Dataset Splitting for Backdoor Defense on GTSRB
97.12PrecisionHARVEY
Evaluation results
| Method | Links | ||||
|---|---|---|---|---|---|
| HARVEYModel=ResNet18, Attack=IAB2026.07 | 97.12 | 100 | 98.54 | 0 | |
| HARVEYModel=ResNet18, Attack=Trojan2026.07 | 96.03 | 100 | 97.97 | 0 | |
| HARVEYModel=ResNet18, Attack=WaNet2026.07 | 95.66 | 100 | 97.78 | 0 | |
| HARVEYModel=ResNet18, Attack=BadNets2026.07 | 95.54 | 100 | 97.72 | 0 | |
| HARVEYModel=ResNet18, Attack=Blend2026.07 | 94.55 | 100 | 97.2 | 0 | |
| HARVEYModel=WRN16-1, Attack=BadNets2026.07 | 91.03 | 99.92 | 95.27 | 0.01 | |
| HARVEYModel=WRN16-1, Attack=Trojan2026.07 | 90.31 | 99.13 | 94.51 | 0.1 | |
| HARVEYModel=ResNet18, Attack=Average2026.07 | 88.37 | 100 | 92.84 | 0 | |
| D-STModel=WRN16-1, Attack=IAB2026.07 | 76.26 | 100 | 86.53 | 0 | |
| HARVEYModel=WRN16-1, Attack=Average2026.07 | 73.54 | 99.3 | 83.91 | 0.08 | |
| HARVEYModel=WRN16-1, Attack=IAB2026.07 | 68.33 | 99.95 | 81.17 | 0.01 | |
| HARVEYModel=WRN16-1, Attack=Blend2026.07 | 67.52 | 100 | 80.61 | 0 | |
| HARVEYModel=WRN16-1, Attack=WaNet2026.07 | 67.12 | 97.27 | 79.43 | 0.32 | |
| HARVEYModel=WRN16-1, Attack=CLB2026.07 | 56.94 | 99.55 | 72.44 | 0.01 | |
| HARVEYModel=WRN16-1, Attack=Worst Case2026.07 | 56.94 | 97.27 | 72.44 | 0.32 | |
| HARVEYModel=ResNet18, Attack=CLB2026.07 | 51.34 | 100 | 67.85 | 0 | |
| HARVEYModel=ResNet18, Attack=Worst Case2026.07 | 51.34 | 100 | 67.85 | 0 | |
| D-STModel=WRN16-1, Attack=Trojan2026.07 | 31.15 | 96.15 | 47.06 | 0.56 | |
| D-STModel=ResNet18, Attack=Trojan2026.07 | 27.38 | 99.97 | 42.99 | 0 | |
| D-STModel=ResNet18, Attack=BadNets2026.07 | 27.37 | 99.97 | 42.97 | 0 | |
| D-STModel=WRN16-1, Attack=Average2026.07 | 25.92 | 78.67 | 34.55 | 2.69 | |
| D-STModel=WRN16-1, Attack=BadNets2026.07 | 22.8 | 99.97 | 37.13 | 0 | |
| DBDModel=ResNet18, Attack=BadNets2026.07 | 19.95 | 100 | 33.26 | 0 | |
| DBDModel=ResNet18, Attack=WaNet2026.07 | 19.95 | 99.77 | 33.25 | 0.05 | |
| DBDModel=ResNet18, Attack=Trojan2026.07 | 19.94 | 99.74 | 33.24 | 0.05 | |
| DBDModel=WRN16-1, Attack=WaNet2026.07 | 17.1 | 85.49 | 28.5 | 2.9 | |
| D-STModel=ResNet18, Attack=Average2026.07 | 15.75 | 94.12 | 26.11 | 2.26 | |
| DBDModel=ResNet18, Attack=Average2026.07 | 15.31 | 88.58 | 25.74 | 2.28 | |
| D-STModel=ResNet18, Attack=IAB2026.07 | 14.61 | 99.97 | 25.49 | 0.01 | |
| DBDModel=ResNet18, Attack=IAB2026.07 | 14.32 | 71.63 | 23.87 | 5.67 | |
| D-STModel=WRN16-1, Attack=Blend2026.07 | 12.73 | 95.31 | 22.46 | 1.87 | |
| DBDModel=ResNet18, Attack=Blend2026.07 | 12.06 | 60.33 | 20.1 | 7.93 | |
| D-STModel=ResNet18, Attack=Blend2026.07 | 12.01 | 96.1 | 21.35 | 1.95 | |
| D-STModel=ResNet18, Attack=WaNet2026.07 | 10 | 80.08 | 17.78 | 10 | |
| D-STModel=WRN16-1, Attack=WaNet2026.07 | 9.96 | 6.79 | 8.08 | 10 | |
| DBDModel=ResNet18, Attack=CLB2026.07 | 5.66 | 100 | 10.71 | 0 | |
| DBDModel=ResNet18, Attack=Worst Case2026.07 | 5.66 | 60.33 | 10.71 | 7.93 | |
| DBDModel=WRN16-1, Attack=Average2026.07 | 4.52 | 31 | 7.68 | 13.1 | |
| DBDModel=WRN16-1, Attack=CLB2026.07 | 3.99 | 70.53 | 7.55 | 1.67 | |
| D-STModel=ResNet18, Attack=CLB2026.07 | 3.14 | 88.65 | 6.07 | 1.61 | |
| D-STModel=ResNet18, Attack=Worst Case2026.07 | 3.14 | 80.08 | 6.07 | 10 | |
| DBDModel=WRN16-1, Attack=BadNets2026.07 | 2.96 | 14.79 | 4.93 | 17.04 | |
| D-STModel=WRN16-1, Attack=CLB2026.07 | 2.61 | 73.78 | 6.07 | 3.71 | |
| D-STModel=WRN16-1, Attack=Worst Case2026.07 | 2.61 | 6.79 | 6.07 | 10 | |
| DBDModel=WRN16-1, Attack=Trojan2026.07 | 2.52 | 12.6 | 4.2 | 17.48 | |
| DBDModel=WRN16-1, Attack=Blend2026.07 | 0.42 | 2.09 | 0.7 | 19.58 | |
| DBDModel=WRN16-1, Attack=IAB2026.07 | 0.1 | 0.51 | 0.17 | 19.9 | |
| DBDModel=WRN16-1, Attack=Worst Case2026.07 | 0.1 | 0.51 | 0.17 | 19.9 |