Data Poisoning Defense on CIFAR-10 (test)
95.33Test AccuracyNone
Evaluation results
| Method | Links | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| NoneModel=DenseNet121, Training Protocol=From Scratch2024.05 | 95.33 | 46.52 | — | — | — | — | — | — | |
| NoneTraining Regime=From Scratch, Attack Scenario=Narcissus-1%, Backbone=ResNet-182024.05 | 94.89 | — | — | — | 43.95 | 93.59 | — | — | |
| NoneTraining Regime=From Scratch, Attack Scenario=Gradient Matching-1%, Backbone=ResNet-182024.05 | 94.84 | — | — | 44 | — | — | — | — | |
| NoneModel=Hyperlight Bench, Training Protocol=From Scratch2024.05 | 93.95 | 76.39 | — | — | — | — | — | — | |
| NoneModel=MobileNetV2, Training Protocol=From Scratch, Attack Budget (epsilon)=8, Poisoning Rate=1%2024.05 | 93.92 | 32.7 | — | — | — | — | — | — | |
| PUREGEN-DDPMTraining Regime=Linear, Attack Scenario=BlackBox-10%, Backbone=ResNet-182024.05 | 93.81 | — | — | 0 | — | — | — | — | |
| DeepKNNBackbone=ResNet-18, Attack Method=Gradient Matching, Attack Epsilon (eps)=16, Training Epochs=802022.08 | 93.72 | 75 | — | — | — | — | — | — | |
| PUREGEN-EBMModel=DenseNet121, Training Protocol=From Scratch2024.05 | 93.48 | 1.42 | — | — | — | — | — | — | |
| AP-0.25Backbone=ResNet-18, Attack Method=Gradient Matching, Attack Epsilon (eps)=16, Training Epochs=80, Threshold=0.252022.08 | 93.27 | 15 | — | — | — | — | — | — | |
| PUREGEN-EBMTraining Regime=From Scratch, Attack Scenario=Gradient Matching-1%, Backbone=ResNet-182024.05 | 92.98 | — | — | 1 | — | — | — | — | |
| JPEGTraining Regime=From Scratch, Attack Scenario=Narcissus-1%, Backbone=ResNet-182024.05 | 92.94 | — | — | — | 1.78 | 4.13 | — | — | |
| PUREGEN-EBMTraining Regime=From Scratch, Attack Scenario=Narcissus-1%, Backbone=ResNet-182024.05 | 92.92 | — | — | — | 1.39 | 2.5 | — | — | |
| AP-0.5Backbone=ResNet-18, Attack Method=Gradient Matching, Attack Epsilon (eps)=16, Training Epochs=80, Threshold=0.52022.08 | 92.83 | 10 | — | — | — | — | — | — | |
| JPEGTraining Regime=Linear, Attack Scenario=BlackBox-10%, Backbone=ResNet-182024.05 | 92.44 | — | — | 0 | — | — | — | — | |
| PUREGEN-EBMTraining Regime=Linear, Attack Scenario=BlackBox-10%, Backbone=ResNet-182024.05 | 92.38 | — | — | 0 | — | — | — | — | |
| Adversarial TrainingBackbone=ResNet-18, Attack Method=Gradient Matching, Attack Epsilon (eps)=16, Training Epochs=802022.08 | 92.03 | 60 | — | — | — | — | — | — | |
| JPEGModel=DenseNet121, Training Protocol=From Scratch2024.05 | 92.03 | 1.9 | — | — | — | — | — | — | |
| PUREGEN-EBMModel=Hyperlight Bench, Training Protocol=From Scratch2024.05 | 91.94 | 1.89 | — | — | — | — | — | — | |
| FRIENDS-UBackbone=ResNet-18, Attack Method=Gradient Matching, Attack Epsilon (eps)=16, Training Epochs=80, Noise Distribution=Uniform2022.08 | 91.91 | 5 | — | — | — | — | — | — | |
| PUREGEN-EBMModel=MobileNetV2, Training Protocol=From Scratch2024.05 | 91.75 | 1.64 | — | — | — | — | — | — | |
| Friendly NoiseBackbone=ResNet-18, Attack Method=Gradient Matching, Attack Epsilon (eps)=16, Training Epochs=802022.08 | 91.73 | 10 | — | — | — | — | — | — | |
| FRIENDSModel=DenseNet121, Training Protocol=From Scratch2024.05 | 91.55 | 8.6 | — | — | — | — | — | — | |
| PUREGEN-DDPMTraining Regime=Fine-Tune, Attack Scenario=Bullseye Polytope-10%, Backbone=ResNet-182024.05 | 91.53 | — | — | 0 | — | — | — | — | |
| FRIENDS-BBackbone=ResNet-18, Attack Method=Gradient Matching, Attack Epsilon (eps)=16, Training Epochs=80, Noise Distribution=Bernoulli2022.08 | 91.52 | 0 | — | — | — | — | — | — | |
| FRIENDS-GBackbone=ResNet-18, Attack Method=Gradient Matching, Attack Epsilon (eps)=16, Training Epochs=80, Noise Distribution=Gaussian2022.08 | 91.5 | 0 | — | — | — | — | — | — | |
| AP-0.75Backbone=ResNet-18, Attack Method=Gradient Matching, Attack Epsilon (eps)=16, Training Epochs=80, Threshold=0.752022.08 | 91.29 | 0 | — | — | — | — | — | — | |
| FRIENDSTraining Regime=From Scratch, Attack Scenario=Gradient Matching-1%, Backbone=ResNet-182024.05 | 91.15 | — | — | 0 | — | — | — | — | |
| FRIENDSTraining Regime=From Scratch, Attack Scenario=Narcissus-1%, Backbone=ResNet-182024.05 | 91.01 | — | — | — | 8.32 | 83.03 | — | — | |
| PUREGEN-DDPMTraining Regime=From Scratch, Attack Scenario=Narcissus-1%, Backbone=ResNet-182024.05 | 90.99 | — | — | — | 1.64 | 2.83 | — | — | |
| PUREGEN-DDPMModel=DenseNet121, Training Protocol=From Scratch2024.05 | 90.94 | 1.71 | — | — | — | — | — | — | |
| PUREGEN-DDPMTraining Regime=From Scratch, Attack Scenario=Gradient Matching-1%, Backbone=ResNet-182024.05 | 90.93 | — | — | 0 | — | — | — | — | |
| JPEGModel=Hyperlight Bench, Training Protocol=From Scratch2024.05 | 90.92 | 1.73 | — | — | — | — | — | — | |
| PUREGEN-DDPMTraining Regime=Fine-Tune, Attack Scenario=Narcissus-10%, Backbone=ResNet-182024.05 | 90.69 | — | — | — | 1.88 | 3.42 | — | — | |
| JPEGTraining Regime=Fine-Tune, Attack Scenario=Bullseye Polytope-10%, Backbone=ResNet-182024.05 | 90.4 | — | — | 0 | — | — | — | — | |
| NoneTraining Regime=Fine-Tune, Attack Scenario=Narcissus-10%, Backbone=ResNet-182024.05 | 90.14 | — | — | — | 33.41 | 98.27 | — | — | |
| EPIC-0.1Backbone=ResNet-18, Attack Method=Gradient Matching, Attack Epsilon (eps)=16, Training Epochs=80, Epsilon Parameter=0.12022.08 | 90.04 | 0 | — | — | — | — | — | — | |
| JPEGTraining Regime=From Scratch, Attack Scenario=Gradient Matching-1%, Backbone=ResNet-182024.05 | 90 | — | — | 0 | — | — | — | — | |
| NoneTraining Regime=Fine-Tune, Attack Scenario=Bullseye Polytope-10%, Backbone=ResNet-182024.05 | 89.84 | — | — | 46 | — | — | — | — | |
| FRIENDSTraining Regime=Fine-Tune, Attack Scenario=Narcissus-10%, Backbone=ResNet-182024.05 | 89.81 | — | — | — | 3.04 | 17.32 | — | — | |
| PUREGEN-EBMTraining Regime=Fine-Tune, Attack Scenario=Narcissus-10%, Backbone=ResNet-182024.05 | 89.78 | — | — | — | 2.02 | 3.85 | — | — | |
| PUREGEN-DDPMModel=Hyperlight Bench, Training Protocol=From Scratch2024.05 | 89.34 | 1.75 | — | — | — | — | — | — | |
| PUREGEN-EBMModel=DenseNet121, Training Protocol=Linear Transfer BlackBox2024.05 | 89.29 | 0 | — | — | — | — | — | — | |
| PUREGEN-DDPMModel=DenseNet121, Training Protocol=Linear Transfer BlackBox2024.05 | 89.02 | 0 | — | — | — | — | — | — | |
| FRIENDSModel=MobileNetV2, Training Protocol=From Scratch2024.05 | 88.82 | 2 | — | — | — | — | — | — | |
| EPICTraining Regime=Fine-Tune, Attack Scenario=Narcissus-10%, Backbone=ResNet-182024.05 | 88.58 | — | — | — | 20.93 | 91.72 | — | — | |
| FRIENDSTraining Regime=Fine-Tune, Attack Scenario=Bullseye Polytope-10%, Backbone=ResNet-182024.05 | 87.82 | — | — | 8 | — | — | — | — | |
| Activation ClusteringBackbone=ResNet-18, Attack Method=Gradient Matching, Attack Epsilon (eps)=16, Training Epochs=802022.08 | 87.69 | 45 | — | — | — | — | — | — | |
| JPEGTraining Regime=Fine-Tune, Attack Scenario=Narcissus-10%, Backbone=ResNet-182024.05 | 87.63 | — | — | — | 2.95 | 12.55 | — | — | |
| PUREGEN-EBMTraining Regime=Fine-Tune, Attack Scenario=Bullseye Polytope-10%, Backbone=ResNet-182024.05 | 87.52 | — | — | 0 | — | — | — | — | |
| FRIENDSModel=Hyperlight Bench, Training Protocol=From Scratch2024.05 | 87.03 | 11.35 | — | — | — | — | — | — | |
| PUREGEN-DDPMModel=MobileNetV2, Training Protocol=From Scratch2024.05 | 86.91 | 2.13 | — | — | — | — | — | — | |
| JPEGModel=MobileNetV2, Training Protocol=From Scratch2024.05 | 86.6 | 2.3 | — | — | — | — | — | — | |
| FRIENDSTraining Regime=Linear, Attack Scenario=BlackBox-10%, Backbone=ResNet-182024.05 | 85.18 | — | — | 33.33 | — | — | — | — | |
| EPICTraining Regime=From Scratch, Attack Scenario=Gradient Matching-1%, Backbone=ResNet-182024.05 | 85.14 | — | — | 10 | — | — | — | — | |
| EPICModel=DenseNet121, Training Protocol=From Scratch2024.05 | 85.12 | 32.6 | — | — | — | — | — | — | |
| EPICTraining Regime=Linear, Attack Scenario=BlackBox-10%, Backbone=ResNet-182024.05 | 84.34 | — | — | 66.67 | — | — | — | — | |
| NoneTraining Regime=Linear, Attack Scenario=BlackBox-10%, Backbone=ResNet-182024.05 | 83.59 | — | — | 93.75 | — | — | — | — | |
| PUREGEN-DDPMModel=MobileNetV2, Training Protocol=Linear Transfer BlackBox2024.05 | 83.15 | 0 | — | — | — | — | — | — | |
| EPICTraining Regime=From Scratch, Attack Scenario=Narcissus-1%, Backbone=ResNet-182024.05 | 82.2 | — | — | — | 27.31 | 84.71 | — | — | |
| NoneModel=DenseNet121, Training Protocol=Linear Transfer BlackBox2024.05 | 82.13 | 73.47 | — | — | — | — | — | — | |
| EPICTraining Regime=Fine-Tune, Attack Scenario=Bullseye Polytope-10%, Backbone=ResNet-182024.05 | 81.95 | — | — | 42 | — | — | — | — | |
| FRIENDSModel=DenseNet121, Training Protocol=Linear Transfer BlackBox2024.05 | 80.22 | 60.42 | — | — | — | — | — | — | |
| JPEGModel=DenseNet121, Training Protocol=Linear Transfer BlackBox2024.05 | 78.67 | 0 | — | — | — | — | — | — | |
| PUREGEN-EBMModel=MobileNetV2, Training Protocol=Linear Transfer BlackBox2024.05 | 78.57 | 0 | — | — | — | — | — | — | |
| EPICModel=MobileNetV2, Training Protocol=From Scratch2024.05 | 78.16 | 22.35 | — | — | — | — | — | — | |
| Diff. Priv. SGDBackbone=ResNet-18, Attack Method=Gradient Matching, Attack Epsilon (eps)=16, Training Epochs=802022.08 | 75.7 | 5 | — | — | — | — | — | — | |
| NoneModel=MobileNetV2, Training Protocol=Linear Transfer BlackBox, Poisoning Rate=10%2024.05 | 73.27 | 81.25 | — | — | — | — | — | — | |
| JPEGModel=MobileNetV2, Training Protocol=Linear Transfer BlackBox2024.05 | 73.14 | 2.08 | — | — | — | — | — | — | |
| EPICModel=DenseNet121, Training Protocol=Linear Transfer BlackBox2024.05 | 70.2 | 66.67 | — | — | — | — | — | — | |
| FRIENDSModel=MobileNetV2, Training Protocol=Linear Transfer BlackBox2024.05 | 68.86 | 41.67 | — | — | — | — | — | — | |
| TGDA HessianModel=CNN2026.03 | 64.3 | — | — | — | — | — | 2.04 | 21.5 | |
| KFAC (OURS)Model=CNN2026.03 | 64.3 | — | — | — | — | — | 3.44 | 6.2 | |
| BOME (VF)Model=CNN2026.03 | 64.3 | — | — | — | — | — | 2.15 | 5.9 | |
| Label FlipModel=CNN2026.03 | 64.3 | — | — | — | — | — | 0.17 | — | |
| EPICModel=MobileNetV2, Training Protocol=Linear Transfer BlackBox2024.05 | 54.47 | 56.25 | — | — | — | — | — | — | |
| EPICModel=Hyperlight Bench, Training Protocol=From Scratch2024.05 | 24.88 | 10.58 | — | — | — | — | — | — |