DISPEL: Diffusion Interpretability and Selective Patching to Eliminate Latent Backdoors

Diffusion models have become the standard for text-to-image generation and are widely deployed in creative and commercial tools. Recent work has shown that they are vulnerable to backdoor attacks, where an adversary implants a hidden behaviour that activates on a chosen trigger while the model continues to behave normally on all other inputs. The community has approached this problem from two directions: preventing the backdoor by sanitizing training data, and removing it afterwards by fine-tuning or erasing a named concept. Both treat the model as a black box, and neither tells us where the backdoor resides inside it. In this work, we present the first study of backdoor attacks in diffusion models through the lens of interpretability. By contrasting the activations of a backdoored model against those of its clean counterpart, we find that the backdoor is concentrated: it lives in a small number of layers and, within those layers, in a small number of activation channels. Motivated by this finding, we propose DISPEL , an activation patching defense that steers the model at inference time by adding a correction at the localized channels, suppressing the backdoor without retraining and without knowing the trigger. We evaluate across three diffusion models and three backdoor attacks, spanning poisoned data, distillation, and a training-free weight edit. The block the scan returns is the same in all nine combinations, but neither the channels nor any single repair transfers: DISPEL removes the two trained backdoors, while the weight-edited one is undone instead by restoring the projection matrices that the same localization identifies. What generalizes is the procedure that finds the backdoor, not the parameters it returns.