Backdoor Defense on CIFAR-10 (Overall Accuracy and ASR)
94.25Overall AccuracyNo Defense
Evaluation results
| Method | Links | ||
|---|---|---|---|
| No DefenseModel=ResNet18, Attack=CLB2026.07 | 94.25 | 100 | |
| Trojaned model2026.03 | 94.01 | 99.79 | |
| No DefenseModel=ResNet18, Attack=Blend2026.07 | 94.01 | 100 | |
| D-STModel=ResNet18, Attack=Trojan2026.07 | 93.97 | 0.22 | |
| HARVEYModel=ResNet18, Attack=Trojan2026.07 | 93.96 | 0.93 | |
| No DefenseModel=ResNet18, Attack=BadNets2026.07 | 93.8 | 100 | |
| No DefenseModel=ResNet18, Attack=Average2026.07 | 93.73 | 99.99 | |
| No DefenseModel=ResNet18, Attack=IAB2026.07 | 93.62 | 100 | |
| D-STModel=ResNet18, Attack=IAB2026.07 | 93.6 | — | |
| No DefenseModel=ResNet18, Attack=Trojan2026.07 | 93.58 | 100 | |
| HARVEYModel=ResNet18, Attack=WaNet2026.07 | 93.56 | 1.22 | |
| HARVEYModel=ResNet18, Attack=Average2026.07 | 93.56 | 0.85 | |
| Dynamic edited modeln=202026.03 | 93.55 | 0.16 | |
| HARVEYModel=ResNet18, Attack=CLB2026.07 | 93.52 | 0.49 | |
| Dynamic edited modeln=12026.03 | 93.37 | 0.65 | |
| HARVEYModel=ResNet18, Attack=Blend2026.07 | 93.37 | 0.58 | |
| No DefenseModel=ResNet18, Attack=WaNet2026.07 | 93.36 | 99.92 | |
| No DefenseModel=ResNet18, Attack=Worst Case2026.07 | 93.36 | 100 | |
| HARVEYModel=ResNet18, Attack=BadNets2026.07 | 93.34 | 0.56 | |
| Static edited modeln=12026.03 | 93.32 | 4.49 | |
| DBDModel=ResNet18, Attack=Trojan2026.07 | 93.31 | 99.99 | |
| ABLModel=ResNet18, Attack=IAB2026.07 | 93.3 | 6.32 | |
| DBDModel=ResNet18, Attack=BadNets2026.07 | 93.24 | 14.65 | |
| HARVEYModel=ResNet18, Attack=IAB2026.07 | 93.11 | 0.77 | |
| HARVEYModel=ResNet18, Attack=Worst Case2026.07 | 93.11 | 1.43 | |
| D-STModel=ResNet18, Attack=WaNet2026.07 | 93.09 | 99.72 | |
| DBDModel=ResNet18, Attack=WaNet2026.07 | 93.03 | 15.27 | |
| DBDModel=ResNet18, Attack=CLB2026.07 | 93.01 | 100 | |
| Fine-tuned modeln=202026.03 | 92.85 | 9.7 | |
| CBDModel=ResNet18, Attack=CLB2026.07 | 92.83 | 0.19 | |
| CBDModel=ResNet18, Attack=IAB2026.07 | 92.39 | 69.1 | |
| D-STModel=ResNet18, Attack=BadNets2026.07 | 92.27 | 0.01 | |
| D-STModel=ResNet18, Attack=CLB2026.07 | 91.96 | 0.26 | |
| D-STModel=ResNet18, Attack=Average2026.07 | 91.62 | 25.46 | |
| Fine-tuned modeln=12026.03 | 91.59 | 69.07 | |
| ABLModel=ResNet18, Attack=Trojan2026.07 | 91.59 | 1.24 | |
| DBDModel=ResNet18, Attack=Average2026.07 | 91.46 | 73.04 | |
| CBDModel=ResNet18, Attack=Trojan2026.07 | 91.4 | 1.92 | |
| No DefenseModel=WRN16-1, Attack=CLB2026.07 | 90.96 | 99.87 | |
| ABLModel=ResNet18, Attack=BadNets2026.07 | 90.67 | 0.37 | |
| DBDModel=ResNet18, Attack=Blend2026.07 | 90.27 | 99.91 | |
| No DefenseModel=WRN16-1, Attack=IAB2026.07 | 90.18 | 99.8 | |
| CBDModel=ResNet18, Attack=Average2026.07 | 90.09 | 16.41 | |
| D-STModel=ResNet18, Attack=Blend2026.07 | 89.93 | 55.48 | |
| No DefenseModel=WRN16-1, Attack=Trojan2026.07 | 89.91 | 99.93 | |
| HARVEYModel=WRN16-1, Attack=CLB2026.07 | 89.85 | 0.83 | |
| No DefenseModel=WRN16-1, Attack=BadNets2026.07 | 89.8 | 100 | |
| No DefenseModel=WRN16-1, Attack=Blend2026.07 | 89.8 | 98.78 | |
| No DefenseModel=WRN16-1, Attack=Average2026.07 | 89.64 | 99.49 | |
| HARVEYModel=WRN16-1, Attack=BadNets2026.07 | 89.52 | 1.5 | |
| HARVEYModel=WRN16-1, Attack=Blend2026.07 | 89.4 | 0.99 | |
| D-STModel=WRN16-1, Attack=BadNets2026.07 | 89.04 | 99.97 | |
| HARVEYModel=WRN16-1, Attack=Average2026.07 | 88.91 | 1.19 | |
| D-STModel=WRN16-1, Attack=Trojan2026.07 | 88.88 | 98.93 | |
| HARVEYModel=WRN16-1, Attack=Trojan2026.07 | 88.82 | 1.83 | |
| ABLModel=ResNet18, Attack=WaNet2026.07 | 88.74 | 55.81 | |
| HARVEYModel=WRN16-1, Attack=IAB2026.07 | 88.72 | 1.66 | |
| CBDModel=ResNet18, Attack=WaNet2026.07 | 88.49 | 32.73 | |
| ABLModel=ResNet18, Attack=Average2026.07 | 88.49 | 11.23 | |
| No DefenseModel=WRN16-1, Attack=WaNet2026.07 | 88.31 | 98.55 | |
| No DefenseModel=WRN16-1, Attack=Worst Case2026.07 | 88.31 | 100 | |
| CBDModel=ResNet18, Attack=BadNets2026.07 | 88.19 | 1.48 | |
| CBDModel=WRN16-1, Attack=CLB2026.07 | 88.18 | 0 | |
| CBDModel=WRN16-1, Attack=BadNets2026.07 | 87.95 | 1.06 | |
| DBDModel=ResNet18, Attack=IAB2026.07 | 87.91 | 83.23 | |
| DBDModel=ResNet18, Attack=Worst Case2026.07 | 87.91 | 100 | |
| CBDModel=WRN16-1, Attack=Trojan2026.07 | 87.85 | 1.04 | |
| ABLModel=ResNet18, Attack=Blend2026.07 | 87.66 | 6.59 | |
| D-STModel=WRN16-1, Attack=Blend2026.07 | 87.62 | 99.8 | |
| D-STModel=WRN16-1, Attack=Average2026.07 | 87.31 | 82.87 | |
| HARVEYModel=WRN16-1, Attack=WaNet2026.07 | 87.15 | 0.3 | |
| HARVEYModel=WRN16-1, Attack=Worst Case2026.07 | 87.15 | 1.83 | |
| D-STModel=WRN16-1, Attack=CLB2026.07 | 87.06 | 0 | |
| D-STModel=ResNet18, Attack=Worst Case2026.07 | 86.51 | 99.72 | |
| CBDModel=ResNet18, Attack=Blend2026.07 | 86.33 | 5.77 | |
| CBDModel=ResNet18, Attack=Worst Case2026.07 | 86.33 | 69.1 | |
| D-STModel=WRN16-1, Attack=WaNet2026.07 | 86.27 | 98.81 | |
| CBDModel=WRN16-1, Attack=IAB2026.07 | 86.07 | 1.04 | |
| CBDModel=WRN16-1, Attack=Average2026.07 | 85.89 | 15.04 | |
| ABLModel=WRN16-1, Attack=IAB2026.07 | 85.36 | 9.03 | |
| CBDModel=WRN16-1, Attack=WaNet2026.07 | 85.12 | 2 | |
| D-STModel=WRN16-1, Attack=IAB2026.07 | 84.96 | 99.68 | |
| D-STModel=WRN16-1, Attack=Worst Case2026.07 | 84.96 | 99.97 | |
| ABLModel=WRN16-1, Attack=Trojan2026.07 | 84.91 | 4.49 | |
| ABLModel=WRN16-1, Attack=WaNet2026.07 | 84.9 | 4.14 | |
| ABLModel=WRN16-1, Attack=Average2026.07 | 82.82 | 5.54 | |
| ABLModel=WRN16-1, Attack=BadNets2026.07 | 82.72 | 4.46 | |
| Vanilla FL2026.06 | 81.67 | 98.39 | |
| ABLModel=WRN16-1, Attack=CLB2026.07 | 80.74 | 0.83 | |
| CBDModel=WRN16-1, Attack=Blend2026.07 | 80.17 | 85.12 | |
| CBDModel=WRN16-1, Attack=Worst Case2026.07 | 80.17 | 85.12 | |
| ABLModel=ResNet18, Attack=CLB2026.07 | 79.39 | 0.84 | |
| ABLModel=ResNet18, Attack=Worst Case2026.07 | 79.39 | 55.81 | |
| ABLModel=WRN16-1, Attack=Blend2026.07 | 78.3 | 10.27 | |
| ABLModel=WRN16-1, Attack=Worst Case2026.07 | 78.3 | 10.27 | |
| SCRUB-FL2026.06 | 77.88 | 4.04 | |
| Fine-Pruning2026.06 | 72.65 | 8.67 | |
| DBDModel=WRN16-1, Attack=Blend2026.07 | 71.08 | 7.79 | |
| DBDModel=WRN16-1, Attack=BadNets2026.07 | 70.53 | 6.61 | |
| DBDModel=WRN16-1, Attack=CLB2026.07 | 70.16 | 100 |