List your company
ResearchFormerly WizWand

Backdoor Attack on CIFAR10

100Attack Success RateMarksman
10.35233.62656.980.174May 23, 2024Sep 22, 2024Jan 22, 2025May 25, 2025Sep 24, 2025Jan 24, 2026May 27, 2026
Updated 5mo ago

Evaluation results

MethodLinks
MarksmanBackbone=VGG2025.04100—90.780.01—
UBABackbone=VGG, Data Augmentation=without2025.04100—85.231.36—
CAABackbone=ResNet182026.03100—93.28——
InkDropCondensation Method=IDM, Condensation Backbone=ConvNet2026.03100———64.71
DoorpingCondensation Method=DAM, Condensation Backbone=ConvNet2026.03100———53.14
RelaxCondensation Method=DM, Condensation Backbone=ConvNet2026.03100———57.38
BadNetPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.0510092.07———
BadNetPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.0510091.96———
WaveAttackPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.0510089.11———
DSAPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.0510090.58———
CAABackbone=Pre-activation ResNet182026.0399.99—92.86——
CAABackbone=MobileNetV22026.0399.99—92.43——
WaveAttackPoisoning rate (ρ)=0.5%, Defense Protocol=No defense, Backbone=ResNet-182026.0599.9988.73———
DSAPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.0599.9991.27———
BlendedPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.0599.9891.09———
DSAPoisoning rate (ρ)=1%, Defense Protocol=FT-init, Backbone=ResNet-182026.0599.9891.54———
BadNetPoisoning rate (ρ)=0.5%, Defense Protocol=No defense, Backbone=ResNet-182026.0599.9791.27———
DSAPoisoning rate (ρ)=0.5%, Defense Protocol=FT-init, Backbone=ResNet-182026.0599.9790.17———
RelaxCondensation Method=DAM, Condensation Backbone=ConvNet2026.0399.96———55.92
CAABackbone=SENet2026.0399.94—93.16——
DSAPoisoning rate (ρ)=5%, Defense Protocol=FT-init, Backbone=ResNet-182026.0599.9187.7———
MarksmanBackbone=PreActResNet2025.0499.89—93.21.36—
SFIBABackbone=PreActResNet, Data Augmentation=without2025.0499.84—87.740.01—
WaveAttackPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.0599.8191.46———
SFIBABackbone=PreActResNet, Data Augmentation=with2025.0499.72—93.680.88—
InkDropCondensation Method=DM, Condensation Backbone=ConvNet2026.0399.67———62.17
INACTIVEPre-training Dataset=STL10, Trigger=Invisible (Ours)2024.0599.58—87.11——
SFIBABackbone=VGG, Data Augmentation=without2025.0499.58—86.450.14—
SFIBABackbone=VGG, Data Augmentation=with2025.0499.54—90.20.59—
InkDropCondensation Method=DAM, Condensation Backbone=ConvNet2026.0399.33———58.72
DoorpingCondensation Method=DM, Condensation Backbone=ConvNet2026.0398.76———62.11
WaNetReABackbone=ResNet182026.0398.43—91.75——
DRUPEPre-training Dataset=STL10, Trigger=Patch2024.0598.39—84.36——
BppAttackPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.0598.391.47———
WaNetReABackbone=Pre-activation ResNet182026.0398.17—91.3——
SSBAPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.0598.1191.18———
WaNetReABackbone=SENet2026.0397.95—91.3——
DSAPoisoning rate (ρ)=0.5%, Defense Protocol=No defense, Backbone=ResNet-182026.0597.7891.09———
BlendedPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.0597.3890.87———
WaNetReABackbone=MobileNetV22026.0396.37—90.65——
BppAttackReABackbone=ResNet182026.0396.23—90.85——
BppAttackReABackbone=SENet2026.0396.03—91.15——
Adapt-BlendPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.0595.4187.82———
LIRAPoisoning rate (ρ)=-, Defense Protocol=No defense, Backbone=ResNet-182026.0595.2388.17———
BppAttackReABackbone=Pre-activation ResNet182026.0395.03—90.59——
FTrojanReABackbone=ResNet182026.0394.91—91.32——
BppAttackReABackbone=MobileNetV22026.0394.67—89.97——
UBABackbone=PreActResNet, Data Augmentation=without2025.0494.45—86.751—
FTrojanReABackbone=SENet2026.0394.25—90.93——
FTrojanReABackbone=Pre-activation ResNet182026.0394.19—91.35——
CAABackbone=ResNet18, Attack Mode=All-to-all2026.0393.76—93.51——
Adapt-BlendPoisoning rate (ρ)=0.5%, Defense Protocol=No defense, Backbone=ResNet-182026.0593.5890.29———
Adapt-BlendPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.0592.7389.81———
BlendedPoisoning rate (ρ)=0.5%, Defense Protocol=No defense, Backbone=ResNet-182026.0591.9790.61———
FTrojanReABackbone=MobileNetV22026.0391.58—90.64——
DSAPoisoning rate (ρ)=5%, Defense Protocol=FST, Backbone=ResNet-182026.0587.887.97———
SSBAPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.0584.0891.2———
DSAPoisoning rate (ρ)=1%, Defense Protocol=FST, Backbone=ResNet-182026.0579.3787.08———
WaNetBackbone=ResNet182026.0377.58—84.72——
DSAPoisoning rate (ρ)=5%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.0575.0786.2———
IUPoison Rate (%)=0.622026.0272—87.9——
SimpleCondensation Method=DAM, Condensation Backbone=ConvNet2026.0367.36———53.73
DSAPoisoning rate (ρ)=1%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.0562.3991.94———
One-to-NBackbone=PreActResNet2025.0460.78—91.143.42—
DSAPoisoning rate (ρ)=0.5%, Defense Protocol=FST, Backbone=ResNet-182026.0560.1889.17———
SimpleCondensation Method=DM, Condensation Backbone=ConvNet2026.0358.96———58.37
DSAPoisoning rate (ρ)=0.5%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.0558.8789.03———
One-to-NBackbone=VGG2025.0458.42—88.172.62—
BlendedPoisoning rate (ρ)=5%, Defense Protocol=FT-init, Backbone=ResNet-182026.0558.0793.23———
BlendedPoisoning rate (ρ)=1%, Defense Protocol=FT-init, Backbone=ResNet-182026.0557.3592.97———
RelaxCondensation Method=IDM, Condensation Backbone=ConvNet2026.0352.16———65.31
BlendedPoisoning rate (ρ)=0.5%, Defense Protocol=FT-init, Backbone=ResNet-182026.0551.5891.38———
WaNetBackbone=Pre-activation ResNet182026.0351.25—86.3——
NarcissusReABase Attack=Narcissus, Reactivation=true2026.0350.26—94.82——
SSBAPoisoning rate (ρ)=0.5%, Defense Protocol=No defense, Backbone=ResNet-182026.0548.3291.08———
SAAReABase Attack=Sleeper Agent Attack, Reactivation=true2026.0345.24—94.29——
BppAttackBackbone=ResNet182026.0344.17—88.03——
SSBAPoisoning rate (ρ)=5%, Defense Protocol=FT-init, Backbone=ResNet-182026.0538.4292.27———
IUPoison Rate (%)=0.392026.0235.8—87.9——
Adapt-BlendPoisoning rate (ρ)=5%, Defense Protocol=FT-init, Backbone=ResNet-182026.0532.1789.72———
WaNetBackbone=ResNet18, Attack Mode=All-to-all2026.0329.21—91.13——
BppAttackBackbone=ResNet18, Attack Mode=All-to-all2026.0328.58—90.32——
WaNetBackbone=SENet2026.0328.05—89.23——
BadNetPoisoning rate (ρ)=0.5%, Defense Protocol=FT-init, Backbone=ResNet-182026.0525.9293.37———
WaveAttackPoisoning rate (ρ)=5%, Defense Protocol=FT-init, Backbone=ResNet-182026.0524.7183.77———
IUPoison Rate (%)=0.162026.0223.3—87——
Adapt-BlendPoisoning rate (ρ)=1%, Defense Protocol=FT-init, Backbone=ResNet-182026.0521.8490.18———
WaveAttackPoisoning rate (ρ)=0.5%, Defense Protocol=FT-init, Backbone=ResNet-182026.0520.5178.41———
SSBAPoisoning rate (ρ)=1%, Defense Protocol=FT-init, Backbone=ResNet-182026.0518.7491.03———
BadEncoderPre-training Dataset=STL10, Trigger=Ins-Kelvin2024.0518.63—86.75——
NarcissusBase Attack=Narcissus, Reactivation=false2026.0317.27—94.23——
BadEncoderPre-training Dataset=STL10, Trigger=Ins-Xpro22024.0516.83—86.85——
WaNetBackbone=MobileNetV22026.0316.74—90.35——
DoorpingCondensation Method=IDM, Condensation Backbone=ConvNet2026.0316.48———65.39
BppAttackBackbone=Pre-activation ResNet182026.0316.17—90.61——
WaveAttackPoisoning rate (ρ)=1%, Defense Protocol=FT-init, Backbone=ResNet-182026.0516.1781.3———
BppAttackBackbone=SENet2026.0316.14—90.67——
Adapt-BlendPoisoning rate (ρ)=0.5%, Defense Protocol=FT-init, Backbone=ResNet-182026.0515.4290.61———
SimpleCondensation Method=IDM, Condensation Backbone=ConvNet2026.0314.24———65.19
WaveAttackPoisoning rate (ρ)=5%, Defense Protocol=FST, Backbone=ResNet-182026.0513.874.12———