List your company
ResearchFormerly WizWand

Backdoor Attack on GTSRB

100Attack Success RateMarksman
10.0433.39556.7580.105May 23, 2024Sep 22, 2024Jan 22, 2025May 25, 2025Sep 24, 2025Jan 24, 2026May 27, 2026
Updated 5mo ago

Evaluation results

MethodLinks
MarksmanBackbone=VGG2025.04100—97.120.12
CAABackbone=ResNet182026.03100—99.13—
WaveAttackPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.0510096.17——
WaveAttackPoisoning rate (ρ)=0.5%, Defense Protocol=No defense, Backbone=ResNet-182026.0599.9988.73——
MarksmanBackbone=PreActResNet2025.0499.98—97.890.09
CAABackbone=Pre-activation ResNet182026.0399.95—99.13—
SFIBABackbone=VGG, Data Augmentation=with2025.0499.94—97.210.03
SFIBABackbone=VGG, Data Augmentation=without2025.0499.92—97.020.12
CAABackbone=MobileNetV22026.0399.91—98.76—
CAABackbone=SENet2026.0399.89—98.69—
WaveAttackPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.0599.8191.46——
UBABackbone=PreActResNet, Data Augmentation=without2025.0499.75—95.552.43
SFIBABackbone=PreActResNet, Data Augmentation=with2025.0499.75—97.550.43
SFIBABackbone=PreActResNet, Data Augmentation=without2025.0499.64—97.380.6
UBABackbone=VGG, Data Augmentation=without2025.0499.61—96.330.81
DSAPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.0599.4894.22——
CAABackbone=ResNet18, Attack Mode=All-to-all2026.0399.46—99.17—
DSAPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.0599.191.63——
BadNetPoisoning rate (ρ)=0.5%, Defense Protocol=No defense, Backbone=ResNet-182026.0598.9791.7——
DSAPoisoning rate (ρ)=0.5%, Defense Protocol=No defense, Backbone=ResNet-182026.0598.7493.09——
INACTIVEPre-training Dataset=CIFAR10, Trigger=Invisible (Ours)2024.0598.73—79.15—
Adapt-BlendPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.0598.4291.17——
BadNetPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.0598.1690.31——
INACTIVEPre-training Dataset=STL10, Trigger=Invisible (Ours)2024.0597.97—75.82—
BadEncoderPre-training Dataset=CIFAR10, Trigger=CTRL2024.0597.95—79.94—
DRUPEPre-training Dataset=CIFAR10, Trigger=Patch2024.0597.22—80.35—
BlendedPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.0597.1891.01——
BadNetPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.0597.1792.38——
BppAttackPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.0597.192.83——
Adapt-BlendPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.0596.8387.21——
SSBAPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.0596.3792.12——
DRUPEPre-training Dataset=STL10, Trigger=Patch2024.0596.09—75.93—
LIRAPoisoning rate (ρ)=—, Defense Protocol=No defense, Backbone=ResNet-182026.0595.428.14——
BlendedPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.0595.3490.17——
Adapt-BlendPoisoning rate (ρ)=0.5%, Defense Protocol=No defense, Backbone=ResNet-182026.0594.7188.51——
WaNetReABackbone=ResNet182026.0393.85—98.25—
BlendedPoisoning rate (ρ)=0.5%, Defense Protocol=No defense, Backbone=ResNet-182026.0593.1791.01——
WaNetReABackbone=SENet2026.0392.7—97.69—
WaNetReABackbone=MobileNetV22026.0392.34—97.79—
WaNetReABackbone=Pre-activation ResNet182026.0392.26—97.43—
SSBAPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.0591.6891.11——
SSBAPoisoning rate (ρ)=5%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.0590.0992.41——
DSAPoisoning rate (ρ)=0.5%, Defense Protocol=FT-init, Backbone=ResNet-182026.0589.8195.53——
FTrojanReABackbone=ResNet182026.0389.34—97.43—
SSBAPoisoning rate (ρ)=5%, Defense Protocol=FT-init, Backbone=ResNet-182026.0588.4197.87——
FTrojanReABackbone=SENet2026.0387.43—97.17—
BppAttackReABackbone=ResNet182026.0387.23—94.84—
SSBAPoisoning rate (ρ)=0.5%, Defense Protocol=No defense, Backbone=ResNet-182026.0586.1792.28——
BppAttackReABackbone=Pre-activation ResNet182026.0385.02—94.08—
BppAttackReABackbone=SENet2026.0384.76—93.1—
BlendedPoisoning rate (ρ)=5%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.0584.7194.22——
DSAPoisoning rate (ρ)=0.5%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.0584.1291.17——
FTrojanReABackbone=Pre-activation ResNet182026.0383.77—97.02—
FTrojanReABackbone=MobileNetV22026.0381.85—96.28—
SSBAPoisoning rate (ρ)=1%, Defense Protocol=FT-init, Backbone=ResNet-182026.0581.6198.03——
DSAPoisoning rate (ρ)=1%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.0581.393.21——
SSBAPoisoning rate (ρ)=1%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.0580.0394.34——
BppAttackReABackbone=MobileNetV22026.0378.28—93.82—
DSAPoisoning rate (ρ)=5%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.0574.8192.1——
BadEncoderPre-training Dataset=STL10, Trigger=Ins-Kelvin2024.0572.95—76.49—
DSAPoisoning rate (ρ)=1%, Defense Protocol=FT-init, Backbone=ResNet-182026.0572.7996.12——
WaNetBackbone=ResNet182026.0372.32—94.43—
WaNetBackbone=Pre-activation ResNet182026.0371.8—92.73—
Adapt-BlendPoisoning rate (ρ)=0.5%, Defense Protocol=FT-init, Backbone=ResNet-182026.0571.2989.74——
DSAPoisoning rate (ρ)=0.5%, Defense Protocol=FST, Backbone=ResNet-182026.0571.2994.92——
BlendedPoisoning rate (ρ)=1%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.0569.5195.32——
DSAPoisoning rate (ρ)=5%, Defense Protocol=FT-init, Backbone=ResNet-182026.0569.0895.08——
Adapt-BlendPoisoning rate (ρ)=1%, Defense Protocol=FT-init, Backbone=ResNet-182026.0568.4788.93——
Adapt-BlendPoisoning rate (ρ)=5%, Defense Protocol=FT-init, Backbone=ResNet-182026.0564.3192.14——
WaNetBackbone=SENet2026.0363.25—95.02—
BlendedPoisoning rate (ρ)=5%, Defense Protocol=FT-init, Backbone=ResNet-182026.0562.7194.4——
SSBAPoisoning rate (ρ)=0.5%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.0561.1793.6——
WaNetBackbone=MobileNetV22026.0360.75—94.13—
Adapt-BlendPoisoning rate (ρ)=0.5%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.0555.8388.92——
BlendedPoisoning rate (ρ)=0.5%, Defense Protocol=FT-init, Backbone=ResNet-182026.0555.6396.14——
BlendedPoisoning rate (ρ)=0.5%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.0553.3994.18——
DSAPoisoning rate (ρ)=5%, Defense Protocol=FST, Backbone=ResNet-182026.0552.2894.34——
Adapt-BlendPoisoning rate (ρ)=1%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.0552.1787.58——
SSBAPoisoning rate (ρ)=0.5%, Defense Protocol=FT-init, Backbone=ResNet-182026.0548.3294.59——
Adapt-BlendPoisoning rate (ρ)=5%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.0546.7290.83——
BppAttackPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.0543.9191.52——
BadEncoderPre-training Dataset=CIFAR10, Trigger=Ins-Xpro22024.0542.4—75.08—
BppAttackBackbone=ResNet182026.0342.25—90.78—
BlendedPoisoning rate (ρ)=1%, Defense Protocol=FT-init, Backbone=ResNet-182026.0541.2893.29——
DSAPoisoning rate (ρ)=1%, Defense Protocol=FST, Backbone=ResNet-182026.0540.1595.12——
BppAttackBackbone=ResNet18, Attack Mode=All-to-all2026.0339.62—89.47—
BppAttackBackbone=Pre-activation ResNet182026.0336.83—89.85—
BppAttackBackbone=SENet2026.0336.07—91.79—
FTrojanBackbone=ResNet182026.0330.61—95.72—
FTrojanBackbone=SENet2026.0329.68—94.87—
FTrojanBackbone=Pre-activation ResNet182026.0323.26—94.25—
BppAttackBackbone=MobileNetV22026.0322.75—95.97—
LIRAPoisoning rate (ρ)=—, Defense Protocol=FST, Backbone=ResNet-182026.0518.6448.29——
BppAttackPoisoning rate (ρ)=5%, Defense Protocol=FT-init, Backbone=ResNet-182026.0518.6290.3——
WaNetBackbone=ResNet18, Attack Mode=All-to-all2026.0317.57—98.14—
FTrojanBackbone=MobileNetV22026.0316.09—96.83—
One-to-NBackbone=VGG2025.0415.23—96.211.03
BadEncoderPre-training Dataset=STL10, Trigger=Ins-Xpro22024.0514.02—76.71—
One-to-NBackbone=PreActResNet2025.0414.02—96.771.21
BadNetPoisoning rate (ρ)=5%, Defense Protocol=FT-init, Backbone=ResNet-182026.0513.589.89——