Backdoor Defense on CIFAR-10 (Comprehensive Attack Profile)
90.22CA (BadNets)RNP
Evaluation results
| Method | Links | ||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| RNPBackbone=ResNet-182026.06 | 90.22 | 0.66 | 1.66 | 0.94 | 84.88 | 3.8 | 21.6 | 12 | 87.72 | 3.1 | 20.7 | 13.5 | 89.46 | 4.04 | 26.98 | 19.68 | 88.86 | 3.04 | 45.84 | 16.44 | 90.67 | 0.4 | 92.5 | 76.8 | 81.81 | 71.91 | 76.46 | 69.47 | 79.54 | 99.48 | 99.84 | 98.02 | 77.38 | 12.3 | 54.5 | 53.7 | 75.42 | 73.5 | 89.8 | 87.9 | 84.59 | 27.22 | 52.98 | 44.84 | |
| No DefenseBackbone=ResNet-182026.06 | 90 | 99.7 | — | — | 90.98 | 100 | — | — | 89.54 | 99.9 | — | — | 91.25 | 99.3 | — | — | 91.96 | 99.9 | — | — | 88.18 | 99.1 | — | — | 88.81 | 99.44 | — | — | 91.18 | 99.78 | — | — | 90.64 | 84.9 | — | — | 90.73 | 88 | — | — | 90.32 | 97 | — | — | |
| IBUBackbone=ResNet-18, Strategy=Idealized backdoor unlearning2026.06 | 87.95 | 0.1 | 0 | 7.1 | 88.42 | 0 | 0 | 0 | 87.57 | 0.3 | 0.1 | 0.1 | 91 | 2.6 | 70.8 | 4.3 | 87.05 | 1 | 0.8 | 1.4 | 85.03 | 0 | 26.1 | 1.5 | 85.89 | 0 | 0 | 0.11 | 86.28 | 0.48 | 2.6 | 0.28 | 86.96 | 0 | 0 | 0 | 87.35 | 0 | 0 | 0 | 87.35 | 0.44 | 10.04 | 1.47 | |
| BTI-DBFBackbone=ResNet-182026.06 | 86.64 | 5.4 | 88.6 | 61.4 | 88.87 | 82.6 | 96.5 | 76.9 | 85.67 | 8 | 97.7 | 79.3 | 85.1 | 20.6 | 88.7 | 81.4 | 86.95 | 3.8 | 29.1 | 11.7 | 82.61 | 1.8 | 2.3 | 2.3 | 84.27 | 83.26 | 92.86 | 69.76 | 85.78 | 1.44 | 95.42 | 92.16 | 85.46 | 30.4 | 61.2 | 61.4 | 87.75 | 16.8 | 31 | 25.6 | 85.91 | 25.49 | 68.33 | 56.19 | |
| ANPBackbone=ResNet-182026.06 | 86.25 | 0.6 | 3.6 | 2.4 | 85.04 | 4.3 | 27.5 | 37.3 | 85.93 | 0.6 | 6.9 | 2.5 | 88.47 | 0.7 | 75 | 71 | 88.06 | 4.2 | 51.6 | 20.6 | 88.12 | 0.7 | 44.9 | 37.8 | 83.87 | 11.95 | 71.17 | 57.4 | 87.1 | 97.52 | 99.34 | 98.62 | 87.27 | 17.3 | 62.6 | 61.5 | 83.32 | 32.9 | 70.9 | 60.8 | 86.34 | 17.07 | 51.35 | 44.99 | |
| PAMBackbone=ResNet-182026.06 | 85.83 | 0 | 58.1 | 11 | 88.1 | 0.4 | 20 | 0.2 | 80.1 | 20.3 | 19.4 | 16.6 | 82.68 | 6.7 | 82.5 | 68.2 | 77.61 | 8.3 | 9.6 | 6.5 | 78.1 | 5.8 | 1.9 | 2.1 | 80.89 | 4.04 | 69.62 | 34.16 | 86.42 | 0 | 72.66 | 57.94 | 85.36 | 54.7 | 72.5 | 72.2 | 86.4 | 28.4 | 45.6 | 38.3 | 83.14 | 12.86 | 45.18 | 30.72 | |
| SAUBackbone=ResNet-182026.06 | 85.21 | 3 | 96.9 | 42.1 | 85.52 | 8 | 45.2 | 24.5 | 83.71 | 1.8 | 96.1 | 51.1 | 85.31 | 3.1 | 88.5 | 47.3 | 85.75 | 6.8 | 68.5 | 17.6 | 80.81 | 2.7 | 73.5 | 25.4 | 82.56 | 35.22 | 88.06 | 68.44 | 85.86 | 10.3 | 93.78 | 71.1 | 84.1 | 5.5 | 72.9 | 69.4 | 85.42 | 31.9 | 53.9 | 40.5 | 84.42 | 10.83 | 77.73 | 45.74 | |
| BI-BAU (T)Backbone=ResNet-18, Setting=Targeted AT2026.06 | 83.81 | 2.4 | 3.7 | 2.7 | 84.7 | 1.6 | 8.9 | 3.6 | 85.48 | 2.2 | 12.3 | 4.2 | 86.42 | 4.3 | 11.8 | 3.9 | 86.7 | 5.1 | 13.3 | 8.3 | 84.61 | 1.6 | 2.8 | 1.5 | 77.22 | 1.6 | 64.24 | 14.47 | 77.22 | 1.6 | 23.38 | 6.7 | 84.54 | 2.9 | 6.1 | 3 | 85.16 | 16.4 | 20.9 | 17 | 83.57 | 3.97 | 16.74 | 6.53 | |
| BI-BAU (U)Backbone=ResNet-18, Setting=Untargeted AT2026.06 | 83.74 | 2.7 | 3.6 | 2.8 | 86.78 | 0.1 | 4.3 | 4.7 | 86.05 | 1.3 | 12.8 | 0.1 | 86.38 | 1.4 | 11.6 | 2.9 | 86.25 | 3.8 | 7 | 4.6 | 83.74 | 2.1 | 7 | 14.8 | 82.29 | 0.46 | 33.77 | 2.4 | 83.34 | 9.86 | 20.92 | 8.38 | 82.84 | 2.5 | 4.9 | 2.7 | 80.45 | 14.9 | 19 | 14.2 | 84.18 | 3.91 | 12.48 | 5.75 |