Backdoor Defense on CIFAR-10 (test)
0ASRFine Pruning
Evaluation results
| Method | Links | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Fine Pruningdefense_setup=data-free, data_source=recovered images2021.12 | 0 | 27.27 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| No DefenseAttack Type=None2023.03 | 0 | 89.14 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| FPAttack Type=None2023.03 | 0 | 85.17 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| CBDAttack Type=None2023.03 | 0 | 88.95 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PRISMAttack=BadNet, Attack Category=Classic2026.01 | 0 | 93.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PRISMAttack=Blend, Attack Category=Classic2026.01 | 0 | 94.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PRISMAttack=WaNet, Attack Category=Dynamic2026.01 | 0 | 93.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PRISMAttack=IAB, Attack Category=Dynamic2026.01 | 0 | 92.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PRISMAttack=SSBA, Attack Category=Dynamic2026.01 | 0 | 93.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PRISMAttack=CTRL, Attack Category=Clean Label2026.01 | 0 | 94.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PRISMAttack=LC, Attack Category=Clean Label2026.01 | 0 | 94.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| T&RAttack=SIG, Backbone=WRN16-12022.10 | 0.02 | 82.97 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| T&R (Ours)Attack=SIG, Backbone=WRN16-1, Clean holdout ratio=5%2022.10 | 0.02 | 82.97 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ShapPruningBackbone=VGG, Trigger Type=Original2021.12 | 0.03 | 85.66 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NPD-TUAttack=Blended, Backbone=PreAct-ResNet18, Benign data ratio=5%, Poison ratio=10%2023.06 | 0.03 | 91.88 | — | 98.06 | — | — | — | — | — | — | — | — | — | — | — | — | |
| ANPAttack=SIG, Backbone=WRN16-12022.10 | 0.05 | 85.67 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ANPAttack=SIG, Backbone=WRN16-1, Clean holdout ratio=5%2022.10 | 0.05 | 85.67 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ShapPruningBackbone=VGG, Trigger Type=Synthesized2021.12 | 0.06 | 85.63 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NPD-TUAttack=Input-Aware, Backbone=PreAct-ResNet18, Benign data ratio=5%, Poison ratio=10%2023.06 | 0.14 | 92.01 | — | 98.1 | — | — | — | — | — | — | — | — | — | — | — | — | |
| IADefense=Fine-pruning2024.03 | 0.17 | — | 91.07 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| CBDAttack Type=SIG2023.03 | 0.25 | 87.29 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| BadNetsDefense=ANP2024.03 | 0.32 | — | 89.15 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ABLAttack Type=SIG2023.03 | 0.36 | 88.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Naive VLM Zero-shotAttack=Average, Attack Category=Aggregate2026.01 | 0.4 | 86.7 | — | — | — | — | — | — | — | — | — | — | 5.3 | 96 | — | — | |
| NPDAttack=Blended, Backbone=PreAct-ResNet18, Benign data ratio=5%, Poison ratio=10%2023.06 | 0.41 | 91.18 | — | 97.52 | — | — | — | — | — | — | — | — | — | — | — | — | |
| DBDAttack Type=SIG2023.03 | 0.44 | 87.52 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PBEclean extra dataset=true2022.02 | 0.46 | 94.32 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| BadNetsDefense=Fine-pruning2024.03 | 0.53 | — | 91.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| WaNetDefense=ANP2024.03 | 0.54 | — | 89.07 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ANPclean extra dataset=true2022.02 | 0.62 | 93.36 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NPD-TPAttack=BadNets-A2O, Backbone=PreAct-ResNet18, Benign data ratio=5%, Poison ratio=10%2023.06 | 0.62 | 90.9 | — | 96.12 | — | — | — | — | — | — | — | — | — | — | — | — | |
| Neural Cleanseclean extra dataset=true2022.02 | 0.63 | 93.28 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NONEAverage Runtime=3,149.7s2022.02 | 0.69 | — | 92.24 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| T&RAttack=l2-Invisible, Backbone=WRN16-12022.10 | 0.74 | 84.01 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| T&R (Ours)Attack=l_2-Invisible, Backbone=WRN16-1, Clean holdout ratio=5%2022.10 | 0.74 | 84.01 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NPDAttack=WaNet, Backbone=PreAct-ResNet18, Benign data ratio=5%, Poison ratio=10%2023.06 | 0.8 | 91.57 | — | 98.43 | — | — | — | — | — | — | — | — | — | — | — | — | |
| BadNetsDefense=NAD2024.03 | 0.8 | — | 87.81 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PRISMAttack=Average, Attack Category=Aggregate2026.01 | 0.8 | 93.2 | — | — | — | — | — | — | — | — | — | — | 1.2 | 95.6 | — | — | |
| Neural Cleanseclean extra dataset=true2022.02 | 0.83 | 93.73 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NPD-TPAttack=Blended, Backbone=PreAct-ResNet18, Benign data ratio=5%, Poison ratio=10%2023.06 | 0.83 | 91.33 | — | 97.38 | — | — | — | — | — | — | — | — | — | — | — | — | |
| FPAttack=BadNets-A2O, Backbone=PreAct-ResNet18, Benign data ratio=5%, Poison ratio=10%2023.06 | 0.84 | 91.77 | — | 96.45 | — | — | — | — | — | — | — | — | — | — | — | — | |
| PBEclean extra dataset=false2022.02 | 0.86 | 93.67 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| CBDAttack Type=Dynamic2023.03 | 0.86 | 85.67 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ShapPruningdefense_setup=data-free, data_source=recovered images2021.12 | 0.9 | 83.04 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NONEAverage Runtime=3,149.7s2022.02 | 0.93 | — | 94.21 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PBEclean extra dataset=true2022.02 | 0.93 | 93.98 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DBDAverage Runtime=18,988.4s2022.02 | 0.95 | — | 90.98 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ANPAttack=LCBA, Backbone=WRN16-12022.10 | 1.02 | 84.21 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ANPAttack=LCBA, Backbone=WRN16-1, Clean holdout ratio=5%2022.10 | 1.02 | 84.21 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| CBDAttack Type=BadNets2023.03 | 1.06 | 87.46 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NONEAverage Runtime=3,149.7s2022.02 | 1.07 | — | 93.62 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| WaNetDefense=Fine-pruning2024.03 | 1.07 | — | 90.22 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NONEAverage Runtime=3,149.7s2022.02 | 1.08 | — | 93.79 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PBEclean extra dataset=true2022.02 | 1.09 | 94.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PRISMAttack=BPP, Attack Category=Dynamic2026.01 | 1.1 | 93.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PRISMAttack=FLIP, Attack Category=Clean Image2026.01 | 1.1 | 91.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PBEclean extra dataset=false2022.02 | 1.12 | 93.01 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PBEclean extra dataset=true2022.02 | 1.12 | 93.01 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PBEclean extra dataset=false2022.02 | 1.16 | 93.04 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NONEAverage Runtime=3,149.7s2022.02 | 1.2 | — | 89.87 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| T&RAttack=BadNet-Grid, Backbone=WRN16-12022.10 | 1.21 | 84.42 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| T&R (Ours)Attack=BadNet-Grid, Backbone=WRN16-1, Clean holdout ratio=5%2022.10 | 1.21 | 84.42 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| CBDAttack Type=Trojan2023.03 | 1.24 | 87.52 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DBDAverage Runtime=18,988.4s2022.02 | 1.25 | — | 91.24 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| EPAttack=BadNets-A2O, Backbone=PreAct-ResNet18, Benign data ratio=5%, Poison ratio=10%2023.06 | 1.26 | 89.8 | — | 95.26 | — | — | — | — | — | — | — | — | — | — | — | — | |
| NPDAttack=BadNets-A2O, Backbone=PreAct-ResNet18, Benign data ratio=5%, Poison ratio=10%2023.06 | 1.26 | 88.93 | — | 94.82 | — | — | — | — | — | — | — | — | — | — | — | — | |
| ANPclean extra dataset=true2022.02 | 1.27 | 92.48 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ANPclean extra dataset=true2022.02 | 1.36 | 93.42 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| WaNetDefense=Fine-tuning2024.03 | 1.37 | — | 89.56 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PBEclean extra dataset=true2022.02 | 1.39 | 93.35 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| WaNetDefense=NAD2024.03 | 1.4 | — | 89.74 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DBDAverage Runtime=18,988.4s2022.02 | 1.42 | — | 88.75 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NPD-TUAttack=BadNets-A2O, Backbone=PreAct-ResNet18, Benign data ratio=5%, Poison ratio=10%2023.06 | 1.44 | 90.81 | — | 95.67 | — | — | — | — | — | — | — | — | — | — | — | — | |
| DBDAverage Runtime=18,988.4s2022.02 | 1.51 | — | 91.55 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NADclean extra dataset=true2022.02 | 1.6 | 90.13 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NCAttack=BadNets-A2O, Backbone=PreAct-ResNet18, Benign data ratio=5%, Poison ratio=10%2023.06 | 1.62 | 90.27 | — | 95.31 | — | — | — | — | — | — | — | — | — | — | — | — | |
| ANPclean extra dataset=true2022.02 | 1.66 | 93.39 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| BadNetsDefense=Fine-tuning2024.03 | 1.74 | — | 89.31 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PBEclean extra dataset=false2022.02 | 1.76 | 93.56 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Neural Cleanseclean extra dataset=true2022.02 | 1.79 | 92.23 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NADAttack Type=SIG2023.03 | 1.79 | 83.54 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ANPclean extra dataset=true2022.02 | 1.81 | 92.03 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DBDAverage Runtime=18,988.4s2022.02 | 1.87 | — | 91.08 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| I-BAUAttack=SIG, Backbone=WRN16-12022.10 | 1.89 | 77.05 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| I-BAUAttack=SIG, Backbone=WRN16-1, Clean holdout ratio=5%2022.10 | 1.89 | 77.05 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DBDAverage Runtime=18,988.4s2022.02 | 1.96 | — | 92.03 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| CBDAttack Type=Blend2023.03 | 1.96 | 87.48 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NADAttack=BadNets-A2O, Backbone=PreAct-ResNet18, Benign data ratio=5%, Poison ratio=10%2023.06 | 1.96 | 88.82 | — | 94.42 | — | — | — | — | — | — | — | — | — | — | — | — | |
| IADefense=ANP2024.03 | 1.98 | — | 88.73 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NONEAverage Runtime=3,149.7s2022.02 | 2.14 | — | 94.01 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NADclean extra dataset=true2022.02 | 2.17 | 88.09 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| LIRADefense=Fine-tuning2024.03 | 2.19 | — | 89.96 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| PRISMAttack=SIG, Attack Category=Clean Label2026.01 | 2.2 | 92.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| IADefense=NAD2024.03 | 2.29 | — | 87.14 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| BI-BAU(U)Backbone=ResNet-18, Attack=Enhanced Adap-Blend2026.06 | 2.3 | 74.76 | — | — | — | — | — | — | — | — | — | — | — | — | 6.6 | 2.3 | |
| LIRADefense=NAD2024.03 | 2.32 | — | 90.23 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ANPAttack=BadNet-Grid, Backbone=WRN16-12022.10 | 2.64 | 84.55 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| I-BAUAttack=l2-Invisible, Backbone=WRN16-12022.10 | 2.64 | 82.48 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ANPAttack=BadNet-Grid, Backbone=WRN16-1, Clean holdout ratio=5%2022.10 | 2.64 | 84.55 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| I-BAUAttack=l_2-Invisible, Backbone=WRN16-1, Clean holdout ratio=5%2022.10 | 2.64 | 82.48 | — | — | — | — | — | — | — | — | — | — | — | — | — | — |