Backdoor Defense (BadNet/Blended/SSBA) on CIFAR-10 (test)
94.31Clean AccuracyNo defense
Evaluation results
| Method | Links | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| No defenseQuantization=8-bit, Attack Scenario=Exploiting LLM2026.06 | 94.31 | — | — | — | — | — | — | 97.49 | |
| Gaussian NoiseQuantization=8-bit, Attack Scenario=Exploiting LLM2026.06 | 93.99 | — | — | — | — | — | — | 6.77 | |
| LACQuantization=4-bit, Attack Scenario=Qu-Anti-zation2026.06 | 93.78 | — | — | — | — | — | — | 0.85 | |
| No defenseQuantization=4-bit, Attack Scenario=Exploiting LLM2026.06 | 93.74 | — | — | — | — | — | — | 97.47 | |
| LACQuantization=8-bit, Attack Scenario=Exploiting LLM2026.06 | 93.51 | — | — | — | — | — | — | 0.52 | |
| LACQuantization=8-bit, Attack Scenario=Qu-Anti-zation2026.06 | 93.44 | — | — | — | — | — | — | 9.22 | |
| Gaussian NoiseQuantization=4-bit, Attack Scenario=Exploiting LLM2026.06 | 93.43 | — | — | — | — | — | — | 31.37 | |
| EFRAPQuantization=8-bit, Attack Scenario=Exploiting LLM2026.06 | 93.39 | — | — | — | — | — | — | 0.33 | |
| QVec (0.95)Quantization=8-bit, Attack Scenario=Exploiting LLM2026.06 | 93.32 | — | — | — | — | — | — | 0.5 | |
| QVec (0.98)Quantization=8-bit, Attack Scenario=Exploiting LLM2026.06 | 93.32 | — | — | — | — | — | — | 0.5 | |
| EFRAPQuantization=4-bit, Attack Scenario=Qu-Anti-zation2026.06 | 93.3 | — | — | — | — | — | — | 0.97 | |
| No-defensePDR=0.005, Attack Type=BadNet, Backbone=VGG19_BN2024.12 | 93.22 | — | — | — | — | — | — | 83.89 | |
| No-defensePDR=0.05, Attack Type=SIG, Backbone=VGG19_BN2024.12 | 93.2 | — | — | — | — | — | — | 93.77 | |
| EFRAPQuantization=8-bit, Attack Scenario=Qu-Anti-zation2026.06 | 93.19 | — | — | — | — | — | — | 23.9 | |
| LACQuantization=4-bit, Attack Scenario=Exploiting LLM2026.06 | 93.18 | — | — | — | — | — | — | 0.6 | |
| No-defensePDR=0.01, Attack Type=BadNet, Backbone=VGG19_BN2024.12 | 93.17 | — | — | — | — | — | — | 87.12 | |
| No-defensePDR=0.05, Attack Type=Blended, Backbone=VGG19_BN2024.12 | 93.11 | — | — | — | — | — | — | 99.44 | |
| No-defensePDR=0.02, Attack Type=Blended, Backbone=VGG19_BN2024.12 | 93.07 | — | — | — | — | — | — | 98.54 | |
| EFRAPQuantization=4-bit, Attack Scenario=Exploiting LLM2026.06 | 92.84 | — | — | — | — | — | — | 0.65 | |
| No defenseQuantization=4-bit, Attack Scenario=Qu-Anti-zation2026.06 | 92.73 | — | — | — | — | — | — | 97.52 | |
| No-defensePDR=0.005, Attack Type=Blended, Backbone=VGG19_BN2024.12 | 92.62 | — | — | — | — | — | — | 97.89 | |
| No-defensePDR=0.05, Attack Type=BadNet, Backbone=VGG19_BN2024.12 | 92.52 | — | — | — | — | — | — | 94.3 | |
| No-defensePDR=0.02, Attack Type=BadNet, Backbone=VGG19_BN2024.12 | 92.51 | — | — | — | — | — | — | 90.39 | |
| QVec (0.98)Quantization=4-bit, Attack Scenario=Exploiting LLM2026.06 | 92.48 | — | — | — | — | — | — | 0.71 | |
| No-defensePDR=0.01, Attack Type=Blended, Backbone=VGG19_BN2024.12 | 92.35 | — | — | — | — | — | — | 95.47 | |
| No-defensePDR=0.005, Attack Type=SIG, Backbone=VGG19_BN2024.12 | 92.23 | — | — | — | — | — | — | 76.95 | |
| Gaussian NoiseQuantization=8-bit, Attack Scenario=Qu-Anti-zation2026.06 | 92.23 | — | — | — | — | — | — | 25.61 | |
| No-defensePDR=0.02, Attack Type=SIG, Backbone=VGG19_BN2024.12 | 91.68 | — | — | — | — | — | — | 88.6 | |
| QVec (0.98)Quantization=8-bit, Attack Scenario=Qu-Anti-zation2026.06 | 91.52 | — | — | — | — | — | — | 0.43 | |
| No-defensePDR=0.01, Attack Type=SIG, Backbone=VGG19_BN2024.12 | 91.47 | — | — | — | — | — | — | 80.48 | |
| QVec (0.98)Quantization=4-bit, Attack Scenario=Qu-Anti-zation2026.06 | 91.4 | — | — | — | — | — | — | 1.74 | |
| No defenseQuantization=8-bit, Attack Scenario=Qu-Anti-zation2026.06 | 90.23 | — | — | — | — | — | — | 98.24 | |
| FSTPDR=0.05, Attack Type=Blended, Backbone=VGG19_BN2024.12 | 89.81 | — | — | — | — | — | — | 23.99 | |
| QVec (0.95)Quantization=4-bit, Attack Scenario=Exploiting LLM2026.06 | 89.79 | — | — | — | — | — | — | 1.19 | |
| PBPPDR=0.05, Attack Type=Blended, Backbone=VGG19_BN2024.12 | 89.63 | — | — | — | — | — | — | 4.63 | |
| PBPPDR=0.02, Attack Type=BadNet, Backbone=VGG19_BN2024.12 | 89.26 | — | — | — | — | — | — | 2.41 | |
| FSTPDR=0.05, Attack Type=BadNet, Backbone=VGG19_BN2024.12 | 89.1 | — | — | — | — | — | — | 2.61 | |
| FSTPDR=0.01, Attack Type=BadNet, Backbone=VGG19_BN2024.12 | 89.04 | — | — | — | — | — | — | 1.53 | |
| PBPPDR=0.005, Attack Type=BadNet, Backbone=VGG19_BN2024.12 | 88.97 | — | — | — | — | — | — | 2.44 | |
| FSTPDR=0.02, Attack Type=Blended, Backbone=VGG19_BN2024.12 | 88.94 | — | — | — | — | — | — | 24.75 | |
| PBPPDR=0.01, Attack Type=BadNet, Backbone=VGG19_BN2024.12 | 88.9 | — | — | — | — | — | — | 2 | |
| QVec (0.95)Quantization=8-bit, Attack Scenario=Qu-Anti-zation2026.06 | 88.83 | — | — | — | — | — | — | 0.14 | |
| FSTPDR=0.005, Attack Type=Blended, Backbone=VGG19_BN2024.12 | 88.79 | — | — | — | — | — | — | 28.19 | |
| PBPPDR=0.02, Attack Type=Blended, Backbone=VGG19_BN2024.12 | 88.73 | — | — | — | — | — | — | 5.21 | |
| PBPPDR=0.01, Attack Type=Blended, Backbone=VGG19_BN2024.12 | 88.7 | — | — | — | — | — | — | 9.4 | |
| FSTPDR=0.01, Attack Type=Blended, Backbone=VGG19_BN2024.12 | 88.67 | — | — | — | — | — | — | 29.1 | |
| FSTPDR=0.05, Attack Type=SIG, Backbone=VGG19_BN2024.12 | 88.65 | — | — | — | — | — | — | 8.73 | |
| PBPPDR=0.05, Attack Type=BadNet, Backbone=VGG19_BN2024.12 | 88.51 | — | — | — | — | — | — | 3.03 | |
| FSTPDR=0.005, Attack Type=BadNet, Backbone=VGG19_BN2024.12 | 88.49 | — | — | — | — | — | — | 2.02 | |
| QVec (0.95)Quantization=4-bit, Attack Scenario=Qu-Anti-zation2026.06 | 88.34 | — | — | — | — | — | — | 1.79 | |
| FSTPDR=0.02, Attack Type=BadNet, Backbone=VGG19_BN2024.12 | 88.23 | — | — | — | — | — | — | 2.13 | |
| PBPPDR=0.05, Attack Type=SIG, Backbone=VGG19_BN2024.12 | 87.4 | — | — | — | — | — | — | 0.65 | |
| FSTPDR=0.005, Attack Type=SIG, Backbone=VGG19_BN2024.12 | 87.29 | — | — | — | — | — | — | 17.14 | |
| PBPPDR=0.005, Attack Type=Blended, Backbone=VGG19_BN2024.12 | 87.25 | — | — | — | — | — | — | 10.32 | |
| FSTPDR=0.01, Attack Type=SIG, Backbone=VGG19_BN2024.12 | 87.01 | — | — | — | — | — | — | 13.12 | |
| FSTPDR=0.02, Attack Type=SIG, Backbone=VGG19_BN2024.12 | 87 | — | — | — | — | — | — | 6.18 | |
| PBPPDR=0.005, Attack Type=SIG, Backbone=VGG19_BN2024.12 | 86.47 | — | — | — | — | — | — | 0.82 | |
| FedAvgAttack Type=A3FL, Data Distribution (Dirichlet alpha)=0.52025.05 | 86.36 | — | — | — | — | — | — | 92.47 | |
| PBPPDR=0.01, Attack Type=SIG, Backbone=VGG19_BN2024.12 | 86.27 | — | — | — | — | — | — | 4.02 | |
| PBPPDR=0.02, Attack Type=SIG, Backbone=VGG19_BN2024.12 | 86.11 | — | — | — | — | — | — | 1.83 | |
| ProtoGuard-SLAttack=SplitNN attack2026.04 | 85 | — | — | — | — | — | — | 5 | |
| Gaussian NoiseQuantization=4-bit, Attack Scenario=Qu-Anti-zation2026.06 | 84.7 | — | — | — | — | — | — | 97.33 | |
| FeRAAttack Type=A3FL, Data Distribution (Dirichlet alpha)=0.52025.05 | 84.26 | — | — | — | — | — | — | 1.26 | |
| ProtoGuard-SLAttack=BadVFL2026.04 | 84 | — | — | — | — | — | — | 3 | |
| ProtoGuard-SLAttack=VILLAIN attack2026.04 | 83 | — | — | — | — | — | — | 6 | |
| DeepSightAttack Type=A3FL, Data Distribution (Dirichlet alpha)=0.52025.05 | 80.84 | — | — | — | — | — | — | 91.85 | |
| No defenseAttack=VILLAIN attack2026.04 | 80 | — | — | — | — | — | — | 92 | |
| No defenseAttack=BadVFL2026.04 | 79 | — | — | — | — | — | — | 89 | |
| DPAttack=SplitNN attack2026.04 | 79 | — | — | — | — | — | — | 73 | |
| HACSFT Multi-MetricsAttack=DBA, m=82025.09 | 78.74 | — | — | — | — | — | — | 3.84 | |
| HACSFT Multi-MetricsAttack=BadNet, m=82025.09 | 78.56 | — | — | — | — | — | — | 3.1 | |
| HACSFT FlameAttack=BadNet, m=82025.09 | 78.24 | — | — | — | — | — | — | 3.33 | |
| HACSFT FlameAttack=Neurotoxin, m=82025.09 | 78.21 | — | — | — | — | — | — | 3.18 | |
| HACSFT Multi-MetricsAttack=Replacement, m=82025.09 | 78.05 | — | — | — | — | — | — | 3.3 | |
| HACSFT Multi-MetricsAttack=Neurotoxin, m=82025.09 | 77.79 | — | — | — | — | — | — | 3.2 | |
| HACSFT FlameAttack=Replacement, m=82025.09 | 77.62 | — | — | — | — | — | — | 3.93 | |
| HACSFT FlameAttack=DBA, m=82025.09 | 77.37 | — | — | — | — | — | — | 3.77 | |
| No defenseAttack=SplitNN attack2026.04 | 77 | — | — | — | — | — | — | 95 | |
| DPAttack=BadVFL2026.04 | 77 | — | — | — | — | — | — | 68 | |
| ANPAttack=VILLAIN attack2026.04 | 77 | — | — | — | — | — | — | 66 | |
| ANPAttack=BadVFL2026.04 | 76 | — | — | — | — | — | — | 65 | |
| RLRAttack Type=A3FL, Data Distribution (Dirichlet alpha)=0.52025.05 | 75.26 | — | — | — | — | — | — | 92.36 | |
| HACSFT KrumAttack=Replacement, m=82025.09 | 74.8 | — | — | — | — | — | — | 21.69 | |
| HACSFT KrumAttack=Neurotoxin, m=82025.09 | 74.52 | — | — | — | — | — | — | 3.96 | |
| HACSFT KrumAttack=BadNet, m=82025.09 | 74.37 | — | — | — | — | — | — | 4.04 | |
| DPAttack=VILLAIN attack2026.04 | 74 | — | — | — | — | — | — | 77 | |
| MPAttack=VILLAIN attack2026.04 | 74 | — | — | — | — | — | — | 67 | |
| ANPAttack=SplitNN attack2026.04 | 74 | — | — | — | — | — | — | 67 | |
| HACSFT KrumAttack=DBA, m=82025.09 | 72.5 | — | — | — | — | — | — | 3.61 | |
| MPAttack=SplitNN attack2026.04 | 72 | — | — | — | — | — | — | 70 | |
| MPAttack=BadVFL2026.04 | 72 | — | — | — | — | — | — | 78 | |
| VFLIPAttack=SplitNN attack2026.04 | 72 | — | — | — | — | — | — | 33 | |
| VFLIPAttack=BadVFL2026.04 | 66 | — | — | — | — | — | — | 28 | |
| VFLIPAttack=VILLAIN attack2026.04 | 65 | — | — | — | — | — | — | 35 | |
| ANPMode=O-Robustness, Backbone=ResNet-18, Poisoning Rate=1%2024.10 | — | 0.9341 | 0.006 | 0.9384 | 0.0029 | 0.9461 | 0.0113 | — | |
| ANPMode=P-Robustness, Backbone=ResNet-18, Poisoning Rate=1%2024.10 | — | 0.9432 | 0.8711 | 0.9449 | 0.0082 | 0.9437 | 0.4821 | — | |
| AttackMode=O-Backdoor, Backbone=ResNet-18, Poisoning Rate=1%2024.10 | — | 0.9477 | 1 | 0.949 | 0.9912 | 0.9494 | 0.7998 | — | |
| BAUMode=O-Robustness, Backbone=ResNet-18, Poisoning Rate=1%2024.10 | — | 0.9264 | 0.0689 | 0.9264 | 0.0367 | 0.9318 | 0.0281 | — | |
| BAUMode=P-Robustness, Backbone=ResNet-18, Poisoning Rate=1%2024.10 | — | 0.9388 | 0.9567 | 0.9392 | 0.9991 | 0.9414 | 0.5804 | — | |
| BTIMode=O-Robustness, Backbone=ResNet-18, Poisoning Rate=1%2024.10 | — | 0.9289 | 0.0144 | 0.9282 | 0.0106 | 0.929 | 0.0152 | — |