Image Classification on GTSRB (CA, ASR)
96.2CAWaveAttack
Evaluation results
| Method | Links | |||
|---|---|---|---|---|
| WaveAttackPoisoning Rate (ρ)=5%, Defense=No defense2026.05 | 96.2 | 100 | — | |
| WaNetDefense State=Before Defense2026.02 | 95.99 | 99.78 | — | |
| WaNetDefense State=CLP2026.02 | 95.99 | 99.83 | — | |
| DSAPoisoning Rate (ρ)=1%, Defense=FST2026.05 | 95.1 | 40.2 | — | |
| DSAPoisoning Rate (ρ)=0.5%, Defense=FST2026.05 | 94.9 | 71.3 | — | |
| DSAPoisoning Rate (ρ)=5%, Defense=FST2026.05 | 94.3 | 52.2 | — | |
| IndividualAttack Setting=BadMerging2026.06 | 94.27 | — | 49.46 | |
| DSAPoisoning Rate (ρ)=1%, Defense=No defense2026.05 | 94.2 | 99.5 | — | |
| BlendDefense State=Fine Tuning2026.02 | 93.52 | 6.25 | — | |
| WaNetDefense State=TSBD2026.02 | 93.49 | 3 | — | |
| BlendDefense State=Before Defense2026.02 | 93.29 | 96.71 | — | |
| BlendDefense State=CLP2026.02 | 93.29 | 96.71 | — | |
| DSAPoisoning Rate (ρ)=0.5%, Defense=No defense2026.05 | 93.1 | 98.7 | — | |
| BppAttackPoisoning Rate (ρ)=5%, Defense=No defense2026.05 | 92.8 | 97.1 | — | |
| BadNetsPoisoning Rate (ρ)=1%, Defense=No defense2026.05 | 92.4 | 97.2 | — | |
| SSBAPoisoning Rate (ρ)=0.5%, Defense=No defense2026.05 | 92.3 | 86.2 | — | |
| BadNetsPoisoning Rate (ρ)=1%, Defense=FST2026.05 | 92.2 | 0 | — | |
| SSBAPoisoning Rate (ρ)=5%, Defense=No defense2026.05 | 92.1 | 96.4 | — | |
| BppAttackPoisoning Rate (ρ)=5%, Defense=FST2026.05 | 92.1 | 0 | — | |
| BlendDefense State=TSBD2026.02 | 92.05 | 73.81 | — | |
| BlendedPoisoning Rate (ρ)=0.5%, Defense=FST2026.05 | 92 | 0 | — | |
| SSBAPoisoning Rate (ρ)=1%, Defense=FST2026.05 | 92 | 0.1 | — | |
| BppAttackPoisoning Rate (ρ)=1%, Defense=FST2026.05 | 91.8 | 0 | — | |
| BadNetsPoisoning Rate (ρ)=0.5%, Defense=No defense2026.05 | 91.7 | 99 | — | |
| DSAPoisoning Rate (ρ)=5%, Defense=No defense2026.05 | 91.6 | 99.1 | — | |
| BppAttackPoisoning Rate (ρ)=1%, Defense=No defense2026.05 | 91.5 | 43.9 | — | |
| WaveAttackPoisoning Rate (ρ)=1%, Defense=No defense2026.05 | 91.5 | 99.8 | — | |
| BppAttackPoisoning Rate (ρ)=0.5%, Defense=FST2026.05 | 91.3 | 0 | — | |
| Adapt-BlendPoisoning Rate (ρ)=5%, Defense=No defense2026.05 | 91.2 | 98.4 | — | |
| SSBAPoisoning Rate (ρ)=5%, Defense=FST2026.05 | 91.1 | 0.1 | — | |
| SSBAPoisoning Rate (ρ)=1%, Defense=No defense2026.05 | 91.1 | 91.7 | — | |
| BlendedPoisoning Rate (ρ)=5%, Defense=No defense2026.05 | 91 | 97.2 | — | |
| BlendedPoisoning Rate (ρ)=0.5%, Defense=No defense2026.05 | 91 | 93.2 | — | |
| SSBAPoisoning Rate (ρ)=0.5%, Defense=FST2026.05 | 91 | 0 | — | |
| WaveAttackPoisoning Rate (ρ)=5%, Defense=FST2026.05 | 91 | 0.6 | — | |
| BlendedPoisoning Rate (ρ)=1%, Defense=FST2026.05 | 90.9 | 0.1 | — | |
| BppAttackPoisoning Rate (ρ)=0.5%, Defense=No defense2026.05 | 90.9 | 10.4 | — | |
| BlendDefense State=NAD2026.02 | 90.64 | 6.94 | — | |
| BlendedPoisoning Rate (ρ)=5%, Defense=FST2026.05 | 90.4 | 0 | — | |
| BadNetsPoisoning Rate (ρ)=5%, Defense=No defense2026.05 | 90.3 | 98.2 | — | |
| Adapt-BlendPoisoning Rate (ρ)=5%, Defense=FST2026.05 | 90.3 | 0.1 | — | |
| BlendedPoisoning Rate (ρ)=1%, Defense=No defense2026.05 | 90.2 | 95.3 | — | |
| BadNetsPoisoning Rate (ρ)=0.5%, Defense=FST2026.05 | 90 | 0.2 | — | |
| WaveAttackPoisoning Rate (ρ)=0.5%, Defense=FST2026.05 | 89.9 | 0.2 | — | |
| IndividualMerging Protocol=LoBAM2026.06 | 89.76 | — | 21.25 | |
| BadNetsPoisoning Rate (ρ)=5%, Defense=FST2026.05 | 89.6 | 0.4 | — | |
| WaveAttackPoisoning Rate (ρ)=1%, Defense=FST2026.05 | 89.6 | 0.4 | — | |
| WaveAttackPoisoning Rate (ρ)=0.5%, Defense=No defense2026.05 | 88.7 | 100 | — | |
| BlendDefense State=ANP2026.02 | 88.61 | 80.1 | — | |
| Adapt-BlendPoisoning Rate (ρ)=0.5%, Defense=FST2026.05 | 88.6 | 0 | — | |
| Adapt-BlendPoisoning Rate (ρ)=0.5%, Defense=No defense2026.05 | 88.5 | 94.7 | — | |
| BadNetDefense State=NAD2026.02 | 88.42 | 3.41 | — | |
| Adapt-BlendPoisoning Rate (ρ)=1%, Defense=FST2026.05 | 88 | 0.1 | — | |
| BadSNNDefense State=TSBD2026.02 | 87.65 | 84.99 | — | |
| BadNetDefense State=TSBD2026.02 | 87.58 | 3.02 | — | |
| BadSNNDefense State=Before Defense2026.02 | 87.43 | 84.99 | — | |
| Adapt-BlendPoisoning Rate (ρ)=1%, Defense=No defense2026.05 | 87.2 | 96.8 | — | |
| BadNetDefense State=Before Defense2026.02 | 87.09 | 80.8 | — | |
| BadNetDefense State=CLP2026.02 | 86.59 | 76.43 | — | |
| BenignPre-train Dataset=CIFAR-102026.02 | 82.03 | — | — | |
| HPEPre-train Dataset=CIFAR-102026.02 | 81.18 | 98.12 | — | |
| BenignPre-train Dataset=CIFAR-10, Backbone=ResNet-18, SSL Algorithm=SimCLR2026.02 | 81.13 | — | — | |
| ADCAPre-train Dataset=CIFAR-10, Backbone=ResNet-18, SSL Algorithm=SimCLR2026.02 | 80.56 | 96.11 | — | |
| BadEncoderPre-train Dataset=CIFAR-102026.02 | 79.52 | 62.35 | — | |
| BadEncoderPre-train Dataset=CIFAR-10, Backbone=ResNet-18, SSL Algorithm=SimCLR2026.02 | 78.45 | 62.78 | — | |
| CTRLPre-train Dataset=CIFAR-102026.02 | 77.53 | 62.37 | — | |
| BASSLPre-train Dataset=CIFAR-102026.02 | 76.56 | 47.23 | — | |
| DBAPre-train Dataset=CIFAR-10, Backbone=ResNet-18, SSL Algorithm=SimCLR2026.02 | 76.54 | 57.98 | — | |
| BADFSSPre-train Dataset=CIFAR-102026.02 | 76.53 | 61.32 | — | |
| EmInspectorPre-train Dataset=CIFAR-1002026.02 | 76.37 | 89.37 | — | |
| HPEPre-train Dataset=CIFAR-1002026.02 | 76.24 | 95.97 | — | |
| CLDefense State=Fine Tuning2026.02 | 76.23 | 3.46 | — | |
| BenignPre-train Dataset=CIFAR-100, Backbone=ResNet-18, SSL Algorithm=SimCLR2026.02 | 75.67 | — | — | |
| EmInspectorPre-train Dataset=CIFAR-102026.02 | 75.64 | 91.35 | — | |
| BADFSSPre-train Dataset=CIFAR-10, Backbone=ResNet-18, SSL Algorithm=SimCLR2026.02 | 75.53 | 61.33 | — | |
| CLDefense State=NAD2026.02 | 75.5 | 4.85 | — | |
| BenignPre-train Dataset=STL-102026.02 | 75.07 | — | — | |
| UBAPre-train Dataset=CIFAR-100, Backbone=ResNet-18, SSL Algorithm=SimCLR2026.02 | 74.65 | 66.43 | — | |
| BenignPre-train Dataset=CIFAR-1002026.02 | 74.63 | — | — | |
| ADCAPre-train Dataset=CIFAR-100, Backbone=ResNet-18, SSL Algorithm=SimCLR2026.02 | 74.53 | 91.78 | — | |
| HPEPre-train Dataset=STL-102026.02 | 73.92 | 97.37 | — | |
| DBAPre-train Dataset=CIFAR-100, Backbone=ResNet-18, SSL Algorithm=SimCLR2026.02 | 73.87 | 60.52 | — | |
| BenignPre-train Dataset=STL-10, Backbone=ResNet-18, SSL Algorithm=SimCLR2026.02 | 73.78 | — | — | |
| ADCAPre-train Dataset=STL-10, Backbone=ResNet-18, SSL Algorithm=SimCLR2026.02 | 73.69 | 85.56 | — | |
| FCBAPre-train Dataset=CIFAR-100, Backbone=ResNet-18, SSL Algorithm=SimCLR2026.02 | 73.28 | 61.42 | — | |
| FCBAPre-train Dataset=CIFAR-10, Backbone=ResNet-18, SSL Algorithm=SimCLR2026.02 | 73.15 | 75.13 | — | |
| BadEncoderPre-train Dataset=CIFAR-100, Backbone=ResNet-18, SSL Algorithm=SimCLR2026.02 | 72.93 | 61.53 | — | |
| CLDefense State=TSBD2026.02 | 72.9 | 4.62 | — | |
| BASSLPre-train Dataset=STL-102026.02 | 72.71 | 49.15 | — | |
| BASSLPre-train Dataset=CIFAR-1002026.02 | 72.51 | 42.51 | — | |
| UBAPre-train Dataset=STL-10, Backbone=ResNet-18, SSL Algorithm=SimCLR2026.02 | 72.43 | 61.72 | — | |
| BADFSSPre-train Dataset=STL-102026.02 | 72.37 | 60.28 | — | |
| BadEncoderPre-train Dataset=CIFAR-1002026.02 | 72.14 | 65.36 | — | |
| BenignPre-train Dataset=ImageNet-1002026.02 | 72.14 | — | — | |
| CTRLPre-train Dataset=CIFAR-1002026.02 | 71.62 | 64.12 | — | |
| BadEncoderPre-train Dataset=STL-102026.02 | 71.46 | 65.94 | — | |
| HPEPre-train Dataset=ImageNet-1002026.02 | 71.14 | 91.83 | — | |
| BadNetDefense State=Fine Tuning2026.02 | 70.93 | 2.92 | — | |
| UBAPre-train Dataset=CIFAR-10, Backbone=ResNet-18, SSL Algorithm=SimCLR2026.02 | 70.86 | 65.33 | — | |
| BadEncoderPre-train Dataset=ImageNet-1002026.02 | 70.67 | 60.18 | — |