A computer-vision preprint reports that DEFUSE, a diffusion-based detector, produced AUPRC scores from 0.81 to 0.96 when tested against four data-poisoning attacks. In three training-manipulation tests, its reported AUPRC range was 0.81 to 0.90.
AUPRC is the study’s summary measure for how well backdoored and clean inputs are distinguished. The four data-poisoning scores were 0.81 for SSLBKD, 0.84 for CTRL, 0.88 for BLTO and 0.96 for CLIP Backdoor; the training-manipulation scores were 0.89 for BadEncoder, 0.81 for DRUPE and 0.90 for BadCLIP.
A detector built around reconstructed images
DEFUSE is designed for a black-box setting: the defender is not assumed to know the training data or the attack strategy. It takes a suspect encoder’s representation—an internal numerical description of an image—and uses it to prompt a pretrained conditional diffusion model that reconstructs an image. It then scores semantic consistency, or how well the reconstruction retains the input’s meaning, in a reference representation space.
The underlying hypothesis is that clean representations should yield semantically consistent reconstructions, while backdoored representations may produce lower-consistency, target or meaningless reconstructions. A score threshold then turns that comparison into a detection decision.
The test bed and its boundaries
The core benchmark used CLIP ViT-B with a 50,000-image subset of CC3M and ImageNet-1K evaluation, alongside SimSiam ResNet18 on the ImageNet-100 split. The images were resized to 224 by 224 pixels.
The study tested seven named backdoor attacks. It poisoned 500 image-text pairs for image-text encoders and 650 images for visual self-supervised learning; the default HTBA trigger was 50 by 50 pixels.
In the default evaluation, SDXL served as the conditional diffusion model and DINOv2 as the reference encoder. The diffusion model was fine-tuned on poison-free ImageNet-900, images were sampled with DDIM for 30 steps, and the default detection threshold was 0.1.
Where the score held up
An ablation of the similarity measure found DINOv2 to be the strongest listed individual metric. AUROC, another score for how well clean and backdoored inputs are separated, reached 0.997 for CLIP Backdoor, 0.902 for CTRL and 0.931 for BadEncoder. DINOv2 exceeded the listed L2 and SSIM AUROCs in every reported row.
The comparison of training-free and fine-tuned versions reported a 0.09 to 0.17 AUROC difference in favor of fine-tuning. Twenty inference steps were sufficient for the best reported performance, compared with the default 30-step evaluation.
An out-of-distribution check used an ImageNet-finetuned SDXL detector on four datasets outside the main benchmark’s image setting. Reported AUROC values were 0.90 on NIH ChestX-ray14, 0.96 on AID, 0.98 on HAM10000 and 0.95 on NWPU-RESISC45. These point estimates show performance in the listed tests, but do not establish broad generalization to other domains.
Under the tested adaptive perturbation, AUROC fell to 0.78 before a noise defense was applied. Gaussian noise with variance 0.1 was associated with an AUROC of 0.90. The result is specific to the attack and defense combination described in the study.
In a separate adaptive-poisoning analysis, the authors reported that DEFUSE was not significantly affected when malicious samples reached 30,000, approximately 3.33% of the setting. The supplied analysis gives no detailed test statistics or curve values for this result.
Purification was a separate measure
DEFUSE was also evaluated as a purification step. In the listed CLIP-Backdoor case, the table reported clean accuracy changing from 0.0% to 22.0% and attack success rate from 95.2% to 8.0%. For BadCLIP, clean accuracy changed from 0.0% to 28.4%, while attack success rate changed from 88.9% to 0.0%.
Those results cover the listed attacks and downstream measures; they do not show that purification generally removes backdoors or restores all of a model’s downstream function.
The auxiliary-classifier row reported a different SSLBKD result: recall was 99.8% and attack success rate 0.1%, compared with 43.8% recall and 49.1% attack success rate for DEFUSE alone. The comparison depends on that classifier setup.
The results still have a narrow perimeter
The study’s evidence remains bounded by its benchmark design. The main setup centered on CLIP ViT-B and SimSiam ResNet18 and on seven named attacks and selected datasets; the main detection tables did not report confidence intervals or repeated-run variability. Performance against substantially different architectures, unknown attack distributions and production settings therefore remains unsettled.
DEFUSE also depends on a pretrained generative model, a reference encoder and poison-free training data, even though its black-box setup does not assume prior knowledge of the training data or attack strategy. Threshold calibration, false-positive constraints, computation and stricter white-box adaptive attacks remain open questions.
Metadata identifies the work as a preprint; its front matter shows arXiv:2608.25851v1 dated 26 August 2026. The paper says source code is available through the DEFUSE GitHub repository.
Paper data and sources
Original title: DEFUSE: Generalizable Backdoor Defense for Self-Supervised Encoders with Generative Priors
Authors: Tuo Chen, Jie Gui, Minjing Dong et al.
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-26
DOI: 10.1145/3767308.3835471
Original paper · Full text