Backdoor Defense on GTSRB (test)
0ASRABL
Evaluation results
| Method | Links | ||
|---|---|---|---|
| ABLAttack=BadNet-White2022.10 | 0 | 95.14 | |
| I-BAUAttack=Blend, Clean holdout ratio=5%2022.10 | 0 | 82.03 | |
| CBDAttack Type=None2023.03 | 0 | 96.54 | |
| I-BAUBackdoor Attack=Badnets, Supervision=Labeled2022.11 | 0 | 99.66 | |
| BCUBackdoor Attack=Badnets, Supervision=Unlabeled, Double unlabeled data=true2022.11 | 0 | 97.88 | |
| ANPBackdoor Attack=WaNet, Supervision=Labeled2022.11 | 0 | 98.36 | |
| BTI-DBFBackbone=VGG192026.06 | 0 | 97.37 | |
| ANPBackbone=VGG192026.06 | 0.01 | 93.34 | |
| T&R (Ours)Attack=BadNet-White, Clean holdout ratio=5%2022.10 | 0.01 | 95.74 | |
| NADBackdoor Attack=WaNet, Supervision=Labeled2022.11 | 0.01 | 99.88 | |
| I-BAUBackdoor Attack=WaNet, Supervision=Labeled2022.11 | 0.01 | 99.81 | |
| BCUBackdoor Attack=Badnets, Supervision=Unlabeled, Double unlabeled data=false2022.11 | 0.02 | 96.75 | |
| I-BAUBackdoor Attack=IAB, Supervision=Labeled2022.11 | 0.02 | 99.8 | |
| BCUBackdoor Attack=WaNet, Supervision=Unlabeled, Double unlabeled data=true2022.11 | 0.02 | 98.8 | |
| BI-BAU (U)Backbone=VGG19, variant=Untargeted2026.06 | 0.03 | 96.16 | |
| T&R (Ours)Attack=l_2-Invisible, Clean holdout ratio=5%2022.10 | 0.03 | 96.1 | |
| I-BAUBackdoor Attack=LC, Supervision=Labeled2022.11 | 0.03 | 99.71 | |
| BCUBackdoor Attack=IAB, Supervision=Unlabeled, Double unlabeled data=true2022.11 | 0.07 | 98.07 | |
| ANPBackdoor Attack=IAB, Supervision=Labeled2022.11 | 0.08 | 96.39 | |
| T&R (Ours)Attack=Smooth, Clean holdout ratio=5%2022.10 | 0.11 | 96.12 | |
| ANPBackdoor Attack=LC, Supervision=Labeled2022.11 | 0.11 | 94.15 | |
| BCUBackdoor Attack=WaNet, Supervision=Unlabeled, Double unlabeled data=false2022.11 | 0.11 | 97.59 | |
| CBDAttack Type=Trojan2023.03 | 0.12 | 95.29 | |
| MCRBackdoor Attack=WaNet, Supervision=Labeled, threshold (t)=0.32022.11 | 0.12 | 99.85 | |
| ANPBackdoor Attack=Blended, Supervision=Labeled2022.11 | 0.14 | 98.47 | |
| BCUBackdoor Attack=IAB, Supervision=Unlabeled, Double unlabeled data=false2022.11 | 0.15 | 96.91 | |
| CBDAttack Type=BadNets2023.03 | 0.16 | 96.21 | |
| T&R (Ours)Attack=BadNet-Grid, Clean holdout ratio=5%2022.10 | 0.2 | 95.94 | |
| BI-BAU (T)Backbone=VGG19, variant=Targeted2026.06 | 0.26 | 96.78 | |
| BCUBackdoor Attack=Blended, Supervision=Unlabeled, Double unlabeled data=true2022.11 | 0.37 | 98.9 | |
| NADBackdoor Attack=Blended, Supervision=Labeled2022.11 | 0.38 | 99.84 | |
| ABLAttack=Trojan-SQ2022.10 | 0.45 | 95.88 | |
| BCUBackdoor Attack=Blended, Supervision=Unlabeled, Double unlabeled data=false2022.11 | 0.5 | 97.32 | |
| T&R (Ours)Attack=SIG, Clean holdout ratio=5%2022.10 | 0.54 | 94.56 | |
| BCUBackdoor Attack=Mean, Supervision=Unlabeled, Double unlabeled data=false2022.11 | 0.54 | 97.05 | |
| ABLAttack=Trojan-WM2022.10 | 0.55 | 95.41 | |
| ABLAttack=l_inf-Invisible2022.10 | 0.6 | 96.39 | |
| FinetuningBackdoor Attack=WaNet, Supervision=Labeled2022.11 | 0.61 | 99.84 | |
| BCUBackdoor Attack=LC, Supervision=Unlabeled, Double unlabeled data=true2022.11 | 0.81 | 96.6 | |
| BCUBackdoor Attack=LC, Supervision=Unlabeled, Double unlabeled data=false2022.11 | 0.86 | 96.64 | |
| NADAttack=BadNet-White, Clean holdout ratio=5%2022.10 | 0.96 | 90.61 | |
| CBDAttack Type=Dynamic2023.03 | 0.96 | 96.02 | |
| ABLAttack=l_2-Invisible2022.10 | 1 | 94.74 | |
| I-BAUBackdoor Attack=Blended, Supervision=Labeled2022.11 | 1 | 99.77 | |
| BCUBackdoor Attack=Mean, Supervision=Unlabeled, Double unlabeled data=true2022.11 | 1.26 | 98.16 | |
| T&R (Ours)Attack=l_inf-Invisible, Clean holdout ratio=5%2022.10 | 1.32 | 95.87 | |
| SAUBackbone=VGG192026.06 | 1.36 | 95.24 | |
| T&R (Ours)Attack=Average, Clean holdout ratio=5%2022.10 | 1.41 | 95.23 | |
| T&R (Ours)Attack=Trojan-SQ, Clean holdout ratio=5%2022.10 | 1.47 | 95.17 | |
| NADAttack=Trojan-SQ, Clean holdout ratio=5%2022.10 | 1.52 | 90.56 | |
| NADAttack=Trojan-WM, Clean holdout ratio=5%2022.10 | 1.58 | 92.26 | |
| BCUBackdoor Attack=SIG, Supervision=Unlabeled, Double unlabeled data=false2022.11 | 1.59 | 97.09 | |
| NADAttack=BadNet-Grid, Clean holdout ratio=5%2022.10 | 1.62 | 93.56 | |
| MCRBackdoor Attack=Blended, Supervision=Labeled, threshold (t)=0.32022.11 | 1.69 | 99.71 | |
| T&R (Ours)Attack=Blend, Clean holdout ratio=5%2022.10 | 1.98 | 95.62 | |
| Fine-pruningBackdoor Attack=IAB, Supervision=Labeled2022.11 | 2.23 | 99.8 | |
| I-BAUAttack=Smooth, Clean holdout ratio=5%2022.10 | 2.68 | 94.74 | |
| MCRBackdoor Attack=LC, Supervision=Labeled, threshold (t)=0.32022.11 | 3.07 | 99.5 | |
| MCRBackdoor Attack=IAB, Supervision=Labeled, threshold (t)=0.32022.11 | 3.94 | 99.79 | |
| ABLAttack=BadNet-Grid2022.10 | 4.11 | 95.52 | |
| I-BAUAttack=l_inf-Invisible, Clean holdout ratio=5%2022.10 | 4.73 | 94.31 | |
| ABLAttack=Blend2022.10 | 4.94 | 92.61 | |
| I-BAUBackdoor Attack=Mean, Supervision=Labeled2022.11 | 5.27 | 99.75 | |
| FinetuningBackdoor Attack=Blended, Supervision=Labeled2022.11 | 5.45 | 99.81 | |
| I-BAUAttack=BadNet-Grid, Clean holdout ratio=5%2022.10 | 5.56 | 95.36 | |
| I-BAUAttack=Trojan-SQ, Clean holdout ratio=5%2022.10 | 5.71 | 94.49 | |
| EPBackbone=VGG192026.06 | 5.74 | 96.29 | |
| Fine-pruningBackdoor Attack=Blended, Supervision=Labeled2022.11 | 5.8 | 99.73 | |
| NADAttack=Blend, Clean holdout ratio=5%2022.10 | 5.84 | 91.26 | |
| I-BAUAttack=Average, Clean holdout ratio=5%2022.10 | 5.85 | 93.43 | |
| BCUBackdoor Attack=SIG, Supervision=Unlabeled, Double unlabeled data=true2022.11 | 6.31 | 98.71 | |
| I-BAUAttack=BadNet-White, Clean holdout ratio=5%2022.10 | 6.63 | 95.55 | |
| T&R (Ours)Attack=Trojan-WM, Clean holdout ratio=5%2022.10 | 7.06 | 91.95 | |
| I-BAUAttack=Trojan-WM, Clean holdout ratio=5%2022.10 | 7.47 | 95.3 | |
| I-BAUBackbone=VGG192026.06 | 8.06 | 94.1 | |
| RNPBackbone=VGG192026.06 | 8.44 | 87.04 | |
| ANPAttack=BadNet-Grid, Clean holdout ratio=5%2022.10 | 8.97 | 95.44 | |
| NADBackdoor Attack=Badnets, Supervision=Labeled2022.11 | 9.22 | 99.79 | |
| Fine-pruningBackdoor Attack=WaNet, Supervision=Labeled2022.11 | 9.73 | 99.84 | |
| I-BAUAttack=l_2-Invisible, Clean holdout ratio=5%2022.10 | 9.83 | 94.6 | |
| I-BAUAttack=SIG, Clean holdout ratio=5%2022.10 | 10.04 | 94.53 | |
| ANPAttack=Trojan-SQ, Clean holdout ratio=5%2022.10 | 12.06 | 90.74 | |
| NADAttack=l_2-Invisible, Clean holdout ratio=5%2022.10 | 12.43 | 72.69 | |
| ANPAttack=BadNet-White, Clean holdout ratio=5%2022.10 | 12.68 | 92.06 | |
| ANPBackdoor Attack=Mean, Supervision=Labeled2022.11 | 16.29 | 95.84 | |
| NADAttack=Average, Clean holdout ratio=5%2022.10 | 16.45 | 87.4 | |
| ANPBackdoor Attack=Badnets, Supervision=Labeled2022.11 | 19 | 89.47 | |
| ANPAttack=Blend, Clean holdout ratio=5%2022.10 | 20.36 | 90.53 | |
| ANPAttack=SIG, Clean holdout ratio=5%2022.10 | 20.6 | 82.34 | |
| ANPAttack=Average, Clean holdout ratio=5%2022.10 | 22.01 | 89.03 | |
| ABLAttack=Average2022.10 | 23.3 | 93.21 | |
| ANPAttack=l_2-Invisible, Clean holdout ratio=5%2022.10 | 24.83 | 90.41 | |
| NADAttack=l_inf-Invisible, Clean holdout ratio=5%2022.10 | 25.6 | 91.35 | |
| ANPAttack=Trojan-WM, Clean holdout ratio=5%2022.10 | 25.68 | 88.64 | |
| MCRBackdoor Attack=Mean, Supervision=Labeled, threshold (t)=0.32022.11 | 27.19 | 99.68 | |
| I-BAUBackdoor Attack=SIG, Supervision=Labeled2022.11 | 30.54 | 99.77 | |
| NADBackdoor Attack=Mean, Supervision=Labeled2022.11 | 31.83 | 99.83 | |
| ABLAttack=Smooth2022.10 | 32.24 | 76.7 | |
| NADAttack=Smooth, Clean holdout ratio=5%2022.10 | 33.2 | 75.74 | |
| ANPAttack=l_inf-Invisible, Clean holdout ratio=5%2022.10 | 34.96 | 88.54 |