binzhwang/tnc-defenseResearch code for detecting and detoxifying backdoors in text-to-image diffusion models, with pipelines for Stable Diffusion v1.4, v1.5, XL, and 3 Medium.
TNC-Defense provides research code for detecting and detoxifying backdoors in text-to-image diffusion models. The repository currently includes detection pipelines for Stable Diffusion v1.4, Stable Diffusion v1.5, Stable Diffusion XL, and Stable Diffusion 3 Medium, together with detoxification pipelines for Stable Diffusion v1.4 and Stable Diffusion XL.
Research use only. This code is intended for studying the robustness and security of text-to-image diffusion models. Users are responsible for complying with the licenses and usage policies of all upstream models, datasets, and implementations.
TNC-Defense/
├── TNC-Detect/
│ ├── detect_sd14.py # Detection on Stable Diffusion v1.4
│ ├── detect_sd15.py # Detection on Stable Diffusion v1.5
│ ├── detect_sdxl.py # Detection on Stable Diffusion XL
│ ├── detect_sd3.py # Detection on Stable Diffusion 3 Medium
│ ├── ana.py # Detection metrics and visualization
│ ├── run_detect_sd14.sh # Multi-GPU SD1.4 detection
│ └── ana.sh # Analysis entry point
└── TNC-Detox/
├── data/ # Paired clean/backdoored training data
├── common.py # Shared data and reproducibility utilities
├── detox_sd14.py # Detoxification for SD1.4
├── detox_sdxl.py # Detoxification for SDXL
├── evaluate_sd14.py # SD1.4 generation-based evaluation
├── compute_fid.py # FID evaluation
├── run_detox_sd14.sh # Multi-GPU SD1.4 detoxification
└── run_detox_sdxl.sh # SDXL detoxification
The code has been smoke-tested in the TCN Conda environment with:
The analysis and evaluation utilities additionally require packages including NumPy, pandas, SciPy, scikit-learn, Matplotlib, Pillow, and tqdm.
Activate the environment before running an experiment:
cd TNC-Defense
conda create -n TCN python=3.10 -y
conda activate TCN
python -m pip install --upgrade pip
python -m pip install -r requirements.txt
The Bash entry points use the active environment's python. A different
interpreter can be supplied through the PYTHON environment variable:
PYTHON=python bash TNC-Detect/run_detect_sd14.sh
All repository paths are resolved relative to the location of each script, so
the commands do not depend on the current working directory. The default model
paths follow the local project layout used for the experiments. If models are
stored elsewhere, override the corresponding command-line arguments such as
--base-model-path, --backdoor-model-path, --base-model, or --tox-path.
The detoxification datasets are included under:
TNC-Detox/data/
├── sd14/
│ ├── pixel/
│ ├── pixel_mul_tokens/
│ ├── eviledit/
│ ├── personal_bkd/
│ └── villain_mul/
└── sdxl/
├── pixel/
└── pixel_mul_tokens/
Each dataset contains clean/, poison/, and metadata.json.
The default runner evaluates all configured SD1.4 backdoor methods. It assigns
the methods to the GPU IDs defined in run_detect_sd14.sh and launches them in
parallel.
cd TNC-Defense/TNC-Detect
bash run_detect_sd14.sh
To run one method directly:
python detect_sd14.py \
--backdoor-method pixel \
--device cuda:0 \
--seed 0 \
--num-inference-steps 50
The available arguments for every model family can be inspected with:
python detect_sd14.py --help
python detect_sd15.py --help
python detect_sdxl.py --help
python detect_sd3.py --help
After generating the MSE CSV files, configure the input files in ana.sh and
run:
bash ana.sh
The detector supports both the naive and dynamic-k decision rules. Metrics and
plots are produced by ana.py.
The default SD1.4 runner launches the five configured methods on the five GPU IDs specified in the script:
cd TNC-Defense/TNC-Detox
bash run_detox_sd14.sh
To run a single method:
python detox_sd14.py \
--method pixel \
--device cuda:0 \
--seed 42
Configure METHOD and GPU_ID in run_detox_sdxl.sh, then run:
bash run_detox_sdxl.sh
The method-specific defaults, including the training steps, timestep sampling
ratios, loss weights, batch sizes, and checkpoint intervals, are defined in the
METHOD_PROFILES section of each training script. Command-line arguments can
override these defaults.
Generate images from one or more detoxified SD1.4 UNets:
python evaluate_sd14.py \
--detox-model checkpoints/sd14/<checkpoint> \
--prompt-file <prompt-file>
Compute FID between reference and detoxified image directories:
python compute_fid.py \
--reference-dir <reference-images> \
--candidate-dir <detoxified-images>
42 by default and enables deterministic cuDNN
behavior.The backdoored models and attack configurations used by this project originate from the following public resources:
Please cite the corresponding original papers when using these attacks or
checkpoints: BadT2I (badt2izhai2023), EvilEdit (evileditwang2024),
VillanDiffusion (villandiffusionchou2023), and PersonalBKD
(personalizationhuang2024).
If you find this project useful in your research, please cite:
@article{wang2026backdoor,
title={Backdoor sentinel: Detecting and detoxifying backdoors in diffusion models via temporal noise consistency},
author={Wang, Bingzheng and Gu, Xiaoyan and Xu, Hongbo and Li, Hongcheng and Yu, Zimo and Zhou, Jiang and Wang, Weiping},
journal={arXiv preprint arXiv:2602.01765},
year={2026}
}
This project is built with substantial reference to the excellent NaviT2I codebase. We sincerely thank the NaviT2I authors for releasing their implementation and supporting resources.
We also thank the authors of BadT2I, EvilEdit, VillanDiffusion, PersonalBKD, Hugging Face Diffusers, and the associated pretrained diffusion models for making their code and checkpoints publicly available. All third-party components remain subject to their respective licenses and terms of use.