后门哨兵：通过时间噪声一致性检测和净化扩散模型中的后门
Backdoor Sentinel: Detecting and Detoxifying Backdoors in Diffusion Models via Temporal Noise Consistency
AI总结：
本文提出TNC-Defense框架，通过时间噪声一致性检测和净化扩散模型中的后门，提升检测准确率并降低净化成本。
摘要：
扩散模型已被广泛应用于AIGC服务；然而，其对不透明训练数据和过程的依赖暴露了广泛的后门注入攻击面。在实际审计场景中，由于知识产权保护和商业保密的考虑，审计员通常无法访问模型参数，使得现有白盒或查询密集型检测方法不切实际。更重要的是，即使在检测到后门后，现有净化方法往往在净化效果和生成质量之间陷入两难。在本工作中，我们识别出一种此前未报告的现象，称为时间噪声不一致性，即当输入被触发时，在特定时间段内相邻扩散时间步的噪声预测会受到破坏，而在干净输入下则保持稳定。利用这一发现，我们提出了时间噪声一致性防御（TNC-Defense），一种用于后门检测和净化的统一框架。该框架首先利用相邻时间步的噪声一致性设计一个灰盒检测模块，用于识别和定位异常的扩散时间步。此外，该框架利用识别出的异常时间步来构建一个不依赖触发器、时间步感知的净化模块，直接纠正后门生成路径。这有效抑制了后门行为，同时显著降低了净化成本。我们评估了所提出方法在五个代表性后门攻击场景下的性能，并将其与最先进的防御方法进行比较。结果表明，TNC-Defense在几乎不增加额外开销的情况下，将平均检测准确率提高了11%，并使被触发样本的无效化率平均达到98.5%，同时仅导致生成质量轻微下降。
英文摘要：
Diffusion models have been widely deployed in AIGC services, but their reliance on opaque training data exposes them to backdoor attacks. In practical auditing scenarios, auditors are typically unable to access model parameters due to intellectual property protection, making white-box or query-intensive detection impractical. After detection, existing detoxification approaches are trapped in a dilemma between detoxification effectiveness and generation quality for service providers. We reveal Temporal Noise Consistency (TNC), a previously unreported phenomenon in which backdoor activation disrupts the consistency of noise predictions between adjacent diffusion timesteps within specific temporal segments, while clean inputs remain stable. Based on this finding, we propose TNC-Defense, a closed-loop framework for gray-box backdoor detection and model repair. Specifically, TNC-Detect (for auditors) uses inference-stage adjacent-noise statistics to detect backdoors and precisely localize anomalous timesteps without model-weight access. TNC-Detox (for service providers) utilizes these locations to perform trigger-agnostic, timestep-aware correction of the generation path, suppressing backdoor behavior while reducing detoxification cost. Across five representative backdoor attacks and state-of-the-art defenses, TNC-Defense improves the average detection accuracy by $11\%$ with negligible additional overhead, and invalidates an average of $98.5\%$ of triggered samples with only a mild degradation in generation quality. Our code is publicly available at: https://github.com/binzhwang/TNC-Defense.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
