Backdoor Defense on Tiny ImageNet
87.48AccuracyBppAttack
Evaluation results
| Method | Links | |||
|---|---|---|---|---|
| BppAttackAttack=BppAttack, Poisoning Rate (ρ)=5%, Defense Method=No defense, Backbone=Swin-L2026.05 | 87.48 | 93.4 | — | |
| DSAAttack=DSA, Poisoning Rate (ρ)=0.5%, Defense Method=No defense, Backbone=Swin-L2026.05 | 86.6 | 98.37 | — | |
| BppAttackAttack=BppAttack, Poisoning Rate (ρ)=0.5%, Defense Method=No defense, Backbone=Swin-L2026.05 | 86.04 | 1.7 | — | |
| WaveAttackAttack=WaveAttack, Poisoning Rate (ρ)=5%, Defense Method=No defense, Backbone=Swin-L2026.05 | 85.94 | 93.61 | — | |
| BppAttackAttack=BppAttack, Poisoning Rate (ρ)=1%, Defense Method=No defense, Backbone=Swin-L2026.05 | 85.67 | 8.7 | — | |
| DSAAttack=DSA, Poisoning Rate (ρ)=1%, Defense Method=No defense, Backbone=Swin-L2026.05 | 84.8 | 99.91 | — | |
| WaveAttackAttack=WaveAttack, Poisoning Rate (ρ)=0.5%, Defense Method=FT-init, Backbone=Swin-L2026.05 | 84.76 | 0.05 | — | |
| WaveAttackAttack=WaveAttack, Poisoning Rate (ρ)=0.5%, Defense Method=FST, Backbone=Swin-L2026.05 | 84.63 | 0.01 | — | |
| LIRAAttack=LIRA, Poisoning Rate (ρ)=–, Defense Method=No defense, Backbone=Swin-L2026.05 | 84.05 | 100 | — | |
| WaveAttackAttack=WaveAttack, Poisoning Rate (ρ)=0.5%, Defense Method=FE-tuning, Backbone=Swin-L2026.05 | 83.89 | 0.03 | — | |
| BadNetAttack=BadNet, Poisoning Rate (ρ)=1%, Defense Method=No defense, Backbone=Swin-L2026.05 | 83.14 | 99.97 | — | |
| DSAAttack=DSA, Poisoning Rate (ρ)=5%, Defense Method=No defense, Backbone=Swin-L2026.05 | 83.1 | 100 | — | |
| SSBAAttack=SSBA, Poisoning Rate (ρ)=0.5%, Defense Method=No defense, Backbone=Swin-L2026.05 | 83.09 | 50.17 | — | |
| BlendedAttack=Blended, Poisoning Rate (ρ)=0.5%, Defense Method=No defense, Backbone=Swin-L2026.05 | 83.02 | 91.58 | — | |
| Adapt-BlendAttack=Adapt-Blend, Poisoning Rate (ρ)=0.5%, Defense Method=No defense, Backbone=Swin-L2026.05 | 83 | 95.47 | — | |
| BadNetAttack=BadNet, Poisoning Rate (ρ)=5%, Defense Method=No defense, Backbone=Swin-L2026.05 | 82.91 | 100 | — | |
| BlendedAttack=Blended, Poisoning Rate (ρ)=1%, Defense Method=No defense, Backbone=Swin-L2026.05 | 82.87 | 97.21 | — | |
| BadNetAttack=BadNet, Poisoning Rate (ρ)=0.5%, Defense Method=No defense, Backbone=Swin-L2026.05 | 82.78 | 99.84 | — | |
| SSBAAttack=SSBA, Poisoning Rate (ρ)=1%, Defense Method=No defense, Backbone=Swin-L2026.05 | 82.72 | 86.34 | — | |
| WaveAttackAttack=WaveAttack, Poisoning Rate (ρ)=0.5%, Defense Method=No defense, Backbone=Swin-L2026.05 | 82.7 | 91.17 | — | |
| Adapt-BlendAttack=Adapt-Blend, Poisoning Rate (ρ)=5%, Defense Method=No defense, Backbone=Swin-L2026.05 | 82.64 | 99.98 | — | |
| BlendedAttack=Blended, Poisoning Rate (ρ)=5%, Defense Method=No defense, Backbone=Swin-L2026.05 | 82.53 | 99.95 | — | |
| Adapt-BlendAttack=Adapt-Blend, Poisoning Rate (ρ)=1%, Defense Method=No defense, Backbone=Swin-L2026.05 | 82.41 | 98.73 | — | |
| SSBAAttack=SSBA, Poisoning Rate (ρ)=5%, Defense Method=No defense, Backbone=Swin-L2026.05 | 82.37 | 99.92 | — | |
| BppAttackAttack=BppAttack, Poisoning Rate (ρ)=0.5%, Defense Method=FST, Backbone=Swin-L2026.05 | 82.34 | 0.04 | — | |
| WaveAttackAttack=WaveAttack, Poisoning Rate (ρ)=1%, Defense Method=FT-init, Backbone=Swin-L2026.05 | 82.34 | 0.08 | — | |
| WaveAttackAttack=WaveAttack, Poisoning Rate (ρ)=1%, Defense Method=FST, Backbone=Swin-L2026.05 | 82.17 | 0.01 | — | |
| WaveAttackAttack=WaveAttack, Poisoning Rate (ρ)=1%, Defense Method=No defense, Backbone=Swin-L2026.05 | 81.4 | 90.82 | — | |
| WaveAttackAttack=WaveAttack, Poisoning Rate (ρ)=1%, Defense Method=FE-tuning, Backbone=Swin-L2026.05 | 81.25 | 0.05 | — | |
| SSBAAttack=SSBA, Poisoning Rate (ρ)=0.5%, Defense Method=FT-init, Backbone=Swin-L2026.05 | 81.24 | 7.21 | — | |
| BadNetAttack=BadNet, Poisoning Rate (ρ)=0.5%, Defense Method=FT-init, Backbone=Swin-L2026.05 | 81.13 | 28.41 | — | |
| Adapt-BlendAttack=Adapt-Blend, Poisoning Rate (ρ)=0.5%, Defense Method=FT-init, Backbone=Swin-L2026.05 | 81.08 | 41.37 | — | |
| DSAAttack=DSA, Poisoning Rate (ρ)=1%, Defense Method=FT-init, Backbone=Swin-L2026.05 | 81.03 | 72.41 | — | |
| SSBAAttack=SSBA, Poisoning Rate (ρ)=1%, Defense Method=FT-init, Backbone=Swin-L2026.05 | 80.91 | 18.73 | — | |
| BppAttackAttack=BppAttack, Poisoning Rate (ρ)=0.5%, Defense Method=FT-init, Backbone=Swin-L2026.05 | 80.91 | 5.17 | — | |
| DSAAttack=DSA, Poisoning Rate (ρ)=0.5%, Defense Method=FT-init, Backbone=Swin-L2026.05 | 80.89 | 64.58 | — | |
| BadNetAttack=BadNet, Poisoning Rate (ρ)=1%, Defense Method=FT-init, Backbone=Swin-L2026.05 | 80.82 | 9.38 | — | |
| BlendedAttack=Blended, Poisoning Rate (ρ)=1%, Defense Method=FT-init, Backbone=Swin-L2026.05 | 80.73 | 47.19 | — | |
| DSAAttack=DSA, Poisoning Rate (ρ)=5%, Defense Method=FT-init, Backbone=Swin-L2026.05 | 80.71 | 79.19 | — | |
| Adapt-BlendAttack=Adapt-Blend, Poisoning Rate (ρ)=1%, Defense Method=FT-init, Backbone=Swin-L2026.05 | 80.64 | 50.84 | — | |
| SSBAAttack=SSBA, Poisoning Rate (ρ)=5%, Defense Method=FT-init, Backbone=Swin-L2026.05 | 80.58 | 37.42 | — | |
| BlendedAttack=Blended, Poisoning Rate (ρ)=0.5%, Defense Method=FT-init, Backbone=Swin-L2026.05 | 80.56 | 38.27 | — | |
| BppAttackAttack=BppAttack, Poisoning Rate (ρ)=1%, Defense Method=FST, Backbone=Swin-L2026.05 | 80.56 | 0.06 | — | |
| BadNetAttack=BadNet, Poisoning Rate (ρ)=5%, Defense Method=FT-init, Backbone=Swin-L2026.05 | 80.47 | 15.72 | — | |
| Adapt-BlendAttack=Adapt-Blend, Poisoning Rate (ρ)=5%, Defense Method=FT-init, Backbone=Swin-L2026.05 | 80.31 | 57.63 | — | |
| BlendedAttack=Blended, Poisoning Rate (ρ)=5%, Defense Method=FT-init, Backbone=Swin-L2026.05 | 80.19 | 52.84 | — | |
| DSAAttack=DSA, Poisoning Rate (ρ)=0.5%, Defense Method=FST, Backbone=Swin-L2026.05 | 80.12 | 31.53 | — | |
| DSAAttack=DSA, Poisoning Rate (ρ)=1%, Defense Method=FST, Backbone=Swin-L2026.05 | 79.47 | 43.27 | — | |
| BadNetAttack=BadNet, Poisoning Rate (ρ)=1%, Defense Method=FST, Backbone=Swin-L2026.05 | 79.41 | 0.84 | — | |
| DSAAttack=DSA, Poisoning Rate (ρ)=5%, Defense Method=FE-tuning, Backbone=Swin-L2026.05 | 79.38 | 60.32 | — | |
| SSBAAttack=SSBA, Poisoning Rate (ρ)=1%, Defense Method=FST, Backbone=Swin-L2026.05 | 79.27 | 0.37 | — | |
| BlendedAttack=Blended, Poisoning Rate (ρ)=0.5%, Defense Method=FST, Backbone=Swin-L2026.05 | 79.14 | 0.58 | — | |
| DSAAttack=DSA, Poisoning Rate (ρ)=5%, Defense Method=FST, Backbone=Swin-L2026.05 | 79.1 | 55.84 | — | |
| Adapt-BlendAttack=Adapt-Blend, Poisoning Rate (ρ)=1%, Defense Method=FST, Backbone=Swin-L2026.05 | 79.02 | 3.14 | — | |
| BadNetAttack=BadNet, Poisoning Rate (ρ)=5%, Defense Method=FST, Backbone=Swin-L2026.05 | 78.93 | 2.17 | — | |
| SSBAAttack=SSBA, Poisoning Rate (ρ)=0.5%, Defense Method=FST, Backbone=Swin-L2026.05 | 78.91 | 0.09 | — | |
| BlendedAttack=Blended, Poisoning Rate (ρ)=1%, Defense Method=FST, Backbone=Swin-L2026.05 | 78.87 | 1.72 | — | |
| BppAttackAttack=BppAttack, Poisoning Rate (ρ)=1%, Defense Method=FT-init, Backbone=Swin-L2026.05 | 78.82 | 7.63 | — | |
| BadNetAttack=BadNet, Poisoning Rate (ρ)=0.5%, Defense Method=FST, Backbone=Swin-L2026.05 | 78.67 | 0.31 | — | |
| SSBAAttack=SSBA, Poisoning Rate (ρ)=5%, Defense Method=FST, Backbone=Swin-L2026.05 | 78.64 | 1.43 | — | |
| BadNetAttack=BadNet, Poisoning Rate (ρ)=1%, Defense Method=FE-tuning, Backbone=Swin-L2026.05 | 78.53 | 3.21 | — | |
| Adapt-BlendAttack=Adapt-Blend, Poisoning Rate (ρ)=0.5%, Defense Method=FST, Backbone=Swin-L2026.05 | 78.53 | 1.27 | — | |
| Adapt-BlendAttack=Adapt-Blend, Poisoning Rate (ρ)=5%, Defense Method=FST, Backbone=Swin-L2026.05 | 78.47 | 6.81 | — | |
| SSBAAttack=SSBA, Poisoning Rate (ρ)=1%, Defense Method=FE-tuning, Backbone=Swin-L2026.05 | 78.31 | 5.62 | — | |
| BlendedAttack=Blended, Poisoning Rate (ρ)=5%, Defense Method=FST, Backbone=Swin-L2026.05 | 78.21 | 4.53 | — | |
| Adapt-BlendAttack=Adapt-Blend, Poisoning Rate (ρ)=1%, Defense Method=FE-tuning, Backbone=Swin-L2026.05 | 78.17 | 13.56 | — | |
| BadNetAttack=BadNet, Poisoning Rate (ρ)=5%, Defense Method=FE-tuning, Backbone=Swin-L2026.05 | 78.14 | 4.83 | — | |
| SSBAAttack=SSBA, Poisoning Rate (ρ)=0.5%, Defense Method=FE-tuning, Backbone=Swin-L2026.05 | 78.07 | 2.84 | — | |
| BlendedAttack=Blended, Poisoning Rate (ρ)=1%, Defense Method=FE-tuning, Backbone=Swin-L2026.05 | 78.04 | 10.82 | — | |
| BppAttackAttack=BppAttack, Poisoning Rate (ρ)=5%, Defense Method=FST, Backbone=Swin-L2026.05 | 78.03 | 0.1 | — | |
| SSBAAttack=SSBA, Poisoning Rate (ρ)=5%, Defense Method=FE-tuning, Backbone=Swin-L2026.05 | 77.94 | 9.17 | — | |
| BlendedAttack=Blended, Poisoning Rate (ρ)=0.5%, Defense Method=FE-tuning, Backbone=Swin-L2026.05 | 77.91 | 8.43 | — | |
| BadNetAttack=BadNet, Poisoning Rate (ρ)=0.5%, Defense Method=FE-tuning, Backbone=Swin-L2026.05 | 77.89 | 5.74 | — | |
| Adapt-BlendAttack=Adapt-Blend, Poisoning Rate (ρ)=5%, Defense Method=FE-tuning, Backbone=Swin-L2026.05 | 77.83 | 18.24 | — | |
| Adapt-BlendAttack=Adapt-Blend, Poisoning Rate (ρ)=0.5%, Defense Method=FE-tuning, Backbone=Swin-L2026.05 | 77.72 | 9.91 | — | |
| BppAttackAttack=BppAttack, Poisoning Rate (ρ)=0.5%, Defense Method=FE-tuning, Backbone=Swin-L2026.05 | 77.69 | 0.28 | — | |
| BlendedAttack=Blended, Poisoning Rate (ρ)=5%, Defense Method=FE-tuning, Backbone=Swin-L2026.05 | 77.62 | 14.37 | — | |
| WaveAttackAttack=WaveAttack, Poisoning Rate (ρ)=5%, Defense Method=FT-init, Backbone=Swin-L2026.05 | 77.51 | 0.13 | — | |
| WaveAttackAttack=WaveAttack, Poisoning Rate (ρ)=5%, Defense Method=FST, Backbone=Swin-L2026.05 | 77.5 | 0.01 | — | |
| DSAAttack=DSA, Poisoning Rate (ρ)=1%, Defense Method=FE-tuning, Backbone=Swin-L2026.05 | 77.21 | 41.08 | — | |
| DSAAttack=DSA, Poisoning Rate (ρ)=0.5%, Defense Method=FE-tuning, Backbone=Swin-L2026.05 | 76.83 | 38.04 | — | |
| BppAttackAttack=BppAttack, Poisoning Rate (ρ)=5%, Defense Method=FT-init, Backbone=Swin-L2026.05 | 75.74 | 12.29 | — | |
| BppAttackAttack=BppAttack, Poisoning Rate (ρ)=1%, Defense Method=FE-tuning, Backbone=Swin-L2026.05 | 75.43 | 0.39 | — | |
| WaveAttackAttack=WaveAttack, Poisoning Rate (ρ)=5%, Defense Method=FE-tuning, Backbone=Swin-L2026.05 | 75.37 | 0.07 | — | |
| LIRAAttack=LIRA, Poisoning Rate (ρ)=–, Defense Method=FST, Backbone=Swin-L2026.05 | 74.79 | 10.66 | — | |
| LIRAAttack=LIRA, Poisoning Rate (ρ)=–, Defense Method=FT-init, Backbone=Swin-L2026.05 | 74.78 | 1.82 | — | |
| BppAttackAttack=BppAttack, Poisoning Rate (ρ)=5%, Defense Method=FE-tuning, Backbone=Swin-L2026.05 | 71.81 | 0.57 | — | |
| Gaussian NoiseQuantization=8-bit, Attack Scenario=Exploiting LLM2026.06 | 61.91 | 28 | — | |
| LACQuantization=8-bit, Attack Scenario=Qu-Anti-zation2026.06 | 61.04 | 7.25 | — | |
| EFRAPQuantization=8-bit, Attack Scenario=Qu-Anti-zation2026.06 | 61.03 | 6.81 | — | |
| No defenseAttack=Bpp, Backbone=ResNet-182024.05 | 60.63 | 99.89 | — | |
| No defenseQuantization=8-bit, Attack Scenario=Exploiting LLM2026.06 | 60.29 | 97.99 | — | |
| No defenseQuantization=8-bit, Attack Scenario=Qu-Anti-zation2026.06 | 60.26 | 99.69 | — | |
| LACQuantization=8-bit, Attack Scenario=Exploiting LLM2026.06 | 59.64 | 0.54 | — | |
| Gaussian NoiseQuantization=8-bit, Attack Scenario=Qu-Anti-zation2026.06 | 59.21 | 4.86 | — | |
| QVec (0.98)Quantization=8-bit, Attack Scenario=Exploiting LLM2026.06 | 59.11 | 0.05 | — | |
| QVec (0.95)Quantization=8-bit, Attack Scenario=Exploiting LLM2026.06 | 58.95 | 0.04 | — | |
| No defenseQuantization=4-bit, Attack Scenario=Exploiting LLM2026.06 | 58.83 | 96.6 | — | |
| EFRAPQuantization=4-bit, Attack Scenario=Qu-Anti-zation2026.06 | 58.76 | 2.85 | — | |
| LACQuantization=4-bit, Attack Scenario=Qu-Anti-zation2026.06 | 58.65 | 0.32 | — |