Demand response (DR) is a crucial component of power systems that can offer operating reserves by utilizing flexible loads on the demand side. With the development of communication, information, and control technologies, DR has formed a cyber-physical system. While deep cyber-physical coupling improves the performance of DR, it also introduces cyber-security threats, i.e., deception cyber-attacks (DCAs), which can lead to DR out-of-control and thus threaten the power system's safe operation. To this end, this paper proposes a secure distributed control to safeguard DR against DCAs. First, a cyber-physical DR community is developed based on a distributed control framework for offering operating reserve to power systems. In addition, considering different patterns, the impacts of DCAs on DR are quantified, revealing that different attack patterns can lead to various adverse consequences on DR, such as power deviation, delayed response, power fluctuation, etc. Furthermore, an anti-attack secure distributed control is developed for DR to counteract against arbitrary DCAs. In addition, rigorous proof based on Lyapunov theorem demonstrates that the proposed control can ensure the stability and convergence for the DR power regulation required by power systems, despite arbitrary DCAs. Finally, case studies validate the efficacy of the proposed control method.