---
tags:
- computer-vision
- diffusion
- sdxl
- clip
- backdoor-detection
- research
base_model:
- stabilityai/stable-diffusion-xl-base-1.0
- openai/clip-vit-base-patch32
---

# DEFUSE checkpoints

Official checkpoints for **DEFUSE: Generalizable Backdoor Defense for Self-Supervised Encoders with Generative Priors** (ACM Multimedia 2026, [paper](https://doi.org/10.1145/3767308.3835471)).

These are custom PyTorch checkpoints used by the DEFUSE codebase; they are not a standalone Diffusers pipeline.

## Files

| Path | Description | Size | SHA-256 |
|---|---|---:|---|
| `clip-backdoor/epoch.best.pt` | CLIP ViT-B/32 backdoored encoder checkpoint used by the final experiment (`state_dict`, epoch 6) | 1,815,827,343 bytes | `0820c39e771499158c67084681955407ae8ab931c03cc0f520c8b670daf3a14e` |
| `sdxl-defuse/final.pt` | Final DEFUSE SDXL conditioning weights at step 30,000; this is not the full SDXL base model | 1,790,009,754 bytes | `172b1b5bb20488dea04c33a7216c51c9fa0050fbc8bfe007f19759357e4ee17b` |
| `training/config.resolved.yaml` | Fully resolved configuration for the final experiment | - | - |
| `training/run.json` | Runtime and environment metadata | - | - |

The final experiment was `in900-best-encoder-no-grad-clip-30k-20260818`, trained on ImageNet-900 for 30,000 optimizer steps. The SDXL checkpoint metadata is:

```text
model_type: sdxl
image_tokens: 4
feature_dim: 512
feature_mode: global
cross_attention_dim: 2048
include_text_tokens: false
conditioning_version: 2
```

## Use with DEFUSE

Download the repository, then point the DEFUSE configuration to:

```yaml
encoder:
  model: openai/clip-vit-base-patch32
  checkpoint: /path/to/clip-backdoor/epoch.best.pt

reconstruction:
  checkpoint: /path/to/sdxl-defuse/final.pt
```

You must also provide the SDXL base model configured by the DEFUSE project. See the project README and training configuration for the complete environment and data settings.

## Responsible use and licenses

The CLIP checkpoint is intentionally backdoored and is released only for defensive security research and reproducibility. Do not deploy it as a trusted production encoder.

The checkpoints derive from third-party base models and training code. Users are responsible for complying with the applicable upstream licenses and terms, including those of SDXL, OpenAI CLIP, and the source backdoor-training implementation.