Backdoor Defense on CIFAR-10
6,010Attack Success RateZero-shot
Evaluation results
| Method | Links | ||||
|---|---|---|---|---|---|
| Zero-shotPrompt Attack=Adaptive2026.01 | 6,010 | — | 86.7 | — | |
| PRISMPrompt Attack=Adaptive2026.01 | 1,560 | — | 92.2 | — | |
| PRISMPrompt Attack=Original2026.01 | 130 | — | 92.3 | — | |
| Base (No Defense)Attack=BadNet2026.02 | 100 | — | 95 | — | |
| ZIPAttack=BadNet2026.02 | 100 | — | 88.6 | 0.022 | |
| UndefendedNetwork=ResNet18, Attack=Blend2022.02 | 99.86 | 94.62 | — | — | |
| FeatureREBackbone=ResNet182024.05 | 99.79 | 93.15 | — | — | |
| No defenseBackbone=ResNet182024.05 | 99.41 | 93.37 | — | — | |
| UndefendedNetwork=ResNet18, Attack=Filter2022.02 | 99.34 | 91.08 | — | — | |
| UndefendedNetwork=ResNet18, Attack=SIG2022.02 | 99.08 | 94.34 | — | — | |
| DP-SGD-1Network=NiN, clip=4.0, noise=0.12022.02 | 98.85 | 60.22 | — | — | |
| SampdetoxAttack=BadNet2026.02 | 98.8 | — | 76.3 | 0.034 | |
| UndefendedNetwork=ResNet18, Attack=WaNet2022.02 | 96.71 | 94.39 | — | — | |
| FeatureREAttack=WaNet-All, Backbone=ResNet182024.05 | 91.96 | 93.33 | — | — | |
| No defenseAttack=WaNet-All, Backbone=ResNet182024.05 | 91.86 | 93.6 | — | — | |
| FeatureREAttack=IAD-All, Backbone=ResNet182024.05 | 91.2 | 93.06 | — | — | |
| No defenseAttack=IAD-All, Backbone=ResNet182024.05 | 90.62 | 92.96 | — | — | |
| CSOAttack=Adaptive-Blend2025.12 | 90.56 | 98 | 91.73 | — | |
| No defenseAttack=Average, Backbone=ResNet182024.05 | 89.05 | 93.67 | — | — | |
| FeatureREAttack=Average, Backbone=ResNet182024.05 | 89.01 | 93.57 | — | — | |
| ACNetwork=NiN2022.02 | 88.28 | 83.85 | — | — | |
| NADNetwork=NiN2022.02 | 88.1 | 80.75 | — | — | |
| Fine-tuningBackbone=ResNet182024.05 | 87.81 | 92.93 | — | — | |
| UndefendedNetwork=NiN2022.02 | 87.62 | 91.02 | — | — | |
| UndefendedNetwork=NiN2022.02 | 87.62 | 91.02 | — | — | |
| DBDNetwork=NiN2022.02 | 87.54 | 86.27 | — | — | |
| DP-SGDNetwork=NiN2022.02 | 87.22 | 39.19 | — | — | |
| DP-SGD-2Network=NiN, clip=1.0, noise=0.52022.02 | 87.22 | 39.19 | — | — | |
| ABLNetwork=NiN2022.02 | 86.33 | 86.28 | — | — | |
| No defenseAttack=Bpp-All, Backbone=ResNet182024.05 | 84.68 | 94.45 | — | — | |
| FeatureREAttack=Bpp-All, Backbone=ResNet182024.05 | 83.87 | 94.32 | — | — | |
| NADNetwork=VGG162022.02 | 72.76 | 85.2 | — | — | |
| ABLNetwork=VGG162022.02 | 72.32 | 86.46 | — | — | |
| UndefendedNetwork=VGG162022.02 | 71.88 | 90.78 | — | — | |
| UndefendedNetwork=VGG162022.02 | 71.88 | 90.78 | — | — | |
| DBDNetwork=VGG162022.02 | 68.45 | 86.38 | — | — | |
| ACNetwork=VGG162022.02 | 66.67 | 85.69 | — | — | |
| DP-SGDNetwork=VGG162022.02 | 63.58 | 53.4 | — | — | |
| DP-SGD-2Network=VGG16, clip=1.0, noise=0.52022.02 | 63.58 | 53.4 | — | — | |
| DP-SGD-1Network=VGG16, clip=4.0, noise=0.12022.02 | 61.11 | 78.25 | — | — | |
| I-BAUBackbone=ResNet-182026.06 | 57.4 | — | 92.5 | — | |
| ShrinkPadAttack=BadNet2026.02 | 49.5 | — | 69.9 | 0.386 | |
| Undefendedsetup=Federated Learning2022.02 | 43.23 | 80.31 | — | — | |
| NONENetwork=VGG162022.02 | 37.49 | 81.83 | — | — | |
| NPDBackbone=ResNet-182026.06 | 36.6 | — | 93.1 | — | |
| NONENetwork=NiN2022.02 | 34.21 | 86.94 | — | — | |
| NONENetwork=NiN2022.02 | 34.21 | 86.94 | — | — | |
| Fine-PruningBackbone=ResNet-182026.06 | 33.4 | — | 94.2 | — | |
| NADBackbone=ResNet-182026.06 | 33 | — | 94.1 | — | |
| NONENetwork=VGG162022.02 | 31.49 | 81.83 | — | — | |
| Zero-shotPrompt Attack=Original2026.01 | 20 | — | 86.7 | — | |
| Fine-tuningAttack=WaNet-All, Backbone=ResNet182024.05 | 18.03 | 92.65 | — | — | |
| BTI-DBF(U)Backbone=ResNet182024.05 | 13.12 | 91.26 | — | — | |
| Lite-BD (SW)Attack=Average2026.02 | 8.3 | — | 86.3 | 0.736 | |
| Fine-tuningAttack=Average, Backbone=ResNet182024.05 | 7.78 | 93.25 | — | — | |
| Lite-BD (RE)Attack=Average2026.02 | 7.2 | — | 88.2 | 0.821 | |
| InstantForgetBackbone=ResNet-182026.06 | 7.1 | — | 89.2 | — | |
| NONEsetup=Federated Learning2022.02 | 4.44 | 78.67 | — | — | |
| NADNetwork=ResNet18, Attack=Filter2022.02 | 4.38 | 87.91 | — | — | |
| Fine-tuningAttack=IAD-All, Backbone=ResNet182024.05 | 3.72 | 93.19 | — | — | |
| BTI-DBF(U)Attack=IAD-All, Backbone=ResNet182024.05 | 3.72 | 91.36 | — | — | |
| ABLNetwork=ResNet18, Attack=WaNet2022.02 | 2.68 | 90.79 | — | — | |
| BTI-DBF(U)Attack=Average, Backbone=ResNet182024.05 | 2.49 | 90.94 | — | — | |
| Lite-BD (RE)Attack=BadNet2026.02 | 2.4 | — | 86.5 | 0.911 | |
| Lite-BD (SW)Attack=BadNet2026.02 | 2.4 | — | 84.7 | 0.897 | |
| ABLNetwork=ResNet18, Attack=Filter2022.02 | 2.24 | 88.46 | — | — | |
| BTI-DBF(U)Attack=Bpp-All, Backbone=ResNet182024.05 | 2.05 | 90.16 | — | — | |
| BANBackbone=ResNet182024.05 | 1.97 | 92.06 | — | — | |
| BTI-DBF(U)Attack=WaNet-All, Backbone=ResNet182024.05 | 1.72 | 91.3 | — | — | |
| ABLNetwork=ResNet18, Attack=Blend2022.02 | 1.7 | 92.72 | — | — | |
| NADNetwork=ResNet18, Attack=Blend2022.02 | 1.58 | 88.24 | — | — | |
| Fine-tuningAttack=Bpp-All, Backbone=ResNet182024.05 | 1.58 | 93.9 | — | — | |
| NADNetwork=ResNet18, Attack=SIG2022.02 | 1.42 | 88.26 | — | — | |
| BANAttack=Bpp-All, Backbone=ResNet182024.05 | 1.38 | 93.23 | — | — | |
| ABLNetwork=ResNet18, Attack=SIG2022.02 | 1.29 | 91.44 | — | — | |
| BANAttack=Average, Backbone=ResNet182024.05 | 1.21 | 92.61 | — | — | |
| NONENetwork=ResNet18, Attack=Filter2022.02 | 1.2 | 89.87 | — | — | |
| NADNetwork=ResNet18, Attack=WaNet2022.02 | 1.17 | 88.81 | — | — | |
| BANAttack=IAD-All, Backbone=ResNet182024.05 | 1.13 | 92.31 | — | — | |
| BANAttack=WaNet-All, Backbone=ResNet182024.05 | 1.11 | 92.29 | — | — | |
| NONENetwork=ResNet18, Attack=SIG2022.02 | 1.08 | 93.79 | — | — | |
| NONENetwork=ResNet18, Attack=Blend2022.02 | 0.93 | 94.21 | — | — | |
| NONENetwork=ResNet18, Attack=WaNet2022.02 | 0.69 | 92.24 | — | — |