Backdoor Defense on GTSRB
99.49CAIBU
Evaluation results
| Method | Links | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| IBUAttack=BadNets, Backbone=VGG192026.06 | 99.49 | — | 0 | — | — | — | — | — | 3.3 | 0 | |
| IBUAttack=IAD, Backbone=VGG192026.06 | 99.09 | — | 0 | — | — | — | — | — | 0.01 | 0 | |
| IBUAttack=SIG, Backbone=VGG192026.06 | 98.85 | — | 0 | — | — | — | — | — | 0.72 | 0.36 | |
| IBUAttack=Adaptive-Patch, Backbone=VGG192026.06 | 98.75 | — | 0 | — | — | — | — | — | 0 | 0 | |
| IBUAttack=Refool, Backbone=VGG192026.06 | 98.66 | — | 0 | — | — | — | — | — | 0.01 | 0 | |
| IBUAttack=ISSBA, Backbone=VGG192026.06 | 98.64 | — | 0 | — | — | — | — | — | 0 | 0 | |
| IBUAttack=Average, Backbone=VGG192026.06 | 98.54 | — | 0 | — | — | — | — | — | 0.4 | 0.05 | |
| IBUAttack=Adaptive-Blend, Backbone=VGG192026.06 | 98.46 | — | 0 | — | — | — | — | — | 0 | 0.16 | |
| IndividualBackbone=ViT-L/14, Attack Type=BadMerging2026.06 | 98.15 | — | — | — | — | — | — | 2.16 | — | — | |
| No DefenseArchitecture=PreActResNet18, Attack=FTROJAN2026.02 | 98.12 | 0 | — | — | — | — | — | — | — | — | |
| BTI-DBFAttack=Adaptive-Patch, Backbone=VGG192026.06 | 97.65 | — | 10.6 | — | — | — | — | — | 33.49 | 23.83 | |
| IBUAttack=Blended, Backbone=VGG192026.06 | 97.55 | — | 0 | — | — | — | — | — | 0 | 0 | |
| No DefenseArchitecture=PreActResNet18, Attack=INPUTAWARE2026.02 | 97.53 | 6.17 | — | — | — | — | — | — | — | — | |
| No DefenseAttack=Adaptive-Patch, Backbone=VGG192026.06 | 97.44 | — | 60.64 | — | — | — | — | — | — | — | |
| No DefenseAttack=IAD, Backbone=VGG192026.06 | 97.41 | — | 99.65 | — | — | — | — | — | — | — | |
| BTI-DBFAttack=BadNets, Backbone=VGG192026.06 | 97.41 | — | 0.03 | — | — | — | — | — | 0.23 | 0.17 | |
| No DefenseAttack=ISSBA, Backbone=VGG192026.06 | 97.4 | — | 51.93 | — | — | — | — | — | — | — | |
| IBUAttack=WaNet, Backbone=VGG192026.06 | 97.39 | — | 0 | — | — | — | — | — | 0 | 0 | |
| No DefenseAttack=WaNet, Backbone=VGG192026.06 | 97.33 | — | 99.68 | — | — | — | — | — | — | — | |
| BTI-DBFAttack=IAD, Backbone=VGG192026.06 | 97.27 | — | 0.12 | — | — | — | — | — | 16.54 | 0.46 | |
| ANPAttack=WaNet, Backbone=VGG192026.06 | 97.25 | — | 0 | — | — | — | — | — | 99.76 | 75.3 | |
| ANPAttack=ISSBA, Backbone=VGG192026.06 | 97.2 | — | 0 | — | — | — | — | — | 28.1 | 28.03 | |
| No DefenseArchitecture=PreActResNet18, Attack=BLENDED2026.02 | 97.06 | 0.27 | — | — | — | — | — | — | — | — | |
| BTI-DBFAttack=Refool, Backbone=VGG192026.06 | 97.02 | — | 57.41 | — | — | — | — | — | 86.82 | 81.14 | |
| BTI-DBFAttack=Average, Backbone=VGG192026.06 | 96.85 | — | 13.85 | — | — | — | — | — | 35.54 | 23.99 | |
| No DefenseAttack=SIG, Backbone=VGG192026.06 | 96.81 | — | 66.12 | — | — | — | — | — | — | — | |
| No DefenseArchitecture=PreActResNet18, Attack=BPP2026.02 | 96.8 | 0.24 | — | — | — | — | — | — | — | — | |
| No DefenseArchitecture=PreActResNet18, Attack=WANET2026.02 | 96.79 | 7.06 | — | — | — | — | — | — | — | — | |
| No DefenseAttack=Average, Backbone=VGG192026.06 | 96.76 | — | 71.88 | — | — | — | — | — | — | — | |
| ANPAttack=IAD, Backbone=VGG192026.06 | 96.76 | — | 0 | — | — | — | — | — | 96.31 | 24.8 | |
| PAMAttack=ISSBA, Backbone=VGG192026.06 | 96.69 | — | 0 | — | — | — | — | — | 0 | 0 | |
| BTI-DBFAttack=SIG, Backbone=VGG192026.06 | 96.68 | — | 45.23 | — | — | — | — | — | 50.88 | 40.56 | |
| BTI-DBFAttack=WaNet, Backbone=VGG192026.06 | 96.59 | — | 10.37 | — | — | — | — | — | 99.84 | 56.37 | |
| BTI-DBFAttack=Adaptive-Blend, Backbone=VGG192026.06 | 96.54 | — | 0.79 | — | — | — | — | — | 30.95 | 11.08 | |
| BTI-DBFAttack=ISSBA, Backbone=VGG192026.06 | 96.52 | — | 0 | — | — | — | — | — | 1.18 | 0 | |
| No DefenseAttack=Refool, Backbone=VGG192026.06 | 96.37 | — | 93.98 | — | — | — | — | — | — | — | |
| RNPAttack=WaNet, Backbone=VGG192026.06 | 96.34 | — | 0 | — | — | — | — | — | 63.34 | 0 | |
| BI-BAU(U)Attack=BadNets, Backbone=VGG192026.06 | 96.32 | — | 0.03 | — | — | — | — | — | 0.39 | 0.03 | |
| ANPAttack=SIG, Backbone=VGG192026.06 | 96.23 | — | 42.7 | — | — | — | — | — | 55.84 | 47.37 | |
| No DefenseAttack=Adaptive-Blend, Backbone=VGG192026.06 | 96.21 | — | 51.54 | — | — | — | — | — | — | — | |
| Vanilla FL2026.06 | 96.18 | — | 99.08 | — | — | — | — | — | — | — | |
| PAMAttack=WaNet, Backbone=VGG192026.06 | 96.15 | — | 0 | — | — | — | — | — | 0 | 0 | |
| No DefenseArchitecture=PreActResNet18, Attack=BADNETS2026.02 | 96.05 | 3.73 | — | — | — | — | — | — | — | — | |
| SAUAttack=Refool, Backbone=VGG192026.06 | 96.02 | — | 50.6 | — | — | — | — | — | 92.35 | 76.36 | |
| BTI-DBFAttack=Blended, Backbone=VGG192026.06 | 96.01 | — | 0.15 | — | — | — | — | — | 0 | 2.3 | |
| No DefenseAttack=BadNets, Backbone=VGG192026.06 | 96 | — | 95.94 | — | — | — | — | — | — | — | |
| PAMAttack=Blended, Backbone=VGG192026.06 | 95.83 | — | 0 | — | — | — | — | — | 0 | 0 | |
| PAMAttack=BadNets, Backbone=VGG192026.06 | 95.75 | — | 0 | — | — | — | — | — | 0.01 | 0 | |
| SAUAttack=ISSBA, Backbone=VGG192026.06 | 95.74 | — | 0 | — | — | — | — | — | 1.66 | 0 | |
| SAUAttack=Adaptive-Blend, Backbone=VGG192026.06 | 95.68 | — | 0 | — | — | — | — | — | 0 | 0 | |
| ANPAttack=Refool, Backbone=VGG192026.06 | 95.56 | — | 6.2 | — | — | — | — | — | 66.66 | 19.89 | |
| SAUAttack=BadNets, Backbone=VGG192026.06 | 95.5 | — | 0 | — | — | — | — | — | 0.01 | 0 | |
| SAUAttack=WaNet, Backbone=VGG192026.06 | 95.5 | — | 0 | — | — | — | — | — | 74.34 | 19.95 | |
| ANPAttack=Adaptive-Patch, Backbone=VGG192026.06 | 95.47 | — | 11.9 | — | — | — | — | — | 35.23 | 32.22 | |
| SAUAttack=Adaptive-Patch, Backbone=VGG192026.06 | 95.43 | — | 0.15 | — | — | — | — | — | 10.6 | 0.24 | |
| ANPAttack=BadNets, Backbone=VGG192026.06 | 95.37 | — | 0.01 | — | — | — | — | — | 60.68 | 25.53 | |
| ANPAttack=Average, Backbone=VGG192026.06 | 95.26 | — | 10.64 | — | — | — | — | — | 63.54 | 38.14 | |
| PAMAttack=Adaptive-Patch, Backbone=VGG192026.06 | 95.25 | — | 0 | — | — | — | — | — | 34.36 | 0 | |
| No DefenseAttack=Blended, Backbone=VGG192026.06 | 95.24 | — | 99.36 | — | — | — | — | — | — | — | |
| RNPAttack=IAD, Backbone=VGG192026.06 | 95.12 | — | 0 | — | — | — | — | — | 89.2 | 2.69 | |
| BI-BAU(T)Attack=IAD, Backbone=VGG192026.06 | 95.12 | — | 0.03 | — | — | — | — | — | 1.64 | 0.05 | |
| BI-BAU(U)Attack=IAD, Backbone=VGG192026.06 | 95.1 | — | 0.03 | — | — | — | — | — | 4.95 | 0 | |
| SAUAttack=Average, Backbone=VGG192026.06 | 95.08 | — | 9.28 | — | — | — | — | — | 45.64 | 16.04 | |
| RNPAttack=ISSBA, Backbone=VGG192026.06 | 94.92 | — | 0 | — | — | — | — | — | 30.48 | 6.1 | |
| BI-BAU(T)Attack=ISSBA, Backbone=VGG192026.06 | 94.9 | — | 0 | — | — | — | — | — | 0 | 0 | |
| PAMAttack=Adaptive-Blend, Backbone=VGG192026.06 | 94.7 | — | 0 | — | — | — | — | — | 30.95 | 0 | |
| BI-BAU(U)Attack=WaNet, Backbone=VGG192026.06 | 94.68 | — | 0 | — | — | — | — | — | 0 | 0 | |
| SAUAttack=IAD, Backbone=VGG192026.06 | 94.67 | — | 0 | — | — | — | — | — | 79.12 | 0 | |
| BI-BAU(T)Attack=Refool, Backbone=VGG192026.06 | 94.34 | — | 4.32 | — | — | — | — | — | 25.57 | 8.79 | |
| RNPAttack=Refool, Backbone=VGG192026.06 | 94.33 | — | 9.24 | — | — | — | — | — | 72.57 | 13.59 | |
| PAMAttack=Average, Backbone=VGG192026.06 | 94.18 | — | 0 | — | — | — | — | — | 31.89 | 0 | |
| BI-BAU(U)Attack=ISSBA, Backbone=VGG192026.06 | 94.15 | — | 0 | — | — | — | — | — | 0.23 | 1.11 | |
| BI-BAU(T)Attack=WaNet, Backbone=VGG192026.06 | 93.96 | — | 0 | — | — | — | — | — | 0.07 | 0 | |
| BI-BAU(U)Attack=Adaptive-Patch, Backbone=VGG192026.06 | 93.79 | — | 1.1 | — | — | — | — | — | 1.66 | 0.55 | |
| SAUAttack=SIG, Backbone=VGG192026.06 | 93.74 | — | 32.38 | — | — | — | — | — | 69.01 | 47.47 | |
| ANPAttack=Adaptive-Blend, Backbone=VGG192026.06 | 93.58 | — | 28.5 | — | — | — | — | — | 44.57 | 42.99 | |
| SAUAttack=Blended, Backbone=VGG192026.06 | 93.51 | — | 0.39 | — | — | — | — | — | 83.68 | 0.4 | |
| PAMAttack=IAD, Backbone=VGG192026.06 | 93.49 | — | 0 | — | — | — | — | — | 78.81 | 0 | |
| ZIPAttack=LF2026.02 | 92.9 | 0.239 | 87.6 | — | — | — | — | — | — | — | |
| Base (No Defense)Attack=LF2026.02 | 92.7 | — | 99.4 | — | — | — | — | — | — | — | |
| BI-BAU(T)Attack=Average, Backbone=VGG192026.06 | 92.26 | — | 7.78 | — | — | — | — | — | 11.26 | 9.03 | |
| BI-BAU(U)Attack=Average, Backbone=VGG192026.06 | 92.21 | — | 1.44 | — | — | — | — | — | 4.66 | 3.14 | |
| BI-BAU(T)Attack=Adaptive-Blend, Backbone=VGG192026.06 | 92.17 | — | 0.07 | — | — | — | — | — | 0.15 | 0.08 | |
| BI-BAU(U)Attack=Adaptive-Blend, Backbone=VGG192026.06 | 91.34 | — | 0.39 | — | — | — | — | — | 1.42 | 0.79 | |
| BI-BAU(U)Attack=Refool, Backbone=VGG192026.06 | 91.24 | — | 0.55 | — | — | — | — | — | 4.76 | 1.17 | |
| SCRUB-FL2026.06 | 91.23 | — | 3.88 | — | — | — | — | — | — | — | |
| RNPAttack=Average, Backbone=VGG192026.06 | 91.19 | — | 15.89 | — | — | — | — | — | 73.29 | 21.46 | |
| BI-BAU(T)Attack=Adaptive-Patch, Backbone=VGG192026.06 | 91.01 | — | 0 | — | — | — | — | — | 0.23 | 0 | |
| BI-BAU(T)Attack=BadNets, Backbone=VGG192026.06 | 90.94 | — | 0 | — | — | — | — | — | 0.15 | 0.03 | |
| BI-BAU(T)Attack=SIG, Backbone=VGG192026.06 | 90.73 | — | 21.6 | — | — | — | — | — | 27.38 | 24.84 | |
| PAMAttack=Refool, Backbone=VGG192026.06 | 90.65 | — | 0.01 | — | — | — | — | — | 91.29 | 0.05 | |
| Lite-BD (SW)Attack=Average2026.02 | 90.6 | 0.623 | 27.7 | — | — | — | — | — | — | — | |
| ANPAttack=Blended, Backbone=VGG192026.06 | 89.99 | — | 6.49 | — | — | — | — | — | 84.71 | 47.19 | |
| RNPAttack=SIG, Backbone=VGG192026.06 | 89.8 | — | 54.72 | — | — | — | — | — | 55.32 | 50.71 | |
| RNPAttack=Blended, Backbone=VGG192026.06 | 89.31 | — | 0 | — | — | — | — | — | 98.02 | 0 | |
| PAMAttack=SIG, Backbone=VGG192026.06 | 89.11 | — | 0 | — | — | — | — | — | 51.6 | 0 | |
| Lite-BD (SW)Attack=LF2026.02 | 88 | 0.775 | 0 | — | — | — | — | — | — | — | |
| SampdetoxAttack=LF2026.02 | 87.8 | 0.527 | 51 | — | — | — | — | — | — | — | |
| BI-BAU(U)Attack=Blended, Backbone=VGG192026.06 | 87.23 | — | 0.15 | — | — | — | — | — | 0.71 | 0.24 | |
| BI-BAU(T)Attack=Blended, Backbone=VGG192026.06 | 87.21 | — | 44.02 | — | — | — | — | — | 57.48 | 56.53 |