{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,4]],"date-time":"2026-05-04T10:14:23Z","timestamp":1777889663541,"version":"3.51.4"},"reference-count":85,"publisher":"IEEE","license":[{"start":{"date-parts":[[2025,10,19]],"date-time":"2025-10-19T00:00:00Z","timestamp":1760832000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,10,19]],"date-time":"2025-10-19T00:00:00Z","timestamp":1760832000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100012166","name":"National Key R&D Program of China","doi-asserted-by":"publisher","award":["2022YFB2703301"],"award-info":[{"award-number":["2022YFB2703301"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["CNS-2424127"],"award-info":[{"award-number":["CNS-2424127"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,10,19]]},"DOI":"10.1109\/iccv51701.2025.01409","type":"proceedings-article","created":{"date-parts":[[2026,4,29]],"date-time":"2026-04-29T19:45:49Z","timestamp":1777491949000},"page":"15182-15193","source":"Crossref","is-referenced-by-count":0,"title":["Efficient Input-Level Backdoor Defense on Text-to-Image Synthesis via Neuron Activation Variation"],"prefix":"10.1109","author":[{"given":"Shengfang","family":"Zhai","sequence":"first","affiliation":[{"name":"School of Software and Microelectronics, National Engineering Research Center for Software Engineering, Peking University"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jiajun","family":"Li","sequence":"additional","affiliation":[{"name":"School of Software and Microelectronics, National Engineering Research Center for Software Engineering, Peking University"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yue","family":"Liu","sequence":"additional","affiliation":[{"name":"National University of Singapore"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Huanran","family":"Chen","sequence":"additional","affiliation":[{"name":"College of AI, Tsinghua University"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zhihua","family":"Tian","sequence":"additional","affiliation":[{"name":"Zhejiang University"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Wenjie","family":"Qu","sequence":"additional","affiliation":[{"name":"National University of Singapore"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Qingni","family":"Shen","sequence":"additional","affiliation":[{"name":"School of Software and Microelectronics, National Engineering Research Center for Software Engineering, Peking University"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ruoxi","family":"Jia","sequence":"additional","affiliation":[{"name":"Virginia Tech"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yinpeng","family":"Dong","sequence":"additional","affiliation":[{"name":"College of AI, Tsinghua University"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jiaheng","family":"Zhang","sequence":"additional","affiliation":[{"name":"National University of Singapore"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/wacv61041.2025.00590"},{"key":"ref2","first-page":"2255","article-title":"\\{T- Miner\\}: A generative approach to defend against trojan attacks on \\{DNN-based\\} text classification","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Azizi","year":"2021"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.02171"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-25056-9_26"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2021.04.105"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.52202\/079017-1584"},{"key":"ref7","first-page":"6643","article-title":"Robust classification via a single diffusion model","volume-title":"International Conference on Machine Learning","author":"Chen","year":"2024"},{"key":"ref8","article-title":"Towards the worst-case robustness of large language models","author":"Chen","year":"2025","journal-title":"arXiv preprint"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3485832.3485837"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-17140-6_22"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/SPW50608.2020.00025"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.52202\/075280-1471"},{"key":"ref13","article-title":"Civitai","volume-title":"Civitai","year":"2025"},{"key":"ref14","article-title":"CompVis","year":"2024","journal-title":"Stable-Diffusion-v1\u20134"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01617"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1016\/j.patrec.2005.10.010"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359790"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2021.3055844"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2909068"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v39i26.34941"},{"key":"ref21","article-title":"Scale-up: An efficient black-box inputlevel backdoor detection via analyzing scaled prediction consistency","volume-title":"The Eleventh International Conference on Learning Representations","author":"Guo"},{"key":"ref22","article-title":"Scale-up: An efficient black-box inputlevel backdoor detection via analyzing scaled prediction consistency","author":"Guo","year":"2023","journal-title":"arXiv preprint"},{"key":"ref23","article-title":"Diff-cleanse: Identifying and mitigating backdoor attacks in diffusion models","author":"Hao","year":"2024","journal-title":"arXiv preprint"},{"key":"ref24","first-page":"6840","article-title":"Denoising diffusion probabilistic models","volume":"33","author":"Ho","year":"2020","journal-title":"Advances in neural information processing systems"},{"key":"ref25","article-title":"On the effectiveness of mitigating data poisoning attacks with gradient shaping","author":"Hong","journal-title":"arXiv preprint"},{"key":"ref26","article-title":"Ibd-psc: Input-level backdoor detection via parameter-oriented scaling consistency","author":"Hou","year":"2024","journal-title":"arXiv preprint"},{"key":"ref27","article-title":"Ibd-psc: Input-level backdoor detection via parameter-oriented scaling consistency","volume-title":"Forty-first International Conference on Machine Learning","author":"Hou","year":"2024"},{"key":"ref28","article-title":"Lora: Low-rank adaptation of large language models","author":"Hu","year":"2021","journal-title":"arXiv preprint"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i19.30110"},{"key":"ref30","article-title":"Huggingface","volume-title":"The python code of fine-tuning stable-diffusion","year":"2024"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833644"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.52202\/068431-1926"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.emnlp-main.55"},{"key":"ref34","article-title":"DeepFloyd Lab","volume-title":"Deepfloyd if","year":"2023"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.241"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-10602-1_48"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"ref38","article-title":"Pseudo numerical methods for diffusion models on manifolds","author":"Liu","year":"2022","journal-title":"arXiv preprint"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01570"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833579"},{"key":"ref41","article-title":"Neuron activation coverage: Rethinking out-ofdistribution detection and generalization","volume-title":"The Twelfth International Conference on Learning Representations","author":"Liu","year":"2024"},{"key":"ref42","article-title":"Generating images from captions with attention","author":"Mansimov","year":"2015","journal-title":"arXiv preprint"},{"key":"ref43","article-title":"Terd: A unified framework for safeguarding diffusion models against backdoors","author":"Mo","year":"2024","journal-title":"arXiv preprint"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00387"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/3132747.3132785"},{"key":"ref46","article-title":"Sdxl: Improving latent diffusion models for high-resolution image synthesis","volume-title":"arXiv preprint","author":"Podell","year":"2023"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.752"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.374"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.37"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/3433210.3453108"},{"key":"ref51","first-page":"8821","article-title":"Zero-shot text-to-image generation","volume-title":"International conference on machine learning","author":"Ramesh","year":"2021"},{"issue":"2","key":"ref52","article-title":"Hierarchical text-conditional image generation with clip latents","volume":"1","author":"Ramesh","year":"2022","journal-title":"arXiv preprint"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-17143-7_41"},{"key":"ref54","first-page":"1060","article-title":"Generative adversarial text to image synthesis","volume-title":"International conference on machine learning","author":"Reed","year":"2016"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01042"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-24574-4_28"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.02155"},{"key":"ref58","article-title":"Runwayml","year":"2024","journal-title":"Stable-Diffusion-v1\u20135"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.52202\/068431-2643"},{"key":"ref60","article-title":"Denoising diffusion implicit models","author":"Song","journal-title":"arXiv preprint"},{"key":"ref61","article-title":"Stabilityai","year":"2025","journal-title":"Stable-Diffusion-v3\u20135"},{"key":"ref62","article-title":"Stabilityai","year":"2025","journal-title":"Stable-Diffusion-v2\u20131"},{"key":"ref63","article-title":"Rickrolling the artist: Injecting invisible backdoors into text-guided image generation models","author":"Struppek","year":"2022","journal-title":"arXiv preprint"},{"key":"ref64","author":"Truong","year":"2025","journal-title":"arXiv preprint"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1145\/3664647.3680689"},{"key":"ref67","article-title":"Lie detector: Unified backdoor detection via crossexamination framework","author":"Wang","year":"2025","journal-title":"arXiv preprint"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-73013-9_7"},{"key":"ref69","first-page":"16913","article-title":"Adversarial neuron pruning purifies backdoored deep models","volume":"34","author":"Wu","year":"2021","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref70","article-title":"Backdooring textual inversion for concept censorship","author":"Wu","year":"2023","journal-title":"arXiv preprint"},{"key":"ref71","first-page":"38013","article-title":"Umd: Unsupervised model detection for x 2 x backdoor attacks","volume-title":"International Conference on Machine Learning","author":"Xiang","year":"2023"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.findings-emnlp.369"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00143"},{"key":"ref74","article-title":"Uncovering safety risks in opensource 11 ms through concept activation vector","author":"Xu","year":"2024","journal-title":"arXiv preprint"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.659"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-acl.317"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1162\/tacl_a_00166"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE48619.2023.00107"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.emnlp-main.732"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1145\/3581783.3612108"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP49357.2023.10095007"},{"key":"ref82","article-title":"Text-to-image synthesis: A decade survey","volume-title":"arXiv preprint","author":"Zhang","year":"2024"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1145\/3618342"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-20065-6_11"},{"key":"ref85","article-title":"Investigating coverage criteria in large language models: An in-depth study through jailbreak attacks","author":"Zhou","year":"2024","journal-title":"arXiv preprint"}],"event":{"name":"2025 IEEE\/CVF International Conference on Computer Vision (ICCV)","location":"Honolulu, HI, USA","start":{"date-parts":[[2025,10,19]]},"end":{"date-parts":[[2025,10,25]]}},"container-title":["2025 IEEE\/CVF International Conference on Computer Vision (ICCV)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11443115\/11443287\/11445060.pdf?arnumber=11445060","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T05:15:45Z","timestamp":1777612545000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11445060\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,19]]},"references-count":85,"URL":"https:\/\/doi.org\/10.1109\/iccv51701.2025.01409","relation":{},"subject":[],"published":{"date-parts":[[2025,10,19]]}}}