PaperlayerView exact revision on arXiv

Source-linked AI summary

SemPurify: Semantics-Aware Data Purification for Black-box Backdoor Defense

Jiawei Yu, Syed Irfan Ali Meerza, Yi Wu, Amir Sadovnik, Jian Liu

arXiv:2610.23589v1cs.CV

TL;DR

Backdoor purification can disrupt triggers but may alter visual details or semantics, and black-box defenses cannot rely on clean samples or model access. SemPurify guides text-to-image restoration with semantic embeddings and image tags; experiments report mitigation and semantic preservation across classification, CLIP-style, and generative settings.

  • Problem

    Existing purification can alter visual details or semantic information, while the paper asks how to remove triggers and preserve semantics without clean samples or prior model knowledge.

    Source: §1 · p. 1

  • Method

    SemPurify extracts semantic embeddings and image tags and uses them to guide a text-to-image model restoring transformed samples in a black-box setting.

    Source: §1 · pp. 1–2

  • Results

    Experiments report effective backdoor mitigation with semantic preservation across classification models, CLIP-style encoders, and generative models.

    Source: §1 · p. 2, §5.2.1 · p. 6, §5.2.2 · p. 7

  • Takeaways & Limitations

    The reported results support multi-level semantic guidance as an approach to black-box purification that seeks to suppress backdoor behavior while retaining semantic information.

    Source: §1 · p. 2, §6 · p. 8

    The threat model assumes access to an independently pretrained, trusted image-tagging model that is not compromised by the backdoor.

    Source: §3.1 · p. 3

Abstract

from arXiv · show

Backdoor attacks have emerged as a critical security threat in machine learning, where adversaries embed triggers within poisoned training samples to manipulate a model's predictions on targeted inputs while leaving its general behavior unaffected. This stealthy nature makes backdoor attacks difficult to detect, as the model functions normally until activated by a specific malicious trigger. Current purification-based defenses use image transformations (e.g., blurring) to disrupt trigger patterns but often degrade image quality. Even with advanced restoration techniques like diffusion models, these approaches can still alter visual or semantic information, reducing utility for downstream tasks. To address this, we propose the first semantics-aware data purification framework for black-box backdoor defense, SemPurify, which explicitly incorporates multi-level semantics (i.e., low-level semantic embeddings and high-level image tags) within a text-to-image (T2I) framework to guide image restoration during purification. Using this semantic information, the T2I model subsequently refines the transformed samples, helping preserve visual details and semantic information during restoration. Extensive experiments spanning multiple backdoor scenarios, i.e., classification models, CLIP-style encoders, and generative models, demonstrate that SemPurify reliably removes backdoors while effectively preserving semantic information for downstream tasks.

1. Introduction

The paper asks whether black-box purification can remove backdoor triggers while preserving semantics without clean samples or model knowledge. SemPurify uses image tags and semantic embeddings to guide restoration, with experiments spanning classification, CLIP-style, and generative models.

Motivation

  • Existing purification methods can alter visual details or semantic information, while some provide limited protection against sophisticated attacks.Other defenses may require clean samples or model access, and removing poisoned samples can discard critical training data.Source: §1 · p. 1

Research question

  • The central question is whether triggers can be eliminated while preserving semantics in a fully black-box setting without clean samples or prior model knowledge.SemPurify is designed to operate without model parameters, training data, or knowledge of whether individual samples are clean or poisoned.Source: §1 · p. 1

Approach

  • SemPurify extracts low-level semantic embeddings and high-level image tags with RAM, then uses both to guide a pre-trained text-to-image model during restoration.Linear transformations such as blurring disrupt triggers but can also damage semantic content; semantic guidance is used to preserve that information while suppressing backdoor effects.Source: §1 · pp. 1–2

Contributions

  • SemPurify is evaluated across classification models, CLIP-style encoders, and image-to-image generative models, with experiments reporting backdoor mitigation and semantic preservation in all three settings.The framework is presented as the first semantics-aware black-box purification approach to incorporate multi-level semantic information into restoration.Source: §1 · p. 2

2. Related Work

Prior backdoor defenses include detection and purification, but they may discard useful samples, depend on unavailable data or model access, or change image content. SemPurify distinguishes itself by explicitly using multi-level semantics to guide restoration during purification.

Detection-based defenses

  • Detection-based defenses do not remove triggers from poisoned inputs, limiting later use when downstream models require those samples.Simply removing poisoned samples can also lose critical training data.Source: §2 · p. 2

Purification approaches

  • Several purification approaches have specific constraints: transformation methods can alter visual or semantic content, U-Net purification relies on an identically distributed benign dataset, and masking struggles with distributed patterns.The cited examples include Li et al. [24], Chen et al. [3], and May et al. and Sun et al. [44].Source: §2 · p. 2

Inference-time methods

  • Inference-time methods also trade off restoration quality, semantics, overhead, or black-box applicability across ZIP, DataElixir, SampDetox, and BDFirewall [19].ZIP can alter fine details; DataElixir can alter visual and semantic information and adds detection overhead; SampDetox's stronger second-stage perturbation can alter semantics; BDFirewall relies on a clean calibration subset.Source: §2 · p. 2

SemPurify

  • SemPurify explicitly extracts and uses multi-level semantics to guide restoration, with the stated aim of preserving semantic information while mitigating backdoor effects.Source: §2 · p. 2

3. Threat Model and Multi-level Semantics

The threat model is a black-box defender facing unknown clean or poisoned inputs, while multi-level semantics combine detailed embeddings with image tags. The paper argues these signals complement one another during restoration and can remain largely stable across evaluated attacks.

3.1. Threat Model

  • For classification and CLIP-style encoders, an attacker seeks a targeted label from a triggered input, while a generative backdoor seeks attacker-directed patterns in the output.The threat model describes poisoned test samples as inputs formed by adding a trigger to the original sample.Source: §3.1 · p. 3
  • The defender has no model parameters, training data, attack-setting knowledge, or indication whether an inference sample is clean or poisoned, but assumes a trusted independently pretrained image-tagging model.SemPurify is intended to purify both clean and potentially poisoned samples, with objectives of trigger removal and semantic preservation for downstream tasks.Source: §3.1 · p. 3

3.2. Multi-level Semantics Analysis

  • Figure 1 illustrates a “church”-to-“dog” BadNet example in which two introduced tags remain related to the original image and neither names the target label.Source: Figure 1 · p. 3
  • Semantic embeddings retain fine-grained visual information, whereas image tags describe prominent objects and scenes; the two provide complementary restoration guidance.The extracted semantics are reported as largely stable across evaluated attacks, and the BadNet example's tags do not include the target label “dog.”Source: §3.2 · p. 3

4. Methodology

SemPurify extracts semantics from a potentially poisoned sample, transforms the sample, and restores it with a conditional text-to-image diffusion model. Structural information and two levels of semantics condition restoration so the output can recover lost content while retaining the transformed structure.

4.1. Overview of SemPurify

  • The three-stage pipeline takes a potentially poisoned sample and produces a purified sample through semantic extraction, linear transformation, and semantic restoration.The stages are designed to address backdoor threats while preserving essential content.Source: §4.1 · p. 3, Figure 2 · p. 4

4.2. Multi-level Semantic Extraction

  • RAM extracts semantic embeddings with its image encoder and produces image tags from those embeddings with its tagging head.The passage describes RAM's Swin Transformer encoder and two-layer transformer tagging head; its tag queries derive from frequent labels and a pretrained CLIP encoder.Source: §4.2 · pp. 3–4

4.3. Semantic Data Restoration

  • The T2I diffusion model restores information lost when x+ is formed by applying a linear transformation to the potentially poisoned input, while maintaining the transformed structure.The restoration model is trained with a noise-prediction objective conditioned on x+, Se, and St; the pretrained VAE, text encoder, and original U-Net parameters remain frozen while conditioning modules are optimized.Source: §4.3 · p. 4
  • The transformed image x+ provides structural guidance, while image tags St and embeddings Se provide high-level and feature-level semantic guidance during denoising.ControlNet receives the image-conditioning features, tags enter through text cross-attention, and embeddings enter through representation cross-attention modules.Source: §4.3 · p. 4
  • Reverse diffusion denoises the latent using x+, Se, and St, then decodes the resulting z0 into the purified image x0.At each step, D uses the conditioned denoising network and the noise schedule to produce the preceding latent state.Source: §4.3 · pp. 4–5

5. Experiments

Across classification, CLIP-style, and generative backdoor settings, SemPurify generally balances trigger suppression with preservation of task-relevant information. Ablations show complementary roles for semantic embeddings and image tags, and its measured inference time is sub-second per image.

5.1. Experimental Setup

  • Evaluation covers classification, CLIP-style, and generative models, comparing SemPurify with representative purification baselines under a black-box setup without model internals or task-specific clean datasets.Classification experiments use ResNet-34 on CIFAR-10, GTSRB, and Imagenette; generative evaluation uses EDSR for super-resolution.Source: §5.1 · p. 5

5.2.1. Performance Against Classification Backdoors

  • Across CIFAR-10, GTSRB, and Imagenette, SemPurify achieves the highest average PA (85.00%, 85.76%, 82.57%) and low average ASR (1.19%, 2.35%, 3.18%).It also preserves the highest average PA across these datasets while maintaining low ASR under Semantic Blended attacks, where triggers contain semantic content.Source: §5.2.1 · p. 6, Table 1 · p. 6
  • Classification fidelity results show a trade-off: BDMAE often scores highest on PSNR and SSIM, yet its average ASR reaches 40.32%, 26.23%, and 35.66% across the three datasets.SemPurify reduces corresponding average ASR to 1.19%, 2.35%, and 3.18%, while maintaining the highest average PA; under PhysicalBA it also records LPIPS 0.05 versus BDMAE's 0.08.Source: Table 2 · p. 6, §5.2.1 · p. 7

5.2.2. Performance Against CLIP Backdoors

  • On Caltech101 and OxfordPets, SemPurify achieves the lowest ASR and highest PA among evaluated BadCLIP defenses while maintaining competitive CA.The respective ASR/PA pairs are 0.20%/91.30% and 3.20%/93.30%.Source: §5.2.2 · p. 7, Table 3 · p. 7

5.2.3. Performance Against Generative Backdoors

  • For generative backdoors, SemPurify attains the highest CS and lowest PS, reducing PS from 0.86 without defense to 0.20 while maintaining CS of 0.78.BDMAE and DataElixir reduce PS to 0.24 and 0.21, respectively, but their CS falls to 0.54 and 0.61.Source: §5.2.3 · p. 8, Table 4 · p. 8

5.3. Impact of Semantic Embeddings and Tags

  • Under Semantic Blended, adding image tags to embeddings raises PA from 72.58% to 77.65% and lowers ASR from 6.96% to 6.11%.The ablation describes embeddings as feature-level guidance and tags as higher-level descriptions, with complementary roles in restoration.Source: §5.3 · p. 8, Table 5 · p. 8

5.4. Inference Efficiency

  • On 50 Imagenette images at 256 × 256 resolution, SemPurify processes each image in 0.5101 seconds, faster than ZIP, DataElixir, and SampDetox, but uses 5764.6 MB peak GPU memory.ShrinkPad and BDMAE are more lightweight.Source: §5.4 · p. 8, Table 6 · p. 8

6. Conclusion

SemPurify combines semantic embeddings and tag-level prompts with a text-to-image model to remove backdoor triggers while preserving semantic information, with experiments showing effectiveness across three model families.

6. Conclusion

  • SemPurify combines semantic embeddings and tag-level prompts in a text-to-image model, suppressing backdoor behavior while maintaining high PA across classification, CLIP-style, and generative models.The experiments also report preserved semantic information across diverse attacks and datasets.Source: §6 · p. 8

Related papers

Loading 2610.23589v1…