| --- |
| tags: |
| - computer-vision |
| - diffusion |
| - sdxl |
| - clip |
| - backdoor-detection |
| - research |
| base_model: |
| - stabilityai/stable-diffusion-xl-base-1.0 |
| - openai/clip-vit-base-patch32 |
| --- |
| |
| # DEFUSE checkpoints |
|
|
| Official checkpoints for **DEFUSE: Generalizable Backdoor Defense for Self-Supervised Encoders with Generative Priors** (ACM Multimedia 2026, [paper](https://doi.org/10.1145/3767308.3835471)). |
|
|
| These are custom PyTorch checkpoints used by the DEFUSE codebase; they are not a standalone Diffusers pipeline. |
|
|
| ## Files |
|
|
| | Path | Description | Size | SHA-256 | |
| |---|---|---:|---| |
| | `clip-backdoor/epoch.best.pt` | CLIP ViT-B/32 backdoored encoder checkpoint used by the final experiment (`state_dict`, epoch 6) | 1,815,827,343 bytes | `0820c39e771499158c67084681955407ae8ab931c03cc0f520c8b670daf3a14e` | |
| | `sdxl-defuse/final.pt` | Final DEFUSE SDXL conditioning weights at step 30,000; this is not the full SDXL base model | 1,790,009,754 bytes | `172b1b5bb20488dea04c33a7216c51c9fa0050fbc8bfe007f19759357e4ee17b` | |
| | `training/config.resolved.yaml` | Fully resolved configuration for the final experiment | - | - | |
| | `training/run.json` | Runtime and environment metadata | - | - | |
|
|
| The final experiment was `in900-best-encoder-no-grad-clip-30k-20260818`, trained on ImageNet-900 for 30,000 optimizer steps. The SDXL checkpoint metadata is: |
|
|
| ```text |
| model_type: sdxl |
| image_tokens: 4 |
| feature_dim: 512 |
| feature_mode: global |
| cross_attention_dim: 2048 |
| include_text_tokens: false |
| conditioning_version: 2 |
| ``` |
|
|
| ## Use with DEFUSE |
|
|
| Download the repository, then point the DEFUSE configuration to: |
|
|
| ```yaml |
| encoder: |
| model: openai/clip-vit-base-patch32 |
| checkpoint: /path/to/clip-backdoor/epoch.best.pt |
| |
| reconstruction: |
| checkpoint: /path/to/sdxl-defuse/final.pt |
| ``` |
|
|
| You must also provide the SDXL base model configured by the DEFUSE project. See the project README and training configuration for the complete environment and data settings. |
|
|
| ## Responsible use and licenses |
|
|
| The CLIP checkpoint is intentionally backdoored and is released only for defensive security research and reproducibility. Do not deploy it as a trusted production encoder. |
|
|
| The checkpoints derive from third-party base models and training code. Users are responsible for complying with the applicable upstream licenses and terms, including those of SDXL, OpenAI CLIP, and the source backdoor-training implementation. |
|
|
