Backdoor Detection on GTSRB
100TPRK-Arm
Evaluation results
| Method | Links | |||||||
|---|---|---|---|---|---|---|---|---|
| K-ArmAttack Type=BadNet2023.10 | 100 | — | 5 | — | — | — | — | |
| K-ArmAttack Type=CB2023.10 | 100 | — | 5 | — | — | — | — | |
| K-ArmAttack Type=Blend2023.10 | 100 | — | 5 | — | — | — | — | |
| CBDsupAttack Type=BadNet2023.10 | 100 | — | 5 | — | — | — | — | |
| CBDsupAttack Type=Blend2023.10 | 100 | — | 5 | — | — | — | — | |
| SCPAttack Type=Badnet, Poisoning ratio=10%2024.06 | 100 | — | 34.4 | — | — | — | — | |
| FeatureREModel=ConvNet2026.05 | 100 | — | 100 | — | — | — | 0 | |
| PSBDAttack Type=ISSBA, Poisoning ratio=10%2024.06 | 99.9 | — | 21.1 | — | — | — | — | |
| StripAttack Type=Badnet, Poisoning ratio=10%2024.06 | 99.9 | — | 9.6 | — | — | — | — | |
| PSBDAttack Type=WaNet, Poisoning ratio=10%2024.06 | 99.6 | — | 11.5 | — | — | — | — | |
| PSBDAttack Type=Badnet, Poisoning ratio=10%2024.06 | 98.7 | — | 20.2 | — | — | — | — | |
| PSBDAttack Type=Average2024.06 | 95.5 | — | 19.2 | — | — | — | — | |
| PSBDAttack Type=TrojanNN, Poisoning ratio=10%2024.06 | 95.2 | — | 21.2 | — | — | — | — | |
| CBDsupAttack Type=CB2023.10 | 95 | — | 5 | — | — | — | — | |
| CBDbeta=0, Attack Type=CB2023.10 | 95 | 80 | 0 | — | — | — | — | |
| CBDbeta=0.1, Attack Type=CB2023.10 | 95 | 85 | 0 | — | — | — | — | |
| CBDbeta=0.2, Attack Type=CB2023.10 | 95 | 85 | 0 | — | — | — | — | |
| CBDbeta=0.2, Attack Type=Blend2023.10 | 95 | 35 | 0 | — | — | — | — | |
| PSBDAttack Type=Label-Consistent, Poisoning ratio=10%2024.06 | 94.4 | — | 20.3 | — | — | — | — | |
| CD-LAttack Type=Badnet, Poisoning ratio=10%2024.06 | 91.1 | — | 19.3 | — | — | — | — | |
| PSBDAttack Type=Blend, Poisoning ratio=10%2024.06 | 91 | — | 20.7 | — | — | — | — | |
| CBDbeta=0.1, Attack Type=BadNet2023.10 | 90 | 15 | 0 | — | — | — | — | |
| CBDbeta=0.1, Attack Type=Blend2023.10 | 90 | 25 | 0 | — | — | — | — | |
| CBDbeta=0.2, Attack Type=BadNet2023.10 | 90 | 15 | 0 | — | — | — | — | |
| PSBDAttack Type=Adaptive-Blend, Poisoning ratio=1%2024.06 | 89.9 | — | 19.4 | — | — | — | — | |
| CBDbeta=0, Attack Type=Blend2023.10 | 80 | 20 | 0 | — | — | — | — | |
| NCAttack Type=CB2023.10 | 75 | — | 20 | — | — | — | — | |
| CBDbeta=0, Attack Type=BadNet2023.10 | 75 | 5 | 0 | — | — | — | — | |
| StripAttack Type=Average2024.06 | 61.4 | — | 9.9 | — | — | — | — | |
| SpectreAttack Type=Average2024.06 | 55.6 | — | 48.1 | — | — | — | — | |
| SpectreAttack Type=Badnet, Poisoning ratio=10%2024.06 | 52.4 | — | 49.7 | — | — | — | — | |
| CD-LAttack Type=Average2024.06 | 50.3 | — | 18.5 | — | — | — | — | |
| NCAttack Type=BadNet2023.10 | 50 | — | 20 | — | — | — | — | |
| Neural CleanseModel=ViT2026.05 | 50 | — | 70 | — | — | — | 20 | |
| UNICORNModel=ViT2026.05 | 50 | — | 0 | — | — | — | 50 | |
| SSAttack Type=Badnet, Poisoning ratio=10%2024.06 | 47.6 | — | 50.2 | — | — | — | — | |
| SCPAttack Type=Average2024.06 | 45.4 | — | 33.8 | — | — | — | — | |
| SSAttack Type=Average2024.06 | 45.1 | — | 48.6 | — | — | — | — | |
| Neural CleanseModel=ResNet-182026.05 | 30 | — | 50 | — | — | — | 20 | |
| NCAttack Type=Blend2023.10 | 20 | — | 20 | — | — | — | — | |
| MNTDAttack Type=BadNet2023.10 | 20 | — | 5 | — | — | — | — | |
| Neural CleanseModel=ConvNet2026.05 | 20 | — | 10 | — | — | — | 10 | |
| UNICORNModel=ConvNet2026.05 | 10 | — | 0 | — | — | — | 10 | |
| UNICORNModel=ResNet-182026.05 | 10 | — | 20 | — | — | — | 10 | |
| MNTDAttack Type=CB2023.10 | 0 | — | 5 | — | — | — | — | |
| MNTDAttack Type=Blend2023.10 | 0 | — | 5 | — | — | — | — | |
| FeatureREModel=ResNet-182026.05 | 0 | — | 0 | — | — | — | 0 | |
| FeatureREModel=ViT2026.05 | 0 | — | 0 | — | — | — | 0 | |
| ANPAttack=Avg. (6 attacks), Poisoning Rate=5%2026.04 | — | — | — | — | — | 89.6 | — | |
| BANAttack=BadNets, Backbone=ResNet182024.05 | — | — | — | 20 | 100 | — | — | |
| BANAttack=WaNet, Backbone=ResNet182024.05 | — | — | — | 20 | 100 | — | — | |
| BANAttack=IAD, Backbone=ResNet182024.05 | — | — | — | 20 | 100 | — | — | |
| BANAttack=Bpp, Backbone=ResNet182024.05 | — | — | — | 20 | 100 | — | — | |
| BTI-DBF*Attack=BadNets, Backbone=ResNet182024.05 | — | — | — | 20 | 100 | — | — | |
| BTI-DBF*Attack=WaNet, Backbone=ResNet182024.05 | — | — | — | 18 | 90 | — | — | |
| BTI-DBF*Attack=IAD, Backbone=ResNet182024.05 | — | — | — | 20 | 100 | — | — | |
| BTI-DBF*Attack=Bpp, Backbone=ResNet182024.05 | — | — | — | 14 | 70 | — | — | |
| Functional Attribution (Mean)Attack=Avg. (6 attacks), Detection Setting=Online, Coupling Measure=Mean, Poisoning Rate=5%2026.04 | — | — | — | — | — | 97.6 | — | |
| Functional Attribution (UMAP K-NN)Attack=Avg. (6 attacks), Detection Setting=Offline, Poisoning Rate=5%2026.04 | — | — | — | — | — | 99 | — | |
| NCAttack=BadNets, Backbone=ResNet182024.05 | — | — | — | 20 | 100 | — | — | |
| NCAttack=WaNet, Backbone=ResNet182024.05 | — | — | — | 8 | 40 | — | — | |
| NCAttack=IAD, Backbone=ResNet182024.05 | — | — | — | 0 | 0 | — | — | |
| NCAttack=Bpp, Backbone=ResNet182024.05 | — | — | — | 13 | 65 | — | — |