Trigger Inversion on SST2
100RecallCSO(discrete)
Evaluation Results
| Method | Links | ||
|---|---|---|---|
| CSO(discrete)Model=Flan-t5-small, Trigger=Tell me seriously (3 tokens), Label Type=dirty label, Poison Rate=low2026.06 | 100 | — | |
| CSO(discrete)Model=Flan-t5-small, Trigger=Tell me seriously (3 tokens), Label Type=dirty label, Poison Rate=high2026.06 | 100 | — | |
| CSO(discrete)Model=Flan-t5-small, Trigger=Tell me seriously (3 tokens), Label Type=clean label, Poison Rate=high2026.06 | 90 | — | |
| CSO(discrete)Model=Flan-t5-small, Trigger=Tell me seriously (3 tokens), Label Type=clean label, Poison Rate=low2026.06 | 83.3333 | — | |
| UATModel=Flan-t5-small, Trigger=Tell me seriously (3 tokens), Label Type=clean label, Poison Rate=high2026.06 | 36.6667 | — | |
| CSO(discrete)Model=Flan-t5-small, Trigger=mb (1 token), Label Type=clean label, Poison Rate=low2026.06 | 33.3333 | — | |
| CSO(discrete)Model=Flan-t5-small, Trigger=mb (1 token), Label Type=clean label, Poison Rate=high2026.06 | 33.3333 | — | |
| CSO(discrete)Model=Flan-t5-small, Trigger=mb (1 token), Label Type=dirty label, Poison Rate=high2026.06 | 33.3333 | — | |
| UATModel=Flan-t5-small, Trigger=Tell me seriously (3 tokens), Label Type=clean label, Poison Rate=low2026.06 | 33.3333 | — | |
| CSO(discrete)Model=Flan-t5-small, Trigger=mb (1 token), Label Type=dirty label, Poison Rate=low2026.06 | 30 | — | |
| UATModel=Flan-t5-small, Trigger=Tell me seriously (3 tokens), Label Type=dirty label, Poison Rate=high2026.06 | 26.6667 | — | |
| UATModel=Flan-t5-small, Trigger=mb (1 token), Label Type=dirty label, Poison Rate=high2026.06 | 26.6667 | — | |
| UATModel=Flan-t5-small, Trigger=mb (1 token), Label Type=clean label, Poison Rate=high2026.06 | 16.6667 | — | |
| UATModel=Flan-t5-small, Trigger=mb (1 token), Label Type=dirty label, Poison Rate=low2026.06 | 16.6667 | — | |
| PICCOLOModel=Flan-t5-small, Trigger=Tell me seriously (3 tokens), Label Type=clean label, Poison Rate=high2026.06 | 16.6667 | — | |
| UATModel=Flan-t5-small, Trigger=Tell me seriously (3 tokens), Label Type=dirty label, Poison Rate=low2026.06 | 13.3333 | — | |
| DBSModel=Flan-t5-small, Trigger=Tell me seriously (3 tokens), Label Type=clean label, Poison Rate=low2026.06 | 10 | — | |
| DBSModel=Flan-t5-small, Trigger=Tell me seriously (3 tokens), Label Type=clean label, Poison Rate=high2026.06 | 10 | — | |
| PICCOLOModel=Flan-t5-small, Trigger=Tell me seriously (3 tokens), Label Type=clean label, Poison Rate=low2026.06 | 10 | — | |
| DBSModel=Flan-t5-small, Trigger=Tell me seriously (3 tokens), Label Type=dirty label, Poison Rate=high2026.06 | 6.6667 | — | |
| DBSModel=Flan-t5-small, Trigger=mb (1 token), Label Type=clean label, Poison Rate=high2026.06 | 6.6667 | — | |
| PICCOLOModel=Flan-t5-small, Trigger=Tell me seriously (3 tokens), Label Type=dirty label, Poison Rate=high2026.06 | 6.6667 | — | |
| GBDAModel=Flan-t5-small, Trigger=Tell me seriously (3 tokens), Label Type=clean label, Poison Rate=low2026.06 | 6.6667 | — | |
| MMModel=Flan-t5-small, Trigger=Tell me seriously (3 tokens), Label Type=clean label, Poison Rate=high2026.06 | 3.3333 | — | |
| MMModel=Flan-t5-small, Trigger=Tell me seriously (3 tokens), Label Type=dirty label, Poison Rate=high2026.06 | 3.3333 | — | |
| MMModel=Flan-t5-small, Trigger=mb (1 token), Label Type=dirty label, Poison Rate=high2026.06 | 3.3333 | — | |
| DBSModel=Flan-t5-small, Trigger=Tell me seriously (3 tokens), Label Type=dirty label, Poison Rate=low2026.06 | 3.3333 | — | |
| UATModel=Flan-t5-small, Trigger=mb (1 token), Label Type=clean label, Poison Rate=low2026.06 | 3.3333 | — | |
| MMModel=Flan-t5-small, Trigger=Tell me seriously (3 tokens), Label Type=clean label, Poison Rate=low2026.06 | 0 | — | |
| MMModel=Flan-t5-small, Trigger=Tell me seriously (3 tokens), Label Type=dirty label, Poison Rate=low2026.06 | 0 | — | |
| MMModel=Flan-t5-small, Trigger=mb (1 token), Label Type=clean label, Poison Rate=low2026.06 | 0 | — | |
| MMModel=Flan-t5-small, Trigger=mb (1 token), Label Type=clean label, Poison Rate=high2026.06 | 0 | — | |
| MMModel=Flan-t5-small, Trigger=mb (1 token), Label Type=dirty label, Poison Rate=low2026.06 | 0 | — | |
| DBSModel=Flan-t5-small, Trigger=mb (1 token), Label Type=clean label, Poison Rate=low2026.06 | 0 | — | |
| DBSModel=Flan-t5-small, Trigger=mb (1 token), Label Type=dirty label, Poison Rate=low2026.06 | 0 | — | |
| DBSModel=Flan-t5-small, Trigger=mb (1 token), Label Type=dirty label, Poison Rate=high2026.06 | 0 | — | |
| PICCOLOModel=Flan-t5-small, Trigger=Tell me seriously (3 tokens), Label Type=dirty label, Poison Rate=low2026.06 | 0 | — | |
| GBDAModel=Flan-t5-small, Trigger=Tell me seriously (3 tokens), Label Type=clean label, Poison Rate=high2026.06 | 0 | — | |
| GBDAModel=Flan-t5-small, Trigger=Tell me seriously (3 tokens), Label Type=dirty label, Poison Rate=low2026.06 | 0 | — | |
| GBDAModel=Flan-t5-small, Trigger=Tell me seriously (3 tokens), Label Type=dirty label, Poison Rate=high2026.06 | 0 | — | |
| GBDAModel=Flan-t5-small, Trigger=mb (1 token), Label Type=clean label, Poison Rate=low2026.06 | 0 | — | |
| GBDAModel=Flan-t5-small, Trigger=mb (1 token), Label Type=clean label, Poison Rate=high2026.06 | 0 | — | |
| GBDAModel=Flan-t5-small, Trigger=mb (1 token), Label Type=dirty label, Poison Rate=low2026.06 | 0 | — | |
| GBDAModel=Flan-t5-small, Trigger=mb (1 token), Label Type=dirty label, Poison Rate=high2026.06 | 0 | — | |
| ALTModel=Qwen3-4b, Poison Rate=high, Target Trigger=Tell me seriously(3 tokens), Labeling Strategy=clean label2026.06 | — | 12 | |
| ALTModel=Qwen3-4b, Poison Rate=high, Target Trigger=Tell me seriously(3 tokens), Labeling Strategy=dirty label2026.06 | — | 10 | |
| ALTModel=Qwen3-4b, Poison Rate=high, Target Trigger=mb(1 token), Labeling Strategy=clean label2026.06 | — | 10 | |
| ALTModel=Qwen3-4b, Poison Rate=high, Target Trigger=mb(1 token), Labeling Strategy=dirty label2026.06 | — | 10 | |
| CSO(discrete)Model=Qwen3-4b, Poison Rate=high, Target Trigger=Tell me seriously(3 tokens), Labeling Strategy=clean label2026.06 | — | 25 | |
| CSO(discrete)Model=Qwen3-4b, Poison Rate=high, Target Trigger=Tell me seriously(3 tokens), Labeling Strategy=dirty label2026.06 | — | 30 | |
| CSO(discrete)Model=Qwen3-4b, Poison Rate=high, Target Trigger=mb(1 token), Labeling Strategy=clean label2026.06 | — | 10 | |
| CSO(discrete)Model=Qwen3-4b, Poison Rate=high, Target Trigger=mb(1 token), Labeling Strategy=dirty label2026.06 | — | 10 | |
| DBSModel=Qwen3-4b, Poison Rate=high, Target Trigger=Tell me seriously(3 tokens), Labeling Strategy=clean label2026.06 | — | 0 | |
| DBSModel=Qwen3-4b, Poison Rate=high, Target Trigger=Tell me seriously(3 tokens), Labeling Strategy=dirty label2026.06 | — | 2 | |
| DBSModel=Qwen3-4b, Poison Rate=high, Target Trigger=mb(1 token), Labeling Strategy=clean label2026.06 | — | 3 | |
| DBSModel=Qwen3-4b, Poison Rate=high, Target Trigger=mb(1 token), Labeling Strategy=dirty label2026.06 | — | 2 | |
| GBDAModel=Qwen3-4b, Poison Rate=high, Target Trigger=Tell me seriously(3 tokens), Labeling Strategy=clean label2026.06 | — | 0 | |
| GBDAModel=Qwen3-4b, Poison Rate=high, Target Trigger=Tell me seriously(3 tokens), Labeling Strategy=dirty label2026.06 | — | 3 | |
| GBDAModel=Qwen3-4b, Poison Rate=high, Target Trigger=mb(1 token), Labeling Strategy=clean label2026.06 | — | 0 | |
| GBDAModel=Qwen3-4b, Poison Rate=high, Target Trigger=mb(1 token), Labeling Strategy=dirty label2026.06 | — | 0 | |
| MMModel=Qwen3-4b, Poison Rate=high, Target Trigger=Tell me seriously(3 tokens), Labeling Strategy=clean label2026.06 | — | 5 | |
| MMModel=Qwen3-4b, Poison Rate=high, Target Trigger=Tell me seriously(3 tokens), Labeling Strategy=dirty label2026.06 | — | 8 | |
| MMModel=Qwen3-4b, Poison Rate=high, Target Trigger=mb(1 token), Labeling Strategy=clean label2026.06 | — | 10 | |
| MMModel=Qwen3-4b, Poison Rate=high, Target Trigger=mb(1 token), Labeling Strategy=dirty label2026.06 | — | 10 | |
| PICCOLOModel=Qwen3-4b, Poison Rate=high, Target Trigger=Tell me seriously(3 tokens), Labeling Strategy=clean label2026.06 | — | 2 | |
| PICCOLOModel=Qwen3-4b, Poison Rate=high, Target Trigger=Tell me seriously(3 tokens), Labeling Strategy=dirty label2026.06 | — | 3 | |
| UATModel=Qwen3-4b, Poison Rate=high, Target Trigger=Tell me seriously(3 tokens), Labeling Strategy=clean label2026.06 | — | 1 | |
| UATModel=Qwen3-4b, Poison Rate=high, Target Trigger=Tell me seriously(3 tokens), Labeling Strategy=dirty label2026.06 | — | 2 | |
| UATModel=Qwen3-4b, Poison Rate=high, Target Trigger=mb(1 token), Labeling Strategy=clean label2026.06 | — | 5 | |
| UATModel=Qwen3-4b, Poison Rate=high, Target Trigger=mb(1 token), Labeling Strategy=dirty label2026.06 | — | 8 |