Backdoor Attack Detection and Mitigation on CIFAR-10
0Attack Success RateNo Defense
Evaluation results
| Method | Links | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| No DefenseArchitecture=PreActResNet18, Attack=FTROJAN2026.02 | 0 | — | — | — | — | 93.56 | — | — | — | — | — | — | |
| No DefenseArchitecture=PreActResNet34, Attack=BLIND2026.02 | 0.03 | — | — | — | — | 89.43 | — | — | — | — | — | — | |
| No DefenseArchitecture=PreActResNet34, Attack=FTROJAN2026.02 | 0.06 | — | — | — | — | 93.63 | — | — | — | — | — | — | |
| No DefenseArchitecture=PreActResNet18, Attack=BLENDED2026.02 | 0.18 | — | — | — | — | 93.57 | — | — | — | — | — | — | |
| No DefenseArchitecture=PreActResNet34, Attack=BLENDED2026.02 | 0.21 | — | — | — | — | 94.02 | — | — | — | — | — | — | |
| No DefenseArchitecture=PreActResNet34, Attack=BPP2026.02 | 0.28 | — | — | — | — | 92.23 | — | — | — | — | — | — | |
| No DefenseArchitecture=PreActResNet18, Attack=BPP2026.02 | 0.39 | — | — | — | — | 91.07 | — | — | — | — | — | — | |
| No DefenseArchitecture=PreActResNet18, Attack=BLIND2026.02 | 0.4 | — | — | — | — | 80.2 | — | — | — | — | — | — | |
| No DefenseArchitecture=PreActResNet18, Attack=INPUTAWARE2026.02 | 2.54 | — | — | — | — | 91.29 | — | — | — | — | — | — | |
| No DefenseArchitecture=PreActResNet34, Attack=INPUTAWARE2026.02 | 3.71 | — | — | — | — | 91.61 | — | — | — | — | — | — | |
| No DefenseArchitecture=PreActResNet18, Attack=WANET2026.02 | 3.9 | — | — | — | — | 91.24 | — | — | — | — | — | — | |
| No DefenseArchitecture=PreActResNet34, Attack=BADNETS2026.02 | 4.31 | — | — | — | — | 92.46 | — | — | — | — | — | — | |
| No DefenseArchitecture=PreActResNet18, Attack=BADNETS2026.02 | 5.27 | — | — | — | — | 91.86 | — | — | — | — | — | — | |
| Oracle RetrainMalicious client percentage=10%, Poison ratio=50%, Target class=7, Federated rounds=20, Time (s)=1867.89, Speedup=1×2026.05 | 9.64 | — | — | — | — | 72.58 | — | — | — | — | 88.6 | 0.07 | |
| No DefenseArchitecture=PreActResNet34, Attack=WANET2026.02 | 9.74 | — | — | — | — | 90.17 | — | — | — | — | — | — | |
| ShrinkPadArchitecture=PreActResNet18, Attack=BLIND2026.02 | 26.94 | — | — | — | — | — | — | — | 2.9 | — | — | — | |
| ShrinkPadArchitecture=PreActResNet18, Attack=BLENDED2026.02 | 33.82 | — | — | — | — | — | — | — | 2.8 | — | — | — | |
| ShrinkPadArchitecture=PreActResNet34, Attack=BLENDED2026.02 | 37.56 | — | — | — | — | — | — | — | 5.3 | — | — | — | |
| ShrinkPadArchitecture=PreActResNet34, Attack=BLIND2026.02 | 48.64 | — | — | — | — | — | — | — | 5 | — | — | — | |
| ShrinkPadArchitecture=PreActResNet34, Attack=WANET2026.02 | 49.66 | — | — | — | — | — | — | — | 4.9 | — | — | — | |
| ShrinkPadArchitecture=PreActResNet34, Attack=INPUTAWARE2026.02 | 59.36 | — | — | — | — | — | — | — | 5 | — | — | — | |
| ShrinkPadArchitecture=PreActResNet18, Attack=INPUTAWARE2026.02 | 62.41 | — | — | — | — | — | — | — | 3 | — | — | — | |
| ShrinkPadArchitecture=PreActResNet34, Attack=BADNETS2026.02 | 64.2 | — | — | — | — | — | — | — | 5 | — | — | — | |
| ShrinkPadArchitecture=PreActResNet34, Attack=BPP2026.02 | 65.51 | — | — | — | — | — | — | — | 5.2 | — | — | — | |
| ShrinkPadArchitecture=PreActResNet18, Attack=WANET2026.02 | 65.63 | — | — | — | — | — | — | — | 2.9 | — | — | — | |
| ShrinkPadArchitecture=PreActResNet18, Attack=BADNETS2026.02 | 67.43 | — | — | — | — | — | — | — | 3 | — | — | — | |
| HF-KCUMalicious client percentage=10%, Poison ratio=50%, Target class=7, Federated rounds=20, Time (s)=4.34, Speedup=430×2026.05 | 71.37 | — | — | — | — | 72.61 | — | — | — | — | 15.4 | 0.04 | |
| ShrinkPadArchitecture=PreActResNet18, Attack=BPP2026.02 | 75.86 | — | — | — | — | — | — | — | 3.1 | — | — | — | |
| ShrinkPadArchitecture=PreActResNet34, Attack=FTROJAN2026.02 | 78.13 | — | — | — | — | — | — | — | 5 | — | — | — | |
| ShrinkPadArchitecture=PreActResNet18, Attack=FTROJAN2026.02 | 78.89 | — | — | — | — | — | — | — | 2.7 | — | — | — | |
| Poisoned ModelMalicious client percentage=10%, Poison ratio=50%, Target class=7, Federated rounds=202026.05 | 84.35 | — | — | — | — | 72.65 | — | — | — | — | — | — | |
| BANAttack=LC2024.05 | 100 | 92.72 | 90 | 89.27 | 6.16 | — | — | — | — | — | — | — | |
| FIREArchitecture=PreActResNet18, Attack=BADNETS2026.02 | — | — | — | — | — | — | 22.56 | 86.22 | 14 | 223.7 | — | — | |
| FIREArchitecture=PreActResNet18, Attack=BLENDED2026.02 | — | — | — | — | — | — | 25.44 | 64 | 12.1 | 222 | — | — | |
| FIREArchitecture=PreActResNet18, Attack=BLIND2026.02 | — | — | — | — | — | — | 3.78 | 69.78 | 15.2 | 228.5 | — | — | |
| FIREArchitecture=PreActResNet18, Attack=BPP2026.02 | — | — | — | — | — | — | 29.44 | 78.22 | 11.8 | 213.6 | — | — | |
| FIREArchitecture=PreActResNet18, Attack=FTROJAN2026.02 | — | — | — | — | — | — | 29.44 | 67.67 | 12 | 220.4 | — | — | |
| FIREArchitecture=PreActResNet18, Attack=INPUTAWARE2026.02 | — | — | — | — | — | — | 24.56 | 72.11 | 12.1 | 214.4 | — | — | |
| FIREArchitecture=PreActResNet18, Attack=WANET2026.02 | — | — | — | — | — | — | 17.56 | 71.44 | 16.8 | 219.2 | — | — | |
| FIREArchitecture=PreActResNet34, Attack=BADNETS2026.02 | — | — | — | — | — | — | 26.78 | 88.67 | 22.1 | 208.5 | — | — | |
| FIREArchitecture=PreActResNet34, Attack=BLENDED2026.02 | — | — | — | — | — | — | 26.89 | 61.78 | 20.4 | 205.5 | — | — | |
| FIREArchitecture=PreActResNet34, Attack=BLIND2026.02 | — | — | — | — | — | — | 19.78 | 78.44 | 24.2 | 212.1 | — | — | |
| FIREArchitecture=PreActResNet34, Attack=BPP2026.02 | — | — | — | — | — | — | 25.44 | 71.11 | 21.8 | 209.4 | — | — | |
| FIREArchitecture=PreActResNet34, Attack=FTROJAN2026.02 | — | — | — | — | — | — | 29.11 | 82.89 | 21.1 | 210.8 | — | — | |
| FIREArchitecture=PreActResNet34, Attack=INPUTAWARE2026.02 | — | — | — | — | — | — | 21.11 | 71.33 | 23.2 | 221.1 | — | — | |
| FIREArchitecture=PreActResNet34, Attack=WANET2026.02 | — | — | — | — | — | — | 13.33 | 50.78 | 26.2 | 209.5 | — | — |