Backdoor Defense on Average of four datasets (test)
93.24AccuracyNo Defense (Before)
Evaluation results
| Method | Links | ||
|---|---|---|---|
| No Defense (Before)Backbone=RoBERTa, Attack Type=BadSent2023.05 | 93.24 | 98.98 | |
| No Defense (Before)Backbone=RoBERTa, Attack Type=BadWord2023.05 | 92.44 | 98.92 | |
| Before (No Defense)Backbone=ROBERTa, Attack=BadWord2023.05 | 92.44 | 98.92 | |
| No Defense (Before)Backbone=RoBERTa, Attack Type=Average2023.05 | 92.34 | 98.95 | |
| NADBackbone=RoBERTa, Attack Type=BadWord2023.05 | 92.25 | 98.96 | |
| Before (No Defense)Backbone=ROBERTa, Attack=BadSent2023.05 | 92.24 | 98.98 | |
| NADBackbone=RoBERTa, Attack Type=Average2023.05 | 92.11 | 98.95 | |
| KDBackbone=RoBERTa, Attack Type=BadWord2023.05 | 92.04 | 97.92 | |
| NADBackbone=RoBERTa, Attack Type=BadSent2023.05 | 91.97 | 98.94 | |
| KDBackbone=RoBERTa, Attack Type=Average2023.05 | 91.88 | 98.43 | |
| KDBackbone=RoBERTa, Attack Type=BadSent2023.05 | 91.72 | 98.94 | |
| No Defense (Before)Backbone=BERT, Attack Type=BadSent2023.05 | 91.63 | 98.6 | |
| Before (No Defense)Backbone=BERT, Attack=BadSent2023.05 | 91.62 | 98.6 | |
| NADBackbone=BERT, Attack Type=BadWord2023.05 | 91.59 | 98.65 | |
| No Defense (Before)Backbone=BERT, Attack Type=Average2023.05 | 91.49 | 98.63 | |
| NADBackbone=BERT, Attack Type=Average2023.05 | 91.47 | 98.66 | |
| No Defense (Before)Backbone=BERT, Attack Type=BadWord2023.05 | 91.46 | 98.65 | |
| Before (No Defense)Backbone=BERT, Attack=BadWord2023.05 | 91.36 | 98.65 | |
| Fine-tuningBackbone=ROBERTa, Attack=BadSent2023.05 | 91.36 | 98.92 | |
| NADBackbone=BERT, Attack Type=BadSent2023.05 | 91.35 | 98.67 | |
| KDBackbone=BERT, Attack Type=BadWord2023.05 | 91.22 | 98.75 | |
| Fine-tuningBackbone=ROBERTa, Attack=BadWord2023.05 | 91.12 | 97.46 | |
| KDBackbone=BERT, Attack Type=Average2023.05 | 91.1 | 98.72 | |
| KDBackbone=BERT, Attack Type=BadSent2023.05 | 90.98 | 98.69 | |
| Fine-tuningBackbone=BERT, Attack=BadWord2023.05 | 90.65 | 98.6 | |
| Fine-tuningBackbone=BERT, Attack=BadSent2023.05 | 90.41 | 98.66 | |
| RAPBackbone=RoBERTa, Attack Type=BadWord2023.05 | 89.95 | 21.34 | |
| RAPBackbone=RoBERTa, Attack Type=Average2023.05 | 89.82 | 59.56 | |
| RAPBackbone=RoBERTa, Attack Type=BadSent2023.05 | 89.69 | 97.78 | |
| RAPBackbone=BERT, Attack Type=BadSent2023.05 | 89.2 | 79.98 | |
| RAPBackbone=BERT, Attack Type=Average2023.05 | 89.11 | 51.48 | |
| RAPBackbone=BERT, Attack Type=BadWord2023.05 | 89.02 | 22.98 | |
| Fine-purifyingBackdoor Attack=Anchoring2023.05 | 88.1 | 14.67 | |
| Fine-purifyingBackdoor Attack=Syntactic2023.05 | 87.54 | 21.21 | |
| Fine-pruningBackbone=ROBERTa, Attack=BadWord2023.05 | 87.5 | 91.17 | |
| ONIONBackbone=BERT, Attack Type=BadSent2023.05 | 87.42 | 82.51 | |
| ONIONBackbone=BERT, Attack Type=Average2023.05 | 87.39 | 47.65 | |
| ONIONBackbone=BERT, Attack Type=BadWord2023.05 | 87.35 | 12.78 | |
| Fine-mixingBackdoor Attack=Syntactic2023.05 | 87.1 | 25.42 | |
| Fine-purifyingBackbone=RoBERTa, Attack Type=BadSent2023.05 | 86.85 | 19.2 | |
| Fine-purifyingBackbone=ROBERTa, Attack=BadSent2023.05 | 86.85 | 19.2 | |
| Fine-purifyingBackbone=RoBERTa, Attack Type=Average2023.05 | 86.75 | 18.4 | |
| ONIONBackbone=RoBERTa, Attack Type=BadSent2023.05 | 86.72 | 84.85 | |
| Fine-purifyingBackbone=RoBERTa, Attack Type=BadWord2023.05 | 86.64 | 17.59 | |
| Fine-purifyingBackbone=ROBERTa, Attack=BadWord2023.05 | 86.64 | 17.56 | |
| ONIONBackbone=RoBERTa, Attack Type=Average2023.05 | 86.58 | 48.67 | |
| ONIONBackbone=RoBERTa, Attack Type=BadWord2023.05 | 86.44 | 12.48 | |
| Fine-pruningBackbone=ROBERTa, Attack=BadSent2023.05 | 86.41 | 62.53 | |
| Fine-pruningBackbone=BERT, Attack=BadWord2023.05 | 86.39 | 90.48 | |
| Fine-mixingBackbone=ROBERTa, Attack=BadWord2023.05 | 86.39 | 18.12 | |
| Fine-pruningBackbone=BERT, Attack=BadSent2023.05 | 86.36 | 74.21 | |
| Fine-mixingBackdoor Attack=Anchoring2023.05 | 86.27 | 19.96 | |
| Fine-purifyingBackdoor Attack=EP2023.05 | 86.14 | 11.49 | |
| Fine-purifyingBackdoor Attack=BadWord2023.05 | 86.13 | 24.71 | |
| Fine-mixingBackbone=ROBERTa, Attack=BadSent2023.05 | 86.11 | 35.97 | |
| Fine-purifyingBackdoor Attack=Layerwise2023.05 | 85.81 | 13.55 | |
| Fine-purifyingBackbone=BERT, Attack Type=BadSent2023.05 | 85.64 | 25.78 | |
| Fine-purifyingBackbone=BERT, Attack=BadSent2023.05 | 85.64 | 25.78 | |
| Fine-purifyingBackbone=BERT, Attack Type=BadWord2023.05 | 85.62 | 31.83 | |
| Fine-purifyingBackbone=BERT, Attack=BadWord2023.05 | 85.62 | 31.82 | |
| Fine-purifyingBackbone=BERT, Attack Type=Average2023.05 | 85.53 | 28.8 | |
| Fine-mixingBackdoor Attack=BadWord2023.05 | 85.53 | 28.94 | |
| Fine-mixingBackdoor Attack=EP2023.05 | 85.14 | 17.67 | |
| Fine-mixingBackbone=BERT, Attack=BadSent2023.05 | 85.03 | 52.07 | |
| Fine-mixingBackbone=BERT, Attack=BadWord2023.05 | 84.66 | 39.75 | |
| Fine-mixingBackdoor Attack=Layerwise2023.05 | 84.62 | 21.11 | |
| Fine-purifyingBackdoor Attack=EWC2023.05 | 83.42 | 19.25 | |
| Fine-mixingBackdoor Attack=EWC2023.05 | 82.21 | 27.42 | |
| CI-triggerAttack=WaNet2026.04 | 82.1 | 92.7 | |
| CI-triggerAttack=BadCLIP2026.04 | 81.8 | 99 | |
| CI-triggerAttack=Blended2026.04 | 81.7 | 99.7 | |
| CI-triggerAttack=BadCLIP_adaptive2026.04 | 81.6 | 64.1 | |
| CI-triggerAttack=Average2026.04 | 80.6 | 84.4 | |
| Fine-mixingBackdoor Attack=Surgery2023.05 | 76.44 | 32.75 | |
| CI-triggerAttack=SIBA2026.04 | 75.9 | 66.3 | |
| Fine-purifyingBackdoor Attack=Surgery2023.05 | 74.47 | 26.96 |