Backdoor Defense on Tiny-ImageNet (test)
100AccuracyBTI-DBF
Evaluation results
| Method | Links | |||
|---|---|---|---|---|
| BTI-DBFAttack=No Attack, Backbone=ResNet182024.05 | 100 | — | 0 | |
| BTI-DBF*Attack=No Attack, Backbone=ResNet182024.05 | 100 | — | 0 | |
| BANAttack=No Attack, Backbone=ResNet182024.05 | 100 | — | 0 | |
| BANAttack=WaNet, Backbone=ResNet182024.05 | 100 | — | 10 | |
| BANAttack=IAD, Backbone=ResNet182024.05 | 100 | — | 10 | |
| BTI-DBFAttack=IAD, Backbone=ResNet182024.05 | 90 | — | 9 | |
| BTI-DBF*Attack=IAD, Backbone=ResNet182024.05 | 80 | — | 8 | |
| NoneTraining Regime=From Scratch, Attack Scenario=Gradient Matching-0.25%, Backbone=ResNet-342024.05 | 65.2 | 26 | — | |
| No Defense (Before)Attack=SIG2022.02 | 64.1 | 99.74 | — | |
| ANPAttack=SIG2022.02 | 63.85 | 4.56 | — | |
| No Defense (Before)Attack=Blend2022.02 | 63.3 | 99.7 | — | |
| PUREGEN-EBMTraining Regime=From Scratch, Attack Scenario=Gradient Matching-0.25%, Backbone=ResNet-342024.05 | 63.27 | 2 | — | |
| Progressive Backdoor ErasingAttack=Badnet, clean_extra_dataset=available2022.02 | 63.23 | 1.65 | — | |
| ANPAttack=Badnet2022.02 | 63.05 | 3.93 | — | |
| No Defense (Before)Attack=Badnet2022.02 | 62.99 | 99.89 | — | |
| Neural CleanseAttack=Badnet2022.02 | 62.86 | 1.84 | — | |
| Progressive Backdoor ErasingAttack=SIG, clean_extra_dataset=available2022.02 | 62.58 | 4.12 | — | |
| ANPAttack=Blend2022.02 | 62.49 | 0.61 | — | |
| Progressive Backdoor ErasingAttack=Blend, clean_extra_dataset=available2022.02 | 62.37 | 1.19 | — | |
| Neural CleanseAttack=Blend2022.02 | 62.2 | 3.96 | — | |
| NADAttack=Blend2022.02 | 62.02 | 9.6 | — | |
| NADAttack=SIG2022.02 | 61.94 | 11.55 | — | |
| NADAttack=Badnet2022.02 | 61.63 | 0.85 | — | |
| Neural CleanseAttack=SIG2022.02 | 61.34 | 4.13 | — | |
| No Defense (Before)Attack=WaNet2022.02 | 60.76 | 99.92 | — | |
| EPICTraining Regime=From Scratch, Attack Scenario=Gradient Matching-0.25%, Backbone=ResNet-342024.05 | 60.55 | 18 | — | |
| Progressive Backdoor ErasingAttack=WaNet, clean_extra_dataset=available2022.02 | 60.52 | 5.32 | — | |
| Progressive Backdoor ErasingAttack=Blend, clean_extra_dataset=unavailable2022.02 | 60.21 | 4.23 | — | |
| Progressive Backdoor ErasingAttack=SIG, clean_extra_dataset=unavailable2022.02 | 60.01 | 7.41 | — | |
| JPEGTraining Regime=From Scratch, Attack Scenario=Gradient Matching-0.25%, Backbone=ResNet-342024.05 | 60.01 | 10 | — | |
| BTI-DBF*Attack=WaNet, Backbone=ResNet182024.05 | 60 | — | 6 | |
| Fine-tuningAttack=Blend2022.02 | 59.98 | 1.02 | — | |
| Fine-pruningAttack=Blend2022.02 | 59.84 | 62.17 | — | |
| Fine-tuningAttack=SIG2022.02 | 59.13 | 42.13 | — | |
| Fine-pruningAttack=SIG2022.02 | 58.62 | 40.68 | — | |
| Neural CleanseAttack=WaNet2022.02 | 58.34 | 34.21 | — | |
| Progressive Backdoor ErasingAttack=Badnet, clean_extra_dataset=unavailable2022.02 | 58.23 | 8.25 | — | |
| Progressive Backdoor ErasingAttack=WaNet, clean_extra_dataset=unavailable2022.02 | 57.98 | 6.41 | — | |
| Fine-tuningAttack=WaNet2022.02 | 57.96 | 77.45 | — | |
| Fine-pruningAttack=Badnet2022.02 | 57.43 | 57.42 | — | |
| Fine-tuningAttack=Badnet2022.02 | 56.97 | 99.26 | — | |
| NADAttack=WaNet2022.02 | 56.42 | 27.79 | — | |
| ANPAttack=WaNet2022.02 | 54.82 | 16.98 | — | |
| Fine-pruningAttack=WaNet2022.02 | 53.86 | 43.7 | — | |
| PUREGEN-DDPMTraining Regime=From Scratch, Attack Scenario=Gradient Matching-0.25%, Backbone=ResNet-342024.05 | 50.5 | 0 | — | |
| FRIENDSTraining Regime=From Scratch, Attack Scenario=Gradient Matching-0.25%, Backbone=ResNet-342024.05 | 42.74 | 2 | — | |
| BTI-DBFAttack=WaNet, Backbone=ResNet182024.05 | 40 | — | 4 |