Backdoor Attack on CIFAR10
100Attack Success RateMarksman
Evaluation Results
| Method | Links | |||||
|---|---|---|---|---|---|---|
| MarksmanBackbone=VGG2025.04 | 100 | — | 90.78 | 0.01 | — | |
| UBABackbone=VGG, Data Augmentation=without2025.04 | 100 | — | 85.23 | 1.36 | — | |
| CAABackbone=ResNet182026.03 | 100 | — | 93.28 | — | — | |
| InkDropCondensation Method=IDM, Condensation Backbone=ConvNet2026.03 | 100 | — | — | — | 64.71 | |
| DoorpingCondensation Method=DAM, Condensation Backbone=ConvNet2026.03 | 100 | — | — | — | 53.14 | |
| RelaxCondensation Method=DM, Condensation Backbone=ConvNet2026.03 | 100 | — | — | — | 57.38 | |
| BadNetPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 100 | 92.07 | — | — | — | |
| BadNetPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 100 | 91.96 | — | — | — | |
| WaveAttackPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 100 | 89.11 | — | — | — | |
| DSAPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 100 | 90.58 | — | — | — | |
| CAABackbone=Pre-activation ResNet182026.03 | 99.99 | — | 92.86 | — | — | |
| CAABackbone=MobileNetV22026.03 | 99.99 | — | 92.43 | — | — | |
| WaveAttackPoisoning rate (ρ)=0.5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 99.99 | 88.73 | — | — | — | |
| DSAPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 99.99 | 91.27 | — | — | — | |
| BlendedPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 99.98 | 91.09 | — | — | — | |
| DSAPoisoning rate (ρ)=1%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 99.98 | 91.54 | — | — | — | |
| BadNetPoisoning rate (ρ)=0.5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 99.97 | 91.27 | — | — | — | |
| DSAPoisoning rate (ρ)=0.5%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 99.97 | 90.17 | — | — | — | |
| RelaxCondensation Method=DAM, Condensation Backbone=ConvNet2026.03 | 99.96 | — | — | — | 55.92 | |
| CAABackbone=SENet2026.03 | 99.94 | — | 93.16 | — | — | |
| DSAPoisoning rate (ρ)=5%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 99.91 | 87.7 | — | — | — | |
| MarksmanBackbone=PreActResNet2025.04 | 99.89 | — | 93.2 | 1.36 | — | |
| SFIBABackbone=PreActResNet, Data Augmentation=without2025.04 | 99.84 | — | 87.74 | 0.01 | — | |
| WaveAttackPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 99.81 | 91.46 | — | — | — | |
| SFIBABackbone=PreActResNet, Data Augmentation=with2025.04 | 99.72 | — | 93.68 | 0.88 | — | |
| InkDropCondensation Method=DM, Condensation Backbone=ConvNet2026.03 | 99.67 | — | — | — | 62.17 | |
| INACTIVEPre-training Dataset=STL10, Trigger=Invisible (Ours)2024.05 | 99.58 | — | 87.11 | — | — | |
| SFIBABackbone=VGG, Data Augmentation=without2025.04 | 99.58 | — | 86.45 | 0.14 | — | |
| SFIBABackbone=VGG, Data Augmentation=with2025.04 | 99.54 | — | 90.2 | 0.59 | — | |
| InkDropCondensation Method=DAM, Condensation Backbone=ConvNet2026.03 | 99.33 | — | — | — | 58.72 | |
| DoorpingCondensation Method=DM, Condensation Backbone=ConvNet2026.03 | 98.76 | — | — | — | 62.11 | |
| WaNetReABackbone=ResNet182026.03 | 98.43 | — | 91.75 | — | — | |
| DRUPEPre-training Dataset=STL10, Trigger=Patch2024.05 | 98.39 | — | 84.36 | — | — | |
| BppAttackPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 98.3 | 91.47 | — | — | — | |
| WaNetReABackbone=Pre-activation ResNet182026.03 | 98.17 | — | 91.3 | — | — | |
| SSBAPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 98.11 | 91.18 | — | — | — | |
| WaNetReABackbone=SENet2026.03 | 97.95 | — | 91.3 | — | — | |
| DSAPoisoning rate (ρ)=0.5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 97.78 | 91.09 | — | — | — | |
| BlendedPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 97.38 | 90.87 | — | — | — | |
| WaNetReABackbone=MobileNetV22026.03 | 96.37 | — | 90.65 | — | — | |
| BppAttackReABackbone=ResNet182026.03 | 96.23 | — | 90.85 | — | — | |
| BppAttackReABackbone=SENet2026.03 | 96.03 | — | 91.15 | — | — | |
| Adapt-BlendPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 95.41 | 87.82 | — | — | — | |
| LIRAPoisoning rate (ρ)=-, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 95.23 | 88.17 | — | — | — | |
| BppAttackReABackbone=Pre-activation ResNet182026.03 | 95.03 | — | 90.59 | — | — | |
| FTrojanReABackbone=ResNet182026.03 | 94.91 | — | 91.32 | — | — | |
| BppAttackReABackbone=MobileNetV22026.03 | 94.67 | — | 89.97 | — | — | |
| UBABackbone=PreActResNet, Data Augmentation=without2025.04 | 94.45 | — | 86.75 | 1 | — | |
| FTrojanReABackbone=SENet2026.03 | 94.25 | — | 90.93 | — | — | |
| FTrojanReABackbone=Pre-activation ResNet182026.03 | 94.19 | — | 91.35 | — | — | |
| CAABackbone=ResNet18, Attack Mode=All-to-all2026.03 | 93.76 | — | 93.51 | — | — | |
| Adapt-BlendPoisoning rate (ρ)=0.5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 93.58 | 90.29 | — | — | — | |
| Adapt-BlendPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 92.73 | 89.81 | — | — | — | |
| BlendedPoisoning rate (ρ)=0.5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 91.97 | 90.61 | — | — | — | |
| FTrojanReABackbone=MobileNetV22026.03 | 91.58 | — | 90.64 | — | — | |
| DSAPoisoning rate (ρ)=5%, Defense Protocol=FST, Backbone=ResNet-182026.05 | 87.8 | 87.97 | — | — | — | |
| SSBAPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 84.08 | 91.2 | — | — | — | |
| DSAPoisoning rate (ρ)=1%, Defense Protocol=FST, Backbone=ResNet-182026.05 | 79.37 | 87.08 | — | — | — | |
| WaNetBackbone=ResNet182026.03 | 77.58 | — | 84.72 | — | — | |
| DSAPoisoning rate (ρ)=5%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.05 | 75.07 | 86.2 | — | — | — | |
| IUPoison Rate (%)=0.622026.02 | 72 | — | 87.9 | — | — | |
| SimpleCondensation Method=DAM, Condensation Backbone=ConvNet2026.03 | 67.36 | — | — | — | 53.73 | |
| DSAPoisoning rate (ρ)=1%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.05 | 62.39 | 91.94 | — | — | — | |
| One-to-NBackbone=PreActResNet2025.04 | 60.78 | — | 91.14 | 3.42 | — | |
| DSAPoisoning rate (ρ)=0.5%, Defense Protocol=FST, Backbone=ResNet-182026.05 | 60.18 | 89.17 | — | — | — | |
| SimpleCondensation Method=DM, Condensation Backbone=ConvNet2026.03 | 58.96 | — | — | — | 58.37 | |
| DSAPoisoning rate (ρ)=0.5%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.05 | 58.87 | 89.03 | — | — | — | |
| One-to-NBackbone=VGG2025.04 | 58.42 | — | 88.17 | 2.62 | — | |
| BlendedPoisoning rate (ρ)=5%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 58.07 | 93.23 | — | — | — | |
| BlendedPoisoning rate (ρ)=1%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 57.35 | 92.97 | — | — | — | |
| RelaxCondensation Method=IDM, Condensation Backbone=ConvNet2026.03 | 52.16 | — | — | — | 65.31 | |
| BlendedPoisoning rate (ρ)=0.5%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 51.58 | 91.38 | — | — | — | |
| WaNetBackbone=Pre-activation ResNet182026.03 | 51.25 | — | 86.3 | — | — | |
| NarcissusReABase Attack=Narcissus, Reactivation=true2026.03 | 50.26 | — | 94.82 | — | — | |
| SSBAPoisoning rate (ρ)=0.5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 48.32 | 91.08 | — | — | — | |
| SAAReABase Attack=Sleeper Agent Attack, Reactivation=true2026.03 | 45.24 | — | 94.29 | — | — | |
| BppAttackBackbone=ResNet182026.03 | 44.17 | — | 88.03 | — | — | |
| SSBAPoisoning rate (ρ)=5%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 38.42 | 92.27 | — | — | — | |
| IUPoison Rate (%)=0.392026.02 | 35.8 | — | 87.9 | — | — | |
| Adapt-BlendPoisoning rate (ρ)=5%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 32.17 | 89.72 | — | — | — | |
| WaNetBackbone=ResNet18, Attack Mode=All-to-all2026.03 | 29.21 | — | 91.13 | — | — | |
| BppAttackBackbone=ResNet18, Attack Mode=All-to-all2026.03 | 28.58 | — | 90.32 | — | — | |
| WaNetBackbone=SENet2026.03 | 28.05 | — | 89.23 | — | — | |
| BadNetPoisoning rate (ρ)=0.5%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 25.92 | 93.37 | — | — | — | |
| WaveAttackPoisoning rate (ρ)=5%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 24.71 | 83.77 | — | — | — | |
| IUPoison Rate (%)=0.162026.02 | 23.3 | — | 87 | — | — | |
| Adapt-BlendPoisoning rate (ρ)=1%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 21.84 | 90.18 | — | — | — | |
| WaveAttackPoisoning rate (ρ)=0.5%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 20.51 | 78.41 | — | — | — | |
| SSBAPoisoning rate (ρ)=1%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 18.74 | 91.03 | — | — | — | |
| BadEncoderPre-training Dataset=STL10, Trigger=Ins-Kelvin2024.05 | 18.63 | — | 86.75 | — | — | |
| NarcissusBase Attack=Narcissus, Reactivation=false2026.03 | 17.27 | — | 94.23 | — | — | |
| BadEncoderPre-training Dataset=STL10, Trigger=Ins-Xpro22024.05 | 16.83 | — | 86.85 | — | — | |
| WaNetBackbone=MobileNetV22026.03 | 16.74 | — | 90.35 | — | — | |
| DoorpingCondensation Method=IDM, Condensation Backbone=ConvNet2026.03 | 16.48 | — | — | — | 65.39 | |
| BppAttackBackbone=Pre-activation ResNet182026.03 | 16.17 | — | 90.61 | — | — | |
| WaveAttackPoisoning rate (ρ)=1%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 16.17 | 81.3 | — | — | — | |
| BppAttackBackbone=SENet2026.03 | 16.14 | — | 90.67 | — | — | |
| Adapt-BlendPoisoning rate (ρ)=0.5%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 15.42 | 90.61 | — | — | — | |
| SimpleCondensation Method=IDM, Condensation Backbone=ConvNet2026.03 | 14.24 | — | — | — | 65.19 | |
| WaveAttackPoisoning rate (ρ)=5%, Defense Protocol=FST, Backbone=ResNet-182026.05 | 13.8 | 74.12 | — | — | — |