Backdoor Poisoning Sample Isolation on CIFAR10 (train)
89.02PrecisionD-ST
Evaluation results
| Method | Links | ||||
|---|---|---|---|---|---|
| D-STModel=ResNet18, Attack=Trojan2026.07 | 89.02 | 99.54 | 93.99 | 0.05 | |
| HARVEYModel=WRN16-1, Attack=BadNets2026.07 | 83.04 | 100 | 90.73 | 0 | |
| HARVEYModel=WRN16-1, Attack=Trojan2026.07 | 75.99 | 99.42 | 86.14 | 0.07 | |
| HARVEYModel=ResNet18, Attack=Trojan2026.07 | 74.57 | 99.82 | 85.37 | 0.02 | |
| HARVEYModel=WRN16-1, Attack=Blend2026.07 | 73.32 | 99.48 | 84.42 | 0.06 | |
| HARVEYModel=ResNet18, Attack=Blend2026.07 | 69.79 | 100 | 82.21 | 0 | |
| HARVEYModel=WRN16-1, Attack=CLB2026.07 | 69.34 | 99.96 | 81.88 | 0 | |
| HARVEYModel=ResNet18, Attack=IAB2026.07 | 67.62 | 100 | 80.68 | 0 | |
| HARVEYModel=WRN16-1, Attack=Average2026.07 | 67.44 | 99.69 | 79.82 | 0.04 | |
| HARVEYModel=ResNet18, Attack=WaNet2026.07 | 67.37 | 98.54 | 80.03 | 0.17 | |
| HARVEYModel=ResNet18, Attack=Average2026.07 | 65.96 | 99.71 | 79.23 | 0.03 | |
| HARVEYModel=ResNet18, Attack=CLB2026.07 | 60.72 | 99.92 | 75.54 | 0 | |
| HARVEYModel=ResNet18, Attack=BadNets2026.07 | 55.69 | 100 | 71.54 | 0 | |
| HARVEYModel=ResNet18, Attack=Worst Case2026.07 | 55.69 | 98.54 | 71.54 | 0.17 | |
| HARVEYModel=WRN16-1, Attack=IAB2026.07 | 53.04 | 99.8 | 69.27 | 0.02 | |
| HARVEYModel=WRN16-1, Attack=WaNet2026.07 | 49.93 | 99.5 | 66.49 | 0.06 | |
| HARVEYModel=WRN16-1, Attack=Worst Case2026.07 | 49.93 | 99.42 | 66.49 | 0.07 | |
| D-STModel=ResNet18, Attack=BadNets2026.07 | 45.48 | 99.98 | 62.52 | 0 | |
| D-STModel=ResNet18, Attack=IAB2026.07 | 45.19 | 89.24 | 60 | 1.34 | |
| D-STModel=ResNet18, Attack=Average2026.07 | 40.07 | 85.16 | 49.5 | 1.69 | |
| D-STModel=ResNet18, Attack=WaNet2026.07 | 29.17 | 23.62 | 26.1 | 8.31 | |
| D-STModel=WRN16-1, Attack=IAB2026.07 | 21.15 | 96.34 | 34.69 | 0.67 | |
| DBDModel=WRN16-1, Attack=Blend2026.07 | 18.24 | 91.18 | 30.4 | 1.76 | |
| DBDModel=WRN16-1, Attack=BadNets2026.07 | 18.19 | 90.96 | 30.32 | 1.81 | |
| DBDModel=WRN16-1, Attack=Trojan2026.07 | 17.26 | 86.3 | 28.77 | 2.74 | |
| DBDModel=ResNet18, Attack=WaNet2026.07 | 17.17 | 85.84 | 28.62 | 2.83 | |
| DBDModel=ResNet18, Attack=BadNets2026.07 | 17.09 | 85.46 | 28.48 | 2.91 | |
| D-STModel=ResNet18, Attack=CLB2026.07 | 16.95 | 99.99 | 28.99 | 0 | |
| D-STModel=ResNet18, Attack=Blend2026.07 | 14.59 | 98.59 | 25.42 | 0.44 | |
| D-STModel=ResNet18, Attack=Worst Case2026.07 | 14.59 | 23.62 | 25.42 | 8.31 | |
| D-STModel=WRN16-1, Attack=WaNet2026.07 | 13.65 | 42.34 | 20.64 | 8.36 | |
| DBDModel=WRN16-1, Attack=Average2026.07 | 13.27 | 66.37 | 22.12 | 6.73 | |
| DBDModel=ResNet18, Attack=Average2026.07 | 12.05 | 60.23 | 20.08 | 7.95 | |
| DBDModel=WRN16-1, Attack=WaNet2026.07 | 11.47 | 57.36 | 19.12 | 8.53 | |
| D-STModel=WRN16-1, Attack=Average2026.07 | 11.18 | 39.22 | 14.35 | 7.05 | |
| DBDModel=ResNet18, Attack=Trojan2026.07 | 11.11 | 55.58 | 18.52 | 8.88 | |
| D-STModel=WRN16-1, Attack=Trojan2026.07 | 10.94 | 8.03 | 9.26 | 9.43 | |
| D-STModel=WRN16-1, Attack=BadNets2026.07 | 10.48 | 7.28 | 8.59 | 9.96 | |
| DBDModel=WRN16-1, Attack=CLB2026.07 | 10.09 | 50.46 | 16.82 | 9.91 | |
| DBDModel=ResNet18, Attack=CLB2026.07 | 10.09 | 50.46 | 16.82 | 9.91 | |
| DBDModel=ResNet18, Attack=IAB2026.07 | 8.42 | 42.1 | 14.03 | 11.58 | |
| DBDModel=ResNet18, Attack=Blend2026.07 | 8.39 | 41.94 | 13.98 | 11.61 | |
| DBDModel=ResNet18, Attack=Worst Case2026.07 | 8.39 | 41.94 | 13.98 | 11.61 | |
| D-STModel=WRN16-1, Attack=Blend2026.07 | 8.25 | 7.54 | 7.88 | 10.18 | |
| DBDModel=WRN16-1, Attack=IAB2026.07 | 4.39 | 21.94 | 7.32 | 15.61 | |
| DBDModel=WRN16-1, Attack=Worst Case2026.07 | 4.39 | 21.94 | 7.32 | 15.61 | |
| D-STModel=WRN16-1, Attack=CLB2026.07 | 2.61 | 73.78 | 5.04 | 3.71 | |
| D-STModel=WRN16-1, Attack=Worst Case2026.07 | 2.61 | 7.28 | 5.04 | 10.18 |