Backdoor Attack on GTSRB
100Attack Success RateMarksman
Evaluation Results
| Method | Links | ||||
|---|---|---|---|---|---|
| MarksmanBackbone=VGG2025.04 | 100 | — | 97.12 | 0.12 | |
| CAABackbone=ResNet182026.03 | 100 | — | 99.13 | — | |
| WaveAttackPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 100 | 96.17 | — | — | |
| WaveAttackPoisoning rate (ρ)=0.5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 99.99 | 88.73 | — | — | |
| MarksmanBackbone=PreActResNet2025.04 | 99.98 | — | 97.89 | 0.09 | |
| CAABackbone=Pre-activation ResNet182026.03 | 99.95 | — | 99.13 | — | |
| SFIBABackbone=VGG, Data Augmentation=with2025.04 | 99.94 | — | 97.21 | 0.03 | |
| SFIBABackbone=VGG, Data Augmentation=without2025.04 | 99.92 | — | 97.02 | 0.12 | |
| CAABackbone=MobileNetV22026.03 | 99.91 | — | 98.76 | — | |
| CAABackbone=SENet2026.03 | 99.89 | — | 98.69 | — | |
| WaveAttackPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 99.81 | 91.46 | — | — | |
| UBABackbone=PreActResNet, Data Augmentation=without2025.04 | 99.75 | — | 95.55 | 2.43 | |
| SFIBABackbone=PreActResNet, Data Augmentation=with2025.04 | 99.75 | — | 97.55 | 0.43 | |
| SFIBABackbone=PreActResNet, Data Augmentation=without2025.04 | 99.64 | — | 97.38 | 0.6 | |
| UBABackbone=VGG, Data Augmentation=without2025.04 | 99.61 | — | 96.33 | 0.81 | |
| DSAPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 99.48 | 94.22 | — | — | |
| CAABackbone=ResNet18, Attack Mode=All-to-all2026.03 | 99.46 | — | 99.17 | — | |
| DSAPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 99.1 | 91.63 | — | — | |
| BadNetPoisoning rate (ρ)=0.5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 98.97 | 91.7 | — | — | |
| DSAPoisoning rate (ρ)=0.5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 98.74 | 93.09 | — | — | |
| INACTIVEPre-training Dataset=CIFAR10, Trigger=Invisible (Ours)2024.05 | 98.73 | — | 79.15 | — | |
| Adapt-BlendPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 98.42 | 91.17 | — | — | |
| BadNetPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 98.16 | 90.31 | — | — | |
| INACTIVEPre-training Dataset=STL10, Trigger=Invisible (Ours)2024.05 | 97.97 | — | 75.82 | — | |
| BadEncoderPre-training Dataset=CIFAR10, Trigger=CTRL2024.05 | 97.95 | — | 79.94 | — | |
| DRUPEPre-training Dataset=CIFAR10, Trigger=Patch2024.05 | 97.22 | — | 80.35 | — | |
| BlendedPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 97.18 | 91.01 | — | — | |
| BadNetPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 97.17 | 92.38 | — | — | |
| BppAttackPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 97.1 | 92.83 | — | — | |
| Adapt-BlendPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 96.83 | 87.21 | — | — | |
| SSBAPoisoning rate (ρ)=5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 96.37 | 92.12 | — | — | |
| DRUPEPre-training Dataset=STL10, Trigger=Patch2024.05 | 96.09 | — | 75.93 | — | |
| LIRAPoisoning rate (ρ)=—, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 95.42 | 8.14 | — | — | |
| BlendedPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 95.34 | 90.17 | — | — | |
| Adapt-BlendPoisoning rate (ρ)=0.5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 94.71 | 88.51 | — | — | |
| WaNetReABackbone=ResNet182026.03 | 93.85 | — | 98.25 | — | |
| BlendedPoisoning rate (ρ)=0.5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 93.17 | 91.01 | — | — | |
| WaNetReABackbone=SENet2026.03 | 92.7 | — | 97.69 | — | |
| WaNetReABackbone=MobileNetV22026.03 | 92.34 | — | 97.79 | — | |
| WaNetReABackbone=Pre-activation ResNet182026.03 | 92.26 | — | 97.43 | — | |
| SSBAPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 91.68 | 91.11 | — | — | |
| SSBAPoisoning rate (ρ)=5%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.05 | 90.09 | 92.41 | — | — | |
| DSAPoisoning rate (ρ)=0.5%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 89.81 | 95.53 | — | — | |
| FTrojanReABackbone=ResNet182026.03 | 89.34 | — | 97.43 | — | |
| SSBAPoisoning rate (ρ)=5%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 88.41 | 97.87 | — | — | |
| FTrojanReABackbone=SENet2026.03 | 87.43 | — | 97.17 | — | |
| BppAttackReABackbone=ResNet182026.03 | 87.23 | — | 94.84 | — | |
| SSBAPoisoning rate (ρ)=0.5%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 86.17 | 92.28 | — | — | |
| BppAttackReABackbone=Pre-activation ResNet182026.03 | 85.02 | — | 94.08 | — | |
| BppAttackReABackbone=SENet2026.03 | 84.76 | — | 93.1 | — | |
| BlendedPoisoning rate (ρ)=5%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.05 | 84.71 | 94.22 | — | — | |
| DSAPoisoning rate (ρ)=0.5%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.05 | 84.12 | 91.17 | — | — | |
| FTrojanReABackbone=Pre-activation ResNet182026.03 | 83.77 | — | 97.02 | — | |
| FTrojanReABackbone=MobileNetV22026.03 | 81.85 | — | 96.28 | — | |
| SSBAPoisoning rate (ρ)=1%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 81.61 | 98.03 | — | — | |
| DSAPoisoning rate (ρ)=1%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.05 | 81.3 | 93.21 | — | — | |
| SSBAPoisoning rate (ρ)=1%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.05 | 80.03 | 94.34 | — | — | |
| BppAttackReABackbone=MobileNetV22026.03 | 78.28 | — | 93.82 | — | |
| DSAPoisoning rate (ρ)=5%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.05 | 74.81 | 92.1 | — | — | |
| BadEncoderPre-training Dataset=STL10, Trigger=Ins-Kelvin2024.05 | 72.95 | — | 76.49 | — | |
| DSAPoisoning rate (ρ)=1%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 72.79 | 96.12 | — | — | |
| WaNetBackbone=ResNet182026.03 | 72.32 | — | 94.43 | — | |
| WaNetBackbone=Pre-activation ResNet182026.03 | 71.8 | — | 92.73 | — | |
| Adapt-BlendPoisoning rate (ρ)=0.5%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 71.29 | 89.74 | — | — | |
| DSAPoisoning rate (ρ)=0.5%, Defense Protocol=FST, Backbone=ResNet-182026.05 | 71.29 | 94.92 | — | — | |
| BlendedPoisoning rate (ρ)=1%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.05 | 69.51 | 95.32 | — | — | |
| DSAPoisoning rate (ρ)=5%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 69.08 | 95.08 | — | — | |
| Adapt-BlendPoisoning rate (ρ)=1%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 68.47 | 88.93 | — | — | |
| Adapt-BlendPoisoning rate (ρ)=5%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 64.31 | 92.14 | — | — | |
| WaNetBackbone=SENet2026.03 | 63.25 | — | 95.02 | — | |
| BlendedPoisoning rate (ρ)=5%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 62.71 | 94.4 | — | — | |
| SSBAPoisoning rate (ρ)=0.5%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.05 | 61.17 | 93.6 | — | — | |
| WaNetBackbone=MobileNetV22026.03 | 60.75 | — | 94.13 | — | |
| Adapt-BlendPoisoning rate (ρ)=0.5%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.05 | 55.83 | 88.92 | — | — | |
| BlendedPoisoning rate (ρ)=0.5%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 55.63 | 96.14 | — | — | |
| BlendedPoisoning rate (ρ)=0.5%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.05 | 53.39 | 94.18 | — | — | |
| DSAPoisoning rate (ρ)=5%, Defense Protocol=FST, Backbone=ResNet-182026.05 | 52.28 | 94.34 | — | — | |
| Adapt-BlendPoisoning rate (ρ)=1%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.05 | 52.17 | 87.58 | — | — | |
| SSBAPoisoning rate (ρ)=0.5%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 48.32 | 94.59 | — | — | |
| Adapt-BlendPoisoning rate (ρ)=5%, Defense Protocol=FE-tuning, Backbone=ResNet-182026.05 | 46.72 | 90.83 | — | — | |
| BppAttackPoisoning rate (ρ)=1%, Defense Protocol=No defense, Backbone=ResNet-182026.05 | 43.91 | 91.52 | — | — | |
| BadEncoderPre-training Dataset=CIFAR10, Trigger=Ins-Xpro22024.05 | 42.4 | — | 75.08 | — | |
| BppAttackBackbone=ResNet182026.03 | 42.25 | — | 90.78 | — | |
| BlendedPoisoning rate (ρ)=1%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 41.28 | 93.29 | — | — | |
| DSAPoisoning rate (ρ)=1%, Defense Protocol=FST, Backbone=ResNet-182026.05 | 40.15 | 95.12 | — | — | |
| BppAttackBackbone=ResNet18, Attack Mode=All-to-all2026.03 | 39.62 | — | 89.47 | — | |
| BppAttackBackbone=Pre-activation ResNet182026.03 | 36.83 | — | 89.85 | — | |
| BppAttackBackbone=SENet2026.03 | 36.07 | — | 91.79 | — | |
| FTrojanBackbone=ResNet182026.03 | 30.61 | — | 95.72 | — | |
| FTrojanBackbone=SENet2026.03 | 29.68 | — | 94.87 | — | |
| FTrojanBackbone=Pre-activation ResNet182026.03 | 23.26 | — | 94.25 | — | |
| BppAttackBackbone=MobileNetV22026.03 | 22.75 | — | 95.97 | — | |
| LIRAPoisoning rate (ρ)=—, Defense Protocol=FST, Backbone=ResNet-182026.05 | 18.64 | 48.29 | — | — | |
| BppAttackPoisoning rate (ρ)=5%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 18.62 | 90.3 | — | — | |
| WaNetBackbone=ResNet18, Attack Mode=All-to-all2026.03 | 17.57 | — | 98.14 | — | |
| FTrojanBackbone=MobileNetV22026.03 | 16.09 | — | 96.83 | — | |
| One-to-NBackbone=VGG2025.04 | 15.23 | — | 96.21 | 1.03 | |
| BadEncoderPre-training Dataset=STL10, Trigger=Ins-Xpro22024.05 | 14.02 | — | 76.71 | — | |
| One-to-NBackbone=PreActResNet2025.04 | 14.02 | — | 96.77 | 1.21 | |
| BadNetPoisoning rate (ρ)=5%, Defense Protocol=FT-init, Backbone=ResNet-182026.05 | 13.5 | 89.89 | — | — |