged FID in the matched seed-0 comparison.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 22 of its 36 references that are in the map. First posted on arXiv 10 Aug 2026.

Builds on

22 of 36 references.

Closest ancestors · 4

Same direction, newest first

  1. 2024UIBDiffusion: Universal Imperceptible Backdoor Attack for Diffusion Models16 Dec
  2. 2024PureDiffusion: Using Backdoor to Counter Backdoor in Generative Diffusion Models20 Sep
  3. 2024TERD: A Unified Framework for Safeguarding Diffusion Models Against Backdoors9 Sep
  4. 2023TrojDiff: Trojan Attacks on Diffusion Models with Diverse Targets10 Mar

Other references · 18

  1. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  2. 2017Progressive Growing of GANs for Improved Quality, Stability, and Variationcited by 2,967
  3. 2022Model soups: averaging weights of multiple fine-tuned models improves accuracy without increasing inference timecited by 1,366
  4. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  5. 2023TIES-Merging: Resolving Interference When Merging Modelscited by 795
  6. 2021Merging Models with Fisher-Weighted Averagingcited by 613
  7. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  8. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  9. 2022Dataless Knowledge Fusion by Merging Weights of Language Modelscited by 384
  10. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  11. 2024Model Merging and Safety Alignment: One Bad Model Spoils the Bunchcited by 41
  12. 2024BadMerging: Backdoor Attacks Against Model Mergingcited by 32
6 more
  1. 2025SafeMERGE: Preserving Safety Alignment in Fine-Tuned Large Language Models via Selective Layer-Wise Model Mergingcited by 25
  2. 2024Here's a Free Lunch: Sanitizing Backdoored Models with Model Mergecited by 21
  3. 2024Mitigating the Backdoor Effect for Multi-Task Model Merging via Safety-Aware Subspacecited by 14
  4. 2025LED-Merging: Mitigating Safety-Utility Conflicts in Model Merging with Location-Election-Disjointcited by 7
  5. 2025DMM: Building a Versatile Image Generation Model via Distillation-Based Model Mergingcited by 5
  6. 2026From Parameters to Feature Space: Task Arithmetic for Backdoor Mitigation in Model Mergingcited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2024Diff-Cleanse: Identifying and Mitigating Backdoor Attacks in Diffusion Models
  2. 2024Watch the Watcher! Backdoor Attacks on Security-Enhancing Diffusion Models
  3. 2025A Dual-Purpose Framework for Backdoor Defense and Backdoor Amplification in Diffusion Models
  4. 2023VillanDiffusion: A Unified Backdoor Attack Framework for Diffusion Models
  5. 2023Elijah: Eliminating Backdoors Injected in Diffusion Models via Distribution Shift
  6. 2022How to Backdoor Diffusion Models?
  7. 2024Dual-Model Defense: Safeguarding Diffusion Models from Membership Inference Attacks through Disjoint Data Splitting
  8. 2024Invisible Backdoor Attacks on Diffusion Models