DEFUSE checkpoints

Official checkpoints for DEFUSE: Generalizable Backdoor Defense for Self-Supervised Encoders with Generative Priors (ACM Multimedia 2026, paper).

These are custom PyTorch checkpoints used by the DEFUSE codebase; they are not a standalone Diffusers pipeline.

Files

Path	Description	Size	SHA-256
clip-backdoor/epoch.best.pt	CLIP ViT-B/32 backdoored encoder checkpoint used by the final experiment (state_dict, epoch 6)	1,815,827,343 bytes	0820c39e771499158c67084681955407ae8ab931c03cc0f520c8b670daf3a14e
sdxl-defuse/final.pt	Final DEFUSE SDXL conditioning weights at step 30,000; this is not the full SDXL base model	1,790,009,754 bytes	172b1b5bb20488dea04c33a7216c51c9fa0050fbc8bfe007f19759357e4ee17b
training/config.resolved.yaml	Fully resolved configuration for the final experiment	-	-
training/run.json	Runtime and environment metadata	-	-

The final experiment was in900-best-encoder-no-grad-clip-30k-20260818, trained on ImageNet-900 for 30,000 optimizer steps. The SDXL checkpoint metadata is:

model_type: sdxl
image_tokens: 4
feature_dim: 512
feature_mode: global
cross_attention_dim: 2048
include_text_tokens: false
conditioning_version: 2

Use with DEFUSE

Download the repository, then point the DEFUSE configuration to:

encoder:
  model: openai/clip-vit-base-patch32
  checkpoint: /path/to/clip-backdoor/epoch.best.pt

reconstruction:
  checkpoint: /path/to/sdxl-defuse/final.pt

You must also provide the SDXL base model configured by the DEFUSE project. See the project README and training configuration for the complete environment and data settings.

Responsible use and licenses

The CLIP checkpoint is intentionally backdoored and is released only for defensive security research and reproducibility. Do not deploy it as a trusted production encoder.

The checkpoints derive from third-party base models and training code. Users are responsible for complying with the applicable upstream licenses and terms, including those of SDXL, OpenAI CLIP, and the source backdoor-training implementation.