# Supplementary Material of “BackdoorBench: A Comprehensive Benchmark and
Analysis of Backdoor Learning"

Baoyuan Wu, Hongrui Chen, Mingda Zhang, Zihao Zhu, Shaokui Wei, Danni Yuan,
Mingli Zhu, Ruotong Wang, Li Liu
The first seven authors are with the School of Data Science, The Chinese
University of Hong Kong, Shenzhen, China, email<EMAIL_ADDRESS><EMAIL_ADDRESS>Li Liu is with the Hong Kong University of Science
and Technology (Guangzhou), China, email<EMAIL_ADDRESS>Corresponding author: Baoyuan Wu (wubaoyuan@cuhk.edu.cn).

††publicationid: pubid: 0000–0000/00$00.00 © 2021 IEEE

## Implementation details and computational complexities

TABLE I: Hyper-parameter settings of all implemented attack methods.

Attack | Hyper-parameter | Setting | Theoretical complexity
---|---|---|---
General Settings | attack target | all-to-one with class 0 |  train sample size($N_{\mathcal{T}}$),
optimizer | SGD |  batch size ($B$),
momentum | 0.9 |  forward process for net C ($f_{C}$),
weight decay | 0.0005 |  backward process for net C ($b_{C}$),
batch size | 128 |  epochs ($E$) ,
epochs on CIFAR10 and CIFAR-100 | 100 |  number of classes ( $N_{cls}$)
epochs on GTSRB | 50 |
lr schedule (except for | CosineAnnealingLR |
training-controllable attack) on |  |
CIFAR10, CIFAR-100 and GTSRB |  |
epochs on TinyImageNet-200 | 200 |
lr schedule on TinyImageNet-200 | ReduceLROnPlateau |
| random seed | 0 |
BadNets [gu2019badnets] | pattern & location |  $3\times 3$, pure white, at | $O(N_{\mathcal{T}}/BE(f+b))$
| downright corner |
|  | (no margin left) |
Blended [chen2017targeted] | pattern | hello kitty | $O(N_{\mathcal{T}}/BE(f+b))$
alpha | 0.2 |
Blind [bagdasaryan2021blind] |  loss weight ($\alpha_{0}$) | 1.0 | $O(2N_{\mathcal{T}}/BE(f+b))$
backdoored loss weights ($\alpha_{1}$) | 0.9 |
MGDA loss normalization |  $l_{2}$-norm of weight times loss |
length of batch history ($T$) | 1000 |
loss threshold for backdoor attack to start attack | 1.0 |
BPP [wang2022bppattack] |  negative ratio ($\rho_{neg}$) | 0.1 | $O((1+\rho_{neg})N_{\mathcal{T}}/BE(f+b))$
step scheduler milestones | 100, 200, 300, 400 |
step scheduler gamma | 0.1 |
squeeze number | 8 |
Input-aware [nguyen2020input] | Generator lr (both for M, G) | 0.01 | $O(E_{mask}N_{\mathcal{T}}/B(f_{mask}+b_{mask})+$
schedule (for M, G and C) | MultiStepLR | $(E-E_{mask})N_{\mathcal{T}}/B(2f_{mask}+$
schedule milestones for G | 200, 300, 400, 500 | $2f_{generator}+2b_{generator}+f+b))$
schedule milestones for C | 100, 200, 300, 400 |
schedule milestones for M | 10, 20 |
schedule gamma (for M and G) | 0.1 |
$\lambda_{div}$ | 1 |
$\lambda_{norm}$ | 400 |
mask density | 0.032 |
cross_ratio | 1 |
|  mask train epochs ($E_{mask}$) | 25 |
Label Consistent [turner2019labelconsistent] | adversarial attack | PGD | $O(N_{\mathcal{T}}/BE(f+b)+N_{\mathcal{T}}/BT_{step}(f+b))$
step ($T_{step}$) | 100 |
$\alpha$ | 1.5 |
$\epsilon$ | 8 |
Low Frequency [zeng2021rethinking] | maximum number of termination | 50 | $O(T_{ter}N_{sample}(2f+T_{df}f+T_{df}N_{cls}b)+$
iteration ($T_{ter}$) |  | $N_{\mathcal{T}}/BE(f+b))$
fooling rate | 0.2 |
overshoot | 0.02 |
maximum number of iterations | 200 |
for deepfool ($T_{df}$) |  |
|  sample number for UAP ($N_{sample}$) | 100 |
LIRA [doan2021lira] |  autoencoder learning rate ($\gamma_{T}$) | 0.0001 |  $O(m(2f_{encoder}+b_{encoder}+3f_{cls}+b_{cls})N_{\mathcal{T}}/B+n(f_{encoder}+2f_{cls}+b_{cls})N_{\mathcal{T}}/B$ )
perturb ($\epsilon$) | 0.01 |
stage one epoch ($m$) | 50 |
stage two epoch ($n$) | 250 |
model finetune learning rate ($\gamma_{f}$) | 0.01 |
backdoor loss weight ($\beta$) | 0.5 |
step scheduler milestones | 50, 100, 150, 200 |
step scheduler gamma | 0.1 |
SIG [SIG] | $\delta$ | 40 | $O(N_{\mathcal{T}}/BE(f+b))$
$f$ | 6 |
SSBA [ssba] | encoded bit | 1 | $O(T_{step}(f_{auto}+b_{auto})+N_{\mathcal{T}}/BE(f+b))$
|  autoencoder train step ($T_{step}$) | 140000 |
TrojanNN [liu2018trojaning] |  target neural number ($n_{t}$) | 2 | $O(n_{t}e(f+b)+N_{\mathcal{T}}/BE(f+b))$
mask shape | apple |
optimization neuron target value ($t$) | 100 |
PGD step number ($e$) | 1000 |
|  trigger learning rate ($lr$) | 0.1 |
WaNet [nguyen2021wanet] | cross_ratio | 2 | $O(N_{\mathcal{T}}/BE(f+b))$
lr schedule | MultiStepLR |
schedule milestones | 100, 200, 300, 400 |
| grid_rescale | 1 |

TABLE II: Hyper-parameter settings of all implemented defense methods.

Defense | Hyper-parameter | Setting | Theoretical complexity
---|---|---|---
General Settings | optimizer | SGD |  train sample size ($N_{\mathcal{T}}$), batch size ($B$),
momentum | 0.9 |  forward process for net C ($f_{C}$),
weight decay | 0.0005 |  backward process for net C ($b_{C}$),
batch size | 256 |  epochs ($E$) , number of classes ( $N_{cls}$)
epochs on CIFAR10, CIFAR-100 and GTSRB | 100 |  the number of pruning neurons ($N_{neu}$)
| lr schedule (except for special learning defense) | CosineAnnealingLR |
| on CIFAR10, CIFAR-100 and GTSRB |  |
| epochs on TinyImageNet-200 | 200 |
| lr schedule on TinyImageNet-200 | ReduceLROnPlateau |
| the number of pruning neurons | the number of neurons in the last layer |
| random seed | 0 |
FT |  ratio of validation data ($p_{v}$) |  5$\%$ | $O(N_{\mathcal{T}}p_{v}/BE(f+b))$
FP [FP] |  ratio of validation data ($p_{v}$) |  5$\%$ | $O(N_{neu}N_{\mathcal{T}}p_{v}f/B)$
the tolerance of accuracy reduction111For FP and ANP, we define a hyper-parameter the tolerance of clean accuracy reduction as the maximum relative drop of clean accuracy. It is used to determine the number of pruned neurons. |  10$\%$ | $+O(N_{\mathcal{T}}p_{v}/BE(f+b))$
NAD 333For NAD, we use the code and recommended hyper-parameters at https://github.com/bboylyg/NAD/tree/d61e4d74ee697f125336bfc42a03c707679071a6. [nad-iclr-2020] |  ratio of validation data for teacher model ($p_{v}$) |  5$\%$ | $O(N_{\mathcal{T}}p_{v}/BE_{ft}(f+b))$
$\beta_{1}$ for the loss | 500 | $+O(N_{\mathcal{T}}p_{v}/BE(2f+b))$
|  $\beta_{2}$ for the loss | 1000 |
|  $\beta_{3}$ for the loss | 1000 |
| the power for attention | 2.0 |
|  the epoch for teacher model to fine-tune ($E_{ft}$) | 10 |
NC [wang2019neural] | the norm used for the reversed trigger | L1 | $O(N_{\mathcal{T}}p_{v}E_{r}N_{cls}/B(f+b))$
cleaning ratio ($p_{v}$) | 0.05 | $+O(N_{\mathcal{T}}p_{v}/BE(f+b))$
| unlearning ratio | 0.2 |
|  the epoch of learning trigger ($E_{r}$) | 80 |
ANP [wu2021adversarial] |  the tolerance of accuracy reduction111For FP and ANP, we define a hyper-parameter the tolerance of clean accuracy reduction as the maximum relative drop of clean accuracy. It is used to determine the number of pruned neurons. |  10$\%$ | $O(e_{i}(f+b))$
number of validation data ($p_{v}$) |  5$\%$
the number of iteration during pertubation ($e_{i}$) | 2000
$\epsilon$ | 0.4
| $\alpha$ | 0.2 |
AC [AC] | number of reduced dimensions | 10 |  $O(N_{\mathcal{T}}/BN_{fe}^{3})+O(N_{\mathcal{T}}/BE(f+b))$222For AC and Spectral, $N_{fe}$ is the dimensions of the representation.
Spectral [tran2018spectral] | The percentile of backdoor data |  85$\%$ |  $O(N_{fe}^{3})+O(N_{\mathcal{T}}/BE_{d}(f+b))$222For AC and Spectral, $N_{fe}$ is the dimensions of the representation.
ABL [li2021anti] |  tuning epochs ($E_{tu}$) for CIFAR10, CIFAR-100 and GTSRB | 20 | $O(N_{\mathcal{T}}/BE_{tu}(f+b))$
finetuning epochs ($E_{ft}$) for CIFAR10, CIFAR-100 and GTSRB | 60 | $+O(N_{\mathcal{T}}(1-p_{i})/BE_{ft}(f+b))$
unlearning epochs ($E_{u}$) for CIFAR10, CIFAR-100 and GTSRB | 20 | $+O(N_{\mathcal{T}}p_{i}/BE_{u}(f+b))$
tuning epochs for Tiny | 40 |
finetuning epochs for Tiny | 120 |
unlearning epochs for Tiny | 4 |
| lr for unlearning | 0.0005 |
| the value of flooding | 0.5 |
|  the isolation ratio of training data ($p_{i}$) | 0.01 |
DBD [huang2022backdoor] |  the epoch for self-supervised learning ($E_{se}$) | 100 | $O(N_{\mathcal{T}}/B_{se}E_{se}(f+b))$
the epoch for warmup ($E_{wa}$) | 10 | $+O(N_{\mathcal{T}}/B_{semi}E_{se}(f+b))$
the epsilon for the dataset ($\epsilon$) | 0.5 | $+O(N_{\mathcal{T}}\epsilon/B_{semi}E(f+b))$
during the semi-supervised learning |  |
|  The batch size of self learning ($B_{self}$) | 512 |
|  The batch size of self learning ($B_{semi}$) | 128 |
CLP [clp-2022] | The threshold of pruning | 3 | $O(f)$
The threshold of pruning for Tiny | 5
D-BR/D-ST [chen2022dbr] | the epochs of training without transformation | 2 | $O(N_{\mathcal{T}}/BE_{d}(f+b))$
the epochs of finetuning without transformation | 10
the epochs of unlearning/relearning without transformation | 20
the lr of unlearning/relearning without transformation | 0.0001
EP/BNP [ep-bnp-2022] | The threshold of pruning | 3 | $O(B*f)$
The threshold of pruning for Tiny | 4
I-BAU [i-bau] |  ratio of validation data ($p_{v}$) |  5$\%$ | $O(N_{\mathcal{T}}/BE_{d}(f+b))$
Outer iteration numbers | 5
Inner iteration numbers | 5

Hyper-parameter settings The hyper-parameter settings adopted in our
evaluations about backdoor attack and defense algorithms are described in
Table I and Table II, respectively. With these hyper-parameter settings, the
reported results of 11,492 pairs of evaluations could be reproduced. Moreover,
we would like to explain our rules to adopt above settings, as follows:

  * •

We don’t perform a separate hyper-parameter search for each method, mainly due
to the following two reasons:

    * –

As shown in Tables I and II, most methods have several hyper-parameters. For
most hyper-parameters of a method, there is neither a good rule to determine
the values, nor a suitable range of the values suggested in its original
manuscript. And, the suitable value or range of each hyper-parameter may vary
across different datasets, different model architectures, different against
attack/defense methods. Consequently, the hyper-parameter search space for
each method could be very large, requiring unimaginably high computational
resource.

    * –

Even assuming sufficient computing resources, then we can search a good value
for each hyper-parameter of each method in each evaluation. However, the
comparison results and analysis based on sufficient hyper-parameter search may
be unfair and make no sense in practice. Because, we still cannot tell a rule
or even some experiences to determine the hyper-parameter values in practice.
The sensitivity to hyper-parameters should also be an important metric of one
method’s performance, not just the best ACC/ASR values through the sufficient
hyper-parameter search.

  * •

How do we set the hyper-parameter values in our current 11,492 pairs of
evaluations.

    * –

If the original paper has provided the suggested good values of some hyper-
parameters, then we adopt those values in our evaluations. For example, the
ANP defense method explicitly wrote that "the perturbation budget
$\epsilon=0.4$ and the trade-off coefficient $\alpha=0.2$", so we also adopt
these values in our evaluations.

    * –

For those hyper-parameters without suggested values/ranges (or even without
descriptions) in their original papers, we will search values that lead to
comparable results (ACC/ASR) with the reported results in the same setting
($i.e.$, same dataset, same/similar model architecture, same poisoning ratio),
then fix these values in evaluations of other settings ($e.g.$, changing the
poisoning ratio).

    * –

The consistent values of hyper-parameters of each method across different
settings somewhat guarantee the fairness of evaluations. And, since the
adopted values may not be the optimal ones for some hyper-parameters, we
didn’t conduct the fine-grained analysis about the effects of some specific
hyper-parameters ($e.g.$, the trigger size/location in attack methods with
patch based triggers). Instead, we provided some high-level analysis w.r.t.
the shared hyper-parameters in all methods ($e.g.$, the number of classes, the
poisoning ratio, the model architecture). The findings of these high-level
analysis will not be significantly affected by the particular hyper-parameters
of each individual method.

Computational complexities The computational complexity of each attack and
each defense algorithm is also described in Table I and Table II,
respectively.

##  I Description of backdoor attack algorithms

  * •

BadNets [gu2019badnets]: It was the first work in backdoor learning, which
simply inserted a small patch with fixed pattern and location to replace the
original pixels in the clean image to obtain a poisoned image.

  * •

Blended [chen2017targeted]: It extended BadNets by encouraging the
invisibility of the trigger through alpha blending.

  * •

Label consistent (LC) [turner2019labelconsistent]: It generated a poisoned
image using adversarial attack, by enforcing it to be close to the clean
target image in the original RGB space, and close to the clean source image
patched with a trigger in the feature space of a pre-trained clean model.
Since the poisoned image is labeled as the target class, the mapping from the
trigger to the target class could be learned.

  * •

SIG [SIG]: It adopted a ramp or sinusoidal signal as the trigger to perturb
the clean images of the target class, while not changing their labels, such
that achieving the label consistent backdoor attack.

  * •

Low frequency attack (LF) [zeng2021rethinking] : It was built upon an analysis
that the triggers in many backdoor attacks bring in high-frequency artifacts,
which are easily detectable. Inspired by this analysis, LF developed a smooth
trigger by filtering high-frequency artifacts from a universal adversarial
perturbation.

  * •

Sample-specific backdoor attack (SSBA) [ssba]: It utilized an auto-encoder to
fuse a trigger ($e.g.$, a string) into clean samples to obtain poisoned
samples. The residual between the poisoned and the clean sample varied for
different clean images, $i.e.$, sample-specific.

  * •

Input-aware dynamic backdoor attack (Input-aware) [nguyen2020input]: It was a
training-controllable attack by simultaneously learning the model parameters
and a trigger generator. When testing, the learned trigger generator generated
one unique trigger for each clean testing sample.

  * •

Warping-based poisoned networks (WaNet) [nguyen2021wanet]: It was also a
training-controllable attack. A fixed warping function is adopted to slightly
distort the clean sample to construct the poisoned sample. The attacker
further controlled the training process to ensure that only the adopted fixed
warping function can activate the backdoor.

  * •

Blind [bagdasaryan2021blind]: It assumed that the attacker cannot directly
access the training data, but can insert a malicious loss-computation code to
manipulate the loss value during the training process, such that the trained
model can well fit both clean data and the inserted code synthesized poisoned
data.

  * •

BppAttack [wang2022bppattack]: It firstly constructed the poisoned image via
image quantization and dithering, such that the poisoned image is visually
similar to the original clean image. Then, it trained the model through
contrastive adversarial training, where the targeted adversarial example
w.r.t. the target label is treated as negative samples, to put more emphasis
on the mapping from the poisoned sample to the target label.

  * •

Trojaning Attack on Neural Networks (TrojanNN) [liu2018trojaning]: It aimed to
insert a backdoor into a pre-trained clean model by three steps: generating a
fixed-shape trigger by maximizing the activation of particularly selected
neurons; generating some training data via model inversion; re-training the
model based on the generated training data and trigger.

  * •

Learnable Imperceptible and Robust Backdoor Attack (LIRA) [doan2021lira]: It
jointly trains a classification model and a parametric transformation function
through a bi-level minimization problem, such that the classification model
performs well on clean sample while predicting the corresponding sample after
the learned transformation ($i.e.$., the poisoned sample) as the target label.

##  II Description of backdoor defense algorithms

  * •

Fine-tuning (FT): It assumed that fine-tuning the backdoored model on a subset
of clean samples could mitigate the backdoor effect. Note that FT is a widely
used approach for transferring pre-trained models to new tasks, but it has
been used as a basic component in several backdoor defense methods, such as
Fine-pruning (FP) [FP], Neural Attention Distillation (NAD) [nad-iclr-2020].

  * •

Fine-pruning (FP) [FP]: It was built upon the assumption that poisoned and
clean samples have different activation paths in the backdoored model.
Inspired, FP proposed to firstly prune some inactivated neurons of clean
samples, then fine-tune the pruned model based on the subset of clean samples
to recover the model performance.

  * •

Neural Attention Distillation (NAD) [nad-iclr-2020]: Its assumption is same
with FT. Instead of directly using the fine-tuned model as the mitigated
model, NAD adopted the first fine-tuned model as a teacher and fine-tuned the
backdoored model again by encouraging the consistency of the attention
representation between the new fine-tuned model and the teacher model.

  * •

Neural cleanse (NC) [wang2019neural]: It was built upon the assumption that
the trigger provides a “shortcut" between the samples from different source
classes and the target class. Based on this assumption, the possible trigger
is searched through optimization. If a small-size trigger ($e.g.$, a small
patch in the image) is found, then the model is detected as a backdoored
model, which is then mitigated through pruning or unlearning based on the
searched trigger.

  * •

Adversarial Neuron Pruning (ANP) [wu2021adversarial]: It was built upon an
observation that the neurons related to the injected backdoor are more
sensitive to adversarial neuron perturbation ($i.e.$, perturbing the neuron
weight to achieve adversarial attack) than other neurons in a backdoored
model. Inspired by this, ANP proposed to prune these sensitive neurons for
backdoor mitigation.

  * •

Activation Clustering (AC) [AC]: It was built upon an observation that the
sample activations ($i.e.$, the feature presentations) of the target class
will form two clusters, and the smaller cluster corresponds to poisoned
samples, while clean samples form one cluster. Then, the model is trained from
scratch based on the dataset without poisoned samples.

  * •

Spectral Signatures (SS) [tran2018spectral]: Its assumption is that the
feature representation distributions of clean and poisoned samples in one
class are spectrally separable, which is a concept of robust statistics.
Consequently, the poisoned samples can be identified by analyzing the spectrum
of the covariance matrix of the feature representations. Then, the model is
retrained from scratch by removing the poisoned samples from the training set.

  * •

Anti-Backdoor Learning (ABL) [li2021anti]: It was built upon an observation
that the loss values of poisoned samples drops much faster than those of clean
samples in early epochs during the training process. Inspired, ABL proposed to
first isolate poisoned samples from clean samples according to their
difference in loss dropping speed, then mitigate the backdoor effect by
maximizing the loss of the isolated poisoned samples.

  * •

Decoupling-based Backdoor Defense (DBD) [huang2022backdoor]: It was built upon
an observation that poisoned samples from different source classes gather
together in the feature space of a backdoored model. DBD proposed to prevent
the gathering by learning the model backbone through self-supervised learning
without labels, rather than the standard supervised learning. Then, since the
poisoned samples were separated, their loss values were larger than clean
samples when learning the classifier, such that samples with large loss values
can be identified as poisoned samples. Finally, the labels of poisoned samples
were abandoned, and a semi-supervised fine-tuning of both the backbone and
classifier was conducted to improve the model performance.

  * •

Implicit Backdoor Adversarial Unlearning (I-BAU) [i-bau]: It borrowed the idea
of adversarial training[advlearning] to fine-tune a backdoored model based on
a small subset of clean data through a min-max optimization, where the clean
sample is perturbed in the inner max to simulate the unknown poisoned sample.
The min-max optimization problem can be solved by an implicit hyper-gradient
algorithm, to output a mitigated model.

  * •

Channel Lipschitzness based Pruning (CLP) [clp-2022]: It was built upon an
empirical connection between the backdoor effect and the measure called
Channel Lipschitz Constant (CLC), such that the neuron with large CLC values
could be pruned to mitigate the backdoor effect. Due to the data-free setting,
it further designed an Upper bound of the Channel Lipschitz Constant (UCLC) of
each channel based on model weight. Note that it is the first data-free post-
training backdoor defense method.

  * •

Distinguishment and Secure Training (D-ST) [chen2022dbr]: It was built upon
the observation that in the feature space of a backdoored model, the poisoned
sample is more sensitive to transformations ($e.g.$, rotation, flipping) than
the clean sample. Thus, it defined a measure called feature consistency
towards transformations (FCT), and then the poisoned dataset could be
distinguished into a poisoned subset, clean subset and uncertain subset based
on FCT. Then, a secure training algorithm was designed to train a secure model
based on the poisoned dataset from scratch. It first trained the backbone via
semi-supervised contrastive learning by utilizing the labels of the
distinguished clean subset, while the labels of the other two subsets were
abandoned. Then, the classifier was trained by minimizing the loss of the
clean subset, while maximizing the loss of the poisoned subset, to inhibit the
backdoor injection.

  * •

Distinguishment and Backdoor Removal (D-BR) [chen2022dbr]: It was proposed by
the same work with D-ST, and also developed based on the distinguishment of
the poisoned dataset. Given a backdoored model that was regularly trained on
the poisoned dataset, D-BR aimed to mitigate the backdoor effect by
iteratively relearning the clean subset and unlearning the poisoned subset.

  * •

Entropy-based pruning (EP) [ep-bnp-2022]: It was built upon the observation
that the pre-activation ($i.e.$, the maximal activation value of one neuron)
distributions of poisoned samples and clean samples are significantly
different on backdoor related neuron ($i.e.$, the neuron contributing to
backdoor effect, hereafter we use "backdoor neuron" for clarity), while they
are similar on clean neurons. Then, the entropy of the pre-activation
distribution of each neuron on the whole poisoned dataset was measured, and
the neuron with a larger entropy value was pruned.

  * •

BN statistics-based pruning (BNP) [ep-bnp-2022]: It was built upon the same
observation with EP. It calculated the statistics of each neuron’s pre-
activation on a small subset of clean data to obtain a Gaussian distribution.
If this distribution was far from the BN statistics ($i.e.$, the parameters of
the batch normalization layer) induced Gaussian distribution, then it was
identified as a backdoor neuron, which will be pruned.

  * •

MCR [mcr]: It adopted the mode connectivity analysis to reveal that on the
connection path between two backdoored models, the clean accuracy could be
maintained, while the attack success rate will degrade significantly, such
that the backdoor effect could be mitigated.

  * •

FT-SAM [zhu2023enhancing]: This work analyzed backdoor mitigation from the
neuron weight perspective. It was inspired by the observation that backdoor-
related neurons often have larger weight norms. Then they proposed a novel
backdoor defense paradigm that aims to shrink the norms of backdoor-related
neurons by incorporating sharpness-aware minimization with fine-tuning.

  * •

NAB [liu2023beating]: It induced the model to concentrate on a novel injection
backdoor by introducing the defender’s distinctive backdoor during training.
Simultaneously, the model was compelled to misidentify the attacker’s backdoor
during the inference stage by incorporating the unique backdoor into all
images, ensuring accurate predictions.

  * •

RNP [li2023reconstructive]: The purpose of RNP was the same as that of ANP,
aiming to identify the backdoor neurons. In contrast to ANP, RNP revealed the
backdoor neurons in reverse by unlearning the clean sample. RNP initially
forgot the clean sample to expose the backdoor neurons, subsequently acquiring
a mask to restore the model’s predictive ability for the clean sample.
Finally, it pruned based on the mask. This approach allowed for a more precise
identification of backdoor neurons with fewer samples.

  * •

NPD [zhu2023neural]: It mimicked the optical polarizer to mitigate backdoors
by inserting a neural polarizer inside the model that allowed clean features
to pass through and filtered trigger information. The proposed method only
needed to train the neural polarizer layer, such that it was more efficient
and required less clean data for backdoor removal.

  * •

SAU [wei2023shared]: SAU, built upon the removal of backdoors through the
forgetting of adversarial noise, theoretically examined the disparity between
adversarial learning risk and backdoor learning risk. It proposed the
theoretical upper bound of backdoor learning risk. SAU was crafted more
effectively to eliminate backdoors by identifying and forgetting both the
backdoored model and the shared counter noise during fine-tuning.

  * •

SCAn [tang2019demon]: It was built upon the observation that backdoors caused
by data contamination are source-agnostic and primarily governed by the
trigger. It adopted the EM algorithm to decompose samples into two parts and
utilizes a likelihood-ratio test for each class to identify class(es) with a
mixed distribution.

  * •

Beatrix [mabeatrix]: It adopted a Gram matrix to grasp the feature
correlations and the order information of features, which can reflect changes
in the activation pattern. By learning class-conditional statistics of
activation patterns on some clean samples, Beatrix captured anomalies in
activation patterns to detect poisoned samples.

  * •

SPECTURE [hayase2021spectre]: It used Principal Component Analysis (PCA) to
project features to $k$ dimensions and measure the Quantum Entropy Score (QUE)
for each sample. The samples with the greatest QUE scores can be identified as
poisoned. To find an appropriate dimension $k$, SPECTURE calculates the
average of QUE-score for various $k$ and selects $k$ corresponding to the
highest average QUE-score.

  * •

FREAK [al2023don]: It was built upon the observation that the frequency bases
used to predict clean samples are different from those for poisoned samples.
FREAK calculated the distribution of the indices of the top-$k$ most sensitive
frequency bases of some clean samples and then detected poisoned samples by
measuring the distance of the distribution of the top-$k$ bases of test
samples.

  * •

STRIP [gao2019strip]: This method was based on the observation that the
prediction entropy of the perturbed poisoned samples is lower than that of the
perturbed clean samples. It recorded a proper detection boundary estimated on
some clean samples and identified samples whose entropy is smaller than the
boundary as poisoned. Although this method is primarily applied during the
inference stage, we have also extended its application to the pretraining
stage.

  * •

TeCo [liu2023detecting]: It was built upon the observation that the backdoored
models exhibit consistent performance across various image corruptions for
clean samples, yet show divergent performance for poisoned samples. To detect
poisoned samples, TeCo estimated the consistency of robustness which is
defined as a transition in the predictions on different corruptions.

  * •

SentiNet [chou2020sentinet]: It was based on the understanding that the
‘salient’ features significantly impact the model’s predictions. This method
detected poisoned samples by extracting regions that greatly influence the
model’s predictions and applying these regions to some clean samples to
observe the model’s behaviour.

##  III Full results

## Full results on different datasets

The full results on CIFAR-10 with five different poisoning ratios ($i.e.$,
10%, 5%, 1%, 0.5%, 0.1%) are presented in Tables III – XII, respectively. The
remaining results on other datasets and model architectures among 11,492
attack-defense pairs of evaluations are presented in the Leaderborad in the
BackdoorBench website (see https://backdoorbench.github.io).

TABLE III: Full results on CIFAR-10 with 10% poisoning ratio (The first part).

| Defense $\rightarrow$ | No defense | ABL | AC | ANP | CLP | D-BR | D-ST | DBD
---|---|---|---|---|---|---|---|---|---
Targeted Model | Attack $\downarrow$ | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%)
PreAct-ResNet18 | BadNets | 91.32 | 95.03 | 4.67 | 50.0 | 83.32 | 0.00 | 89.02 | 93.52 | 88.80 | 86.23 | 13.28 | 53.14 | 84.17 | 0.73 | 84.04 | 93.58 | 90.07 | 77.56 | 21.44 | 58.11 | 29.41 | 4.68 | 27.28 | 64.22 | 82.63 | 5.41 | 80.87 | 90.47 | 89.65 | 1.28 | 89.17 | 96.04
Blended | 93.47 | 99.92 | 0.08 | 50.0 | 77.30 | 0.73 | 64.52 | 91.51 | 88.52 | 99.72 | 0.28 | 47.63 | 86.58 | 2.19 | 61.17 | 95.42 | 91.32 | 99.74 | 0.23 | 49.01 | 14.77 | 7.70 | 10.92 | 56.76 | 83.33 | 79.49 | 16.51 | 55.15 | 69.91 | 99.98 | 0.02 | 38.22
Blind | 83.32 | 99.94 | 0.06 | 50.0 | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | 82.43 | 99.91 | 0.09 | 49.57 | 83.58 | 99.32 | 0.66 | 50.31 | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN
BppAttack | 90.69 | 99.78 | 0.21 | 50.0 | 78.55 | 13.77 | 64.93 | 86.94 | 89.29 | 99.73 | 0.26 | 49.32 | 81.78 | 0.24 | 75.37 | 95.31 | 90.40 | 2.18 | 83.97 | 98.66 | 83.11 | 90.87 | 7.40 | 50.67 | 87.02 | 99.17 | 0.78 | 48.47 | 68.65 | 100.00 | 0.00 | 38.98
Input | 90.67 | 98.26 | 1.66 | 50.0 | 63.19 | 90.16 | 5.77 | 40.31 | 91.48 | 88.62 | 10.61 | 54.82 | 90.36 | 1.64 | 86.99 | 98.15 | 90.30 | 2.17 | 85.51 | 97.86 | 81.87 | 94.16 | 5.68 | 47.65 | 74.71 | 94.63 | 4.46 | 43.83 | 78.60 | 8.54 | 75.28 | 88.82
LF | 93.19 | 99.28 | 0.71 | 50.0 | 81.72 | 0.21 | 84.81 | 93.80 | 88.92 | 98.09 | 1.72 | 48.46 | 85.15 | 0.60 | 82.72 | 95.32 | 92.84 | 99.18 | 0.80 | 49.88 | 11.23 | 77.14 | 2.79 | 20.09 | 76.48 | 93.20 | 6.23 | 44.68 | 50.98 | 99.70 | 0.08 | 28.90
LIRA | 52.22 | 85.56 | 11.14 | 50.0 | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | 20.58 | 90.83 | 8.04 | 34.18 | 21.07 | 90.36 | 8.33 | 34.42 | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN
SSBA | 92.88 | 97.86 | 1.99 | 50.0 | 80.79 | 0.00 | 84.66 | 92.88 | 90.00 | 96.23 | 3.53 | 49.37 | 86.54 | 0.39 | 79.87 | 95.56 | 91.38 | 68.13 | 29.16 | 64.11 | 16.18 | 38.54 | 12.34 | 41.31 | 82.16 | 80.03 | 18.16 | 53.55 | 63.50 | 99.51 | 0.39 | 35.31
TrojanNN | 93.42 | 100.00 | 0.00 | 50.0 | 11.07 | 100.00 | 0.00 | 8.82 | 89.75 | 99.97 | 0.03 | 48.18 | 86.87 | 0.20 | 76.24 | 96.62 | 92.98 | 100.00 | 0.00 | 49.78 | 12.03 | 0.00 | 12.97 | 59.30 | 88.71 | 99.47 | 0.53 | 47.91 | 66.23 | 100.00 | 0.00 | 36.40
WaNet | 91.25 | 89.73 | 9.76 | 50.0 | 83.19 | 0.00 | 85.86 | 90.84 | 91.93 | 96.80 | 3.06 | 50.00 | 85.73 | 0.43 | 86.50 | 91.89 | 81.91 | 78.42 | 17.68 | 50.99 | 61.70 | 82.06 | 9.30 | 39.06 | 77.56 | 7.91 | 74.46 | 84.07 | 80.90 | 6.61 | 77.61 | 86.39
VGG19-BN | BadNets | 90.42 | 94.43 | 5.24 | 50.0 | 68.81 | 79.96 | 16.43 | 46.43 | 84.81 | 93.83 | 5.49 | 47.50 | 88.39 | 0.48 | 89.21 | 95.96 | NaN | NaN | NaN | 52.01 | 10.41 | 0.00 | 11.56 | 57.21 | 84.28 | 47.32 | 46.79 | 70.49 | 56.35 | 20.95 | 51.49 | 69.71
Blended | 91.91 | 99.50 | 0.48 | 50.0 | 10.00 | 0.00 | 11.11 | 58.79 | 86.21 | 99.17 | 0.70 | 47.32 | 89.19 | 4.77 | 69.92 | 96.01 | NaN | NaN | NaN | 53.80 | 10.00 | 100.00 | 0.00 | 9.04 | 91.15 | 97.81 | 1.71 | 50.46 | 46.97 | 99.97 | 0.03 | 27.53
Blind | 88.65 | 99.29 | 0.71 | 50.0 | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | 88.01 | 98.77 | 1.20 | 49.94 | 86.22 | 97.52 | 2.42 | 49.67 | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN
BppAttack | 89.32 | 99.79 | 0.18 | 50.0 | 10.00 | 100.00 | 0.00 | 10.34 | 86.62 | 93.22 | 5.89 | 51.93 | 83.63 | 0.03 | 85.46 | 97.03 | 87.37 | 0.80 | 83.94 | 98.52 | 11.45 | 0.00 | 11.49 | 60.96 | 80.10 | 99.90 | 0.10 | 45.39 | 54.07 | 99.96 | 0.03 | 32.38
Input | 88.66 | 94.58 | 5.10 | 50.0 | 10.00 | 100.00 | 0.00 | 10.67 | 86.53 | 83.22 | 15.16 | 54.61 | 86.56 | 0.71 | 83.78 | 95.88 | 87.54 | 2.66 | 83.28 | 95.40 | 91.66 | 98.47 | 1.41 | 50.00 | 89.84 | 81.59 | 17.03 | 56.49 | 54.60 | 36.44 | 43.11 | 62.04
LF | 83.28 | 13.83 | 81.93 | 50.0 | 62.37 | 0.00 | 69.00 | 46.46 | 80.26 | 10.86 | 79.08 | 49.98 | 84.33 | 0.08 | 88.09 | 56.88 | 81.99 | 14.61 | 80.46 | 49.36 | 14.00 | 2.17 | 13.51 | 21.19 | 60.11 | 9.76 | 60.11 | 40.45 | 59.77 | 8.15 | 55.96 | 41.09
LIRA | 10.05 | 99.96 | 0.04 | 50.0 | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | 10.00 | 100.00 | 0.00 | 49.98 | 10.20 | 99.81 | 0.19 | 50.07 | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN
SSBA | 90.85 | 95.11 | 4.44 | 50.0 | 10.00 | 0.00 | 11.11 | 57.13 | 85.54 | 90.61 | 8.16 | 49.60 | 89.81 | 1.34 | 85.26 | 96.36 | 85.82 | 98.56 | 1.33 | 47.48 | 78.27 | 54.40 | 37.53 | 64.07 | 80.31 | 68.83 | 23.01 | 57.87 | 51.21 | 98.81 | 0.81 | 30.18
TrojanNN | 91.57 | 100.00 | 0.00 | 50.0 | 10.00 | 100.00 | 0.00 | 9.22 | 87.07 | 99.97 | 0.03 | 47.77 | 89.39 | 0.00 | 34.31 | 98.91 | 90.56 | 99.70 | 0.29 | 49.64 | 10.00 | 0.00 | 11.11 | 59.22 | 88.52 | 99.37 | 0.04 | 48.79 | 46.60 | 100.00 | 0.00 | 27.51
WaNet | 84.58 | 96.49 | 3.00 | 50.0 | 32.80 | 99.99 | 0.00 | 24.11 | 85.05 | 80.78 | 16.98 | 57.86 | 78.04 | 0.03 | 81.98 | 94.96 | 88.46 | 1.75 | 82.47 | 97.37 | 10.12 | 99.71 | 0.12 | 12.77 | 89.23 | 14.72 | 78.31 | 90.89 | 56.87 | 36.84 | 49.00 | 65.97
ConvNeXt_tiny | BadNets | 90.49 | 94.33 | 5.31 | 50.0 | 90.92 | 93.57 | 6.00 | 50.38 | 89.07 | 94.83 | 4.70 | 49.29 | 86.75 | 25.74 | 67.32 | 82.42 | 90.48 | 94.34 | 5.30 | 50.00 | 86.00 | 4.28 | 84.06 | 92.78 | 59.32 | 5.86 | 60.46 | 78.65 | 77.86 | 4.42 | 75.95 | 88.64
Blended | 92.31 | 99.80 | 0.19 | 50.0 | 93.04 | 99.88 | 0.10 | 50.00 | 91.70 | 99.39 | 0.56 | 49.90 | 85.19 | 82.69 | 15.36 | 55.00 | 92.31 | 99.80 | 0.19 | 50.00 | 91.73 | 99.71 | 0.27 | 49.75 | 63.82 | 87.12 | 9.77 | 42.09 | 65.97 | 99.77 | 0.15 | 36.85
Blind | 92.24 | 100.00 | 0.00 | 50.0 | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | 83.82 | 49.62 | 43.27 | 70.98 | 92.24 | 100.00 | 0.00 | 50.00 | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN
BppAttack | 86.79 | 99.48 | 0.50 | 50.0 | 92.62 | 99.84 | 0.14 | 50.00 | 91.15 | 99.41 | 0.57 | 50.03 | 85.44 | 5.72 | 79.02 | 96.20 | 86.79 | 99.48 | 0.50 | 50.00 | 72.10 | 99.32 | 0.44 | 42.73 | 54.12 | 14.62 | 49.48 | 76.09 | 69.90 | 12.62 | 64.94 | 84.98
Input | 87.70 | 93.08 | 6.53 | 50.0 | 91.98 | 92.29 | 7.19 | 50.39 | 90.99 | 88.61 | 10.50 | 52.23 | 81.92 | 6.37 | 71.42 | 90.47 | 87.29 | 97.62 | 2.21 | 49.80 | 58.00 | 98.96 | 0.92 | 35.15 | 51.64 | 44.68 | 33.63 | 56.17 | 76.96 | 22.32 | 64.67 | 80.01
LF | 87.94 | 4.28 | 87.28 | 50.0 | 88.94 | 3.87 | 88.62 | 50.21 | 87.24 | 5.19 | 86.37 | 49.65 | 88.49 | 1.54 | 88.51 | 51.37 | 87.94 | 4.28 | 87.28 | 50.00 | 69.26 | 11.64 | 67.27 | 40.66 | 23.60 | 14.62 | 24.96 | 17.83 | 71.24 | 7.43 | 69.14 | 41.65
LIRA | 91.08 | 99.84 | 0.14 | 50.0 | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | 85.11 | 1.39 | 84.58 | 96.24 | 91.26 | 99.72 | 0.27 | 50.06 | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN
SSBA | 91.59 | 97.63 | 2.17 | 50.0 | 92.06 | 99.20 | 0.73 | 50.00 | 90.89 | 95.53 | 4.11 | 50.70 | 85.94 | 82.48 | 16.41 | 54.75 | 91.59 | 97.63 | 2.17 | 50.00 | 79.90 | 67.18 | 27.21 | 59.38 | 25.27 | 17.39 | 20.81 | 56.96 | 56.70 | 74.90 | 23.44 | 43.92
TrojanNN | 92.04 | 99.99 | 0.01 | 50.0 | 93.20 | 99.99 | 0.01 | 50.00 | 91.00 | 100.00 | 0.00 | 49.48 | 82.93 | 28.89 | 53.42 | 81.00 | 92.04 | 99.99 | 0.01 | 50.00 | 90.07 | 99.98 | 0.02 | 49.02 | 24.08 | 13.27 | 18.61 | 59.38 | 64.06 | 100.00 | 0.00 | 36.01
WaNet | 86.56 | 75.68 | 22.35 | 50.0 | 91.35 | 80.34 | 18.42 | 50.00 | 89.70 | 68.65 | 29.02 | 53.52 | 79.44 | 4.72 | 76.46 | 81.92 | 86.56 | 75.68 | 22.35 | 50.00 | 86.39 | 88.29 | 10.74 | 49.92 | 53.76 | 10.22 | 52.84 | 66.33 | 78.55 | 6.80 | 75.69 | 80.44
ViT_b_16 | BadNets | 94.78 | 93.77 | 6.02 | 50.0 | 10.00 | 0.00 | 11.11 | 54.49 | 95.27 | 86.30 | 13.26 | 53.73 | 94.78 | 93.77 | 6.02 | 50.00 | 94.78 | 93.77 | 6.02 | 50.00 | 18.45 | 66.89 | 10.18 | 25.27 | 10.00 | 0.00 | 11.11 | 54.49 | NaN | NaN | NaN | 49.49
Blended | 96.54 | 99.68 | 0.31 | 50.0 | 97.95 | 99.94 | 0.06 | 50.00 | 96.45 | 99.53 | 0.46 | 50.03 | 96.40 | 99.61 | 0.38 | 49.96 | 96.54 | 99.68 | 0.31 | 50.00 | 96.20 | 99.67 | 0.31 | 49.84 | 10.00 | 100.00 | 0.00 | 6.73 | 55.99 | 98.74 | 0.98 | 30.19
Blind | 96.64 | 100.00 | 0.00 | 50.0 | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | 96.36 | 99.88 | 0.12 | 49.92 | 96.64 | 100.00 | 0.00 | 50.00 | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN
BppAttack | 91.38 | 99.37 | 0.58 | 50.0 | 97.86 | 99.90 | 0.10 | 50.00 | 96.63 | 99.80 | 0.19 | 50.00 | 91.38 | 99.37 | 0.58 | 50.00 | 91.38 | 99.37 | 0.58 | 50.00 | 93.48 | 99.00 | 0.96 | 50.18 | NaN | NaN | NaN | 53.99 | NaN | NaN | NaN | 53.99
Input | 91.65 | 92.30 | 7.06 | 50.0 | 21.28 | 99.30 | 0.70 | 14.82 | 95.87 | 64.40 | 34.58 | 63.95 | 91.16 | 75.76 | 23.18 | 58.03 | 91.55 | 79.34 | 19.50 | 56.43 | 93.84 | 97.63 | 2.29 | 50.00 | NaN | NaN | NaN | 50.32 | 15.97 | 99.52 | 0.13 | 12.16
LF | 93.36 | 3.37 | 93.00 | 50.0 | 69.39 | 32.82 | 66.04 | 38.02 | 94.25 | 2.51 | 93.96 | 50.43 | 91.13 | 0.84 | 91.69 | 50.15 | 93.36 | 3.37 | 93.00 | 50.00 | 16.00 | 67.37 | 9.07 | 11.32 | 10.00 | 0.00 | 11.11 | 10.00 | 13.02 | 90.92 | 3.73 | 9.83
LIRA | 86.63 | 88.19 | 11.37 | 50.0 | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | 62.12 | 1.72 | 65.50 | 80.98 | 65.76 | 67.58 | 31.40 | 49.87 | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN
SSBA | 96.17 | 97.81 | 2.13 | 50.0 | 97.79 | 98.31 | 1.64 | 50.00 | 96.28 | 96.60 | 3.27 | 50.61 | 96.06 | 94.01 | 5.80 | 51.84 | 96.17 | 97.81 | 2.13 | 50.00 | 22.75 | 41.18 | 17.13 | 41.61 | 10.00 | 0.00 | 11.11 | 55.82 | NaN | NaN | NaN | 50.82
TrojanNN | 96.46 | 99.98 | 0.02 | 50.0 | 97.85 | 100.00 | 0.00 | 50.00 | 96.48 | 99.99 | 0.01 | 50.00 | 96.35 | 99.96 | 0.04 | 49.96 | 96.46 | 99.98 | 0.02 | 50.00 | 19.54 | 99.77 | 0.07 | 11.65 | 10.00 | 0.00 | 11.11 | 56.76 | NaN | NaN | NaN | 51.76
WaNet | 89.12 | 80.95 | 17.59 | 50.0 | 11.67 | 99.99 | 0.01 | 11.28 | 94.81 | 52.68 | 45.82 | 64.13 | 89.12 | 80.95 | 17.59 | 50.00 | 89.12 | 80.95 | 17.59 | 50.00 | 85.21 | 71.82 | 23.45 | 52.61 | 10.00 | 0.00 | 11.13 | 50.91 | NaN | NaN | NaN | 45.91

TABLE IV: Full results on CIFAR-10 with 10% poisoning ratio (The second part).

| Defense $\rightarrow$ | EP | FP | FT | I-BAU | BNP | NAD | NC | SS
---|---|---|---|---|---|---|---|---|---
Targeted Model | Attack $\downarrow$ | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%)
PreAct-ResNet18 | BadNets | 89.69 | 1.83 | 89.54 | 95.78 | 91.31 | 57.13 | 41.62 | 68.95 | 89.96 | 1.48 | 89.39 | 96.10 | 89.16 | 1.29 | 89.24 | 95.79 | 91.10 | 94.77 | 4.91 | 50.02 | 89.87 | 2.14 | 88.71 | 95.72 | 89.05 | 1.27 | 89.16 | 95.75 | 89.98 | 92.41 | 7.20 | 50.64
Blended | 92.43 | 52.11 | 37.54 | 73.39 | 93.17 | 99.26 | 0.73 | 50.18 | 92.78 | 96.11 | 3.57 | 51.56 | 87.00 | 50.53 | 33.21 | 71.46 | 93.33 | 99.89 | 0.11 | 49.95 | 92.17 | 97.69 | 2.14 | 50.47 | 93.47 | 99.92 | 0.08 | 50.00 | 90.35 | 99.84 | 0.14 | 48.48
Blind | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | 93.36 | 3.91 | 23.23 | 98.02 | 91.01 | 9.70 | 23.69 | 95.12 | NaN | NaN | NaN | NaN | 93.28 | 3.53 | 27.98 | 98.21 | 93.38 | 0.08 | 23.07 | 99.93 | NaN | NaN | NaN | NaN
BppAttack | 90.56 | 2.39 | 83.84 | 98.63 | 92.70 | 18.39 | 72.20 | 90.69 | 93.25 | 2.54 | 87.00 | 98.62 | 90.99 | 6.24 | 82.34 | 96.77 | 90.20 | 33.10 | 59.48 | 83.09 | 92.81 | 2.46 | 86.22 | 98.66 | 92.68 | 2.84 | 85.18 | 98.47 | 92.34 | 99.72 | 0.26 | 50.03
Input | 89.86 | 2.23 | 85.20 | 97.61 | 91.74 | 0.04 | 44.54 | 99.11 | 93.12 | 1.72 | 90.53 | 98.27 | 89.17 | 27.08 | 56.73 | 84.84 | 89.71 | 1.79 | 86.77 | 97.75 | 93.18 | 1.68 | 91.12 | 98.29 | 92.61 | 0.76 | 90.87 | 98.75 | 91.39 | 90.43 | 9.13 | 53.91
LF | 91.82 | 85.98 | 12.77 | 55.97 | 92.90 | 98.97 | 1.02 | 50.01 | 92.37 | 78.44 | 19.42 | 60.01 | 84.36 | 44.96 | 48.00 | 72.75 | 93.06 | 99.23 | 0.76 | 49.96 | 92.37 | 47.83 | 47.49 | 75.31 | 91.62 | 1.41 | 87.48 | 98.15 | 92.58 | 98.67 | 1.28 | 50.00
LIRA | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | 91.71 | 0.20 | 77.56 | 92.68 | 88.24 | 2.59 | 86.34 | 91.48 | NaN | NaN | NaN | NaN | 91.41 | 0.21 | 78.08 | 92.67 | 91.90 | 0.19 | 79.90 | 92.68 | NaN | NaN | NaN | NaN
SSBA | 92.31 | 10.81 | 78.53 | 93.24 | 92.54 | 83.50 | 15.36 | 57.01 | 92.14 | 74.79 | 23.31 | 61.16 | 87.67 | 3.97 | 74.23 | 94.34 | 92.80 | 97.61 | 2.21 | 50.08 | 91.91 | 77.40 | 20.86 | 59.74 | 90.99 | 0.58 | 87.04 | 97.69 | 89.63 | 90.50 | 8.71 | 52.05
TrojanNN | 92.17 | 2.50 | 83.37 | 98.12 | 92.47 | 71.07 | 22.97 | 63.99 | 92.42 | 5.99 | 77.34 | 96.51 | 90.37 | 2.91 | 79.10 | 97.02 | 93.33 | 40.72 | 54.96 | 79.59 | 91.88 | 3.73 | 81.59 | 97.36 | 91.76 | 8.22 | 78.00 | 95.06 | 89.70 | 100.00 | 0.00 | 48.14
WaNet | 90.08 | 86.64 | 12.54 | 50.96 | 91.46 | 1.09 | 69.73 | 94.32 | 93.48 | 17.10 | 78.29 | 86.32 | 89.49 | 5.21 | 86.60 | 91.38 | 90.97 | 1.24 | 89.00 | 94.10 | 93.17 | 22.98 | 72.69 | 83.38 | 91.80 | 7.53 | 85.09 | 91.10 | 91.94 | 90.17 | 9.37 | 50.00
VGG19-BN | BadNets | 87.56 | 7.28 | 83.97 | 92.15 | 88.42 | 5.86 | 82.94 | 93.29 | 88.19 | 27.59 | 67.27 | 82.31 | 86.01 | 2.28 | 85.16 | 93.87 | 90.15 | 94.71 | 5.02 | 49.86 | 86.48 | 5.47 | 81.09 | 92.51 | 89.21 | 11.31 | 80.37 | 90.96 | 10.00 | 100.00 | 0.00 | 9.79
Blended | 90.99 | 22.62 | 55.56 | 87.98 | 89.51 | 86.83 | 12.12 | 55.13 | 90.08 | 86.82 | 11.90 | 55.42 | 87.58 | 69.90 | 22.00 | 62.64 | 91.62 | 99.42 | 0.56 | 49.89 | 88.60 | 83.86 | 13.97 | 56.17 | 90.07 | 83.33 | 14.78 | 57.16 | 10.00 | 100.00 | 0.00 | 9.04
Blind | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | 90.36 | 42.40 | 12.01 | 78.44 | 87.49 | 60.29 | 25.53 | 68.92 | NaN | NaN | NaN | NaN | 88.94 | 98.51 | 0.68 | 50.39 | 89.84 | 73.48 | 8.77 | 62.91 | NaN | NaN | NaN | NaN
BppAttack | 88.41 | 1.34 | 85.50 | 98.77 | 91.45 | 2.79 | 86.00 | 98.50 | 91.39 | 1.91 | 87.29 | 98.94 | 88.69 | 1.72 | 84.27 | 98.72 | 89.17 | 99.81 | 0.16 | 49.92 | 91.09 | 2.49 | 86.57 | 98.65 | 91.50 | 1.92 | 87.38 | 98.93 | 90.00 | 99.16 | 0.82 | 50.32
Input | 88.92 | 3.84 | 83.51 | 95.37 | 91.40 | 3.23 | 82.63 | 95.67 | 91.56 | 13.08 | 79.68 | 90.75 | 88.29 | 69.56 | 25.09 | 62.33 | 89.47 | 2.01 | 84.91 | 96.28 | 91.00 | 14.11 | 78.10 | 90.23 | 89.70 | 97.02 | 2.72 | 50.00 | 89.15 | 89.01 | 10.06 | 52.78
LF | 79.36 | 18.88 | 77.36 | 48.04 | 88.80 | 1.29 | 88.70 | 56.27 | 87.67 | 1.82 | 87.59 | 56.01 | 87.68 | 1.47 | 87.69 | 56.18 | 83.25 | 13.92 | 81.87 | 49.98 | 83.72 | 1.14 | 84.20 | 56.34 | 86.64 | 1.36 | 86.60 | 56.24 | 10.00 | 100.00 | 0.00 | 13.36
LIRA | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | 80.99 | 2.00 | 81.07 | 98.98 | 77.91 | 4.94 | 77.91 | 97.51 | NaN | NaN | NaN | NaN | 80.69 | 1.96 | 80.33 | 99.00 | 81.07 | 1.74 | 81.24 | 99.11 | NaN | NaN | NaN | NaN
SSBA | 89.62 | 85.40 | 13.13 | 54.24 | 89.10 | 65.76 | 30.80 | 63.80 | 89.26 | 70.22 | 27.08 | 61.65 | 87.56 | 22.26 | 58.92 | 84.78 | 90.75 | 94.74 | 4.76 | 50.13 | 88.33 | 56.64 | 38.19 | 67.97 | 90.85 | 95.11 | 4.44 | 50.00 | 10.00 | 100.00 | 0.00 | 9.57
TrojanNN | 89.57 | 7.33 | 74.39 | 95.33 | 89.88 | 63.42 | 27.93 | 67.44 | 89.60 | 7.17 | 67.89 | 95.43 | 88.63 | 8.23 | 45.86 | 94.41 | 91.37 | 100.00 | 0.00 | 49.90 | 87.29 | 2.30 | 72.61 | 96.71 | 89.28 | 7.76 | 76.86 | 94.98 | 10.00 | 100.00 | 0.00 | 9.22
WaNet | 86.10 | 73.61 | 21.47 | 61.44 | 91.07 | 3.91 | 83.21 | 96.29 | 91.35 | 5.72 | 84.16 | 95.39 | 89.76 | 1.61 | 84.85 | 97.44 | 18.14 | 98.92 | 0.75 | 16.78 | 90.73 | 10.33 | 80.45 | 93.08 | 91.20 | 6.88 | 83.83 | 94.81 | 10.00 | 100.00 | 0.00 | 12.71
ConvNeXt_tiny | BadNets | 89.55 | 92.63 | 6.77 | 50.38 | 89.04 | 7.43 | 82.93 | 92.72 | 88.84 | 13.96 | 78.02 | 89.36 | 88.10 | 56.38 | 40.79 | 67.78 | 89.96 | 94.20 | 5.40 | 49.80 | 86.54 | 37.33 | 57.06 | 76.53 | 88.42 | 24.96 | 68.08 | 83.65 | 89.25 | 95.58 | 4.04 | 49.38
Blended | 91.76 | 99.08 | 0.86 | 50.09 | 88.97 | 83.62 | 15.26 | 56.42 | 89.14 | 86.64 | 12.22 | 54.99 | 89.00 | 79.77 | 17.12 | 58.36 | 92.02 | 99.63 | 0.33 | 49.94 | 85.47 | 72.64 | 21.54 | 60.16 | 89.35 | 91.71 | 7.73 | 52.56 | 92.19 | 99.70 | 0.30 | 49.99
Blind | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | 89.51 | 99.39 | 0.61 | 48.94 | 89.88 | 100.00 | 0.00 | 48.82 | NaN | NaN | NaN | NaN | 84.77 | 91.33 | 8.20 | 50.60 | 89.45 | 99.70 | 0.30 | 48.76 | NaN | NaN | NaN | NaN
BppAttack | 86.18 | 99.49 | 0.50 | 49.70 | 87.59 | 97.72 | 2.21 | 50.88 | 88.28 | 99.49 | 0.49 | 50.00 | 88.11 | 27.10 | 46.20 | 86.19 | 86.59 | 99.53 | 0.44 | 49.90 | 87.97 | 99.56 | 0.44 | 50.00 | 88.44 | 99.44 | 0.53 | 50.02 | 93.15 | 99.80 | 0.20 | 50.00
Input | 87.03 | 96.21 | 3.53 | 49.66 | 89.17 | 52.44 | 44.92 | 70.32 | 89.49 | 90.14 | 9.48 | 51.47 | 88.82 | 85.72 | 13.44 | 53.68 | 87.17 | 97.62 | 2.22 | 49.74 | 89.32 | 95.82 | 3.94 | 50.00 | 87.29 | 97.62 | 2.21 | 49.80 | 92.44 | 90.00 | 9.24 | 51.54
LF | 86.39 | 5.44 | 85.66 | 49.22 | 88.92 | 0.83 | 89.06 | 51.72 | 88.71 | 1.06 | 88.71 | 51.61 | 88.44 | 1.21 | 88.37 | 51.53 | 87.60 | 4.58 | 86.89 | 49.83 | 84.95 | 2.80 | 84.17 | 49.24 | 87.94 | 4.28 | 87.28 | 50.00 | 85.35 | 7.00 | 84.27 | 48.70
LIRA | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | 91.48 | 93.68 | 6.01 | 53.08 | 90.57 | 11.11 | 43.32 | 94.11 | NaN | NaN | NaN | NaN | 90.64 | 25.77 | 67.98 | 86.82 | 91.48 | 96.70 | 3.08 | 51.57 | NaN | NaN | NaN | NaN
SSBA | 91.53 | 97.21 | 2.49 | 50.18 | 89.00 | 13.53 | 75.66 | 90.76 | 89.14 | 33.83 | 59.34 | 80.68 | 87.65 | 35.42 | 55.19 | 79.14 | 90.96 | 96.83 | 2.88 | 50.08 | 87.45 | 38.69 | 53.73 | 77.40 | 91.59 | 97.63 | 2.17 | 50.00 | 89.93 | 96.18 | 3.41 | 49.90
TrojanNN | 91.59 | 99.99 | 0.01 | 49.78 | 87.97 | 71.98 | 22.11 | 61.97 | 89.31 | 98.02 | 1.89 | 49.62 | 89.97 | 70.39 | 21.31 | 63.77 | 91.76 | 99.99 | 0.01 | 49.86 | 86.06 | 96.18 | 3.20 | 48.92 | 89.13 | 99.64 | 0.34 | 48.72 | 75.51 | 99.87 | 0.11 | 41.80
WaNet | 86.29 | 75.74 | 22.16 | 49.86 | 88.03 | 1.48 | 85.77 | 87.10 | 89.14 | 8.10 | 80.60 | 83.79 | 88.33 | 28.01 | 63.40 | 73.84 | 86.58 | 71.54 | 26.06 | 52.07 | 88.48 | 11.61 | 77.53 | 82.04 | 88.30 | 5.00 | 83.44 | 85.34 | 86.05 | 59.08 | 35.60 | 58.05
ViT_b_16 | BadNets | NaN | NaN | NaN | 49.49 | 94.77 | 52.33 | 45.78 | 70.71 | 95.19 | 75.51 | 23.64 | 59.13 | 26.39 | 14.10 | 21.47 | 55.64 | NaN | NaN | NaN | 49.49 | 26.34 | 9.66 | 23.83 | 57.84 | 95.30 | 69.40 | 29.34 | 62.18 | 94.99 | 93.31 | 6.47 | 50.23
Blended | NaN | NaN | NaN | 51.57 | 93.52 | 71.77 | 16.97 | 62.45 | 96.28 | 99.37 | 0.61 | 50.03 | 27.09 | 19.31 | 20.93 | 55.46 | NaN | NaN | NaN | 51.57 | 26.23 | 10.62 | 23.30 | 59.37 | 96.01 | 99.59 | 0.40 | 49.78 | 68.74 | 97.17 | 1.88 | 37.36
Blind | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | 96.52 | 100.00 | 0.00 | 49.94 | 27.29 | 10.12 | 24.27 | 60.26 | NaN | NaN | NaN | NaN | 28.45 | 11.30 | 25.71 | 60.26 | 96.45 | 100.00 | 0.00 | 49.90 | NaN | NaN | NaN | NaN
BppAttack | NaN | NaN | NaN | 53.99 | 93.08 | 99.27 | 0.63 | 50.05 | 93.83 | 99.46 | 0.51 | 50.00 | 80.56 | 43.24 | 41.78 | 72.65 | NaN | NaN | NaN | 53.99 | 80.62 | 9.24 | 65.53 | 89.68 | 91.38 | 99.37 | 0.58 | 50.00 | 96.39 | 99.84 | 0.16 | 50.00
Input | 90.94 | 79.03 | 19.64 | 56.28 | 93.95 | 19.81 | 76.37 | 86.24 | 94.38 | 82.54 | 16.33 | 54.88 | 81.93 | 2.28 | 78.29 | 90.15 | 89.90 | 80.74 | 18.07 | 54.90 | 79.02 | 5.43 | 71.96 | 87.12 | 91.55 | 79.34 | 19.50 | 56.43 | 95.88 | 79.10 | 20.12 | 56.60
LF | 93.23 | 3.28 | 92.89 | 49.98 | 94.43 | 0.48 | 94.51 | 51.44 | 95.67 | 0.58 | 95.67 | 51.39 | 27.71 | 7.42 | 26.31 | 17.18 | 90.89 | 5.28 | 90.43 | 48.76 | 25.53 | 11.61 | 22.51 | 16.08 | 95.34 | 0.51 | 95.34 | 51.43 | 81.23 | 7.66 | 80.53 | 43.94
LIRA | NaN | NaN | NaN | NaN | NaN | NaN | NaN | NaN | 90.88 | 1.71 | 90.30 | 93.24 | 78.74 | 3.67 | 77.47 | 88.32 | NaN | NaN | NaN | NaN | 82.37 | 1.80 | 82.07 | 91.06 | 91.04 | 1.33 | 90.63 | 93.43 | NaN | NaN | NaN | NaN
SSBA | 95.97 | 98.10 | 1.82 | 49.90 | 95.22 | 25.49 | 69.24 | 85.69 | 95.99 | 93.57 | 6.24 | 52.03 | 30.61 | 5.96 | 29.74 | 63.15 | 94.67 | 97.63 | 2.27 | 49.34 | 25.54 | 7.92 | 23.81 | 59.63 | 96.13 | 93.80 | 6.01 | 51.99 | 64.56 | 53.02 | 32.64 | 56.59
TrojanNN | 96.12 | 99.99 | 0.01 | 49.83 | 94.04 | 94.78 | 2.76 | 51.39 | 96.24 | 99.73 | 0.27 | 50.01 | 25.83 | 13.01 | 20.48 | 58.17 | 95.53 | 100.00 | 0.00 | 49.54 | 23.85 | 10.09 | 22.02 | 58.64 | 96.13 | 99.91 | 0.09 | 49.87 | 73.21 | 98.86 | 0.84 | 38.94
WaNet | 88.85 | 79.05 | 19.31 | 50.82 | 94.00 | 0.42 | 92.73 | 90.26 | 93.95 | 6.77 | 87.26 | 87.09 | 83.02 | 1.31 | 81.45 | 86.77 | 87.46 | 77.32 | 20.64 | 50.98 | 80.23 | 5.59 | 78.91 | 83.24 | 94.20 | 8.65 | 85.58 | 86.15 | 78.24 | 49.71 | 42.39 | 60.18

TABLE V: Full results on CIFAR-10 with 5% poisoning ratio (The first part).

| Defense $\rightarrow$ | No defense | ABL | AC | ANP | CLP | D-BR | D-ST | DBD
---|---|---|---|---|---|---|---|---|---
Targeted Model | Attack $\downarrow$ | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%)
PreAct-ResNet18 | BadNets | 92.64 | 88.74 | 10.78 | 50.0 | 84.08 | 0.00 | 90.50 | 90.09 | 90.27 | 75.61 | 23.58 | 55.38 | 87.24 | 0.34 | 87.34 | 91.50 | 91.32 | 24.49 | 71.06 | 81.47 | 11.17 | 0.00 | 12.41 | 53.64 | 81.46 | 2.37 | 81.43 | 87.60 | 87.68 | 2.11 | 87.01 | 90.84
Blended | 93.67 | 99.61 | 0.39 | 50.0 | 65.78 | 0.00 | 48.48 | 85.86 | 91.54 | 98.93 | 1.03 | 49.27 | 88.00 | 11.98 | 58.50 | 90.98 | 90.19 | 79.58 | 15.56 | 58.28 | 16.48 | 0.00 | 15.87 | 61.21 | 83.03 | 86.08 | 12.21 | 51.45 | 75.00 | 99.99 | 0.01 | 40.66
BppAttack | 91.47 | 99.34 | 0.62 | 50.0 | 82.89 | 99.93 | 0.07 | 45.71 | 89.64 | 97.96 | 1.90 | 49.78 | 84.03 | 0.69 | 78.00 | 95.61 | 89.13 | 1.43 | 83.23 | 97.79 | 83.08 | 95.02 | 1.12 | 47.97 | 88.04 | 94.51 | 5.21 | 50.70 | 81.71 | 99.98 | 0.01 | 45.12
Input | 91.52 | 90.20 | 8.91 | 50.0 | 58.14 | 92.58 | 4.84 | 33.31 | 92.07 | 92.20 | 7.36 | 50.00 | 91.54 | 2.22 | 86.40 | 93.99 | 90.71 | 2.00 | 85.44 | 93.70 | 74.57 | 98.24 | 1.63 | 41.52 | 77.96 | 15.02 | 59.07 | 80.81 | 76.23 | 6.12 | 71.99 | 84.39
LC | 93.53 | 99.80 | 0.20 | 50.0 | 46.92 | 0.01 | 40.44 | 76.59 | 89.35 | 94.73 | 5.20 | 50.44 | 86.16 | 20.84 | 47.72 | 85.79 | 93.36 | 81.69 | 18.14 | 58.97 | 17.19 | 0.78 | 18.13 | 61.34 | 83.54 | 19.36 | 70.23 | 85.23 | 85.11 | 99.96 | 0.04 | 45.79
LF | 93.35 | 98.03 | 1.86 | 50.0 | 66.54 | 98.02 | 1.27 | 36.60 | 89.02 | 95.14 | 4.29 | 49.28 | 86.32 | 2.66 | 82.79 | 94.17 | 92.81 | 95.86 | 3.86 | 50.82 | 16.55 | 72.48 | 4.64 | 24.38 | 77.60 | 73.43 | 24.47 | 54.42 | 83.98 | 15.67 | 73.11 | 86.50
SIG | 93.64 | 97.09 | 2.90 | 50.0 | 46.14 | 0.00 | 42.30 | 74.79 | 90.24 | 93.32 | 6.31 | 50.18 | 86.64 | 0.21 | 49.61 | 94.94 | 93.18 | 97.19 | 2.77 | 49.77 | 12.51 | 4.17 | 11.50 | 55.90 | 82.88 | 84.42 | 10.79 | 50.95 | 74.86 | 95.58 | 4.22 | 41.37
SSBA | 93.27 | 94.91 | 4.82 | 50.0 | 81.60 | 0.09 | 79.76 | 91.58 | 88.47 | 92.64 | 6.63 | 48.73 | 87.53 | 0.66 | 81.63 | 94.26 | 91.55 | 44.90 | 49.68 | 74.15 | 16.42 | 3.74 | 18.48 | 57.16 | 79.77 | 64.00 | 28.96 | 58.71 | 72.19 | 11.34 | 65.42 | 81.24
TrojanNN | 93.79 | 99.99 | 0.01 | 50.0 | 18.64 | 100.00 | 0.00 | 12.42 | 89.40 | 99.93 | 0.07 | 47.83 | 89.02 | 12.68 | 64.08 | 91.27 | 92.72 | 99.90 | 0.10 | 49.51 | 13.30 | 0.00 | 14.00 | 59.75 | 88.14 | 93.66 | 6.31 | 50.34 | 72.34 | 100.00 | 0.00 | 39.27
WaNet | 91.76 | 85.50 | 13.49 | 50.0 | 69.49 | 95.20 | 3.79 | 38.86 | 91.96 | 88.72 | 10.88 | 50.00 | 87.21 | 0.57 | 87.69 | 90.19 | 90.16 | 25.72 | 66.60 | 79.09 | 61.65 | 82.11 | 11.78 | 36.64 | 76.58 | 5.00 | 76.23 | 82.66 | 72.22 | 9.93 | 69.41 | 78.01
VGG19-BN | BadNets | 91.19 | 93.92 | 5.76 | 50.0 | NaN | NaN | NaN | 51.37 | 85.75 | 88.49 | 10.37 | 50.00 | 84.51 | 5.01 | 81.77 | 91.12 | NaN | NaN | NaN | 51.37 | 74.24 | 61.50 | 32.57 | 57.74 | 81.61 | 3.07 | 80.69 | 90.64 | 61.15 | 2.61 | 61.89 | 80.63
Blended | 92.24 | 99.43 | 0.51 | 50.0 | NaN | NaN | NaN | 53.60 | 87.18 | 97.82 | 1.92 | 48.28 | 89.38 | 40.96 | 45.67 | 77.81 | NaN | NaN | NaN | 53.60 | 91.72 | 98.57 | 1.30 | 50.17 | 72.89 | 85.26 | 11.88 | 47.41 | 52.72 | 99.99 | 0.01 | 30.24
BppAttack | 89.30 | 98.30 | 1.60 | 50.0 | 14.34 | 100.00 | 0.00 | 12.52 | 86.50 | 72.54 | 24.26 | 61.48 | 82.55 | 0.54 | 70.87 | 95.50 | 88.44 | 3.18 | 83.97 | 97.13 | 91.63 | 95.27 | 4.37 | 51.52 | 10.00 | 0.00 | 11.11 | 59.50 | 59.82 | 17.05 | 53.23 | 75.89
Input | 90.01 | 89.74 | 9.09 | 50.0 | 59.66 | 83.81 | 9.72 | 37.79 | 87.79 | 71.59 | 24.83 | 57.97 | 88.20 | 0.88 | 82.49 | 93.53 | 87.11 | 3.58 | 78.98 | 91.63 | 91.57 | 94.28 | 5.51 | 50.00 | 90.19 | 77.01 | 19.61 | 56.37 | 61.18 | 43.38 | 43.59 | 58.77
LC | 91.70 | 98.73 | 1.27 | 50.0 | 10.00 | 0.00 | 11.11 | 58.52 | 86.70 | 98.98 | 1.02 | 47.50 | 87.59 | 27.13 | 59.93 | 83.74 | 89.61 | 14.16 | 77.82 | 91.24 | 11.48 | 0.00 | 12.69 | 59.26 | 56.79 | 27.17 | 44.99 | 68.33 | 55.75 | 100.00 | 0.00 | 32.02
LF | 88.27 | 6.29 | 87.54 | 50.0 | 29.10 | 0.51 | 32.14 | 23.30 | 84.25 | 4.88 | 83.67 | 48.70 | 88.64 | 0.18 | 90.39 | 53.06 | 85.94 | 8.01 | 85.04 | 48.84 | 83.32 | 2.71 | 83.72 | 49.31 | 89.77 | 2.89 | 88.97 | 51.70 | 55.32 | 13.13 | 50.79 | 33.53
SIG | 91.91 | 97.23 | 2.70 | 50.0 | 10.00 | 100.00 | 0.00 | 9.04 | 86.30 | 97.11 | 2.57 | 47.26 | 83.75 | 0.43 | 64.94 | 94.32 | 90.34 | 98.72 | 1.22 | 49.22 | 10.71 | 0.00 | 11.70 | 58.02 | 63.28 | 0.02 | 25.89 | 84.29 | 54.16 | 99.36 | 0.63 | 31.13
SSBA | 91.53 | 90.39 | 8.88 | 50.0 | 58.57 | 19.21 | 49.48 | 69.11 | 85.93 | 74.07 | 22.44 | 55.36 | 88.60 | 0.84 | 85.39 | 93.31 | 90.04 | 83.41 | 15.14 | 52.74 | 90.68 | 58.26 | 38.43 | 65.64 | 55.82 | 21.69 | 48.28 | 66.50 | 48.43 | 97.05 | 2.14 | 28.45
TrojanNN | 92.26 | 99.99 | 0.01 | 50.0 | 10.00 | 100.00 | 0.00 | 8.87 | 86.74 | 99.97 | 0.02 | 47.25 | 86.53 | 0.38 | 60.58 | 96.94 | 90.65 | 92.43 | 6.83 | 52.97 | 10.00 | 100.00 | 0.00 | 8.87 | 64.81 | 20.23 | 24.26 | 76.15 | 47.80 | 100.00 | 0.00 | 27.77
WaNet | 87.42 | 94.32 | 5.30 | 50.0 | 10.00 | 100.00 | 0.00 | 11.29 | 86.03 | 52.47 | 41.75 | 70.23 | 84.28 | 0.40 | 83.45 | 95.39 | 88.48 | 2.93 | 84.12 | 95.70 | 90.28 | 97.23 | 2.62 | 50.00 | 72.18 | 2.67 | 69.49 | 88.21 | 56.72 | 19.82 | 52.24 | 71.90
ConvNeXt_tiny | BadNets | 91.28 | 92.78 | 6.73 | 50.0 | 89.37 | 81.53 | 17.31 | 54.67 | 89.84 | 91.61 | 7.77 | 49.86 | 89.44 | 18.41 | 75.00 | 86.26 | 91.28 | 92.77 | 6.74 | 50.01 | 76.81 | 1.60 | 75.47 | 88.35 | 39.25 | 4.21 | 39.46 | 68.27 | 72.76 | 6.71 | 70.37 | 83.77
Blended | 92.25 | 99.44 | 0.52 | 50.0 | 93.26 | 99.56 | 0.41 | 50.00 | 91.74 | 98.31 | 1.53 | 50.31 | 86.99 | 91.87 | 7.54 | 51.16 | 92.25 | 99.44 | 0.52 | 50.00 | 90.24 | 98.58 | 1.31 | 49.43 | 10.00 | 0.00 | 11.11 | 58.60 | 74.03 | 21.38 | 54.12 | 79.92
BppAttack | 87.34 | 99.48 | 0.47 | 50.0 | 92.89 | 99.50 | 0.49 | 50.00 | 91.31 | 97.66 | 2.21 | 50.91 | 80.79 | 0.71 | 79.36 | 96.11 | 87.34 | 99.48 | 0.47 | 50.00 | 88.85 | 98.18 | 1.77 | 50.65 | 48.34 | 17.80 | 44.71 | 71.34 | 74.59 | 7.28 | 69.91 | 89.73
Input | 88.32 | 92.08 | 7.54 | 50.0 | 92.52 | 76.49 | 21.40 | 57.79 | 91.39 | 71.68 | 25.91 | 60.20 | 80.77 | 3.49 | 72.44 | 90.52 | 87.69 | 91.01 | 8.36 | 50.22 | 88.89 | 95.20 | 4.70 | 50.00 | 17.42 | 3.52 | 18.40 | 58.83 | 70.54 | 13.56 | 62.32 | 80.37
LC | 91.97 | 90.83 | 9.06 | 50.0 | 92.61 | 82.16 | 17.31 | 54.34 | 91.24 | 74.37 | 24.27 | 57.87 | 83.55 | 0.53 | 83.74 | 90.94 | 91.98 | 90.82 | 9.07 | 50.01 | 91.60 | 82.40 | 17.34 | 54.03 | 54.81 | 18.72 | 47.70 | 67.48 | 68.98 | 100.00 | 0.00 | 38.50
LF | 90.21 | 2.07 | 89.89 | 50.0 | 91.22 | 2.17 | 90.72 | 50.00 | 89.28 | 2.46 | 88.93 | 49.54 | 89.52 | 0.50 | 90.23 | 50.44 | 90.21 | 2.06 | 89.89 | 50.01 | 89.47 | 1.97 | 89.28 | 49.68 | 56.51 | 12.70 | 55.89 | 33.15 | 67.76 | 10.04 | 64.89 | 38.78
SIG | 91.88 | 96.01 | 3.78 | 50.0 | 92.56 | 94.61 | 4.91 | 50.70 | 91.67 | 95.58 | 4.11 | 50.11 | 90.73 | 88.67 | 10.36 | 53.10 | 91.88 | 96.01 | 3.78 | 50.00 | 89.79 | 88.84 | 10.03 | 52.54 | 57.87 | 74.12 | 12.19 | 43.94 | 71.59 | 99.63 | 0.36 | 39.85
SSBA | 91.66 | 94.46 | 5.10 | 50.0 | 92.45 | 96.17 | 3.57 | 50.00 | 90.95 | 84.93 | 13.86 | 54.41 | 84.87 | 30.28 | 59.61 | 78.69 | 91.66 | 94.46 | 5.10 | 50.00 | 90.14 | 83.20 | 15.82 | 54.87 | 32.29 | 5.77 | 28.86 | 64.66 | 72.27 | 13.64 | 66.86 | 80.71
TrojanNN | 92.33 | 99.99 | 0.01 | 50.0 | 92.88 | 100.00 | 0.00 | 50.00 | 91.52 | 99.98 | 0.02 | 49.60 | 84.03 | 38.83 | 47.46 | 76.43 | 92.33 | 99.99 | 0.01 | 50.00 | 91.55 | 99.96 | 0.04 | 49.63 | 32.28 | 13.41 | 25.72 | 63.26 | 67.76 | 100.00 | 0.00 | 37.72
WaNet | 87.10 | 56.72 | 39.07 | 50.0 | 92.00 | 53.38 | 43.65 | 51.67 | 90.19 | 39.47 | 55.11 | 58.62 | 79.26 | 7.98 | 73.26 | 70.45 | 87.09 | 56.70 | 39.09 | 50.01 | 86.93 | 76.21 | 21.81 | 49.92 | 17.99 | 25.98 | 16.95 | 30.81 | 77.81 | 2.85 | 74.97 | 72.29
ViT_b_16 | BadNets | 95.58 | 91.08 | 8.62 | 50.0 | 10.00 | 0.00 | 11.11 | 52.75 | 96.31 | 79.33 | 20.23 | 55.87 | 95.58 | 91.08 | 8.62 | 50.00 | 95.58 | 91.08 | 8.62 | 50.00 | 94.52 | 88.00 | 11.68 | 51.01 | 10.00 | 0.00 | 11.11 | 52.75 | NaN | NaN | NaN | 47.75
Blended | 96.65 | 99.32 | 0.66 | 50.0 | 97.74 | 99.81 | 0.19 | 50.00 | 96.74 | 99.18 | 0.80 | 50.07 | 93.38 | 97.66 | 2.21 | 49.20 | 96.65 | 99.32 | 0.66 | 50.00 | 95.68 | 99.22 | 0.74 | 49.56 | 10.00 | 0.00 | 11.11 | 56.34 | NaN | NaN | NaN | 51.34
BppAttack | 91.34 | 99.01 | 0.96 | 50.0 | 97.94 | 99.69 | 0.31 | 50.00 | 96.60 | 99.52 | 0.47 | 50.00 | 91.34 | 99.01 | 0.96 | 50.00 | 91.34 | 99.01 | 0.96 | 50.00 | 70.63 | 98.26 | 1.13 | 40.02 | NaN | NaN | NaN | 53.84 | NaN | NaN | NaN | 53.84
Input | 90.52 | 86.74 | 12.68 | 50.0 | 97.73 | 85.91 | 13.87 | 50.42 | 96.40 | 80.69 | 18.77 | 53.03 | 89.74 | 94.84 | 5.00 | 49.61 | 91.59 | 96.01 | 3.83 | 50.00 | 51.73 | 94.01 | 5.17 | 30.60 | NaN | NaN | NaN | 48.11 | NaN | NaN | NaN | 48.11
LC | 96.48 | 79.60 | 20.37 | 50.0 | 97.80 | 94.97 | 5.03 | 50.00 | 96.46 | 87.38 | 12.62 | 49.99 | 96.48 | 79.60 | 20.37 | 50.00 | 96.48 | 79.60 | 20.37 | 50.00 | 95.99 | 70.07 | 29.83 | 54.52 | 10.00 | 100.00 | 0.00 | 6.76 | NaN | NaN | NaN | 41.56
LF | 95.33 | 1.23 | 95.17 | 50.0 | 10.00 | 100.00 | 0.00 | 7.33 | 95.97 | 0.90 | 95.89 | 50.17 | 94.18 | 0.67 | 94.24 | 49.71 | 95.33 | 1.23 | 95.17 | 50.00 | 80.56 | 2.46 | 79.06 | 42.61 | 10.00 | 0.00 | 11.11 | 7.95 | 15.58 | 79.03 | 6.53 | 10.12
SIG | 96.24 | 87.07 | 12.54 | 50.0 | 97.93 | 81.59 | 18.08 | 52.74 | 96.50 | 81.67 | 17.66 | 52.70 | 96.28 | 83.19 | 16.26 | 51.94 | 96.24 | 87.07 | 12.54 | 50.00 | 95.73 | 77.46 | 21.64 | 54.55 | 10.00 | 0.00 | 11.11 | 50.41 | NaN | NaN | NaN | 45.41
SSBA | 96.46 | 95.48 | 4.39 | 50.0 | 97.64 | 95.58 | 4.37 | 50.00 | 96.33 | 91.96 | 7.91 | 51.70 | 96.35 | 89.07 | 10.70 | 53.15 | 96.45 | 95.48 | 4.39 | 50.00 | 21.26 | 10.62 | 22.64 | 54.83 | 10.00 | 0.00 | 11.11 | 54.51 | 25.27 | 32.89 | 19.56 | 45.70
TrojanNN | 96.46 | 99.87 | 0.13 | 50.0 | 97.96 | 100.00 | 0.00 | 50.00 | 96.52 | 99.81 | 0.19 | 50.03 | 96.47 | 99.78 | 0.22 | 50.04 | 96.45 | 99.87 | 0.13 | 50.00 | 13.31 | 0.00 | 14.32 | 58.36 | 10.00 | 0.00 | 11.11 | 56.70 | 55.10 | 99.98 | 0.02 | 29.32
WaNet | 91.53 | 47.74 | 49.44 | 50.0 | 97.39 | 32.67 | 65.64 | 57.53 | 95.61 | 18.24 | 79.13 | 64.75 | 82.44 | 8.88 | 75.83 | 64.89 | 91.53 | 47.74 | 49.44 | 50.00 | 91.20 | 65.41 | 32.74 | 49.84 | 10.00 | 0.00 | 11.12 | 33.11 | NaN | NaN | NaN | 28.11

TABLE VI: Full results on CIFAR-10 with 5% poisoning ratio (The second part).

| Defense $\rightarrow$ | EP | FP | FT | I-BAU | BNP | NAD | NC | SS
---|---|---|---|---|---|---|---|---|---
Targeted Model | Attack $\downarrow$ | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%)
PreAct-ResNet18 | BadNets | 91.04 | 0.98 | 91.27 | 93.08 | 92.47 | 17.47 | 77.90 | 85.55 | 91.22 | 4.49 | 88.22 | 91.42 | 89.21 | 0.81 | 88.99 | 92.25 | 92.48 | 90.57 | 9.04 | 49.92 | 91.03 | 4.73 | 87.93 | 91.20 | 89.89 | 1.17 | 89.70 | 92.41 | 91.21 | 69.40 | 29.21 | 58.96
Blended | 92.06 | 98.99 | 0.92 | 49.51 | 93.46 | 98.87 | 1.11 | 50.27 | 93.25 | 98.78 | 1.21 | 50.21 | 85.92 | 36.33 | 34.14 | 77.76 | 93.49 | 99.58 | 0.42 | 49.93 | 93.10 | 99.06 | 0.93 | 49.99 | 93.66 | 99.61 | 0.39 | 50.00 | 91.43 | 99.42 | 0.56 | 48.97
BppAttack | 89.14 | 7.60 | 77.67 | 94.71 | 93.26 | 87.12 | 11.63 | 56.11 | 93.37 | 3.46 | 86.60 | 97.94 | 91.35 | 5.72 | 77.33 | 96.75 | 90.75 | 89.31 | 9.68 | 54.66 | 93.09 | 3.53 | 87.29 | 97.91 | 91.47 | 99.34 | 0.62 | 50.00 | 92.10 | 99.82 | 0.17 | 50.00
Input | 90.59 | 1.51 | 85.09 | 93.88 | 91.89 | 52.74 | 44.49 | 68.73 | 93.12 | 89.34 | 9.99 | 50.43 | 91.68 | 9.16 | 77.41 | 90.52 | 90.81 | 1.71 | 85.17 | 93.89 | 93.07 | 97.12 | 2.68 | 50.00 | 91.51 | 90.20 | 8.91 | 50.00 | 92.02 | 83.81 | 14.84 | 53.19
LC | 91.20 | 0.26 | 89.12 | 98.61 | 92.26 | 60.30 | 35.79 | 69.11 | 92.99 | 99.98 | 0.02 | 49.73 | 87.84 | 3.78 | 81.41 | 95.17 | 93.37 | 99.91 | 0.09 | 49.92 | 91.98 | 99.26 | 0.74 | 49.50 | 92.88 | 100.00 | 0.00 | 49.67 | 91.84 | 99.99 | 0.01 | 49.16
LF | 91.65 | 83.71 | 15.22 | 56.31 | 93.14 | 98.37 | 1.53 | 49.90 | 93.21 | 93.62 | 6.02 | 52.14 | 85.74 | 50.78 | 34.38 | 69.82 | 93.21 | 98.08 | 1.83 | 49.93 | 92.98 | 94.23 | 5.30 | 51.72 | 93.35 | 98.03 | 1.86 | 50.00 | 92.36 | 97.32 | 2.49 | 49.86
SIG | 92.43 | 1.57 | 59.07 | 97.16 | 93.27 | 99.79 | 0.20 | 49.81 | 92.84 | 96.42 | 3.46 | 49.93 | 86.12 | 3.50 | 57.24 | 93.03 | 93.40 | 97.23 | 2.76 | 49.88 | 92.49 | 96.98 | 2.93 | 49.48 | 93.65 | 97.09 | 2.90 | 50.00 | 91.79 | 96.36 | 3.31 | 49.44
SSBA | 92.29 | 12.14 | 78.71 | 90.89 | 93.05 | 87.14 | 12.09 | 53.77 | 93.08 | 87.46 | 11.69 | 53.63 | 89.43 | 2.30 | 83.33 | 94.39 | 93.03 | 94.88 | 4.81 | 49.90 | 92.49 | 88.63 | 10.58 | 52.75 | 91.04 | 0.80 | 87.93 | 95.94 | 92.01 | 93.19 | 6.38 | 50.23
TrojanNN | 92.05 | 4.12 | 80.90 | 97.06 | 92.33 | 83.60 | 13.32 | 57.46 | 92.90 | 44.22 | 47.99 | 77.44 | 89.42 | 7.49 | 71.71 | 94.06 | 93.62 | 81.63 | 17.26 | 59.09 | 92.68 | 4.24 | 82.82 | 97.32 | 92.59 | 95.06 | 4.14 | 51.87 | 86.30 | 99.38 | 0.60 | 46.56
WaNet | 91.36 | 31.98 | 62.86 | 76.56 | 92.14 | 26.10 | 63.50 | 79.70 | 93.47 | 31.32 | 64.03 | 77.09 | 91.13 | 6.11 | 85.27 | 89.38 | 91.69 | 1.37 | 90.22 | 92.03 | 93.31 | 50.40 | 46.46 | 67.55 | 91.76 | 85.50 | 13.49 | 50.00 | 91.47 | 83.84 | 15.16 | 50.68
VGG19-BN | BadNets | 89.43 | 80.74 | 18.18 | 55.71 | 89.39 | 33.82 | 61.29 | 79.15 | 88.93 | 52.99 | 44.23 | 69.34 | 88.64 | 33.88 | 61.51 | 78.75 | 90.80 | 93.74 | 5.90 | 49.89 | 86.73 | 71.48 | 25.89 | 58.99 | 88.98 | 45.44 | 50.13 | 73.13 | 9.97 | 99.99 | 0.00 | 9.39
Blended | 90.31 | 98.26 | 1.43 | 49.62 | 90.27 | 89.39 | 9.73 | 54.04 | 89.75 | 96.18 | 3.46 | 50.38 | 89.41 | 61.74 | 30.88 | 67.43 | 92.08 | 99.36 | 0.59 | 49.96 | 88.71 | 89.96 | 8.99 | 52.97 | 88.34 | 15.49 | 48.20 | 90.02 | 10.00 | 100.00 | 0.00 | 8.88
BppAttack | 88.87 | 5.29 | 82.36 | 96.29 | 91.90 | 2.99 | 86.29 | 97.66 | 91.78 | 2.12 | 86.94 | 98.09 | 90.46 | 0.31 | 75.20 | 98.99 | 88.41 | 87.02 | 11.76 | 55.19 | 91.57 | 2.07 | 84.72 | 98.12 | 91.54 | 2.04 | 86.80 | 98.13 | 10.00 | 100.00 | 0.00 | 10.35
Input | 88.32 | 3.26 | 80.00 | 92.40 | 91.09 | 42.01 | 52.66 | 73.87 | 91.07 | 31.36 | 61.11 | 79.19 | 89.33 | 27.39 | 42.19 | 80.84 | 88.71 | 2.44 | 81.32 | 93.00 | 90.65 | 39.68 | 55.06 | 75.03 | 89.22 | 93.34 | 6.18 | 49.60 | 11.29 | 94.14 | 1.64 | 10.64
LC | 89.00 | 0.58 | 85.86 | 97.73 | 89.76 | 86.54 | 13.04 | 55.12 | 89.79 | 90.77 | 8.73 | 53.03 | 83.58 | 30.93 | 45.28 | 79.84 | 91.51 | 99.30 | 0.70 | 49.90 | 88.22 | 99.82 | 0.18 | 48.26 | 89.67 | 19.10 | 37.98 | 88.80 | 10.00 | 100.00 | 0.00 | 9.15
LF | 85.18 | 9.26 | 84.10 | 48.46 | 89.10 | 1.10 | 89.03 | 52.59 | 88.95 | 1.39 | 88.61 | 52.45 | 83.96 | 5.41 | 82.91 | 48.28 | 87.67 | 7.19 | 86.83 | 49.70 | 87.60 | 1.44 | 87.46 | 52.09 | 88.27 | 6.29 | 87.54 | 50.00 | 10.00 | 100.00 | 0.00 | 10.86
SIG | 90.36 | 26.16 | 47.40 | 84.76 | 90.22 | 77.98 | 18.63 | 58.78 | 90.14 | 44.28 | 39.22 | 75.59 | 87.74 | 4.80 | 64.11 | 94.13 | 91.89 | 97.37 | 2.57 | 49.99 | 88.95 | 97.76 | 2.09 | 48.52 | 89.75 | 94.60 | 5.21 | 50.24 | 70.18 | 96.84 | 0.62 | 39.33
SSBA | 90.46 | 78.27 | 19.67 | 55.53 | 89.69 | 54.68 | 40.88 | 66.94 | 89.81 | 53.11 | 42.08 | 67.78 | 88.15 | 8.16 | 77.16 | 89.43 | 91.27 | 90.96 | 8.31 | 49.87 | 87.94 | 55.64 | 39.07 | 65.58 | 91.53 | 90.39 | 8.88 | 50.00 | 10.00 | 100.00 | 0.00 | 9.23
TrojanNN | 89.72 | 8.51 | 57.19 | 94.47 | 89.91 | 93.67 | 5.58 | 51.99 | 89.55 | 85.12 | 12.50 | 56.08 | 89.24 | 0.00 | 27.57 | 98.48 | 92.23 | 99.99 | 0.01 | 49.98 | 88.49 | 98.50 | 1.21 | 48.86 | 88.97 | 7.31 | 69.79 | 94.69 | 10.71 | 97.26 | 0.74 | 10.59
WaNet | 87.19 | 71.37 | 26.03 | 61.36 | 91.74 | 11.27 | 79.84 | 91.53 | 91.83 | 15.86 | 75.85 | 89.23 | 90.11 | 1.96 | 81.58 | 96.18 | 24.41 | 92.67 | 5.60 | 19.32 | 91.34 | 6.88 | 82.77 | 93.72 | 87.42 | 94.32 | 5.30 | 50.00 | 10.00 | 100.00 | 0.00 | 11.29
ConvNeXt_tiny | BadNets | 90.84 | 92.22 | 7.21 | 50.06 | 89.23 | 4.32 | 85.09 | 93.20 | 89.28 | 20.91 | 72.33 | 84.93 | 88.55 | 38.51 | 56.82 | 75.77 | 90.60 | 92.44 | 7.00 | 49.83 | 84.53 | 34.68 | 58.93 | 75.68 | 91.28 | 92.77 | 6.74 | 50.01 | 90.26 | 93.78 | 5.74 | 49.49
Blended | 91.83 | 97.78 | 2.11 | 50.62 | 88.45 | 62.86 | 32.72 | 66.39 | 89.31 | 81.63 | 16.74 | 57.44 | 88.67 | 95.47 | 3.97 | 50.20 | 92.09 | 99.20 | 0.77 | 50.04 | 86.46 | 81.70 | 16.22 | 55.98 | 89.33 | 91.29 | 8.02 | 52.62 | 78.30 | 95.34 | 3.44 | 45.08
BppAttack | 86.01 | 99.69 | 0.28 | 49.34 | 87.90 | 97.59 | 2.32 | 50.94 | 88.87 | 98.53 | 1.42 | 50.47 | 88.92 | 22.27 | 54.19 | 88.61 | 87.02 | 99.31 | 0.62 | 49.92 | 88.63 | 98.24 | 1.67 | 50.62 | 88.82 | 99.16 | 0.78 | 50.16 | 84.62 | 9.46 | 76.69 | 93.65
Input | 85.62 | 96.20 | 3.54 | 48.65 | 88.70 | 55.54 | 41.61 | 68.27 | 89.30 | 88.02 | 11.54 | 52.03 | 88.45 | 88.47 | 10.97 | 51.81 | 87.30 | 92.52 | 6.93 | 49.49 | 89.15 | 83.27 | 15.89 | 54.41 | 89.22 | 91.83 | 7.90 | 50.12 | 89.72 | 55.62 | 38.93 | 68.23
LC | 91.69 | 89.84 | 10.02 | 50.35 | 88.67 | 21.40 | 71.24 | 83.07 | 89.51 | 38.58 | 57.64 | 74.90 | 89.42 | 51.16 | 44.40 | 68.56 | 91.68 | 88.00 | 11.87 | 51.27 | 84.84 | 19.04 | 69.19 | 82.33 | 89.23 | 35.16 | 60.42 | 76.47 | 92.68 | 84.72 | 14.96 | 53.06
LF | 89.86 | 2.47 | 89.44 | 49.82 | 88.67 | 0.96 | 88.58 | 49.79 | 88.92 | 1.04 | 88.82 | 49.87 | 89.63 | 1.03 | 89.66 | 50.23 | 90.29 | 2.07 | 89.87 | 50.00 | 85.43 | 3.40 | 84.49 | 47.61 | 90.21 | 2.06 | 89.89 | 50.01 | 88.95 | 4.07 | 88.30 | 49.37
SIG | 91.69 | 96.36 | 3.42 | 49.90 | 88.98 | 54.76 | 34.19 | 69.18 | 89.41 | 70.13 | 25.62 | 61.70 | 88.74 | 94.33 | 5.18 | 49.27 | 91.82 | 94.86 | 4.84 | 50.55 | 85.18 | 44.93 | 41.50 | 72.19 | 78.63 | 2.37 | 55.68 | 90.20 | 92.57 | 94.51 | 5.18 | 50.75
SSBA | 91.11 | 92.63 | 6.77 | 50.64 | 88.58 | 2.74 | 84.02 | 94.32 | 89.48 | 26.04 | 65.59 | 83.12 | 89.63 | 2.69 | 80.48 | 94.87 | 90.88 | 93.52 | 5.92 | 50.08 | 85.91 | 57.74 | 38.17 | 65.48 | 91.66 | 94.46 | 5.10 | 50.00 | 85.79 | 31.76 | 59.60 | 78.42
TrojanNN | 91.64 | 99.99 | 0.01 | 49.66 | 89.23 | 87.30 | 11.11 | 54.79 | 89.35 | 97.37 | 2.44 | 49.82 | 89.82 | 8.57 | 69.28 | 94.46 | 92.15 | 99.99 | 0.01 | 49.91 | 85.71 | 91.56 | 7.84 | 50.91 | 89.45 | 97.98 | 1.99 | 49.57 | 72.49 | 98.51 | 1.03 | 40.82
WaNet | 86.28 | 60.09 | 35.78 | 49.59 | 88.77 | 0.95 | 87.53 | 77.89 | 88.84 | 2.89 | 86.20 | 76.91 | 88.21 | 7.71 | 80.59 | 74.50 | 86.82 | 56.12 | 39.56 | 50.16 | 88.43 | 5.88 | 83.18 | 75.42 | 87.09 | 56.70 | 39.09 | 50.01 | 88.78 | 27.21 | 64.53 | 64.76
ViT_b_16 | BadNets | NaN | NaN | NaN | 47.75 | 95.18 | 43.57 | 53.78 | 73.56 | 95.80 | 76.32 | 23.01 | 57.38 | 27.61 | 13.70 | 21.34 | 54.70 | NaN | NaN | NaN | 47.75 | 26.89 | 10.36 | 24.34 | 56.02 | 95.88 | 77.16 | 22.17 | 56.96 | 80.18 | 93.51 | 5.47 | 42.30
Blended | NaN | NaN | NaN | 51.34 | 93.84 | 31.48 | 26.94 | 82.52 | 96.51 | 98.70 | 1.26 | 50.24 | 25.97 | 27.50 | 17.28 | 50.57 | NaN | NaN | NaN | 51.34 | 25.05 | 15.79 | 21.59 | 55.97 | 96.37 | 99.20 | 0.77 | 49.92 | 82.79 | 98.10 | 1.60 | 43.68
BppAttack | NaN | NaN | NaN | 53.84 | 93.68 | 98.77 | 1.11 | 50.12 | 94.09 | 99.21 | 0.77 | 50.00 | 83.19 | 53.09 | 39.02 | 68.89 | NaN | NaN | NaN | 53.84 | 76.61 | 10.23 | 60.92 | 87.02 | 94.29 | 99.37 | 0.63 | 50.00 | 75.43 | 98.17 | 1.48 | 42.47
Input | 91.24 | 95.13 | 4.67 | 50.00 | 94.25 | 65.87 | 33.28 | 60.44 | 94.63 | 94.53 | 5.31 | 50.00 | 84.01 | 1.88 | 79.88 | 89.18 | 88.75 | 96.67 | 3.21 | 49.11 | 77.67 | 3.28 | 71.77 | 85.31 | 94.47 | 94.64 | 5.22 | 50.00 | 95.18 | 88.57 | 11.11 | 50.00
LC | 96.13 | 78.04 | 21.93 | 50.60 | 94.53 | 85.02 | 12.53 | 49.02 | 96.28 | 75.69 | 24.27 | 51.86 | 26.41 | 12.60 | 23.56 | 48.46 | 96.00 | 90.28 | 9.59 | 49.76 | 28.40 | 7.78 | 26.18 | 51.87 | 96.23 | 78.74 | 21.23 | 50.30 | 74.26 | 98.97 | 0.79 | 38.89
LF | 94.95 | 1.54 | 94.66 | 49.81 | 94.01 | 0.40 | 94.23 | 49.76 | 96.01 | 0.39 | 95.96 | 50.42 | 28.17 | 9.74 | 25.82 | 16.42 | 93.28 | 2.91 | 92.99 | 48.97 | 23.94 | 8.08 | 22.51 | 14.31 | 95.85 | 0.48 | 95.72 | 50.38 | 76.52 | 3.74 | 76.04 | 40.60
SIG | 96.03 | 88.84 | 10.86 | 49.90 | 93.61 | 70.50 | 20.83 | 56.97 | 96.14 | 87.53 | 12.10 | 49.95 | 26.43 | 7.71 | 25.22 | 54.77 | 95.60 | 91.57 | 8.13 | 49.68 | 26.79 | 8.87 | 24.24 | 54.38 | 95.89 | 87.39 | 12.29 | 49.82 | 96.05 | 85.22 | 14.48 | 50.83
SSBA | 96.26 | 95.59 | 4.31 | 49.90 | 94.83 | 2.00 | 87.80 | 95.92 | 96.45 | 88.81 | 10.86 | 53.33 | 27.75 | 14.39 | 24.92 | 56.19 | 95.27 | 95.62 | 4.21 | 49.40 | 24.69 | 6.58 | 23.49 | 58.56 | 96.34 | 90.06 | 9.58 | 52.65 | 96.42 | 95.32 | 4.50 | 50.06
TrojanNN | 96.21 | 99.98 | 0.02 | 49.87 | 94.38 | 92.08 | 4.50 | 52.85 | 96.30 | 99.23 | 0.77 | 50.24 | 27.10 | 14.00 | 21.39 | 58.25 | 95.89 | 100.00 | 0.00 | 49.72 | 25.51 | 13.41 | 21.38 | 57.75 | 96.41 | 99.82 | 0.18 | 50.00 | 75.63 | 98.20 | 1.33 | 40.42
WaNet | 91.00 | 49.88 | 47.50 | 49.74 | 94.36 | 0.40 | 93.97 | 73.67 | 94.13 | 1.54 | 92.53 | 73.10 | 85.32 | 1.99 | 83.86 | 69.77 | 90.43 | 30.79 | 64.13 | 57.92 | 78.60 | 3.28 | 77.79 | 65.76 | 91.53 | 47.74 | 49.44 | 50.00 | 71.85 | 13.89 | 65.42 | 57.09

TABLE VII: Full results on CIFAR-10 with 1% poisoning ratio (The first part).

| Defense $\rightarrow$ | No defense | ABL | AC | ANP | CLP | D-BR | D-ST | DBD
---|---|---|---|---|---|---|---|---|---
Targeted Model | Attack $\downarrow$ | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%)
PreAct-ResNet18 | BadNets | 93.14 | 74.73 | 24.24 | 50.0 | 72.81 | 53.20 | 41.31 | 50.60 | 88.88 | 27.18 | 68.14 | 71.65 | 84.67 | 0.29 | 85.30 | 82.99 | 89.46 | 3.51 | 87.10 | 83.77 | 11.66 | 0.86 | 12.93 | 46.20 | 81.78 | 2.21 | 80.79 | 80.58 | 78.09 | 2.99 | 76.51 | 78.35
Blended | 93.76 | 94.88 | 4.79 | 50.0 | 66.26 | 0.17 | 34.91 | 83.61 | 89.77 | 86.09 | 12.67 | 52.40 | 86.92 | 37.01 | 40.68 | 75.51 | 92.25 | 90.88 | 8.41 | 51.25 | 10.99 | 0.00 | 11.67 | 56.05 | 79.92 | 47.94 | 34.21 | 66.55 | 70.18 | 8.04 | 55.60 | 81.63
BppAttack | 90.81 | 87.23 | 11.88 | 50.0 | 55.61 | 11.78 | 49.70 | 70.13 | 89.13 | 16.74 | 74.51 | 84.40 | 89.41 | 5.72 | 66.68 | 90.06 | 88.91 | 0.99 | 85.58 | 92.17 | 72.52 | 81.84 | 13.12 | 43.55 | 87.81 | 58.48 | 38.58 | 62.88 | 86.30 | 6.91 | 75.97 | 87.91
Input | 91.74 | 79.18 | 19.89 | 50.0 | 72.26 | 69.31 | 24.89 | 45.19 | 89.44 | 60.56 | 36.07 | 58.16 | 85.88 | 7.54 | 75.41 | 82.89 | 91.24 | 23.19 | 67.31 | 77.74 | 67.69 | 59.08 | 30.12 | 48.03 | 82.69 | 55.81 | 38.97 | 57.16 | 69.66 | 14.36 | 62.67 | 71.37
LC | 93.80 | 93.73 | 6.24 | 50.0 | 54.37 | 2.70 | 45.88 | 75.80 | 89.94 | 62.78 | 35.68 | 63.55 | 87.06 | 53.28 | 23.44 | 66.86 | 93.61 | 89.86 | 10.09 | 51.84 | 10.89 | 0.00 | 12.09 | 55.41 | 81.09 | 44.68 | 47.77 | 68.17 | 66.87 | 99.98 | 0.02 | 36.54
LF | 93.56 | 86.46 | 12.88 | 50.0 | 60.04 | 55.07 | 30.76 | 48.93 | 89.49 | 76.22 | 21.40 | 53.08 | 88.11 | 6.36 | 78.78 | 87.32 | 91.20 | 81.26 | 16.52 | 51.42 | 9.36 | 0.00 | 10.08 | 51.13 | 79.77 | 24.27 | 65.33 | 74.20 | 79.13 | 7.47 | 75.38 | 82.28
SIG | 93.82 | 83.40 | 14.29 | 50.0 | 64.33 | 0.00 | 20.51 | 76.96 | 90.00 | 74.81 | 18.61 | 52.38 | 91.82 | 23.63 | 50.47 | 78.88 | 93.74 | 82.36 | 15.02 | 50.48 | 11.57 | 0.00 | 11.73 | 50.57 | 82.87 | 61.66 | 12.84 | 55.40 | 75.01 | 67.82 | 29.87 | 48.38
SSBA | 93.43 | 73.44 | 24.89 | 50.0 | 83.11 | 56.33 | 37.69 | 53.40 | 89.61 | 27.92 | 64.11 | 70.85 | 91.68 | 2.19 | 87.52 | 84.75 | 90.99 | 5.27 | 83.82 | 82.87 | 12.41 | 27.69 | 11.47 | 32.37 | 82.42 | 2.47 | 76.30 | 79.98 | 78.52 | 1.13 | 74.21 | 78.70
TrojanNN | 93.58 | 99.97 | 0.03 | 50.0 | 24.73 | 100.00 | 0.00 | 15.58 | 89.72 | 99.53 | 0.44 | 48.29 | 86.39 | 94.79 | 3.92 | 48.99 | 92.74 | 94.89 | 4.89 | 52.12 | 12.35 | 0.00 | 13.31 | 59.37 | 88.44 | 98.97 | 1.03 | 47.93 | 74.49 | 99.99 | 0.01 | 40.45
WaNet | 90.65 | 12.63 | 79.94 | 50.0 | 65.43 | 53.43 | 37.98 | 37.39 | 89.53 | 4.87 | 84.87 | 53.32 | 84.96 | 0.59 | 86.37 | 53.18 | 88.57 | 2.91 | 85.96 | 53.82 | 82.12 | 2.86 | 78.67 | 50.62 | 83.91 | 2.72 | 83.59 | 51.59 | 79.74 | 4.60 | 78.46 | 48.56
VGG19-BN | BadNets | 91.51 | 79.87 | 19.12 | 50.0 | NaN | NaN | NaN | 44.18 | 86.58 | 9.01 | 80.99 | 82.96 | 88.41 | 1.74 | 87.17 | 87.51 | NaN | NaN | NaN | 44.18 | 87.88 | 73.66 | 24.82 | 51.29 | 90.60 | 1.86 | 90.10 | 88.55 | 54.81 | 11.12 | 50.42 | 66.02
Blended | 91.83 | 94.19 | 5.21 | 50.0 | NaN | NaN | NaN | 51.18 | 87.17 | 85.10 | 12.60 | 52.21 | 86.94 | 49.83 | 39.09 | 69.73 | NaN | NaN | NaN | 51.18 | 14.55 | 4.76 | 13.83 | 56.08 | 91.22 | 97.10 | 2.33 | 49.70 | 55.09 | 0.00 | 31.27 | 78.73
BppAttack | 89.20 | 47.71 | 47.00 | 50.0 | 10.00 | 100.00 | 0.00 | 10.40 | 86.43 | 4.64 | 81.93 | 70.15 | 82.06 | 1.52 | 71.31 | 69.52 | 86.89 | 1.21 | 83.67 | 72.10 | 10.02 | 0.00 | 11.13 | 34.27 | 83.15 | 14.81 | 74.06 | 63.42 | 56.81 | 7.67 | 51.04 | 53.83
Input | 89.02 | 67.30 | 28.38 | 50.0 | 10.00 | 0.00 | 11.11 | 44.14 | 87.01 | 38.23 | 52.52 | 63.53 | 88.33 | 2.40 | 78.61 | 82.10 | 87.18 | 3.86 | 78.38 | 80.80 | 90.67 | 80.93 | 16.73 | 50.00 | 91.59 | 67.94 | 28.92 | 50.00 | 53.66 | 16.17 | 44.57 | 57.89
LC | 92.41 | 88.44 | 11.46 | 50.0 | 49.38 | 63.57 | 23.29 | 40.92 | 87.09 | 88.94 | 10.40 | 47.34 | 89.36 | 31.48 | 59.86 | 76.96 | 89.92 | 22.61 | 69.46 | 81.67 | 86.59 | 50.76 | 43.88 | 65.93 | 76.28 | 99.90 | 0.02 | 41.94 | 52.82 | 100.00 | 0.00 | 30.20
LF | 91.17 | 1.54 | 91.00 | 50.0 | 70.42 | 0.26 | 72.08 | 40.27 | 86.02 | 1.90 | 85.72 | 47.42 | 91.00 | 0.40 | 91.58 | 50.49 | 89.48 | 1.50 | 89.22 | 49.18 | 9.95 | 0.01 | 11.03 | 10.16 | 82.41 | 0.94 | 81.43 | 45.92 | 56.83 | 10.21 | 52.68 | 32.83
SIG | 92.11 | 92.79 | 6.47 | 50.0 | 63.36 | 56.58 | 20.13 | 53.73 | 87.22 | 79.34 | 14.54 | 54.28 | 88.14 | 3.10 | 64.07 | 92.86 | 91.48 | 96.40 | 3.11 | 49.68 | 82.73 | 86.18 | 5.33 | 48.62 | 82.36 | 91.42 | 5.89 | 45.81 | 55.92 | 0.00 | 12.36 | 78.30
SSBA | 91.90 | 38.08 | 56.67 | 50.0 | 59.23 | 34.57 | 40.78 | 35.42 | 86.90 | 10.61 | 76.34 | 61.23 | 90.33 | 1.49 | 86.61 | 67.51 | 87.81 | 32.21 | 60.33 | 50.89 | 10.92 | 0.46 | 10.84 | 28.32 | 88.00 | 8.39 | 81.59 | 62.89 | 58.45 | 12.20 | 51.74 | 46.21
TrojanNN | 91.97 | 99.92 | 0.08 | 50.0 | 18.54 | 0.00 | 15.40 | 63.25 | 87.57 | 99.68 | 0.31 | 47.92 | 89.18 | 82.90 | 14.91 | 57.12 | 90.75 | 76.58 | 19.96 | 61.06 | 11.41 | 0.00 | 12.10 | 59.68 | 88.26 | 99.88 | 0.12 | 48.17 | 55.68 | 99.87 | 0.13 | 31.88
WaNet | 90.12 | 23.47 | 69.62 | 50.0 | 14.31 | 96.55 | 0.45 | 12.10 | 86.56 | 5.19 | 81.39 | 57.36 | 88.09 | 1.20 | 87.81 | 60.12 | 88.76 | 1.64 | 84.23 | 60.24 | 10.00 | 0.00 | 11.13 | 21.67 | 87.22 | 2.44 | 86.35 | 59.07 | 55.80 | 15.22 | 50.86 | 36.97
ConvNeXt_tiny | BadNets | 91.85 | 67.47 | 30.42 | 50.0 | 92.60 | 86.83 | 12.36 | 50.00 | 91.09 | 40.60 | 55.82 | 63.05 | 85.91 | 1.59 | 86.31 | 79.97 | 91.85 | 67.49 | 30.40 | 50.00 | 85.83 | 44.18 | 50.99 | 58.63 | 62.48 | 9.50 | 61.36 | 64.30 | 68.39 | 5.24 | 65.71 | 69.38
Blended | 92.21 | 94.87 | 4.78 | 50.0 | 92.82 | 96.94 | 2.92 | 50.00 | 91.35 | 92.37 | 7.17 | 50.82 | 86.89 | 75.28 | 21.41 | 57.13 | 92.21 | 94.87 | 4.78 | 50.00 | 89.86 | 93.61 | 5.78 | 49.45 | 62.13 | 7.32 | 46.58 | 78.73 | 74.53 | 4.67 | 66.73 | 86.26
BppAttack | 86.00 | 23.67 | 67.04 | 50.0 | 92.94 | 30.28 | 64.47 | 50.00 | 91.27 | 13.63 | 77.74 | 55.02 | 84.27 | 3.12 | 81.11 | 59.41 | 86.00 | 23.67 | 67.04 | 50.00 | 89.27 | 16.76 | 75.30 | 53.46 | 21.22 | 19.52 | 19.69 | 19.68 | 79.03 | 4.14 | 75.90 | 56.28
Input | 88.18 | 62.34 | 35.34 | 50.0 | 92.94 | 50.88 | 45.36 | 55.73 | 91.35 | 48.08 | 48.01 | 57.13 | 81.69 | 7.00 | 68.11 | 74.43 | 87.96 | 74.36 | 23.62 | 49.89 | 87.48 | 73.48 | 24.64 | 49.65 | 59.71 | 11.23 | 52.06 | 61.32 | 72.47 | 6.34 | 67.48 | 70.14
LC | 92.25 | 71.23 | 27.91 | 50.0 | 92.89 | 58.16 | 39.06 | 56.54 | 91.79 | 43.49 | 52.23 | 63.64 | 85.93 | 0.64 | 86.20 | 82.13 | 92.25 | 71.20 | 27.94 | 50.02 | 91.81 | 65.26 | 33.40 | 52.77 | 58.55 | 18.30 | 49.56 | 59.62 | 67.31 | 75.13 | 20.77 | 37.53
LF | 91.80 | 0.72 | 91.61 | 50.0 | 92.66 | 0.86 | 92.38 | 50.00 | 91.17 | 1.04 | 90.89 | 49.68 | 88.04 | 0.46 | 88.72 | 48.25 | 91.80 | 0.72 | 91.61 | 50.00 | 85.99 | 1.32 | 85.52 | 47.10 | 64.32 | 8.44 | 62.63 | 36.26 | 69.17 | 5.77 | 66.46 | 38.68
SIG | 92.11 | 77.46 | 20.78 | 50.0 | 92.91 | 72.50 | 24.03 | 52.48 | 91.38 | 67.22 | 27.87 | 54.75 | 83.69 | 42.76 | 44.59 | 63.14 | 92.10 | 77.43 | 20.80 | 50.01 | 91.65 | 77.11 | 20.58 | 49.94 | 62.48 | 68.29 | 14.12 | 39.77 | 72.26 | 91.47 | 7.46 | 40.08
SSBA | 91.84 | 38.48 | 56.12 | 50.0 | 92.51 | 59.27 | 38.02 | 50.00 | 91.56 | 11.09 | 80.90 | 63.55 | 88.83 | 18.13 | 72.77 | 58.67 | 91.84 | 38.48 | 56.12 | 50.00 | 91.14 | 22.43 | 70.03 | 57.67 | 39.74 | 9.27 | 37.02 | 38.56 | 75.03 | 6.23 | 70.45 | 57.72
TrojanNN | 92.30 | 99.93 | 0.07 | 50.0 | 92.90 | 99.98 | 0.02 | 50.00 | 91.72 | 99.84 | 0.14 | 49.75 | 84.46 | 18.80 | 59.31 | 86.65 | 92.30 | 99.93 | 0.07 | 50.00 | 89.38 | 98.38 | 1.56 | 49.32 | 62.13 | 50.03 | 31.23 | 59.86 | 74.17 | 16.93 | 59.91 | 82.44
WaNet | 88.70 | 4.17 | 84.60 | 50.0 | 92.82 | 7.68 | 84.92 | 50.00 | 90.81 | 4.57 | 86.15 | 50.00 | 84.16 | 1.61 | 82.19 | 49.01 | 88.71 | 4.17 | 84.60 | 50.00 | 89.25 | 7.98 | 83.43 | 50.00 | 57.80 | 10.52 | 54.01 | 34.55 | 70.97 | 4.69 | 66.87 | 41.13
ViT_b_16 | BadNets | 96.50 | 72.73 | 26.50 | 50.0 | 10.00 | 100.00 | 0.00 | 6.75 | 96.56 | 29.71 | 68.29 | 71.51 | 95.18 | 67.94 | 30.93 | 51.73 | 96.50 | 72.73 | 26.50 | 50.00 | 18.83 | 24.83 | 12.24 | 35.12 | 10.00 | 0.00 | 11.11 | 43.12 | NaN | NaN | NaN | 38.12
Blended | 96.54 | 96.34 | 3.54 | 50.0 | 97.96 | 98.74 | 1.22 | 50.00 | 96.60 | 94.58 | 5.26 | 50.88 | 90.56 | 89.49 | 9.68 | 50.44 | 96.54 | 96.34 | 3.54 | 50.00 | 96.36 | 96.22 | 3.66 | 49.97 | 10.00 | 0.00 | 11.11 | 54.90 | 55.26 | 8.24 | 49.01 | 73.41
BppAttack | 91.63 | 78.04 | 20.41 | 50.0 | 97.90 | 95.53 | 4.40 | 50.00 | 96.66 | 93.81 | 6.01 | 50.00 | 91.19 | 77.01 | 21.38 | 50.30 | 91.63 | 78.04 | 20.41 | 50.00 | 45.74 | 43.90 | 20.23 | 44.13 | NaN | NaN | NaN | 43.21 | NaN | NaN | NaN | 43.21
Input | 90.88 | 61.21 | 37.24 | 50.0 | 97.82 | 60.42 | 39.02 | 50.39 | 96.57 | 53.64 | 45.26 | 53.78 | 90.98 | 82.06 | 17.44 | 50.00 | 90.99 | 83.83 | 15.74 | 50.00 | 53.93 | 39.64 | 32.18 | 42.31 | NaN | NaN | NaN | 35.17 | NaN | NaN | NaN | 35.17
LC | 96.65 | 68.03 | 31.46 | 50.0 | 98.16 | 89.72 | 10.28 | 50.00 | 96.51 | 63.31 | 36.53 | 52.29 | 96.58 | 67.07 | 32.40 | 50.45 | 96.65 | 68.03 | 31.46 | 50.00 | 18.64 | 29.07 | 11.70 | 30.48 | 10.00 | 0.00 | 11.11 | 40.69 | NaN | NaN | NaN | 35.69
LF | 96.18 | 0.48 | 96.09 | 50.0 | 97.84 | 0.16 | 97.81 | 50.16 | 96.32 | 0.59 | 96.23 | 50.00 | 96.30 | 0.42 | 96.24 | 50.03 | 96.18 | 0.48 | 96.09 | 50.00 | 95.55 | 0.53 | 95.48 | 49.68 | 10.00 | 100.00 | 0.00 | 6.91 | 22.47 | 4.88 | 22.00 | 13.14
SIG | 96.74 | 56.59 | 40.83 | 50.0 | 97.94 | 50.12 | 47.90 | 53.23 | 96.45 | 59.98 | 37.37 | 49.86 | 96.72 | 55.34 | 42.01 | 50.61 | 96.74 | 56.59 | 40.83 | 50.00 | 15.70 | 8.02 | 12.37 | 33.76 | 10.00 | 100.00 | 0.00 | 6.63 | 59.83 | 97.72 | 1.56 | 31.54
SSBA | 96.55 | 63.79 | 34.96 | 50.0 | 97.62 | 54.39 | 44.73 | 54.70 | 96.52 | 36.16 | 61.90 | 63.80 | 96.49 | 43.00 | 54.64 | 60.36 | 96.55 | 63.79 | 34.96 | 50.00 | 27.01 | 8.57 | 25.07 | 42.84 | 10.00 | 0.00 | 11.11 | 38.62 | NaN | NaN | NaN | 33.62
TrojanNN | 96.59 | 99.23 | 0.77 | 50.0 | 97.95 | 99.97 | 0.03 | 50.00 | 96.51 | 97.93 | 2.07 | 50.61 | 96.58 | 99.02 | 0.97 | 50.10 | 96.59 | 99.23 | 0.77 | 50.00 | 95.37 | 95.40 | 4.57 | 51.31 | 10.00 | 0.00 | 11.11 | 56.32 | NaN | NaN | NaN | 51.32
WaNet | 92.13 | 0.75 | 91.51 | 50.0 | 97.76 | 0.86 | 96.54 | 50.00 | 96.32 | 0.83 | 95.60 | 50.00 | 92.13 | 0.75 | 91.51 | 50.00 | 92.13 | 0.75 | 91.51 | 50.00 | 92.17 | 1.70 | 89.63 | 50.00 | 10.00 | 0.00 | 11.12 | 9.31 | 58.22 | 6.44 | 55.36 | 33.04

TABLE VIII: Full results on CIFAR-10 with 1% poisoning ratio (The second
part).

| Defense $\rightarrow$ | EP | FP | FT | I-BAU | BNP | NAD | NC | SS
---|---|---|---|---|---|---|---|---|---
Targeted Model | Attack $\downarrow$ | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%)
PreAct-ResNet18 | BadNets | 91.85 | 45.86 | 51.72 | 63.79 | 92.98 | 20.18 | 75.87 | 77.20 | 93.07 | 10.36 | 84.58 | 82.15 | 87.63 | 3.62 | 85.46 | 82.80 | 92.19 | 79.57 | 19.37 | 49.53 | 92.52 | 8.33 | 85.96 | 82.89 | 91.64 | 0.88 | 91.68 | 86.18 | 92.62 | 74.20 | 24.88 | 50.01
Blended | 91.27 | 89.54 | 9.01 | 51.42 | 93.48 | 94.14 | 5.41 | 50.23 | 93.53 | 91.96 | 7.56 | 51.35 | 89.70 | 30.36 | 51.54 | 80.23 | 93.01 | 95.38 | 4.27 | 49.62 | 93.34 | 92.07 | 7.41 | 51.20 | 90.98 | 65.91 | 29.24 | 63.09 | 93.27 | 93.32 | 6.28 | 50.53
BppAttack | 89.65 | 8.32 | 73.42 | 88.88 | 92.97 | 71.73 | 19.80 | 57.75 | 93.35 | 64.96 | 32.53 | 61.14 | 90.69 | 2.77 | 83.98 | 92.17 | 89.28 | 31.96 | 58.10 | 76.87 | 93.16 | 9.40 | 80.92 | 88.92 | 93.21 | 8.98 | 77.39 | 89.13 | 91.94 | 21.02 | 72.13 | 83.11
Input | 88.70 | 5.34 | 79.14 | 85.40 | 92.20 | 53.69 | 43.89 | 62.74 | 93.14 | 77.68 | 21.59 | 50.75 | 88.54 | 3.97 | 78.19 | 86.01 | 90.18 | 82.74 | 16.44 | 49.22 | 93.07 | 85.13 | 14.37 | 50.00 | 91.74 | 79.19 | 19.88 | 50.00 | 92.78 | 60.14 | 37.84 | 59.52
LC | 91.87 | 4.51 | 88.19 | 93.65 | 92.34 | 40.33 | 53.28 | 75.97 | 93.60 | 95.47 | 4.51 | 49.90 | 90.01 | 48.36 | 45.24 | 70.79 | 93.73 | 90.76 | 9.22 | 51.45 | 93.20 | 82.33 | 17.42 | 55.40 | 93.28 | 98.70 | 1.29 | 49.74 | 91.94 | 81.88 | 17.93 | 55.00
LF | 90.39 | 86.24 | 12.74 | 48.52 | 93.25 | 86.58 | 12.60 | 49.84 | 93.35 | 82.54 | 16.36 | 51.85 | 90.41 | 70.56 | 26.09 | 56.38 | 93.32 | 86.76 | 12.54 | 49.88 | 93.34 | 84.43 | 14.64 | 50.90 | 93.56 | 86.46 | 12.87 | 50.00 | 92.68 | 82.19 | 16.68 | 51.69
SIG | 91.99 | 78.71 | 16.81 | 51.43 | 93.48 | 88.07 | 10.08 | 49.83 | 93.59 | 88.17 | 10.13 | 49.88 | 90.66 | 36.52 | 38.69 | 71.86 | 93.45 | 82.50 | 14.89 | 50.26 | 93.41 | 83.20 | 14.22 | 49.89 | 93.82 | 83.40 | 14.29 | 50.00 | 93.09 | 85.91 | 12.12 | 49.63
SSBA | 91.93 | 73.97 | 24.00 | 49.25 | 93.34 | 52.76 | 43.53 | 60.30 | 93.24 | 61.32 | 35.98 | 55.97 | 90.06 | 3.43 | 81.27 | 83.32 | 93.37 | 66.92 | 30.58 | 53.23 | 93.33 | 67.03 | 30.83 | 53.16 | 90.45 | 1.22 | 85.77 | 84.62 | 92.71 | 54.79 | 42.18 | 58.97
TrojanNN | 92.65 | 10.42 | 74.48 | 94.31 | 92.60 | 99.36 | 0.64 | 49.82 | 93.40 | 99.92 | 0.08 | 49.93 | 87.84 | 11.43 | 59.19 | 91.40 | 93.44 | 99.98 | 0.02 | 49.93 | 92.78 | 99.73 | 0.27 | 49.72 | 93.19 | 99.94 | 0.06 | 49.82 | 92.83 | 99.61 | 0.39 | 49.80
WaNet | 87.67 | 12.76 | 76.59 | 48.51 | 92.07 | 0.93 | 91.10 | 55.85 | 93.61 | 0.68 | 92.72 | 55.98 | 91.51 | 2.23 | 89.94 | 55.20 | 90.43 | 14.34 | 78.30 | 49.89 | 93.61 | 0.78 | 92.67 | 55.93 | 90.65 | 12.66 | 79.92 | 50.00 | 92.79 | 8.81 | 84.56 | 51.91
VGG19-BN | BadNets | 90.42 | 71.02 | 27.33 | 53.88 | 89.32 | 29.44 | 66.27 | 74.12 | 89.28 | 30.16 | 65.19 | 73.74 | 85.87 | 9.64 | 76.73 | 82.29 | 91.56 | 79.81 | 19.16 | 50.03 | 87.54 | 49.50 | 46.83 | 63.20 | 90.01 | 37.34 | 58.09 | 70.51 | 89.80 | 55.54 | 41.49 | 61.31
Blended | 89.83 | 93.96 | 5.10 | 49.12 | 89.94 | 83.74 | 14.72 | 54.28 | 89.99 | 74.37 | 22.81 | 58.99 | 89.58 | 79.41 | 16.84 | 56.26 | 91.86 | 94.67 | 4.79 | 50.00 | 89.32 | 87.67 | 10.77 | 52.01 | 88.32 | 48.04 | 42.10 | 71.32 | 90.07 | 93.07 | 6.16 | 49.68
BppAttack | 87.07 | 6.46 | 76.53 | 69.56 | 91.76 | 50.44 | 45.27 | 50.00 | 91.82 | 38.39 | 55.90 | 54.66 | 89.81 | 13.89 | 51.86 | 66.91 | 88.30 | 2.32 | 83.04 | 72.24 | 91.28 | 56.44 | 39.70 | 50.00 | 92.02 | 66.31 | 30.89 | 50.00 | 10.00 | 100.00 | 0.00 | 10.40
Input | 86.79 | 2.91 | 76.08 | 81.08 | 91.61 | 68.04 | 28.19 | 50.00 | 91.75 | 65.29 | 30.51 | 51.01 | 89.31 | 0.16 | 56.90 | 83.57 | 87.95 | 4.31 | 75.96 | 80.96 | 91.33 | 64.10 | 31.43 | 51.60 | 88.27 | 40.51 | 49.40 | 63.02 | 10.00 | 100.00 | 0.00 | 10.49
LC | 87.12 | 1.09 | 83.50 | 91.03 | 90.17 | 64.59 | 34.28 | 60.81 | 90.63 | 77.00 | 22.42 | 54.83 | 89.57 | 65.46 | 32.97 | 60.07 | 92.07 | 89.48 | 10.42 | 49.83 | 89.51 | 76.51 | 23.10 | 54.52 | 90.22 | 68.01 | 30.92 | 59.12 | 89.68 | 92.87 | 6.76 | 48.64
LF | 89.87 | 2.97 | 89.30 | 49.35 | 89.68 | 0.97 | 89.54 | 49.54 | 89.69 | 1.20 | 89.48 | 49.43 | 89.63 | 1.83 | 89.17 | 49.23 | 91.21 | 1.58 | 91.09 | 50.00 | 88.74 | 1.44 | 88.71 | 48.84 | 89.82 | 0.91 | 89.81 | 49.64 | 89.80 | 1.70 | 89.37 | 49.32
SIG | 91.21 | 80.98 | 14.09 | 55.46 | 90.37 | 77.34 | 16.33 | 56.85 | 90.59 | 76.18 | 18.07 | 57.55 | 86.45 | 38.56 | 37.30 | 74.29 | 92.09 | 93.33 | 5.92 | 49.99 | 89.09 | 91.83 | 7.08 | 48.97 | 90.34 | 83.78 | 13.34 | 53.62 | 89.10 | 1.36 | 65.83 | 94.21
SSBA | 90.10 | 21.77 | 70.81 | 57.26 | 90.17 | 8.99 | 80.82 | 63.68 | 89.87 | 4.44 | 84.11 | 65.80 | 89.54 | 13.94 | 76.46 | 60.89 | 91.92 | 41.33 | 53.62 | 50.00 | 88.62 | 8.71 | 78.33 | 63.04 | 91.90 | 38.08 | 56.67 | 50.00 | 89.82 | 24.12 | 67.63 | 55.94
TrojanNN | 91.27 | 23.69 | 56.87 | 87.77 | 90.32 | 99.46 | 0.49 | 49.41 | 90.39 | 98.73 | 1.18 | 49.80 | 88.72 | 99.66 | 0.33 | 48.51 | 91.78 | 99.94 | 0.06 | 49.90 | 88.98 | 100.00 | 0.00 | 48.50 | 91.97 | 99.92 | 0.08 | 50.00 | 90.47 | 28.72 | 57.11 | 84.85
WaNet | 87.43 | 31.16 | 61.64 | 48.66 | 91.42 | 2.01 | 89.12 | 60.73 | 91.64 | 2.33 | 88.92 | 60.57 | 89.77 | 2.26 | 87.17 | 60.43 | 75.84 | 55.76 | 39.70 | 42.86 | 91.02 | 3.37 | 87.38 | 60.05 | 90.12 | 23.47 | 69.62 | 50.00 | 10.00 | 100.00 | 0.00 | 9.94
ConvNeXt_tiny | BadNets | 90.11 | 69.73 | 27.59 | 49.13 | 89.57 | 4.43 | 85.50 | 80.38 | 89.48 | 5.96 | 84.26 | 79.57 | 88.51 | 16.17 | 75.06 | 73.98 | 91.72 | 64.54 | 33.04 | 51.40 | 85.83 | 7.47 | 80.10 | 76.99 | 91.85 | 67.49 | 30.40 | 50.00 | 93.03 | 77.81 | 20.90 | 50.00
Blended | 91.75 | 94.51 | 5.07 | 49.95 | 89.05 | 38.53 | 49.88 | 76.59 | 89.50 | 63.53 | 31.90 | 64.31 | 88.95 | 87.21 | 11.42 | 52.20 | 92.24 | 94.37 | 5.26 | 50.25 | 84.52 | 54.49 | 37.93 | 66.34 | 89.60 | 76.17 | 21.62 | 58.04 | 93.20 | 1.10 | 81.34 | 96.88
BppAttack | 85.06 | 18.23 | 69.91 | 52.25 | 88.33 | 5.30 | 82.11 | 59.18 | 89.08 | 13.70 | 77.58 | 54.98 | 88.58 | 2.76 | 84.12 | 60.46 | 86.04 | 23.38 | 67.14 | 50.14 | 88.94 | 14.24 | 76.67 | 54.71 | 88.92 | 10.31 | 79.63 | 56.68 | 80.10 | 3.08 | 76.89 | 57.34
Input | 87.38 | 74.00 | 23.64 | 49.60 | 88.97 | 27.96 | 60.91 | 67.19 | 89.65 | 46.19 | 48.82 | 58.08 | 89.05 | 6.01 | 77.06 | 78.17 | 87.96 | 72.66 | 25.09 | 49.89 | 89.58 | 47.06 | 48.37 | 57.64 | 89.56 | 66.06 | 31.66 | 50.00 | 68.54 | 3.27 | 63.83 | 69.72
LC | 91.57 | 79.80 | 19.71 | 49.66 | 89.10 | 18.71 | 72.11 | 74.69 | 89.18 | 19.03 | 72.62 | 74.56 | 90.12 | 15.27 | 70.18 | 76.92 | 92.13 | 72.72 | 26.54 | 49.94 | 85.65 | 10.41 | 77.28 | 77.11 | 90.08 | 21.80 | 71.71 | 73.63 | 93.12 | 0.54 | 92.52 | 85.34
LF | 91.35 | 0.57 | 91.29 | 49.85 | 89.83 | 0.72 | 89.71 | 49.02 | 89.09 | 1.01 | 88.99 | 48.64 | 89.65 | 0.67 | 89.80 | 48.95 | 91.73 | 0.81 | 91.51 | 49.96 | 85.73 | 2.64 | 84.86 | 46.96 | 89.50 | 0.97 | 89.38 | 48.85 | 92.70 | 0.93 | 92.42 | 50.00
SIG | 91.74 | 83.37 | 15.49 | 49.82 | 88.16 | 21.40 | 54.14 | 76.05 | 89.70 | 25.86 | 57.58 | 74.60 | 90.16 | 72.97 | 23.42 | 51.27 | 91.92 | 73.62 | 23.98 | 51.82 | 87.25 | 25.99 | 52.01 | 73.30 | 69.39 | 0.41 | 33.66 | 77.16 | 93.11 | 0.34 | 73.06 | 88.56
SSBA | 91.60 | 38.26 | 56.13 | 49.99 | 89.01 | 1.34 | 85.94 | 67.15 | 89.46 | 3.83 | 84.52 | 66.13 | 89.58 | 13.71 | 75.71 | 61.25 | 91.63 | 35.88 | 58.33 | 51.20 | 86.09 | 6.87 | 79.31 | 62.93 | 91.84 | 38.48 | 56.12 | 50.00 | 92.91 | 48.21 | 48.38 | 50.00
TrojanNN | 91.58 | 99.94 | 0.06 | 49.64 | 88.86 | 77.54 | 18.60 | 59.47 | 89.49 | 91.84 | 7.33 | 52.64 | 89.79 | 48.07 | 37.14 | 74.68 | 92.06 | 99.96 | 0.04 | 49.88 | 85.43 | 91.11 | 7.66 | 50.98 | 89.83 | 95.79 | 4.06 | 50.84 | 93.40 | 2.10 | 82.81 | 98.92
WaNet | 87.84 | 3.85 | 84.21 | 49.73 | 88.44 | 1.15 | 87.14 | 51.38 | 88.72 | 1.32 | 87.44 | 51.42 | 88.27 | 1.68 | 86.67 | 51.03 | 88.51 | 4.25 | 84.44 | 49.90 | 88.63 | 1.28 | 87.68 | 51.41 | 88.67 | 0.98 | 87.66 | 51.58 | 91.49 | 9.29 | 82.62 | 50.00
ViT_b_16 | BadNets | NaN | NaN | NaN | 38.12 | 95.51 | 36.83 | 60.30 | 67.46 | 96.41 | 59.82 | 39.10 | 56.41 | 26.72 | 13.09 | 22.02 | 44.93 | NaN | NaN | NaN | 38.12 | 23.13 | 12.94 | 20.32 | 43.21 | 96.14 | 0.44 | 95.93 | 85.96 | 96.35 | 55.94 | 42.84 | 58.32
Blended | NaN | NaN | NaN | 49.90 | 94.34 | 78.23 | 16.10 | 57.96 | 96.51 | 95.26 | 4.59 | 50.53 | 26.10 | 22.60 | 18.27 | 51.65 | NaN | NaN | NaN | 49.90 | 25.14 | 16.09 | 19.52 | 54.43 | 96.41 | 96.28 | 3.58 | 49.97 | 96.54 | 81.50 | 17.53 | 57.42
BppAttack | NaN | NaN | NaN | 43.21 | 93.74 | 86.31 | 13.00 | 50.00 | 94.01 | 89.26 | 10.29 | 50.00 | 81.49 | 6.49 | 71.62 | 80.71 | NaN | NaN | NaN | 43.21 | 75.53 | 4.58 | 66.56 | 78.68 | 91.63 | 78.04 | 20.41 | 50.00 | 71.73 | 11.78 | 61.52 | 73.18
Input | 90.55 | 85.28 | 14.30 | 49.83 | 93.80 | 62.81 | 35.17 | 50.00 | 94.56 | 65.96 | 33.56 | 50.00 | 76.63 | 18.00 | 59.37 | 64.48 | 88.61 | 91.44 | 8.22 | 48.86 | 76.87 | 11.34 | 64.76 | 67.93 | 94.48 | 61.74 | 37.54 | 50.00 | 71.97 | 56.52 | 32.98 | 42.89
LC | 96.54 | 61.71 | 37.50 | 53.11 | 94.12 | 75.12 | 15.91 | 48.74 | 96.46 | 65.61 | 33.80 | 51.12 | 26.23 | 13.14 | 23.43 | 42.23 | 95.95 | 61.74 | 31.99 | 52.79 | 24.51 | 9.47 | 22.70 | 43.21 | 96.43 | 66.21 | 33.21 | 50.80 | 96.14 | 70.57 | 29.22 | 49.74
LF | 96.14 | 0.52 | 96.01 | 49.98 | 95.17 | 0.50 | 95.14 | 49.50 | 96.20 | 0.37 | 96.13 | 50.06 | 27.56 | 11.47 | 25.50 | 15.69 | 94.92 | 1.42 | 94.74 | 49.37 | 25.04 | 6.66 | 23.11 | 14.43 | 96.18 | 0.48 | 96.09 | 50.00 | 96.17 | 0.48 | 96.13 | 50.00
SIG | 96.61 | 56.11 | 41.16 | 50.17 | 94.11 | 20.66 | 51.06 | 66.65 | 96.66 | 57.52 | 39.93 | 49.96 | 27.80 | 9.73 | 25.77 | 38.96 | 95.86 | 68.59 | 29.23 | 49.56 | 25.07 | 10.74 | 22.31 | 37.09 | 96.74 | 56.59 | 40.83 | 50.00 | 94.30 | 62.06 | 32.38 | 48.78
SSBA | 96.36 | 62.23 | 36.43 | 50.68 | 94.64 | 0.54 | 90.17 | 80.67 | 96.44 | 44.57 | 53.16 | 59.56 | 27.52 | 9.81 | 26.19 | 42.47 | 95.51 | 59.44 | 39.14 | 51.65 | 26.28 | 10.22 | 24.26 | 41.65 | 96.59 | 50.52 | 47.54 | 56.63 | 96.24 | 60.74 | 37.63 | 51.37
TrojanNN | 96.53 | 99.24 | 0.76 | 49.97 | 94.80 | 95.03 | 4.63 | 51.20 | 96.53 | 98.40 | 1.59 | 50.39 | 27.00 | 14.28 | 21.42 | 57.68 | 95.87 | 99.93 | 0.07 | 49.64 | 25.61 | 20.82 | 19.91 | 53.72 | 96.65 | 98.63 | 1.36 | 50.30 | 96.29 | 98.93 | 1.06 | 50.00
WaNet | 91.91 | 0.98 | 91.40 | 49.89 | 93.87 | 0.48 | 93.31 | 50.13 | 94.07 | 0.58 | 93.55 | 50.08 | 86.54 | 1.64 | 85.21 | 47.20 | 91.34 | 0.73 | 91.08 | 49.61 | 77.63 | 4.54 | 76.27 | 42.75 | 92.13 | 0.75 | 91.51 | 50.00 | 96.33 | 1.28 | 95.07 | 50.00

TABLE IX: Full results on CIFAR-10 with 0.5% poisoning ratio (The first part).

| Defense $\rightarrow$ | No defense | ABL | AC | ANP | CLP | D-BR | D-ST | DBD
---|---|---|---|---|---|---|---|---|---
Targeted Model | Attack $\downarrow$ | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%)
PreAct-ResNet18 | BadNets | 93.76 | 50.06 | 48.14 | 50.0 | 68.40 | 71.78 | 22.14 | 37.32 | 89.51 | 2.29 | 88.72 | 71.76 | 91.32 | 0.76 | 91.31 | 73.43 | 91.25 | 4.26 | 87.96 | 71.65 | 10.79 | 0.91 | 11.36 | 33.09 | 82.04 | 1.94 | 80.97 | 68.20 | 73.60 | 0.10 | 80.01 | 64.90
Blended | 93.68 | 93.30 | 6.37 | 50.0 | 61.89 | 26.51 | 38.22 | 67.50 | 90.14 | 75.23 | 22.02 | 57.26 | 89.90 | 53.54 | 36.19 | 67.99 | 91.37 | 82.20 | 15.61 | 54.40 | 9.88 | 0.00 | 11.27 | 54.75 | 83.77 | 49.60 | 40.37 | 66.90 | 71.18 | 0.01 | 71.24 | 85.39
BppAttack | 91.37 | 80.06 | 18.30 | 50.0 | 75.56 | 68.12 | 20.86 | 48.06 | 89.55 | 36.03 | 54.59 | 71.10 | 83.57 | 0.86 | 80.74 | 85.70 | 88.35 | 11.44 | 75.00 | 82.80 | 83.97 | 80.69 | 13.74 | 46.30 | 84.39 | 56.66 | 36.08 | 58.21 | 80.07 | 8.17 | 70.45 | 80.29
Input | 90.66 | 56.06 | 41.27 | 50.0 | 66.84 | 62.16 | 22.96 | 38.09 | 89.82 | 62.34 | 33.44 | 49.58 | 88.61 | 9.02 | 74.30 | 72.49 | 89.92 | 22.26 | 69.43 | 66.53 | 63.09 | 50.93 | 29.82 | 38.78 | 83.17 | 78.99 | 18.42 | 46.26 | 77.50 | 3.80 | 71.36 | 69.55
LC | 93.71 | 93.59 | 6.39 | 50.0 | 49.30 | 6.52 | 42.20 | 71.33 | 89.56 | 62.50 | 35.29 | 63.47 | 88.79 | 81.38 | 15.27 | 53.65 | 93.62 | 56.78 | 41.81 | 68.36 | 12.08 | 5.24 | 11.81 | 53.36 | 84.06 | 16.82 | 68.64 | 83.56 | 70.94 | 99.86 | 0.13 | 38.61
LF | 93.85 | 75.09 | 23.57 | 50.0 | 82.88 | 77.69 | 18.56 | 44.51 | 89.21 | 63.48 | 32.44 | 53.49 | 85.00 | 4.43 | 76.66 | 80.90 | 92.97 | 81.21 | 17.88 | 49.56 | 11.17 | 0.00 | 11.16 | 46.20 | 80.38 | 11.81 | 73.81 | 74.90 | 88.95 | 3.63 | 86.48 | 83.28
SIG | 93.80 | 82.43 | 14.90 | 50.0 | 70.52 | 85.82 | 6.64 | 38.36 | 89.66 | 65.29 | 25.72 | 56.50 | 90.11 | 14.97 | 50.53 | 81.89 | 90.29 | 69.86 | 21.27 | 54.53 | 10.18 | 0.00 | 11.28 | 49.41 | 82.23 | 80.32 | 9.38 | 45.27 | 77.35 | 72.37 | 25.28 | 46.81
SSBA | 93.41 | 35.67 | 59.99 | 50.0 | 74.04 | 45.26 | 42.54 | 40.31 | 89.90 | 9.72 | 80.02 | 61.22 | 85.04 | 1.66 | 78.94 | 62.82 | 90.04 | 1.56 | 86.00 | 65.37 | 16.48 | 24.62 | 15.12 | 17.06 | 81.09 | 1.31 | 76.26 | 61.02 | 80.12 | 7.00 | 75.22 | 57.69
TrojanNN | 93.72 | 99.88 | 0.12 | 50.0 | 31.58 | 0.00 | 25.77 | 68.87 | 89.84 | 99.03 | 0.87 | 48.48 | 85.13 | 44.58 | 30.11 | 73.35 | 93.45 | 99.01 | 0.99 | 50.30 | 11.05 | 0.00 | 12.03 | 58.60 | 87.61 | 99.12 | 0.88 | 47.32 | 79.75 | 12.25 | 70.42 | 86.83
WaNet | 91.27 | 1.12 | 91.24 | 50.0 | 42.48 | 75.28 | 19.77 | 25.60 | 89.48 | 2.57 | 86.66 | 49.10 | 91.27 | 1.12 | 91.24 | 50.00 | 90.08 | 4.12 | 88.29 | 49.40 | 81.97 | 5.68 | 77.59 | 45.35 | 84.08 | 2.98 | 83.22 | 46.40 | 64.90 | 0.00 | 72.59 | 37.38
VGG19-BN | BadNets | 91.97 | 55.13 | 42.58 | 50.0 | NaN | NaN | NaN | 31.58 | 87.33 | 2.02 | 86.33 | 74.24 | 89.32 | 2.52 | 87.86 | 74.98 | NaN | NaN | NaN | 31.58 | 10.64 | 1.22 | 11.10 | 36.29 | 91.47 | 1.17 | 90.86 | 76.73 | 58.07 | 0.00 | 64.33 | 60.62
Blended | 92.02 | 90.27 | 8.98 | 50.0 | NaN | NaN | NaN | 49.12 | 86.91 | 69.81 | 25.70 | 57.67 | 88.62 | 65.21 | 26.63 | 60.83 | NaN | NaN | NaN | 49.12 | 12.50 | 0.00 | 12.61 | 55.37 | 87.19 | 89.50 | 9.59 | 47.97 | 53.40 | 30.89 | 42.65 | 60.38
BppAttack | 88.06 | 8.29 | 79.60 | 50.0 | 35.13 | 27.06 | 26.86 | 23.53 | 86.38 | 7.52 | 74.96 | 49.54 | 84.10 | 1.62 | 77.58 | 51.35 | 84.61 | 0.37 | 83.57 | 52.24 | 89.87 | 27.93 | 65.72 | 50.00 | 59.92 | 5.77 | 51.26 | 37.19 | 62.87 | 15.98 | 52.74 | 37.40
Input | 88.57 | 80.46 | 16.56 | 50.0 | 63.37 | 14.43 | 48.70 | 70.41 | 86.80 | 49.30 | 41.70 | 64.69 | 88.86 | 5.29 | 76.79 | 87.58 | 85.90 | 7.11 | 74.32 | 85.34 | 11.98 | 1.41 | 11.52 | 51.23 | 84.45 | 9.96 | 71.31 | 83.19 | 62.15 | 13.18 | 52.63 | 70.43
LC | 92.14 | 92.28 | 7.67 | 50.0 | 42.83 | 4.18 | 30.59 | 69.40 | 87.50 | 55.14 | 40.76 | 66.25 | 91.50 | 87.22 | 12.54 | 52.21 | 90.42 | 16.28 | 73.90 | 87.14 | 22.96 | 5.36 | 23.22 | 58.87 | 88.97 | 79.39 | 14.28 | 54.86 | 55.11 | 99.88 | 0.12 | 31.49
LF | 91.68 | 1.19 | 91.46 | 50.0 | 10.06 | 99.88 | 0.07 | 9.19 | 86.35 | 1.93 | 85.91 | 47.34 | 90.00 | 0.18 | 91.49 | 49.67 | 90.26 | 1.56 | 90.08 | 49.29 | 10.98 | 0.00 | 12.20 | 10.24 | 84.28 | 2.37 | 85.19 | 46.30 | 59.78 | 13.60 | 55.69 | 34.05
SIG | 92.26 | 85.64 | 11.69 | 50.0 | 57.89 | 23.68 | 18.50 | 63.80 | 87.30 | 58.97 | 24.26 | 60.86 | 86.20 | 0.84 | 68.40 | 89.37 | 91.54 | 96.02 | 3.30 | 49.64 | 16.27 | 10.33 | 16.62 | 49.66 | 63.97 | 23.46 | 11.29 | 66.95 | 54.31 | 80.48 | 16.16 | 33.61
SSBA | 92.08 | 7.70 | 83.44 | 50.0 | 66.94 | 15.50 | 54.31 | 37.43 | 86.69 | 5.16 | 81.17 | 48.58 | 91.88 | 1.10 | 88.24 | 53.20 | 89.69 | 7.70 | 80.20 | 48.80 | 10.47 | 0.00 | 11.63 | 13.05 | 88.54 | 0.36 | 88.00 | 51.90 | 61.44 | 4.55 | 56.73 | 36.26
TrojanNN | 91.82 | 99.92 | 0.07 | 50.0 | 38.47 | 0.00 | 23.91 | 73.29 | 87.45 | 99.49 | 0.47 | 48.03 | 85.50 | 56.71 | 34.73 | 68.45 | 88.28 | 45.23 | 43.89 | 75.57 | 91.59 | 99.61 | 0.38 | 50.04 | 91.42 | 98.87 | 0.68 | 50.33 | 54.28 | 99.86 | 0.12 | 31.26
WaNet | 88.68 | 3.55 | 82.64 | 50.0 | 71.78 | 9.67 | 64.43 | 41.55 | 86.33 | 3.43 | 82.98 | 48.89 | 84.25 | 0.83 | 84.06 | 49.14 | 87.08 | 2.53 | 78.91 | 49.71 | 9.10 | 0.00 | 10.13 | 11.98 | 65.14 | 1.93 | 63.43 | 39.04 | 56.57 | 12.81 | 51.06 | 33.94
ConvNeXt_tiny | BadNets | 91.97 | 23.04 | 71.14 | 50.0 | 92.69 | 19.91 | 75.18 | 51.57 | 91.53 | 1.24 | 90.73 | 60.68 | 84.02 | 1.08 | 85.30 | 57.01 | 91.97 | 23.06 | 71.13 | 50.00 | 84.42 | 15.62 | 73.02 | 49.94 | 61.83 | 8.77 | 60.17 | 42.07 | 69.48 | 6.48 | 66.95 | 47.04
Blended | 92.25 | 90.01 | 9.26 | 50.0 | 92.95 | 92.18 | 7.24 | 50.00 | 91.30 | 87.84 | 11.30 | 50.61 | 84.65 | 71.27 | 24.13 | 55.57 | 92.25 | 90.01 | 9.26 | 50.00 | 91.40 | 91.52 | 7.78 | 49.58 | 58.98 | 7.46 | 45.20 | 74.64 | 76.35 | 4.83 | 68.62 | 84.64
BppAttack | 87.09 | 3.13 | 82.26 | 50.0 | 92.59 | 26.66 | 64.51 | 50.00 | 90.86 | 16.39 | 70.91 | 50.00 | 86.02 | 1.38 | 82.89 | 50.34 | 87.09 | 3.13 | 82.26 | 50.00 | 89.31 | 11.50 | 79.16 | 50.00 | 53.44 | 8.17 | 49.40 | 33.17 | 77.47 | 3.94 | 73.87 | 45.19
Input | 87.64 | 41.77 | 50.88 | 50.0 | 92.78 | 56.11 | 39.81 | 50.00 | 91.45 | 57.96 | 37.49 | 50.00 | 81.74 | 12.26 | 66.30 | 61.81 | 87.88 | 74.40 | 24.26 | 50.00 | 89.58 | 76.01 | 22.31 | 50.00 | 63.73 | 9.52 | 53.99 | 54.17 | 72.58 | 7.35 | 65.53 | 59.68
LC | 92.31 | 44.43 | 52.47 | 50.0 | 92.97 | 42.22 | 53.32 | 51.11 | 91.03 | 21.24 | 71.64 | 60.95 | 84.70 | 0.54 | 84.67 | 68.14 | 92.31 | 44.42 | 52.48 | 50.01 | 90.20 | 27.92 | 65.52 | 57.20 | 25.34 | 20.71 | 21.93 | 28.38 | 71.07 | 10.02 | 66.29 | 56.59
LF | 92.08 | 0.79 | 91.86 | 50.0 | 92.86 | 0.81 | 92.58 | 50.00 | 91.43 | 1.01 | 91.12 | 49.68 | 88.11 | 0.52 | 88.87 | 48.15 | 92.08 | 0.79 | 91.86 | 50.00 | 91.70 | 0.76 | 91.48 | 49.83 | 58.33 | 14.84 | 54.66 | 33.12 | 70.52 | 5.29 | 68.23 | 39.22
SIG | 92.10 | 66.09 | 30.48 | 50.0 | 92.84 | 51.44 | 40.52 | 57.32 | 91.83 | 47.38 | 43.10 | 59.22 | 83.74 | 46.47 | 41.59 | 55.63 | 92.11 | 66.09 | 30.48 | 50.00 | 90.67 | 59.57 | 35.12 | 52.55 | 60.22 | 31.42 | 22.39 | 51.39 | 74.08 | 76.09 | 20.11 | 40.99
SSBA | 92.18 | 6.47 | 84.86 | 50.0 | 92.53 | 11.44 | 80.86 | 50.00 | 91.57 | 4.11 | 86.78 | 50.87 | 85.12 | 2.02 | 81.47 | 48.69 | 92.18 | 6.47 | 84.86 | 50.00 | 91.79 | 3.68 | 87.01 | 51.20 | 59.65 | 10.07 | 50.83 | 33.74 | 73.62 | 4.39 | 69.30 | 41.75
TrojanNN | 92.39 | 99.93 | 0.06 | 50.0 | 93.01 | 99.91 | 0.09 | 50.01 | 91.55 | 99.43 | 0.54 | 49.83 | 84.23 | 82.71 | 15.37 | 54.53 | 92.39 | 99.93 | 0.06 | 50.00 | 90.78 | 99.19 | 0.79 | 49.57 | 57.85 | 9.23 | 50.06 | 78.08 | 72.40 | 12.16 | 58.70 | 83.89
WaNet | 87.54 | 1.18 | 85.25 | 50.0 | 92.83 | 3.74 | 88.87 | 50.00 | 91.48 | 2.53 | 88.66 | 50.00 | 85.52 | 0.46 | 85.04 | 49.35 | 87.54 | 1.18 | 85.25 | 50.00 | 83.33 | 4.48 | 77.85 | 47.90 | 59.84 | 5.90 | 58.22 | 36.15 | 69.19 | 4.87 | 66.07 | 40.82
ViT_b_16 | BadNets | 96.49 | 47.00 | 51.53 | 50.0 | 97.79 | 39.88 | 59.11 | 53.56 | 96.62 | 0.72 | 96.40 | 73.14 | 95.56 | 38.01 | 60.16 | 54.03 | 96.49 | 47.01 | 51.53 | 50.00 | 91.23 | 17.52 | 78.17 | 62.11 | 10.00 | 0.00 | 11.11 | 30.26 | NaN | NaN | NaN | 25.25
Blended | 96.49 | 92.90 | 6.86 | 50.0 | 97.92 | 96.63 | 3.27 | 50.00 | 96.72 | 91.78 | 7.89 | 50.56 | 96.49 | 92.91 | 6.84 | 50.00 | 96.49 | 92.91 | 6.84 | 50.00 | 95.61 | 92.39 | 7.29 | 49.82 | 10.00 | 0.00 | 11.11 | 53.21 | NaN | NaN | NaN | 48.21
BppAttack | 91.95 | 80.56 | 18.34 | 50.0 | 97.77 | 91.50 | 8.17 | 50.00 | 96.66 | 84.31 | 14.83 | 50.00 | 91.51 | 77.39 | 21.20 | 51.36 | 91.95 | 80.56 | 18.34 | 50.00 | 92.06 | 88.50 | 10.97 | 50.00 | NaN | NaN | NaN | 44.30 | NaN | NaN | NaN | 44.30
Input | 92.01 | 55.97 | 42.13 | 50.0 | 97.82 | 56.93 | 42.52 | 50.00 | 96.59 | 47.57 | 51.64 | 54.20 | 91.12 | 56.41 | 42.34 | 49.56 | 91.12 | 56.42 | 42.33 | 49.56 | 93.41 | 57.62 | 41.81 | 50.00 | NaN | NaN | NaN | 31.98 | NaN | NaN | NaN | 31.98
LC | 96.79 | 64.37 | 35.38 | 50.0 | 97.94 | 83.01 | 16.98 | 50.00 | 96.65 | 40.60 | 58.62 | 61.81 | 96.78 | 63.22 | 36.51 | 50.57 | 96.79 | 64.37 | 35.38 | 50.00 | 90.26 | 61.29 | 37.92 | 48.27 | 10.00 | 0.00 | 11.11 | 38.79 | NaN | NaN | NaN | 33.79
LF | 96.50 | 0.32 | 96.46 | 50.0 | 97.78 | 0.18 | 97.79 | 50.07 | 96.64 | 0.34 | 96.57 | 50.00 | 96.50 | 0.32 | 96.46 | 50.00 | 96.50 | 0.32 | 96.46 | 50.00 | 96.09 | 0.30 | 96.01 | 49.81 | 10.00 | 100.00 | 0.00 | 6.75 | 22.72 | 1.46 | 23.90 | 13.11
SIG | 96.67 | 44.87 | 51.24 | 50.0 | 97.88 | 47.68 | 48.71 | 50.00 | 96.79 | 36.36 | 58.02 | 54.26 | 96.64 | 44.61 | 51.48 | 50.11 | 96.67 | 44.87 | 51.24 | 50.00 | 96.23 | 43.09 | 51.87 | 50.67 | 10.00 | 100.00 | 0.00 | 6.66 | 55.30 | 72.21 | 12.26 | 29.32
SSBA | 96.52 | 17.64 | 79.06 | 50.0 | 98.11 | 12.68 | 85.14 | 52.48 | 96.58 | 6.80 | 89.44 | 55.42 | 96.30 | 8.93 | 87.36 | 54.25 | 96.52 | 17.63 | 79.08 | 50.01 | 24.38 | 0.57 | 27.71 | 22.47 | 10.00 | 0.00 | 11.11 | 15.56 | NaN | NaN | NaN | 10.56
TrojanNN | 96.78 | 97.97 | 2.03 | 50.0 | 97.95 | 99.97 | 0.03 | 50.00 | 96.64 | 97.11 | 2.89 | 50.36 | 96.52 | 96.84 | 3.16 | 50.43 | 96.77 | 97.97 | 2.03 | 50.00 | 20.33 | 41.16 | 11.81 | 40.18 | 10.00 | 0.00 | 11.11 | 55.59 | NaN | NaN | NaN | 50.59
WaNet | 91.80 | 1.67 | 90.35 | 50.0 | 97.78 | 0.31 | 97.33 | 50.68 | 96.71 | 0.69 | 95.99 | 50.49 | 91.80 | 1.67 | 90.35 | 50.00 | 91.80 | 1.67 | 90.35 | 50.00 | 93.54 | 1.67 | 92.21 | 50.00 | 10.00 | 0.00 | 11.11 | 9.93 | 57.92 | 3.94 | 55.88 | 33.06

TABLE X: Full results on CIFAR-10 with 0.5% poisoning ratio (The second part).

| Defense $\rightarrow$ | EP | FP | FT | I-BAU | BNP | NAD | NC | SS
---|---|---|---|---|---|---|---|---|---
Targeted Model | Attack $\downarrow$ | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%)
PreAct-ResNet18 | BadNets | 91.90 | 50.89 | 47.22 | 49.07 | 93.67 | 5.01 | 89.60 | 72.48 | 93.49 | 4.94 | 89.83 | 72.42 | 87.92 | 7.51 | 83.41 | 68.35 | 93.60 | 50.81 | 47.38 | 49.92 | 93.30 | 7.67 | 87.31 | 70.96 | 92.83 | 0.62 | 92.67 | 74.25 | 92.97 | 7.91 | 87.31 | 70.68
Blended | 92.23 | 93.87 | 5.57 | 49.28 | 93.30 | 93.28 | 6.39 | 49.82 | 93.46 | 90.68 | 8.79 | 51.20 | 88.39 | 40.42 | 44.32 | 73.79 | 93.34 | 93.26 | 6.36 | 49.85 | 93.48 | 91.97 | 7.60 | 50.57 | 90.64 | 60.71 | 33.92 | 64.77 | 93.08 | 88.18 | 10.91 | 52.26
BppAttack | 89.47 | 16.18 | 72.42 | 80.99 | 93.31 | 81.39 | 17.32 | 50.00 | 93.33 | 94.84 | 4.87 | 50.00 | 91.31 | 6.82 | 81.42 | 86.59 | 91.03 | 62.78 | 33.81 | 58.47 | 93.14 | 96.09 | 3.71 | 50.00 | 93.51 | 93.70 | 5.89 | 50.00 | 92.17 | 52.79 | 41.80 | 63.63
Input | 88.90 | 6.66 | 78.86 | 73.82 | 91.93 | 73.21 | 25.83 | 50.00 | 93.22 | 75.64 | 23.93 | 50.00 | 88.54 | 14.72 | 69.76 | 69.61 | 88.45 | 3.17 | 78.91 | 75.34 | 93.36 | 79.54 | 20.07 | 50.00 | 90.66 | 56.07 | 41.27 | 50.00 | 92.98 | 60.34 | 37.51 | 50.00
LC | 91.22 | 1.03 | 89.31 | 95.03 | 92.83 | 53.91 | 39.24 | 69.40 | 93.55 | 94.88 | 5.10 | 49.92 | 79.86 | 1.49 | 68.12 | 89.12 | 93.76 | 92.48 | 7.49 | 50.56 | 93.24 | 91.88 | 8.03 | 50.62 | 93.27 | 92.74 | 7.22 | 50.20 | 92.23 | 86.16 | 13.73 | 52.98
LF | 91.08 | 83.81 | 15.13 | 48.62 | 93.31 | 74.16 | 24.02 | 50.20 | 93.62 | 69.64 | 28.33 | 52.61 | 89.78 | 70.54 | 26.47 | 50.24 | 93.45 | 76.58 | 22.20 | 49.80 | 93.37 | 71.56 | 26.64 | 51.53 | 93.85 | 75.09 | 23.57 | 50.00 | 92.68 | 71.50 | 26.83 | 51.21
SIG | 90.11 | 83.53 | 12.88 | 48.16 | 93.69 | 84.59 | 12.18 | 49.94 | 93.51 | 81.77 | 15.53 | 50.19 | 86.45 | 63.41 | 19.02 | 55.84 | 93.61 | 83.14 | 14.36 | 49.90 | 93.65 | 81.64 | 15.43 | 50.32 | 93.80 | 82.43 | 14.90 | 50.00 | 93.26 | 64.04 | 27.10 | 58.92
SSBA | 91.55 | 20.88 | 72.02 | 56.46 | 93.37 | 16.99 | 76.30 | 59.32 | 93.36 | 27.97 | 66.46 | 53.82 | 89.58 | 6.19 | 82.77 | 62.82 | 93.01 | 38.10 | 57.11 | 49.80 | 93.28 | 30.91 | 63.73 | 52.31 | 93.41 | 35.66 | 60.00 | 50.01 | 92.96 | 23.64 | 69.98 | 55.79
TrojanNN | 92.63 | 99.90 | 0.10 | 49.46 | 92.63 | 98.78 | 1.21 | 50.00 | 93.35 | 99.74 | 0.26 | 49.88 | 88.61 | 6.44 | 74.73 | 94.16 | 93.43 | 99.89 | 0.11 | 49.86 | 92.96 | 99.87 | 0.13 | 49.63 | 93.29 | 99.92 | 0.08 | 49.78 | 91.95 | 99.23 | 0.77 | 49.44
WaNet | 90.77 | 1.41 | 90.37 | 49.75 | 92.34 | 1.11 | 91.49 | 50.01 | 93.99 | 0.76 | 92.83 | 50.18 | 92.38 | 0.78 | 91.17 | 50.17 | 90.54 | 1.26 | 90.48 | 49.64 | 93.67 | 0.89 | 92.67 | 50.12 | 91.27 | 1.12 | 91.24 | 50.00 | 92.94 | 3.59 | 89.34 | 50.00
VGG19-BN | BadNets | 89.67 | 47.94 | 48.68 | 52.44 | 90.15 | 7.43 | 84.76 | 72.94 | 90.17 | 12.54 | 80.98 | 70.39 | 89.29 | 4.30 | 85.33 | 74.08 | 91.74 | 57.20 | 40.60 | 49.89 | 87.55 | 37.48 | 57.04 | 56.62 | 91.97 | 55.13 | 42.58 | 50.00 | 86.66 | 1.50 | 86.31 | 74.16
Blended | 90.09 | 92.46 | 6.66 | 49.04 | 90.36 | 77.81 | 19.87 | 55.40 | 90.49 | 67.62 | 28.29 | 60.56 | 88.34 | 37.56 | 44.43 | 74.52 | 92.01 | 90.38 | 8.83 | 50.00 | 88.45 | 68.51 | 26.50 | 59.09 | 92.02 | 90.27 | 8.98 | 50.00 | 87.69 | 82.52 | 14.62 | 51.71
BppAttack | 87.92 | 5.24 | 81.24 | 51.45 | 91.69 | 4.66 | 85.37 | 51.82 | 91.80 | 11.12 | 80.29 | 50.00 | 89.91 | 1.34 | 86.26 | 53.47 | 84.23 | 0.88 | 78.97 | 51.79 | 91.25 | 10.37 | 80.51 | 50.00 | 91.65 | 6.98 | 83.66 | 50.66 | 89.84 | 15.04 | 72.09 | 50.00
Input | 87.19 | 30.53 | 56.57 | 74.27 | 91.38 | 67.09 | 28.09 | 56.68 | 91.08 | 80.17 | 17.56 | 50.14 | 89.56 | 0.99 | 45.43 | 89.73 | 88.79 | 3.72 | 74.70 | 88.37 | 91.14 | 88.04 | 10.43 | 50.00 | 91.53 | 83.49 | 15.03 | 50.00 | 90.34 | 60.78 | 34.44 | 59.84
LC | 90.51 | 3.37 | 86.22 | 93.64 | 90.24 | 50.04 | 41.63 | 70.17 | 90.11 | 79.20 | 19.98 | 55.52 | 86.67 | 73.76 | 24.23 | 56.53 | 92.02 | 95.52 | 4.46 | 49.94 | 88.28 | 95.86 | 4.07 | 48.07 | 90.12 | 85.00 | 14.53 | 52.63 | 88.21 | 53.54 | 39.97 | 67.40
LF | 90.38 | 1.66 | 90.09 | 49.35 | 90.21 | 1.18 | 89.92 | 49.27 | 89.80 | 1.36 | 89.61 | 49.06 | 88.68 | 2.62 | 87.96 | 48.50 | 91.63 | 1.16 | 91.43 | 49.99 | 88.33 | 1.17 | 88.61 | 48.34 | 91.68 | 1.19 | 91.46 | 50.00 | 88.45 | 0.60 | 88.84 | 48.68
SIG | 90.69 | 63.76 | 26.86 | 60.16 | 90.75 | 76.56 | 17.43 | 53.79 | 90.48 | 71.12 | 22.06 | 56.37 | 89.79 | 67.86 | 19.33 | 57.66 | 92.15 | 87.06 | 10.37 | 49.94 | 88.31 | 77.56 | 16.90 | 52.07 | 90.45 | 86.99 | 10.13 | 49.10 | 89.27 | 7.84 | 59.93 | 87.40
SSBA | 91.34 | 4.01 | 85.88 | 51.47 | 89.98 | 1.82 | 86.19 | 51.89 | 90.07 | 3.17 | 84.32 | 51.26 | 86.02 | 3.38 | 81.00 | 49.13 | 92.11 | 9.20 | 82.27 | 50.00 | 88.74 | 5.93 | 80.67 | 49.21 | 90.36 | 2.06 | 86.06 | 51.96 | 68.36 | 4.37 | 64.43 | 39.81
TrojanNN | 90.12 | 98.98 | 1.01 | 49.62 | 89.95 | 98.69 | 1.23 | 49.68 | 90.26 | 98.68 | 1.26 | 49.84 | 89.96 | 1.60 | 65.57 | 98.23 | 91.75 | 99.94 | 0.06 | 49.96 | 88.70 | 99.12 | 0.86 | 48.84 | 91.82 | 99.92 | 0.07 | 50.00 | 86.99 | 2.22 | 73.56 | 96.44
WaNet | 86.64 | 4.24 | 77.44 | 48.98 | 91.31 | 1.39 | 89.16 | 51.08 | 91.34 | 1.39 | 89.77 | 51.08 | 88.92 | 1.26 | 87.25 | 51.15 | 87.95 | 5.06 | 80.30 | 49.63 | 90.78 | 1.19 | 88.80 | 51.18 | 88.68 | 3.55 | 82.64 | 50.00 | 55.36 | 7.04 | 52.50 | 33.34
ConvNeXt_tiny | BadNets | 91.63 | 14.11 | 78.89 | 54.30 | 89.03 | 1.29 | 88.02 | 59.41 | 89.61 | 2.81 | 87.52 | 58.94 | 90.12 | 6.64 | 84.59 | 57.28 | 91.73 | 19.64 | 74.09 | 51.58 | 86.08 | 3.64 | 83.93 | 56.76 | 56.12 | 3.68 | 56.58 | 41.76 | 92.43 | 9.76 | 83.76 | 56.64
Blended | 91.98 | 90.53 | 8.81 | 49.86 | 88.93 | 38.92 | 51.21 | 73.88 | 89.98 | 58.53 | 35.79 | 64.60 | 88.89 | 8.07 | 65.62 | 89.29 | 92.12 | 85.17 | 13.68 | 52.36 | 86.81 | 39.38 | 49.67 | 72.60 | 92.25 | 90.01 | 9.26 | 50.00 | 92.77 | 16.96 | 68.98 | 86.53
BppAttack | 87.23 | 1.88 | 83.61 | 50.63 | 87.66 | 2.08 | 83.64 | 50.53 | 89.10 | 3.12 | 84.87 | 50.01 | 88.96 | 1.48 | 85.48 | 50.83 | 86.91 | 3.16 | 82.02 | 49.91 | 88.71 | 4.29 | 83.71 | 50.00 | 88.91 | 4.29 | 84.29 | 50.00 | 92.73 | 21.57 | 69.34 | 50.00
Input | 87.35 | 76.14 | 22.47 | 49.86 | 88.82 | 41.40 | 45.62 | 50.18 | 89.28 | 50.73 | 44.27 | 50.00 | 88.36 | 8.90 | 65.33 | 66.43 | 87.75 | 74.23 | 24.36 | 50.00 | 89.21 | 47.51 | 46.32 | 50.00 | 89.19 | 0.68 | 53.62 | 70.54 | 93.20 | 2.19 | 85.84 | 69.79
LC | 91.77 | 51.68 | 45.89 | 49.73 | 88.69 | 8.16 | 80.99 | 66.33 | 89.66 | 12.52 | 78.53 | 64.63 | 90.37 | 8.62 | 81.27 | 66.94 | 92.14 | 45.48 | 51.58 | 49.92 | 86.98 | 10.58 | 78.60 | 64.26 | 78.58 | 2.54 | 76.48 | 64.08 | 93.07 | 3.19 | 89.93 | 70.62
LF | 91.03 | 1.31 | 90.62 | 49.48 | 88.67 | 1.06 | 88.49 | 48.30 | 89.65 | 0.90 | 89.50 | 48.78 | 89.93 | 0.80 | 90.01 | 48.92 | 91.79 | 0.96 | 91.52 | 49.86 | 86.26 | 1.53 | 85.58 | 47.09 | 92.08 | 0.79 | 91.86 | 50.00 | 92.26 | 0.77 | 92.12 | 50.01
SIG | 91.73 | 68.41 | 28.14 | 49.82 | 89.06 | 15.20 | 60.59 | 73.92 | 89.81 | 28.93 | 56.47 | 67.43 | 88.65 | 51.38 | 37.40 | 55.63 | 92.10 | 62.56 | 33.24 | 51.77 | 87.21 | 8.38 | 62.30 | 76.41 | 89.95 | 40.00 | 48.90 | 61.97 | 92.26 | 51.52 | 40.90 | 57.28
SSBA | 91.77 | 6.71 | 84.13 | 49.80 | 89.07 | 1.34 | 86.42 | 51.01 | 89.61 | 1.47 | 86.61 | 51.22 | 90.32 | 1.44 | 86.92 | 51.58 | 92.16 | 5.56 | 85.46 | 50.45 | 85.80 | 2.13 | 83.97 | 48.98 | 76.08 | 2.26 | 73.78 | 44.06 | 92.68 | 11.48 | 81.24 | 50.00
TrojanNN | 91.86 | 99.96 | 0.04 | 49.73 | 89.26 | 71.68 | 25.68 | 62.56 | 89.62 | 93.60 | 5.96 | 51.78 | 88.71 | 96.56 | 3.38 | 49.85 | 92.28 | 99.96 | 0.03 | 49.94 | 85.64 | 91.13 | 8.16 | 51.02 | 89.56 | 91.87 | 7.89 | 52.62 | 92.39 | 1.92 | 82.02 | 99.01
WaNet | 85.38 | 0.71 | 84.14 | 49.15 | 88.35 | 1.10 | 87.09 | 50.04 | 89.04 | 1.12 | 87.78 | 50.03 | 88.00 | 1.29 | 86.28 | 50.00 | 87.14 | 0.86 | 85.23 | 49.96 | 88.81 | 1.31 | 87.47 | 50.00 | 87.54 | 1.18 | 85.25 | 50.00 | 92.45 | 3.08 | 88.88 | 50.00
ViT_b_16 | BadNets | NaN | NaN | NaN | 25.25 | 95.46 | 14.48 | 82.06 | 65.75 | 96.62 | 31.29 | 67.04 | 57.86 | 26.59 | 13.60 | 21.29 | 31.75 | NaN | NaN | NaN | 25.25 | 24.37 | 10.01 | 21.92 | 32.43 | 96.53 | 27.02 | 71.17 | 59.99 | 96.18 | 67.61 | 31.41 | 49.84
Blended | NaN | NaN | NaN | 48.21 | 94.85 | 82.19 | 16.17 | 54.54 | 96.58 | 92.86 | 6.89 | 50.02 | 26.15 | 20.30 | 20.10 | 51.13 | NaN | NaN | NaN | 48.21 | 28.24 | 11.00 | 23.99 | 56.82 | 96.36 | 93.30 | 6.48 | 49.94 | 96.09 | 90.47 | 9.24 | 51.02
BppAttack | NaN | NaN | NaN | 44.30 | 93.10 | 72.68 | 20.93 | 53.94 | 94.19 | 85.88 | 13.53 | 50.00 | 82.06 | 3.49 | 73.70 | 83.59 | NaN | NaN | NaN | 44.30 | 79.25 | 8.00 | 64.88 | 79.93 | 94.25 | 83.77 | 15.51 | 50.00 | 96.71 | 90.91 | 8.46 | 50.00
Input | 90.20 | 56.98 | 41.41 | 49.10 | 93.50 | 28.68 | 53.23 | 63.64 | 94.78 | 57.44 | 42.04 | 50.00 | 83.02 | 5.92 | 70.00 | 70.53 | 88.50 | 68.82 | 30.08 | 48.24 | 75.07 | 10.99 | 58.17 | 64.02 | 94.50 | 53.57 | 45.79 | 51.20 | 96.34 | 50.53 | 48.71 | 52.72
LC | 96.58 | 61.47 | 38.26 | 51.34 | 94.89 | 79.32 | 14.46 | 49.05 | 96.62 | 66.62 | 33.16 | 49.92 | 27.99 | 9.94 | 26.14 | 42.81 | 96.03 | 77.37 | 21.32 | 49.62 | 26.27 | 9.64 | 23.54 | 42.10 | 96.68 | 66.41 | 33.37 | 49.94 | 94.65 | 30.12 | 66.72 | 66.05
LF | 96.17 | 0.41 | 96.10 | 49.84 | 95.19 | 0.40 | 95.24 | 49.34 | 96.36 | 0.38 | 96.28 | 49.93 | 27.82 | 11.48 | 25.20 | 15.66 | 95.13 | 1.36 | 94.90 | 49.32 | 25.95 | 8.10 | 24.04 | 14.72 | 96.37 | 0.33 | 96.34 | 49.94 | 93.52 | 0.87 | 93.67 | 48.51
SIG | 96.48 | 49.73 | 46.63 | 49.90 | 94.70 | 39.56 | 48.73 | 51.67 | 96.54 | 46.13 | 50.16 | 49.94 | 27.35 | 11.06 | 25.39 | 32.25 | 96.09 | 52.51 | 44.12 | 49.71 | 25.40 | 10.89 | 22.60 | 31.35 | 96.67 | 44.87 | 51.24 | 50.00 | 96.12 | 47.64 | 48.26 | 49.72
SSBA | 96.32 | 18.97 | 77.76 | 49.90 | 93.04 | 1.34 | 88.26 | 56.41 | 96.35 | 8.62 | 87.52 | 54.43 | 26.63 | 12.31 | 24.44 | 17.72 | 95.55 | 18.19 | 78.83 | 49.52 | 23.08 | 7.99 | 21.18 | 18.11 | 96.52 | 17.64 | 79.06 | 50.00 | 78.39 | 5.71 | 72.50 | 46.90
TrojanNN | 96.46 | 97.64 | 2.36 | 50.00 | 93.81 | 82.04 | 10.90 | 56.48 | 96.54 | 96.11 | 3.89 | 50.81 | 26.16 | 15.04 | 19.72 | 56.15 | 96.01 | 99.52 | 0.48 | 49.61 | 25.62 | 18.10 | 21.69 | 54.35 | 96.51 | 96.51 | 3.49 | 50.59 | 84.62 | 92.74 | 6.61 | 46.53
WaNet | 91.51 | 1.83 | 89.83 | 49.86 | 93.60 | 0.53 | 93.28 | 50.57 | 93.87 | 0.67 | 93.33 | 50.50 | 84.22 | 1.21 | 83.53 | 46.44 | 90.26 | 1.90 | 88.79 | 49.23 | 79.36 | 4.90 | 78.10 | 43.78 | 91.80 | 1.67 | 90.35 | 50.00 | 74.20 | 2.75 | 73.36 | 41.20

TABLE XI: Full results on CIFAR-10 with 0.1% poisoning ratio (The first part).

| Defense $\rightarrow$ | No defense | ABL | AC | ANP | CLP | D-BR | D-ST | DBD
---|---|---|---|---|---|---|---|---|---
Targeted Model | Attack $\downarrow$ | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%)
PreAct-ResNet18 | BadNets | 93.61 | 1.23 | 93.24 | 50.0 | 81.44 | 1.99 | 79.69 | 43.92 | 89.97 | 1.37 | 89.57 | 48.18 | 89.60 | 0.71 | 89.37 | 48.26 | 90.51 | 1.18 | 90.07 | 48.48 | 11.63 | 0.00 | 13.02 | 9.63 | 84.59 | 1.52 | 84.31 | 45.49 | 71.59 | 4.90 | 68.82 | 38.99
Blended | 93.80 | 56.11 | 39.37 | 50.0 | 67.96 | 12.06 | 40.82 | 59.11 | 89.59 | 41.41 | 48.77 | 55.25 | 85.35 | 24.18 | 49.57 | 61.74 | 91.31 | 32.60 | 54.12 | 60.51 | 11.67 | 0.00 | 13.03 | 36.99 | 83.12 | 5.32 | 62.76 | 70.05 | 78.51 | 0.00 | 81.22 | 70.41
BppAttack | 91.47 | 21.62 | 69.37 | 50.0 | 58.35 | 1.50 | 55.80 | 43.50 | 89.29 | 2.92 | 85.04 | 58.26 | 88.23 | 6.29 | 79.11 | 56.05 | 90.25 | 1.89 | 82.11 | 59.26 | 82.34 | 19.63 | 63.80 | 46.43 | 88.69 | 6.93 | 80.20 | 55.95 | 79.21 | 7.61 | 70.98 | 50.88
Input | 91.94 | 47.32 | 45.53 | 50.0 | 76.14 | 31.19 | 44.80 | 50.17 | 89.93 | 30.92 | 58.30 | 57.20 | 86.47 | 14.83 | 63.89 | 63.51 | 90.39 | 22.02 | 59.74 | 61.87 | 53.22 | 65.12 | 19.56 | 30.64 | 82.61 | 10.68 | 56.09 | 63.66 | 82.22 | 13.18 | 69.51 | 62.21
LC | 93.62 | 71.26 | 28.07 | 50.0 | 78.83 | 15.76 | 60.36 | 70.36 | 89.99 | 5.24 | 85.72 | 81.19 | 87.85 | 33.99 | 43.13 | 65.75 | 93.20 | 28.01 | 67.64 | 71.41 | 11.93 | 0.00 | 13.27 | 44.78 | 85.02 | 7.87 | 77.46 | 77.39 | 72.18 | 84.65 | 12.72 | 39.28
LF | 93.55 | 12.72 | 81.16 | 50.0 | 54.82 | 8.07 | 53.46 | 32.96 | 89.94 | 13.26 | 76.52 | 48.20 | 88.52 | 5.63 | 79.58 | 51.03 | 93.34 | 12.68 | 80.97 | 49.92 | 10.93 | 0.00 | 11.49 | 15.05 | 82.44 | 1.81 | 81.29 | 49.90 | 74.19 | 9.50 | 70.13 | 41.93
SIG | 93.73 | 41.27 | 42.34 | 50.0 | 62.37 | 13.52 | 22.79 | 48.19 | 89.62 | 40.09 | 35.27 | 48.53 | 84.72 | 2.71 | 41.97 | 64.77 | 92.51 | 41.81 | 39.61 | 49.39 | 14.91 | 0.00 | 15.53 | 31.22 | 83.92 | 74.92 | 11.36 | 45.09 | 74.78 | 0.07 | 21.54 | 61.12
SSBA | 93.89 | 1.62 | 90.64 | 50.0 | 81.00 | 6.22 | 76.59 | 43.56 | 89.97 | 2.33 | 86.16 | 48.04 | 90.21 | 0.99 | 86.69 | 48.48 | 91.42 | 1.24 | 89.02 | 48.95 | 10.22 | 0.52 | 10.79 | 8.71 | 82.56 | 0.99 | 79.00 | 44.65 | 73.42 | 4.42 | 67.39 | 39.76
TrojanNN | 94.07 | 98.14 | 1.83 | 50.0 | 31.86 | 20.62 | 23.88 | 57.66 | 89.76 | 84.13 | 14.56 | 54.85 | 89.45 | 88.20 | 8.83 | 52.66 | 93.47 | 96.63 | 3.27 | 50.46 | 28.09 | 25.26 | 22.54 | 53.45 | 88.12 | 60.37 | 34.66 | 65.91 | 76.15 | 5.83 | 71.19 | 87.20
WaNet | 92.18 | 0.78 | 91.42 | 50.0 | 67.90 | 5.04 | 61.27 | 37.86 | 90.07 | 1.69 | 88.13 | 48.94 | 87.53 | 0.56 | 88.91 | 47.79 | 89.84 | 1.10 | 87.18 | 48.83 | 79.20 | 4.16 | 75.59 | 43.51 | 80.73 | 1.92 | 80.29 | 44.28 | 87.83 | 2.63 | 86.66 | 47.82
VGG19-BN | BadNets | 92.15 | 0.96 | 91.84 | 50.0 | 23.50 | 18.66 | 18.61 | 15.68 | 86.76 | 1.49 | 86.24 | 47.30 | 92.01 | 0.54 | 92.10 | 50.14 | NaN | NaN | NaN | 4.40 | 12.54 | 0.00 | 13.97 | 10.67 | 84.69 | 0.80 | 84.28 | 46.35 | 55.80 | 13.31 | 51.05 | 31.83
Blended | 92.34 | 48.53 | 45.57 | 50.0 | 25.87 | 0.02 | 26.44 | 41.02 | 86.92 | 16.40 | 65.18 | 63.36 | 88.71 | 31.33 | 54.93 | 56.78 | NaN | NaN | NaN | 28.10 | 91.06 | 52.93 | 41.10 | 49.36 | 91.75 | 23.62 | 61.59 | 62.16 | 54.46 | 13.43 | 45.76 | 48.61
BppAttack | 90.69 | 2.28 | 84.60 | 50.0 | 58.16 | 15.69 | 52.49 | 33.74 | 87.27 | 1.76 | 83.98 | 48.55 | 89.28 | 1.74 | 82.11 | 49.56 | 89.43 | 1.79 | 85.22 | 49.61 | 9.88 | 0.00 | 10.94 | 10.73 | 72.87 | 0.18 | 69.96 | 42.14 | 54.11 | 13.40 | 46.04 | 31.71
Input | 89.27 | 48.37 | 38.10 | 50.0 | 10.00 | 0.00 | 11.11 | 34.55 | 86.61 | 26.78 | 54.48 | 59.46 | 86.79 | 43.41 | 41.36 | 51.24 | 87.85 | 37.40 | 47.38 | 54.77 | 90.59 | 76.56 | 18.32 | 50.00 | 67.10 | 8.34 | 52.78 | 58.93 | 55.47 | 27.49 | 39.77 | 43.54
LC | 92.40 | 33.61 | 61.69 | 50.0 | 57.69 | 18.11 | 44.40 | 40.39 | 86.96 | 4.81 | 81.92 | 61.68 | 90.17 | 22.42 | 70.60 | 54.48 | 89.00 | 5.49 | 82.47 | 62.36 | 10.81 | 0.00 | 12.03 | 26.01 | 60.81 | 3.63 | 58.07 | 49.19 | 55.99 | 62.68 | 24.09 | 31.80
LF | 92.28 | 0.80 | 92.23 | 50.0 | 55.27 | 6.16 | 52.94 | 31.50 | 87.07 | 1.46 | 86.84 | 47.40 | 92.16 | 0.36 | 92.42 | 50.16 | 91.37 | 1.08 | 91.09 | 49.54 | 10.03 | 0.00 | 11.14 | 9.28 | 91.20 | 0.63 | 91.38 | 49.54 | 52.73 | 8.98 | 49.12 | 30.22
SIG | 92.20 | 32.43 | 48.06 | 50.0 | 70.42 | 17.36 | 36.11 | 46.65 | 86.81 | 11.54 | 51.06 | 57.75 | 87.09 | 9.83 | 53.64 | 58.74 | 90.95 | 50.44 | 30.82 | 49.37 | 9.59 | 99.18 | 0.10 | 8.69 | 59.27 | 0.00 | 24.28 | 49.75 | 56.14 | 53.34 | 30.66 | 31.97
SSBA | 92.13 | 1.47 | 88.92 | 50.0 | 28.22 | 26.59 | 22.70 | 18.05 | 86.83 | 2.12 | 83.37 | 47.35 | 91.60 | 1.08 | 88.90 | 49.93 | 91.64 | 1.51 | 88.80 | 49.76 | 84.85 | 2.83 | 84.92 | 46.36 | 91.73 | 1.62 | 89.08 | 49.80 | 52.21 | 14.04 | 47.27 | 30.04
TrojanNN | 92.30 | 98.92 | 1.06 | 50.0 | 10.00 | 0.00 | 11.11 | 58.31 | 86.98 | 89.78 | 9.32 | 51.91 | 86.62 | 37.12 | 41.20 | 78.06 | 91.65 | 86.81 | 11.90 | 55.73 | 10.00 | 0.00 | 11.11 | 58.31 | 80.91 | 94.23 | 3.90 | 46.65 | 53.99 | 14.17 | 39.41 | 73.22
WaNet | 90.16 | 2.57 | 87.10 | 50.0 | 64.85 | 5.91 | 60.06 | 37.34 | 87.14 | 1.88 | 84.61 | 48.83 | 88.17 | 1.26 | 87.01 | 49.66 | 86.65 | 2.75 | 80.21 | 48.24 | 91.72 | 1.26 | 89.61 | 50.66 | 62.08 | 4.95 | 61.10 | 35.96 | 54.83 | 8.85 | 50.67 | 32.33
ConvNeXt_tiny | BadNets | 92.30 | 0.80 | 91.97 | 50.0 | 92.83 | 0.69 | 92.60 | 50.06 | 91.52 | 1.00 | 91.20 | 49.61 | 92.30 | 0.80 | 91.97 | 50.00 | 92.30 | 0.80 | 91.97 | 50.00 | 89.61 | 1.06 | 88.79 | 48.66 | 60.05 | 6.53 | 58.44 | 33.88 | 69.27 | 4.57 | 67.12 | 38.49
Blended | 92.17 | 63.99 | 33.12 | 50.0 | 92.78 | 57.18 | 38.81 | 53.41 | 91.46 | 31.76 | 58.68 | 65.76 | 84.27 | 28.92 | 54.44 | 63.58 | 92.17 | 64.00 | 33.11 | 50.00 | 91.63 | 59.51 | 36.11 | 51.97 | 64.11 | 1.72 | 47.16 | 67.10 | 68.50 | 5.79 | 61.24 | 67.26
BppAttack | 87.66 | 2.56 | 83.93 | 50.0 | 92.85 | 1.57 | 89.54 | 50.49 | 91.76 | 1.59 | 88.66 | 50.48 | 87.66 | 2.56 | 83.93 | 50.00 | 87.66 | 2.56 | 83.93 | 50.00 | 88.60 | 2.06 | 84.11 | 50.25 | 17.47 | 5.13 | 18.31 | 14.90 | 73.99 | 5.06 | 70.28 | 43.17
Input | 87.57 | 15.47 | 68.44 | 50.0 | 93.00 | 29.41 | 61.50 | 50.00 | 91.91 | 21.80 | 66.28 | 50.00 | 82.30 | 5.32 | 69.08 | 52.44 | 87.54 | 35.73 | 53.50 | 49.98 | 89.71 | 42.09 | 49.39 | 50.00 | 61.84 | 6.89 | 53.80 | 41.42 | 71.22 | 7.32 | 64.87 | 45.90
LC | 92.10 | 4.36 | 88.18 | 50.0 | 93.06 | 2.41 | 90.39 | 50.97 | 91.49 | 1.74 | 89.89 | 51.00 | 88.67 | 1.02 | 87.74 | 49.95 | 92.11 | 4.36 | 88.18 | 50.00 | 91.58 | 4.29 | 87.63 | 49.77 | 55.99 | 11.01 | 50.63 | 31.94 | 74.81 | 4.00 | 71.92 | 41.54
LF | 92.30 | 0.76 | 92.09 | 50.0 | 92.95 | 0.69 | 92.66 | 50.03 | 91.28 | 1.04 | 90.99 | 49.49 | 90.70 | 0.58 | 90.80 | 49.29 | 92.31 | 0.76 | 92.10 | 50.00 | 90.44 | 0.67 | 90.22 | 49.11 | 63.58 | 3.38 | 62.34 | 35.64 | 71.23 | 6.08 | 68.79 | 39.47
SIG | 92.51 | 23.38 | 62.66 | 50.0 | 92.84 | 22.61 | 59.93 | 50.38 | 91.37 | 12.51 | 66.70 | 54.86 | 85.92 | 10.39 | 64.11 | 53.20 | 92.50 | 23.39 | 62.66 | 50.00 | 91.69 | 23.93 | 59.89 | 49.59 | 58.77 | 0.39 | 30.93 | 44.62 | 76.08 | 30.49 | 46.83 | 41.78
SSBA | 92.40 | 1.06 | 90.01 | 50.0 | 92.84 | 1.33 | 90.37 | 50.00 | 91.67 | 1.02 | 89.32 | 49.65 | 90.24 | 0.80 | 87.53 | 49.05 | 92.40 | 1.06 | 90.00 | 50.00 | 91.81 | 0.91 | 89.41 | 49.78 | 25.44 | 1.69 | 26.19 | 16.52 | 70.79 | 5.53 | 65.58 | 39.19
TrojanNN | 92.29 | 95.32 | 4.48 | 50.0 | 92.83 | 97.81 | 2.17 | 50.00 | 91.45 | 91.38 | 8.16 | 51.55 | 85.27 | 64.62 | 28.99 | 61.84 | 92.29 | 95.32 | 4.48 | 50.00 | 91.28 | 93.54 | 6.03 | 50.38 | 63.78 | 10.24 | 47.99 | 78.28 | 67.99 | 4.87 | 60.82 | 83.08
WaNet | 88.04 | 0.95 | 86.17 | 50.0 | 92.91 | 1.02 | 91.14 | 50.00 | 91.69 | 1.12 | 89.70 | 50.00 | 88.10 | 0.87 | 86.39 | 50.04 | 88.06 | 0.95 | 86.17 | 50.00 | 88.99 | 1.58 | 87.12 | 50.00 | 23.46 | 9.11 | 23.36 | 17.71 | 71.25 | 4.61 | 68.95 | 41.61
ViT_b_16 | BadNets | 96.72 | 0.33 | 96.58 | 50.0 | 98.00 | 0.27 | 97.90 | 50.03 | 96.71 | 0.38 | 96.57 | 50.00 | 96.72 | 0.33 | 96.56 | 50.00 | 96.72 | 0.33 | 96.56 | 50.00 | 96.15 | 0.43 | 96.11 | 49.72 | 10.00 | 0.00 | 11.11 | 6.81 | NaN | NaN | NaN | 1.81
Blended | 96.69 | 77.09 | 21.94 | 50.0 | 98.13 | 77.61 | 21.57 | 50.00 | 96.60 | 54.53 | 43.40 | 61.23 | 90.96 | 64.89 | 31.97 | 53.24 | 96.69 | 77.09 | 21.94 | 50.00 | 96.28 | 82.41 | 16.80 | 49.80 | 10.00 | 0.00 | 11.11 | 45.20 | NaN | NaN | NaN | 40.20
BppAttack | 91.46 | 35.26 | 58.06 | 50.0 | 97.72 | 43.27 | 54.90 | 50.00 | 96.69 | 17.21 | 78.54 | 59.02 | 90.84 | 35.19 | 57.83 | 49.72 | 91.46 | 35.26 | 58.06 | 50.00 | 93.71 | 20.36 | 73.51 | 57.45 | NaN | NaN | NaN | 21.90 | NaN | NaN | NaN | 21.90
Input | 91.65 | 29.23 | 63.72 | 50.0 | 98.01 | 65.08 | 34.56 | 50.00 | 96.60 | 52.22 | 47.13 | 50.00 | 90.83 | 54.27 | 40.77 | 49.59 | 90.82 | 54.28 | 40.77 | 49.58 | 80.58 | 57.27 | 37.23 | 44.46 | NaN | NaN | NaN | 18.79 | NaN | NaN | NaN | 18.79
LC | 96.56 | 13.47 | 83.97 | 50.0 | 98.03 | 35.43 | 61.97 | 50.00 | 96.62 | 1.10 | 95.79 | 56.18 | 96.55 | 13.10 | 84.33 | 50.18 | 96.56 | 13.47 | 83.97 | 50.00 | 12.21 | 3.29 | 11.13 | 12.91 | 10.00 | 0.00 | 11.11 | 13.45 | NaN | NaN | NaN | 8.45
LF | 96.48 | 0.34 | 96.40 | 50.0 | 97.94 | 0.14 | 97.91 | 50.10 | 96.91 | 0.22 | 96.86 | 50.06 | 96.38 | 0.31 | 96.33 | 49.97 | 96.48 | 0.34 | 96.40 | 50.00 | 88.36 | 2.66 | 87.54 | 45.94 | 10.00 | 0.00 | 11.11 | 6.93 | 22.52 | 8.23 | 20.79 | 13.02
SIG | 96.61 | 8.67 | 80.47 | 50.0 | 98.08 | 10.64 | 79.43 | 50.00 | 96.63 | 6.99 | 80.58 | 50.84 | 96.61 | 8.67 | 80.47 | 50.00 | 96.61 | 8.67 | 80.47 | 50.00 | 95.81 | 8.42 | 77.46 | 49.72 | 10.00 | 0.00 | 11.11 | 11.03 | 27.85 | 4.02 | 25.05 | 17.94
SSBA | 96.68 | 1.48 | 94.18 | 50.0 | 98.00 | 0.43 | 96.89 | 50.52 | 96.54 | 0.66 | 94.38 | 50.34 | 96.63 | 1.31 | 94.21 | 50.06 | 96.68 | 1.48 | 94.18 | 50.00 | 96.28 | 1.39 | 93.97 | 49.84 | 10.00 | 0.00 | 11.11 | 7.40 | NaN | NaN | NaN | 2.40
TrojanNN | 96.76 | 89.13 | 10.82 | 50.0 | 98.07 | 96.20 | 3.78 | 50.00 | 96.65 | 90.48 | 9.41 | 49.94 | 96.75 | 87.31 | 12.66 | 50.91 | 96.76 | 89.13 | 10.82 | 50.00 | 19.04 | 27.98 | 13.44 | 41.72 | 10.00 | 0.00 | 11.11 | 51.19 | NaN | NaN | NaN | 46.19
WaNet | 91.90 | 0.69 | 91.42 | 50.0 | 98.01 | 0.19 | 97.54 | 50.25 | 96.60 | 0.43 | 96.19 | 50.13 | 91.71 | 0.56 | 91.74 | 49.97 | 91.90 | 0.69 | 91.41 | 50.00 | 93.03 | 0.63 | 92.41 | 50.03 | 10.00 | 0.00 | 11.13 | 9.39 | 23.25 | 4.63 | 22.55 | 15.67

TABLE XII: Full results on CIFAR-10 with 0.1% poisoning ratio (The second
part).

| Defense $\rightarrow$ | EP | FP | FT | I-BAU | BNP | NAD | NC | SS
---|---|---|---|---|---|---|---|---|---
Targeted Model | Attack $\downarrow$ | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%) | C-Acc(%) | ASR(%) | R-Acc(%) | DER(%)
PreAct-ResNet18 | BadNets | 90.17 | 2.79 | 88.78 | 48.28 | 93.54 | 0.91 | 93.24 | 50.13 | 93.59 | 1.20 | 93.20 | 50.01 | 90.11 | 2.23 | 89.36 | 48.25 | 93.46 | 1.18 | 93.00 | 49.95 | 93.45 | 1.26 | 93.03 | 49.92 | 90.29 | 1.27 | 90.08 | 48.34 | 93.03 | 1.01 | 92.53 | 49.82
Blended | 91.88 | 63.11 | 30.82 | 49.04 | 93.70 | 54.67 | 40.38 | 50.67 | 93.78 | 52.60 | 42.09 | 51.75 | 88.89 | 3.09 | 71.10 | 74.06 | 93.65 | 57.41 | 37.92 | 49.92 | 93.71 | 55.23 | 39.76 | 50.39 | 91.07 | 26.83 | 57.16 | 63.27 | 93.14 | 51.16 | 42.93 | 52.15