{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/t2ishield-defending-against-backdoors-on-text","title":"T2IShield: Defending Against Backdoors on Text-to-Image Diffusion Models","arxiv_id":"2407.04215","date":"2024-07-05","proceeding":null,"authors":["Zhongqi Wang","Jie Zhang","Shiguang Shan","Xilin Chen"],"abstract":"While text-to-image diffusion models demonstrate impressive generation capabilities, they also exhibit vulnerability to backdoor attacks, which involve the manipulation of model outputs through malicious triggers. In this paper, for the first time, we propose a comprehensive defense method named T2IShield to detect, localize, and mitigate such attacks. Specifically, we find the \"Assimilation Phenomenon\" on the cross-attention maps caused by the backdoor trigger. Based on this key insight, we propose two effective backdoor detection methods: Frobenius Norm Threshold Truncation and Covariance Discriminant Analysis. Besides, we introduce a binary-search approach to localize the trigger within a backdoor sample and assess the efficacy of existing concept editing methods in mitigating backdoor attacks. Empirical evaluations on two advanced backdoor attack scenarios show the effectiveness of our proposed defense method. For backdoor sample detection, T2IShield achieves a detection F1 score of 88.9$\\%$ with low computational cost. Furthermore, T2IShield achieves a localization F1 score of 86.4$\\%$ and invalidates 99$\\%$ poisoned samples. Codes are released at https://github.com/Robin-WZQ/T2IShield.","url_abs":"https://arxiv.org/abs/2407.04215v2","url_pdf":"https://arxiv.org/pdf/2407.04215v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"t2ishield-defending-against-backdoors-on-text","repo_url":"https://github.com/robin-wzq/t2ishield","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"}],"methods":[{"method_slug":"diffusion","method_name":"Diffusion"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2407.04215","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2407.04215"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/robin-wzq/t2ishield","reach":null}],"summary":{"unverified":3},"by_repo_kind":{"official":{"samples":3,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"a68c381b7719889b","entry":"binary_search_helper","repo":"robin-wzq/t2ishield","repo_kind":"official","path":"backdoor_localization/locate_clip_rickrolling.py","file_url":"https://github.com/robin-wzq/t2ishield/blob/HEAD/backdoor_localization/locate_clip_rickrolling.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a68c381b7719889b"}},{"code_sha256_prefix":"e9260bd77c9e3df8","entry":"binary_search_trigger","repo":"robin-wzq/t2ishield","repo_kind":"official","path":"backdoor_localization/locate_clip_rickrolling.py","file_url":"https://github.com/robin-wzq/t2ishield/blob/HEAD/backdoor_localization/locate_clip_rickrolling.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e9260bd77c9e3df8"}},{"code_sha256_prefix":"a705996c5d120e82","entry":"compute_similairy","repo":"robin-wzq/t2ishield","repo_kind":"official","path":"backdoor_localization/locate_clip_rickrolling.py","file_url":"https://github.com/robin-wzq/t2ishield/blob/HEAD/backdoor_localization/locate_clip_rickrolling.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a705996c5d120e82"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}