Backdoor Defense on CIFAR-10 (Attack Specific Metrics: BadNet, WaNet, BATT, PBA)
99.9Clean AccuracyDARE
Evaluation results
| Method | Links | ||||||
|---|---|---|---|---|---|---|---|
| DAREModel=ViT, Attack Scenario=Combined: Benign + PhysicalBA2025.04 | 99.9 | — | — | — | 10.1 | 10.1 | |
| DAREBackbone=12-layer ViT, Scenario=Combined: Benign + PhysicalBA2025.04 | 99.9 | — | — | — | 10.1 | 10.1 | |
| DAREModel=ViT, Attack Scenario=Combined: BadNet + BATT2025.04 | 99 | 69.2 | — | 26.8 | — | 48 | |
| WAGModel=ViT, Attack Scenario=Combined: BadNet + PhysicalBA2025.04 | 99 | 39.5 | — | — | 39.5 | 39.5 | |
| DAREModel=ViT, Attack Scenario=Combined: BadNet + PhysicalBA2025.04 | 99 | 72.2 | — | — | 72.2 | 72.2 | |
| DAREModel=ViT, Attack Scenario=Combined: Benign + BATT2025.04 | 99 | — | — | 28.2 | — | 28.2 | |
| WAGModel=ViT, Attack Scenario=Combined: Benign + PhysicalBA2025.04 | 99 | — | — | — | 10.1 | 10.1 | |
| DAREBackbone=12-layer ViT, Scenario=Combined: BadNet + BATT2025.04 | 99 | 69.2 | — | 26.8 | — | 48 | |
| WAGBackbone=12-layer ViT, Scenario=Combined: BadNet + PhysicalBA2025.04 | 99 | 39.6 | — | — | 39.5 | 39.6 | |
| TIESBackbone=12-layer ViT, Scenario=Combined: BadNet + PhysicalBA2025.04 | 99 | 38.9 | — | — | 38.9 | 38.9 | |
| DAREBackbone=12-layer ViT, Scenario=Combined: BadNet + PhysicalBA2025.04 | 99 | 72.2 | — | — | 72.2 | 72.2 | |
| WAGBackbone=12-layer ViT, Scenario=Combined: Benign + PhysicalBA2025.04 | 99 | — | — | — | 10.1 | 10.1 | |
| TIESModel=ViT, Attack Scenario=Combined: WaNet + BATT2025.04 | 98.9 | — | 10.2 | 23.9 | — | 17 | |
| DAREModel=ViT, Attack Scenario=Combined: WaNet + BATT2025.04 | 98.9 | — | 10.2 | 45.8 | — | 28 | |
| WAGModel=ViT, Attack Scenario=Combined: BadNet + BATT2025.04 | 98.9 | 10.1 | — | 42.7 | — | 26.4 | |
| TIESModel=ViT, Attack Scenario=Combined: BadNet + BATT2025.04 | 98.9 | 10.1 | — | 55.8 | — | 33 | |
| TIESModel=ViT, Attack Scenario=Combined: WaNet + PhysicalBA2025.04 | 98.9 | — | 10.1 | — | 10.3 | 10.2 | |
| DAREModel=ViT, Attack Scenario=Combined: WaNet + PhysicalBA2025.04 | 98.9 | — | 10.1 | — | 21 | 15.6 | |
| TIESModel=ViT, Attack Scenario=Combined: BadNet + PhysicalBA2025.04 | 98.9 | 43.1 | — | — | 43.1 | 43.1 | |
| WAGModel=ViT, Attack Scenario=Combined: BATT + PhysicalBA2025.04 | 98.9 | — | — | 26.8 | 10 | 18.4 | |
| DAREModel=ViT, Attack Scenario=Combined: BATT + PhysicalBA2025.04 | 98.9 | — | — | 23 | 10.1 | 16.5 | |
| WAGModel=ViT, Attack Scenario=Combined: Benign + WaNet2025.04 | 98.9 | — | 10.2 | — | — | 10.2 | |
| OursModel=ViT, Attack Scenario=Combined: Benign + PhysicalBA2025.04 | 98.9 | — | — | — | 10.1 | 10.1 | |
| WAGBackbone=12-layer ViT, Scenario=Combined: BadNet + BATT2025.04 | 98.9 | 10.1 | — | 42.9 | — | 26.5 | |
| TIESBackbone=12-layer ViT, Scenario=Combined: BadNet + BATT2025.04 | 98.9 | 10.1 | — | 47.9 | — | 29 | |
| MSDBackbone=12-layer ViT, Scenario=Combined: Benign + PhysicalBA2025.04 | 98.9 | — | — | — | 10.1 | 10.1 | |
| BenignModel=ViT, Attack Scenario=Single Attack Baselines2025.04 | 98.8 | 10.1 | 10.2 | 7.7 | 10.1 | 9.5 | |
| DAREModel=ViT, Attack Scenario=Combined: BadNet + WaNet2025.04 | 98.8 | 83.3 | 10.2 | — | — | 46.7 | |
| WAGModel=ViT, Attack Scenario=Combined: WaNet + PhysicalBA2025.04 | 98.8 | — | 10.2 | — | 10.2 | 10.2 | |
| OursModel=ViT, Attack Scenario=Combined: BATT + PhysicalBA2025.04 | 98.8 | — | — | 9.8 | 10 | 9.9 | |
| WAGModel=ViT, Attack Scenario=Combined: Benign + BadNet2025.04 | 98.8 | 19.4 | — | — | — | 19.4 | |
| TIESModel=ViT, Attack Scenario=Combined: Benign + BadNet2025.04 | 98.8 | 10.2 | — | — | — | 10.2 | |
| DAREModel=ViT, Attack Scenario=Combined: Benign + BadNet2025.04 | 98.8 | 10.3 | — | — | — | 10.3 | |
| DAREModel=ViT, Attack Scenario=Combined: Benign + WaNet2025.04 | 98.8 | — | 10.2 | — | — | 10.2 | |
| WAGModel=ViT, Attack Scenario=Combined: Benign + BATT2025.04 | 98.8 | — | — | 19.4 | — | 19.4 | |
| TIESModel=ViT, Attack Scenario=Combined: Benign + BATT2025.04 | 98.8 | — | — | 23.4 | — | 23.4 | |
| OursModel=ViT, Attack Scenario=Combined: Benign + BATT2025.04 | 98.8 | — | — | 15.8 | — | 15.8 | |
| TIESModel=ViT, Attack Scenario=Combined: Benign + PhysicalBA2025.04 | 98.8 | — | — | — | 10.2 | 10.2 | |
| BenignBackbone=12-layer ViT, Scenario=Baseline2025.04 | 98.8 | 10.1 | 10.2 | 7.7 | 10.1 | 9.5 | |
| DAREBackbone=12-layer ViT, Scenario=Combined: BadNet + WaNet2025.04 | 98.8 | 83.3 | 10.2 | — | — | 46.7 | |
| TIESBackbone=12-layer ViT, Scenario=Combined: Benign + PhysicalBA2025.04 | 98.8 | — | — | — | 10.2 | 10.2 | |
| WAGModel=ViT, Attack Scenario=Combined: BadNet + WaNet2025.04 | 98.7 | 13.8 | 10.6 | — | — | 12.2 | |
| OursModel=ViT, Attack Scenario=Combined: BadNet + WaNet2025.04 | 98.7 | 12.3 | 10.5 | — | — | 11.4 | |
| WAGModel=ViT, Attack Scenario=Combined: WaNet + BATT2025.04 | 98.7 | — | 10.2 | 22.3 | — | 16.3 | |
| OursModel=ViT, Attack Scenario=Combined: WaNet + BATT2025.04 | 98.7 | — | 10.3 | 19.1 | — | 14.7 | |
| OursModel=ViT, Attack Scenario=Combined: BadNet + BATT2025.04 | 98.7 | 10.2 | — | 32.6 | — | 21.4 | |
| OursModel=ViT, Attack Scenario=Combined: WaNet + PhysicalBA2025.04 | 98.7 | — | 10.3 | — | 10.2 | 10.2 | |
| OursModel=ViT, Attack Scenario=Combined: BadNet + PhysicalBA2025.04 | 98.7 | 18.5 | — | — | 18.4 | 18.5 | |
| TIESModel=ViT, Attack Scenario=Combined: BATT + PhysicalBA2025.04 | 98.7 | — | — | 23.4 | 10 | 16.7 | |
| OursModel=ViT, Attack Scenario=Combined: Benign + BadNet2025.04 | 98.7 | 10.3 | — | — | — | 10.3 | |
| OursModel=ViT, Attack Scenario=Combined: Benign + WaNet2025.04 | 98.7 | — | 10.3 | — | — | 10.3 | |
| WAGBackbone=12-layer ViT, Scenario=Combined: BadNet + WaNet2025.04 | 98.7 | 13.7 | 10.6 | — | — | 12.2 | |
| MSDBackbone=12-layer ViT, Scenario=Combined: BadNet + WaNet2025.04 | 98.7 | 12.3 | 10.5 | — | — | 11.4 | |
| MSDBackbone=12-layer ViT, Scenario=Combined: BadNet + BATT2025.04 | 98.7 | 10.2 | — | 32.6 | — | 21.4 | |
| MSDBackbone=12-layer ViT, Scenario=Combined: BadNet + PhysicalBA2025.04 | 98.7 | 18.5 | — | — | 18.4 | 18.5 | |
| TIESModel=ViT, Attack Scenario=Combined: BadNet + WaNet2025.04 | 98.6 | 11.9 | 10.6 | — | — | 11.3 | |
| TIESModel=ViT, Attack Scenario=Combined: Benign + WaNet2025.04 | 98.6 | — | 10.3 | — | — | 10.3 | |
| TIESBackbone=12-layer ViT, Scenario=Combined: BadNet + WaNet2025.04 | 98.6 | 11.9 | 10.7 | — | — | 11.3 | |
| VictimModel=ViT, Attack Scenario=Single Attack Baselines2025.04 | 98.5 | 96.3 | 84.7 | 99.9 | 89.4 | 92.6 | |
| VictimBackbone=12-layer ViT, Scenario=Baseline2025.04 | 98.5 | 96.3 | 84.7 | 99.9 | 89.4 | 92.6 | |
| CutMixModel=ViT, Attack Scenario=Single Attack Baselines2025.04 | 97.7 | 87.1 | 70.6 | 99.9 | 64.9 | 80.6 | |
| CutMixBackbone=12-layer ViT, Scenario=Baseline2025.04 | 97.7 | 87.1 | 70.6 | 99.9 | 64.9 | 80.6 | |
| ShrinkPadModel=ViT, Attack Scenario=Single Attack Baselines2025.04 | 97.3 | 14.4 | 51.3 | 99.9 | 88.3 | 63.5 | |
| ShrinkPadBackbone=12-layer ViT, Scenario=Baseline2025.04 | 97.3 | 14.4 | 51.3 | 99.9 | 88.3 | 63.5 |