Backdoor Defense on CIFAR-10 1% (train)
93.73Badnets Defense ACCBefore
Evaluation Results
| Method | Links | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| BeforeBackbone=ResNet-18, Clean data percentage=1%, Defense method=None2021.10 | 93.73 | 94.82 | 93.89 | 94.1 | 93.78 | 93.64 | 99.97 | 100 | 98.49 | 92.88 | 99.94 | 94.26 | — | |
| FPBackbone=ResNet-18, Clean data percentage=1%, Defense method=Fine-pruning2021.10 | 92.18 | 92.4 | 91.57 | 92.28 | 91.91 | 91.64 | 5.34 | 65.39 | 20.73 | 32.36 | 3.4 | 0.32 | 76.33 | |
| FTBackbone=ResNet-18, Clean data percentage=1%, lr (learning rate)=0.01, Defense method=Standard fine-tuning2021.10 | 90.48 | 92.12 | 88.68 | 89.06 | 91.26 | 91.19 | 11.7 | 47.17 | 0.99 | 1.36 | 12.51 | 0.4 | 85.24 | |
| ANPBackbone=ResNet-18, Clean data percentage=1%, perturbation budget ϵ=0.4, trade-off coefficient α=0.2, learning rate=0.2, Defense method=Adversarial Neuron Pruning2021.10 | 90.2 | 93.44 | 92.62 | 92.79 | 92.67 | 93.4 | 0.45 | 0.46 | 0.88 | 0.86 | 3.98 | 0.28 | 96.44 | |
| FTBackbone=ResNet-18, Clean data percentage=1%, lr (learning rate)=0.02, Defense method=Standard fine-tuning2021.10 | 87.23 | 88.98 | 84.85 | 83.77 | 88.25 | 88.63 | 2.95 | 10.2 | 1.7 | 1.83 | 1.17 | 0.39 | 94.55 | |
| MCRBackbone=ResNet-18, Clean data percentage=1%, t (threshold)=0.3, Defense method=Mode connectivity repair2021.10 | 85.95 | 88.26 | 86.3 | 84.53 | 86.87 | 85.88 | 5.7 | 13.57 | 30.23 | 35.17 | 12.77 | 0.52 | 81.26 |