Paper deep dive
BackdoorBench: A Comprehensive Benchmark of Backdoor Learning
Baoyuan Wu, Hongrui Chen, Mingda Zhang, Zihao Zhu, Shaokui Wei, Danni Yuan, Chao Shen
Models: DenseNet-161, EfficientNet-B3, MobileNetV3-Large, PreAct-ResNet18, VGG-19
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 99%
Last extracted: 3/12/2026, 7:40:46 PM
Summary
BackdoorBench is a comprehensive, modular, and extensible benchmark for backdoor learning in deep neural networks. It provides a standardized protocol, a codebase containing 8 state-of-the-art (SOTA) backdoor attacks and 9 SOTA defense algorithms, and 8,000 evaluation pairs across 5 models and 4 datasets to facilitate reproducible research and analysis of backdoor vulnerabilities.
Entities (5)
Relation Signals (3)
BackdoorBench â evaluateson â CIFAR-10
confidence 100% · We evaluate our benchmark on 4 commonly used datasets (CIFAR-10 [25]...)
BackdoorBench â includesalgorithm â BadNets
confidence 100% · It consists of an extensible modular-based codebase (currently including implementations of 8 state-of-the-art (SOTA) attacks...)
BackdoorBench â includesalgorithm â Fine-Pruning
confidence 100% · and 9 SOTA defense algorithms
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Backdoor learning is an emerging and vital topic for studying deep neural networks' vulnerability (DNNs). Many pioneering backdoor attack and defense methods are being proposed, successively or concurrently, in the status of a rapid arms race. However, we find that the evaluations of new methods are often unthorough to verify their claims and accurate performance, mainly due to the rapid development, diverse settings, and the difficulties of implementation and reproducibility. Without thorough evaluations and comparisons, it is not easy to track the current progress and design the future development roadmap of the literature. To alleviate this dilemma, we build a comprehensive benchmark of backdoor learning called BackdoorBench. It consists of an extensible modular-based codebase (currently including implementations of 8 state-of-the-art (SOTA) attacks and 9 SOTA defense algorithms) and a standardized protocol of complete backdoor learning. We also provide comprehensive evaluations of every pair of 8 attacks against 9 defenses, with 5 poisoning ratios, based on 5 models and 4 datasets, thus 8,000 pairs of evaluations in total. We present abundant analysis from different perspectives about these 8,000 evaluations, studying the effects of different factors in backdoor learning. All codes and evaluations of BackdoorBench are publicly available at \url{this https URL}.
Tags
Links
Trouble viewing inline? Open PDF directly â
Full Text
162,892 characters extracted from source content.
Expand or collapse full text
BackdoorBench: A Comprehensive Benchmark of Backdoor Learning Baoyuan Wu 1â Hongrui Chen 1 Mingda Zhang 1 Zihao Zhu 1 Shaokui Wei 1 Danni Yuan 1 Chao Shen 2 1 School of Data Science, Shenzhen Research Institute of Big Data, The Chinese University of Hong Kong, Shenzhen 2 School of Cyber Science and Engineering, Xiâan Jiaotong University Abstract Backdoor learning is an emerging and vital topic for studying deep neural networksâ vulnerability (DNNs). Many pioneering backdoor attack and defense methods are being proposed, successively or concurrently, in the status of a rapid arms race. However, we find that the evaluations of new methods are often unthorough to verify their claims and accurate performance, mainly due to the rapid develop- ment, diverse settings, and the difficulties of implementation and reproducibility. Without thorough evaluations and comparisons, it is not easy to track the current progress and design the future development roadmap of the literature. To alleviate this dilemma, we build a comprehensive benchmark of backdoor learning called BackdoorBench. It consists of an extensible modular-based codebase (currently in- cluding implementations of 8 state-of-the-art (SOTA) attacks and 9 SOTA defense algorithms) and a standardized protocol of complete backdoor learning. We also provide comprehensive evaluations of every pair of 8 attacks against 9 defenses, with 5 poisoning ratios, based on 5 models and 4 datasets, thus 8,000 pairs of evaluations in total. We present abundant analysis from different perspectives about these 8,000 evaluations, studying the effects of different factors in backdoor learning. All codes and evaluations of BackdoorBench are publicly available at https://backdoorbench.github.io. 1 Introduction With the widespread application of deep neural networks (DNNs) in many mission-critical scenarios, the security issues of DNNs have attracted more attentions. One of the typical security issue is backdoor learning, which could insert an imperceptible backdoor into the model through maliciously manipulating the training data or controlling the training process. It brings in severe threat to the widely adopted paradigm that people often download a unverified dataset/checkpoint to train/fine-tune their models, or even outsource the training process to the third-party training platform. Although backdoor learning is a young topic in the machine learning community, its development speed is remarkable and has shown the state of a rapid arms race. When a new backdoor attack or defense method is developed based on an assumption or observation, it will be quickly defeated or evaded by more advanced adaptive defense or attack methods which break previous assumptions or observations. However, we find that the evaluations of new methods are often insufficient, with comparisons with limited previous methods, based on limited models and datasets. The possible reasons include the rapid development of new methods, diverse settings (e.g., different threat models), as well as the difficulties of implementing or reproducing previous methods. Without thorough â Corresponds to Baoyuan Wu (wubaoyuan@cuhk.edu.cn). Accepted at NeurIPS 2022 Datasets and and Benchmarks Track. arXiv:2206.12654v2 [cs.LG] 19 Oct 2022 evaluations and fair comparisons, it is difficult to verify the real performance of a new method, as well as the correctness or generalization of the assumption or observation it is built upon. Consequently, we cannot well measure the actual progress of backdoor learning by simply tracking new methods. This dilemma may not only postpone the development of more advanced methods, but also preclude the exploration of the intrinsic reason/property of backdoor learning. To alleviate this dilemma, we build a comprehensive benchmark of backdoor learning, calledBack- doorBench. It is built on an extensible modular based codebase, consisting of the attack module, the defense module, as well as the evaluation and analysis module. Until now, we have implemented 8 stat-of-the-art (SOTA) backdoor attack methods and 9 SOTA defense methods, and provided 5 analysis tools (e.g., t-SNE, Shapley value, Grad-CAM, frequency saliency map and neuron acti- vation). More methods and tools are continuously updated. Based on the codebase, to ensure fair and reproducible evaluations, we also provide a standardized protocol of the complete procedure of backdoor learning, covering every step of the data preparation, backdoor attack, backdoor defense, as well as the saving, evaluation and analysis of immediate/final outputs. Moreover, we conduct comprehensive evaluations of every pair of attack and defense method (i.e., 8 attacks against 9 defenses), with 5 poisoning ratios, based on 5 DNN models and 4 databases, thus up to 8,000 pairs of evaluations in total. These evaluations allow us to analyze some characteristics of backdoor learning. In this work, we present the analysis from four perspectives, to study the effects of attack/defense methods, poisoning ratios, datasets and model architectures, respectively. We hope that Backdoor- Bench could provide useful tools to facilitate not only the design of new attack/defense methods, but also the exploration of intrinsic properties and reasons of backdoor learning, such that to promote the development of backdoor learning. Our main contributions are three-fold.1) Codebase: We build an extensible modular based codebase, including the implementations of 8 backdoor attack methods and 9 backdoor defense methods.2) 8,000 comprehensive evaluations: We provide evaluations of all pairs of 8 attacks against 9 defense methods, with 5 poisoning ratios, based on 4 datasets and 5 models, up to 8,000 pairs of evaluations in total.3) Thorough analysis and new findings: We present thorough analysis of above evaluations from different perspectives to study the effects of different factors in backdoor learning, with the help of 5 analysis tools, and show some interesting findings to inspire future research directions. 2 Related work Backdoor attacksAccording to the threat model, existing backdoor attack methods can be partitioned into two general categories, includingdata poisoningandtraining controllable.1) Data poisoning attackmeans that the attacker can only manipulate the training data. Existing methods of this category focuses on designing different kinds of triggers to improve the imperceptibility and attack effect, including visible (e.g., BadNets [17]) vs invisible (i.e., Blended [5], Refool [34], Invisible backdoor [28]) triggers, local (e.g., label consistent attack [50,67]) vs global (e.g., SIG [2]) triggers, additive (e.g., Blended [5]) vs non-additive triggers (e.g., smooth low frequency (LF) trigger [66], FaceHack [48]), sample agnostic (e.g., BadNets [17]) vs sample specific (e.g., SSBA [31], sleeper agent [53]) triggers,etc. The definitions of these triggers can be found in the bottom notes of Table 1. 2) Training controllable attackmeans that the attacker can control both the training process and training data simultaneously. Consequently, the attacker can learn the trigger and the model weights jointly, such as LIRA [11], blind backdoor [1], WB [10], Input-aware [38], WaNet [39],etc. Backdoor defensesAccording to the defense stage in the training procedure, existing defense methods can be partitioned into three categories, includingpre-training,in-trainingandpost- training.1) Pre-training defensemeans that the defender aims to remove or break the poisoned samples before training. For example, input anomaly detection and input pre-processing were proposed in [36] to block the backdoor activation by poisoned samples. Februus [9] firstly identified the location of trigger using Grad-CAM [49], and then used a GAN-based inpainting method [23] to reconstruct that region to break the trigger. NEO [60] proposed to use the dominant color in the image to generate a patch to cover the identified trigger. Confoc [61] proposed to change the style of the input image [14] to break the trigger.2) In-training defensemeans that the defender aims to inhibit the backdoor injection during the training. For example, anti-backdoor learning (ABL) [30] utilized the fact that poisoned samples are fitted faster than clean samples, such that they can be distinguished by the loss values in early learning epochs, then the identified poisoned samples are unlearned to mitigate the backdoor effect. DBD [22] observed that poisoned samples will gather together in the 2 feature space of the backdoored model. To prevent such gathering, DBD utilized the self-supervised learning [4] to learn the model backbone, then identified the poisoned samples according to the loss values when learning the classifier.3) Post-training defensemeans that the defender aims to remove or mitigate the backdoor effect from a backdoored model, and most existing defense methods belong to this category. They are often motivated by a property or observation of the backdoored model using some existing backdoor attacks. For example, the fine-pruning (FP) defense [33] and the neural attention distillation (NAD) [29] observed that poisoned and clean samples have different activation paths in the backdoored model. Thus, they aimed to mitigate the backdoor effect by pruning the neurons highly related to the backdoor. The channel Lipschitzness based pruning (CLP) method [68] found that the backdoor related channels often have a higher Lipschitz constant compared to other channels, such that the channels with high Lipschitz constant could be pruned to remove the backdoor. The activation clustering (AC) method [3] observed that samples of the target class will form two clusters in the feature space of a backdoored model, and the smaller cluster corresponds to poisoned samples. The spectral signatures (Spectral) method [58] observed that the feature representation distributions of poisoned and clean samples in the same class class are spectrally separable. The neural cleanse (NC) method [62] assumed that the trigger provides a âshortcut" between the samples from different source classes and the target class. The adversarial neuron pruning (ANP) defense [63] found that the neurons related to the injected backdoor are more sensitive to adversarial neuron perturbation (i.e., perturbing the neuron weight to achieve adversarial attack) than other neurons in a backdoored model. We refer the readers to some backdoor surveys [13,35] for more backdoor attack and defense methods. Related benchmarksSeveral libraries or benchmarks have been proposed for evaluating the adver- sarial robustness of DNNs, such as CleverHans [42], Foolbox [46,47], AdvBox [16], RobustBench [6], RobustART [56], ARES [12], Adversarial Robustness Toolbox (ART) [40],etc. However, these benchmarks mainly focused on adversarial examples [15,26], which occur in the testing stage. In contrast, there are only a few libraries or benchmarks for backdoor learning (e.g., TrojAI [24] and TrojanZoo [41]). Specifically, the most similar benchmark is TrojanZoo, which implemented 8 back- door attack methods and 14 backdoor defense methods. However, there are significant differences between TrojanZoo and our BackdoorBench in two main aspects.1) Codebase: although both bench- marks adopt the modular design to ensure easy extensibility, TrojanZoo adopts the object-oriented programming (OOP) style, where each module is defined as one class. In contrast, BackdoorBench adopts the procedural oriented programming (POP) style, where each module is defined as one func- tion, and each specific algorithm is implemented by several functions in a streamline.2) Analysis and findings. TrojanZoo has provided very abundant and diverse analysis of backdoor learning, mainly including the attack effects of trigger size, trigger transparency, data complexity, backdoor transferability to downstream tasks, and the defense effects of the tradeoff between robustness and utility, the tradeoff between detection accuracy and recovery capability, the impact of trigger defini- tion. In contrast, BackdoorBench provides several new analysis from different perspectives, mainly including the effects of poisoning ratios and number of classes, the quick learning of backdoor, trigger generalization, memorization and forgetting of poisoned samples, as well as several analysis tools. In summary, we believe that BackdoorBench could provide new contributions to the backdoor learning community, and the competition among different benchmarks is beneficial to the development of this topic. 3 Our benchmark 3.1 Implemented algorithms We have implemented 8 backdoor attack and 9 backdoor defense algorithms as the first batch of algorithms in our benchmark. We hold two criteria for choosing methods.First, it should be classic (e.g., BadNets) or advanced method (i.e., published in recent top-tier conferences/journals in machine learning or security community). The classic method serves as the baseline, while the advanced method represents the state-of-the-art, and their difference could measure the progress of this field. Second, the method should be easily implemented and reproducible. We find that some existing methods involve several steps, and some steps depend on a third-party algorithm or a heuristic strategy. Consequently, these methods involve too many hyper-parameters and are full of uncertainty, causing the difficulty on implementation and reproduction. Such methods are not included in BackdoorBench. 3 Table 1: Categorizations of 8 backdoor attack algorithms in BackdoorBench, according tothreat modelsanddifferent kinds of trigger characteristics. AttackThreat modelTrigger characteristics algorithmD-PT-CVIn-VLocalGlobalAddN-AddAgSp BadNets [17]X Blended [5]X LC [50]X SIG [2]X LF [66]X SSBA [31]X Input-aware[38]X WaNet [39]X a)Threat model: D-Pâdata poisoning,i.e., the attacker can only manipulate the training data; T-Câtraining controllable,i.e., the attacker can control the training process and data; b)Trigger characteristics: b.1) Trigger visibility: Vâvisible; In-Vâinvisible; b.2) Trigger coverage: Localâthe trigger is a local patch; Globalâthe trigger covers the whole sample; b.3) Trigger fusion mode: Addâadditive,i.e., the fusion between the clean sample and the trigger is additive; N-Addânon-additive,i.e., the fusion between the clean sample and the trigger is non-additive; b.4) Trigger fusion mode: Agâagnostic,i.e., the triggers in all poisoned samples are same; Spâspecific,i.e., different poisoned samples have different triggers. Table 2: Categorizations of 9 backdoor defense algorithms in BackdoorBench, according to four perspectives, includinginput,output,defense stageanddefense strategy. DefenseInputOutputDefense stageDefense Motivation/Assumption/Observation algorithmB-MS-CDP-DS-MC-DIn-TPost-Tstrategy FTXXXX5Fine-tuning on clean data could mitigate the back- door effect FP [33]X2 + 5Poisoned and clean samples have different activa- tion paths NAD [29]X5Fine-tuning on clean data could mitigate the back- door effect NC [62]X1 + 4 + 5 Trigger can be reversed through searching a short- cut to the target class ANP [63]X2 + 5The backdoor related neurons are sensitive to ad- versarial neuron perturbation AC [3]X3 + 5Samples labeled the target class will form 2 clus- ters in the feature space of a backdoored model Spectral[58]X3 + 5The feature representations of poisoned and clean samples have different spectral signatures ABL [30]X3 + 5Poisoned samples are learned more quickly than clean samples during the training DBD [22]X3 + 6Poisoned samples will gather together in the fea- ture space due to the standard supervised learning a)Input: B-Mâa backdoored model; S-CDâa subset of clean samples; P-Dâa poisoned dataset; b)Output: S-Mâsecure model; C-Dâclean data,i.e., the subset of clean samples in the input poisoned data; c)Defense stage: In-Tâin-training,i.e., defense happens during the training process; Post-Tâpost-training,i.e., defense happens after the backdoor has been inserted through training; d)Defense strategy:1âbackdoor detection,i.e., determining a model to be backdoored or clean; 2âbackdoor identification,i.e., identifying the neurons in a backdoored model related to the backdoor; 3âpoison detection,i.e., detecting poisoned samples; 4âtrigger identification,i.e., identifying the trigger location in a poisoned sample; 5âbackdoor mitigation,i.e., mitigating the backdoor effect of a backdoored model; 6âbackdoor inhibition,i.e., inhibiting the backdoor insertion into the model during the training. As shown in Table 1, the eight implemented backdoor attack methods cover two mainstream threat models, and with diverse triggers. Among them, BadNets[17], Blended[5] and LC[50] (label consistent attack) are three classic attack methods, while the remaining 5 are recently published methods. The general idea of each method will be presented in theAppendix. The basic characteristics of 9 implemented backdoor defense methods are summarized in Table 2, covering different inputs and outputs, different happening stages, different defense strategies. The motivation/assumption/observation behind each defense method is also briefly described in the last column. More detailed descriptions will be presented in theAppendix. 4 ... CleanData Model Architecture Training Controllable Attack Data Poisoning Attack Poisoned Data Detection Backdoor Inhibition Backdoor Detection Backdoor Mitigation Backdoor Identification Trigger Identification Grad-CAM Shapley Valuet-SNE Attack Module Defense Module Evaluation & Analysis Module Evaluation Analysis Input Module Warning! Detect Backdoor model. Warning! Detect Poisoning data. Neuron Activation Attack results Defense results Frequency Saliency Map Figure 1: The general structure of the modular based codebase of BackdoorBench. 3.2 Codebase We have built an extensible modular-based codebase as the basis of BackdoorBench. As shown in Fig. 1, it consists of four modules, includinginput module(providing clean data and model architectures), attack module,defense moduleandevaluation and analysis module. Attack moduleIn the attack module, we provide two sub-modules to implement attacks of two threat models,i.e.,data poisoningandtraining controllable(see Table 1), respectively. For the first sub-module, it provides some functions of manipulating the provided set of clean samples, including trigger generation, poisoned sample generation (i.e., inserting the trigger into the clean sample), and label changing. It outputs a poisoned dataset with both poisoned and clean samples. For the second sub-module, given a set of clean samples and a model architecture, it provides two functions of learning the trigger and model parameters, and outputs a backdoored model and the learned trigger. Defense moduleAccording to the outputs produced by the attack module, there are also two sub- modules to implement backdoor defenses. If given a poisoned dataset, the first sub-module provides three functions ofpoisoned sample detection(i.e., determining whether a sample is poisoned or clean), trigger identification(i.e., identifying the location in the poisoned sample),backdoor inhibition(i.e., training a secure model through inhibiting the backdoor injection). If given a backdoored model, as well as a small subset of clean samples (which is widely required in many defense methods), the second sub-module provides three functions ofbackdoor detection(i.e., determining whether a model has a backdoor or not),badckdoor identification(i.e., identifying the neurons in the backdoored model that are related to the backdoor effect),backdoor mitigation(i.e., mitigating the backdoor effect from the backdoored model). Evaluation and analysis module 1)We providethree evaluation metrics, includingclean accuracy (C-Acc)(i.e., the prediction accuracy of clean samples),attack success rate (ASR)(i.e., the prediction accuracy of poisoned samples to the target class),robust accuracy (R-Acc)(i.e., the prediction accuracy of poisoned samples to the original class). Note that the new metric R-Acc satisfies that ASR + R-Accâ€1, and lower ASR and higher R-Acc indicate better defense performance.2) Moreover, we providefive analysis toolsto facilitate the analysis and understanding of backdoor learning.t-SNEprovides a global visualization of feature representations of a set of samples in a model, and it can help us to observe whether the backdoor is formed or not.Gradient-weighted class 5 activation mapping (Grad-CAM)[49] andShapley value map[37] are two individual analysis tools to visualize the contributions of different pixels of one image in a model, and they can show that whether the trigger activates the backdoor or not. We also propose thefrequency saliency mapto visualize the contribution of each individual frequency spectrum to the prediction, providing a novel perspective of backdoor from the frequency space. The definition will be presented inAppendix. Neuron activationcalculates the average activation of each neuron in a layer for a batch of samples. It can be used to analyze the activation path of poisoned and clean samples, as well as the activation changesw.r.t.the model weightsâ changes due to attack or defense, providing deeper insight behind the backdoor. ProtocolWe present a standardized protocol to call above functional modules to conduct fair and reproducible backdoor learning evaluations, covering every stage from data pre-processing, backdoor attack, backdoor defense, result evaluation and analysis,etc. We also provide three flexible calling modes, includingpure attack mode(only calling an attack method),pure defense mode(only calling a defense method), as well asa joint attack and defense mode(calling an attack against a defense). 4 Evaluations and analysis 4.1 Experimental setup Datasets and models We evaluate our benchmark on 4 commonly used datasets (CIFAR-10 [25], CIFAR-100 [25], GTSRB [19], Tiny ImageNet [27]) and 5 backbone models (PreAct-ResNet18 2 [18], VGG-19 3 [51] (without the batchnorm layer), EfficientNet-B3 4 [55], MobileNetV3-Large 5 [20], DenseNet-161 6 [21]). To fairly measure the performance effects of the attack and defense method for each model, we only used the basic version of training for each model without adding any other training tricks (e.g., augmentation). The details of datasets and clean accuracy 7 of normal training are summarized in Table 3. Table 3: Dataset details and clean accuracy of normal training. DatasetsClasses Training/ Testing Size Image Size Clean Accuracy PreAct-ResNet18 [18]VGG-19 [51]EfficientNet-B3 [55]MobileNetV3-Large [20]DenseNet-161[21] CIFAR-10 [25]1050,000/10,00032Ă3293.90%91.38%64.69%84.44%86.82% CIFAR-100 [25]10050,000/10,00064Ă6470.51%60.21%48.92%50.73%57.57% GTSRB [19]4339,209/12,63032Ă3298.46%95.84%87.39%93.99%92.49% Tiny ImageNet [27]200100,000/10,00064Ă6457.28%46.13%41.08%38.78%51.73% Attacks and defensesWe evaluate each pair of 8 attacks against 9 defenses in each setting, as well as one attack without defense. Thus, there are8Ă(9 + 1) = 80pairs of evaluations. We consider 5 poisoning ratios,i.e.,0.1%,0.5%,1%,5%,10%for each pair, based on all 4 datasets and 5 models, leading to8,000pairs of evaluations in total. The performance of every model is measured by the metrics,i.e., C-Acc, ASR and R-Acc (see Section 3.2). The implementation details of all algorithms, and the results of the DBD defense [22] will be presented in theAppendix. 4.2 Results overview We first show the performance distribution of various attack-defense pairs under one model structure (i.e., PreAct-ResNet18) and one poisoning ratio (i.e.,5%) in Figure 2. In the top row, the perfor- mance is measured by clean accuracy (C-Acc) and attack success rate (ASR). From the attackerâs perspective, the perfect performance should be high C-Acc and high ASR simultaneously,i.e., located at the top-right corner. From the defenderâs perspective, the performance should be high C-Acc and low ASR simultaneously,i.e., located at the top-left corner. It is observed that most color patterns locate at similar horizontal levels, reflecting that most defense methods could mitigate the backdoor 2 https://github.com/VinAIResearch/Warping-based_Backdoor_Attack-release/blob/main/classifier_models/preact_resnet.py 3 https://pytorch.org/vision/0.12/_modules/torchvision/models/vgg.html#vgg19 4 https://pytorch.org/vision/main/_modules/torchvision/models/efficientnet.html#efficientnet_b3 5 https://github.com/pytorch/vision/blob/main/torchvision/models/mobilenetv3.py 6 https://pytorch.org/vision/main/_modules/torchvision/models/densenet.html#densenet161 7 Note that to fairly measure the effects of the attack and defense method, we train all victim models from scratch without further training tricks, which explains the low clean accuracy of some models. 6 20406080100 ASR (%) 0 20 40 60 80 100 C-Acc (%) (1) CIFAR10-5% PreAct-ResNet18 20406080100 ASR (%) 0 20 40 60 80 100 (2) CIFAR100-5% PreAct-ResNet18 20406080100 ASR (%) 0 20 40 60 80 100 (3) GTSRB-5% PreAct-ResNet18 20406080100 ASR (%) 0 20 40 60 80 100 (4) Tiny-5% PreAct-ResNet18 20406080100 ASR (%) 0 20 40 60 80 100 R-Acc (%) (5) CIFAR10-5% PreAct-ResNet18 20406080100 ASR (%) 0 20 40 60 80 100 (6) CIFAR100-5% PreAct-ResNet18 20406080100 ASR (%) 0 20 40 60 80 100 (7) GTSRB-5% PreAct-ResNet18 20406080100 ASR (%) 0 20 40 60 80 100 (8) Tiny-5% PreAct-ResNet18 BadNetsBlendedLCSIGLFSSBAInput-awareWaNet No defenseFTFPNADNCANPACSpectralABL Figure 2: Performance distribution of different attack-defense pairs. Each color pattern represents one attack-defense pair, with attacks distinguished by patterns, while defenses by colors. effect while not harming the clean accuracy significantly. In the bottom row, the performance is measured by robust accuracy (R-Acc) and ASR. As demonstrated in Section 3.2, ASR + R-Accâ€1. From the defenderâs perspective, it is desired that the reduced ASR value equals to the increased R-Acc,i.e., the prediction of the poisoned sample is recovered to the correct class after the defense. It is interesting to see that most color patterns are close to the anti-diagonal line (i.e., ASR + R-Acc = 1) on CIFAR-10 (the first column) and GTSRB (the third column), while most patterns are from that line on CIFAR-100 (the second column) and Tiny ImageNet (the last column). We believe it is highly related to the number of classes of the dataset. Given a large number of classes, it is more difficult to recover the correct prediction after the defense. These figures could provide a big picture of the performance of most attacks against defense methods. Due to the space limit, the results of other settings will be presented in theAppendix. 4.3 Effect of poisoning ratio Here we study the effect of the poisoning ratio on the backdoor performance. Figure 3 visualizes the results on CIFAR-10 and PreAct-ResNet18,w.r.t.each poisoning ratio for all attack-defense pairs, and each sub-figure corresponds to each defense. In sub-figures (1,6,7), ASR curves increase in most cases, being consistent with our initial impression that higher poisoning ratios lead to stronger attack performance. However, in other sub-figures, there are surprisingly sharp drops in ASR curves. To understand suchabnormalphenomenon, we conduct deep analysis for these defenses, as follows. Analysis of FT/FP/NAD/NCThe curves for FT, FP [33], NAD [29] (its plots will be presented inAppendix) and NC[62] are similar since they all use fine-tuning on a small subset of clean data (i.e.,5%training data), thus we present a deep analysis for FT as an example. As shown Figure 4, we compare the performance of5%and10%. We first analyze the changes in the average neuron activation (see Section 3.2) before and after the defense. As shown in the top row, the changes betweenPoisoned+No Defense(green) andPoisoned+FT(purple) in the case of5%are much smaller than those in the case of10%. It tells that the backdoor is significantly affected by FT. We believe the reason is that when the poisoning ratio is not very high (e.g.,5%), the model fits clean samples very well, while the fitting gets worse if the poisoning ratio keeps increasing after a threshold ratio. We find that the clean accuracy on the5%clean data used for fine-tuning by the backdoored model before the defense is99%in the case of5%poisoning ratio, while92%in the case of10% poisoning ratio. It explains why their changes in neuron activation values are different. Analysis of ABL The ABL [30] method uses the loss gap between the poisoned and clean samples in the early training period to isolate some poisoned samples. We find that the loss gap in the case of 7 10%5%1%0.5%0.1% Poison Ratio 0 20 40 60 80 100 ASR (%) (1) PreAct-ResNet18: No defense 10%5%1%0.5%0.1% Poison Ratio 0 20 40 60 80 100 (2) PreAct-ResNet18: FT 10%5%1%0.5%0.1% Poison Ratio 0 20 40 60 80 100 (3) PreAct-ResNet18: FP 10%5%1%0.5%0.1% Poison Ratio 0 20 40 60 80 100 (4) PreAct-ResNet18: NC 10%5%1%0.5%0.1% Poison Ratio 0 20 40 60 80 100 ASR (%) (5) PreAct-ResNet18: ANP 10%5%1%0.5%0.1% Poison Ratio 0 20 40 60 80 100 (6) PreAct-ResNet18: AC 10%5%1%0.5%0.1% Poison Ratio 0 20 40 60 80 100 (7) PreAct-ResNet18: Spectral 10%5%1%0.5%0.1% Poison Ratio 0 20 40 60 80 100 (8) PreAct-ResNet18: ABL BadNetsBlendedLCSIGLFSSBAInput-awareWaNet Figure 3: The effects of different poisoning ratios on backdoor learning. high poisoning ratio is larger than that in the case of low poisoning ratio. Take the LC [50] attack on CIFAR-10 as example. In the case of 5%poisoning ratio, the isolated 500 samples by ABL are 0 poisoned and 500 clean samples, such that the backdoor effect cannot be mitigated in later backdoor unlearning in ABL. In contrast, the isolated 500 samples are all poisoned in the case of 10% poisoning ratio. The t-SNE visualizations shown in the second row of Figure 4 also verify this point. Analysis of ANPThe ANP [63] prunes the neurons that are sensitive to the adversarial neuron perturbation, by setting a threshold. As suggested in [63], this threshold is fixed as 0.2 in our evaluations. We find that when the poisoning ratio is high, more neurons will be pruned, thus the ASR may decrease. For example, given the SIG [2] attack, the pruned neurons by ANP are 328 and 466 for5%and10%poisoning ratios, respectively. As shown in the last row of Figure 4, poisoned samples still gather together for5%, while separated for10%. In summary , the above analysis demonstrates an interesting point that attack with higher poisoning ratios doesnât mean better attack performance, and it may be more easily defended by some defense methods. The reason is that higher poisoning ratios will highlight the difference between poisoned and clean samples, which will be utilized by adaptive defenses. This point inspires two interesting questions that deserve further exploration in the future:how to achieve the desired attack performance using fewer poisoned samples, and how to defend weak attacks with low poisoning ratios. Moreover, considering the randomness due to weight initialization and some methodsâ mechanisms, we repeat the above evaluations several times. Although some fluctuations occur, the trend of ASR curves is similar to that in Figure 3. More details and analysis are presented inAppendix. 4.4 Effect of model architectures As shown in Figure 5, we analyze the influence caused by model architectures. From the top-left sub-figure, it is worth noting that, under the same training scheme, not all backdoor attacks can successfully plant a backdoor in EfficientNet-B3, such as BadNets, LC, SSBA, and WaNet. In contrast, PreAct-ResNet18 is easy to be planted a backdoor. Besides, we find that most defense methods fail to remove the backdoors embedded in the PreAct-ResNet18 and VGG-19, except ANP. However, ANP is less effective on EfficientNet-B3 attacked by SIG. From the second sub-figure in the first row, we notice that FT is an optimal defense method for MobileNetV3-Large, which could effectively decrease the ASR. In most cases, NC and ANP can remove the backdoors embedded in DenseNet-161. The above analysis demonstrates that one attack or defense method may have totally 8 0100200300400500 Neuron Index 0.5 0.0 0.5 Average Activation Value Neuron Activation: CIFAR10, 5% Poisoned Samples, LC Clean+No DefensePoisoned+No DefenseClean+FTPoisoned+FT 0100200300400500 Neuron Index 0.5 0.0 0.5 Neuron Activation: CIFAR10, 10% Poisoned Samples, LC CIFAR10, 5% Poisoned Samples, LC+No DefenseCIFAR10, 5% Poisoned Samples, LC+ABLCIFAR10, 10% Poisoned Samples, LC+No DefenseCIFAR10, 10% Poisoned Samples, LC+ABL CIFAR10, 5% Poisoned Samples, SIG+No Defense AirplaneAutomobileBirdCatDeerDogFrogHorseShipTruckPoisoned CIFAR10, 5% Poisoned Samples, SIG+ANPCIFAR10, 10% Poisoned Samples, SIG+No DefenseCIFAR10, 10% Poisoned Samples, SIG+ANP Figure 4: The changes of neuron activation values due to the FT defense (Top row), and the changes of t-SNE visualization of feature representations due to the ABL defense (Middle row) and the ANP defense (Bottom row), respectively. different performance on different model architectures. It inspires usto further study the effect of model architecture in backdoor learning and to design more robust architectures in the future. BadNetsBlendedLCSIGLFSSBAInput-awareWaNet Attacks 0 20 40 60 80 100 ASR (%) (1) CIFAR10-5%: No defense BadNetsBlendedLCSIGLFSSBAInput-awareWaNet Attacks 0 20 40 60 80 100 (2) CIFAR10-5%: FT BadNetsBlendedLCSIGLFSSBAInput-awareWaNet Attacks 0 20 40 60 80 100 (3) CIFAR10-5%: FP BadNetsBlendedLCSIGLFSSBAInput-awareWaNet Attacks 0 20 40 60 80 100 ASR (%) (4) CIFAR10-5%: NAD BadNetsBlendedLCSIGLFSSBAInput-awareWaNet Attacks 0 20 40 60 80 100 (5) CIFAR10-5%: NC BadNetsBlendedLCSIGLFSSBAInput-awareWaNet Attacks 0 20 40 60 80 100 (6) CIFAR10-5%: ANP BadNetsBlendedLCSIGLFSSBAInput-awareWaNet Attacks 0 20 40 60 80 100 ASR (%) (7) CIFAR10-5%: AC BadNetsBlendedLCSIGLFSSBAInput-awareWaNet Attacks 0 20 40 60 80 100 (8) CIFAR10-5%: Spectral BadNetsBlendedLCSIGLFSSBAInput-awareWaNet Attacks 0 20 40 60 80 100 (9) CIFAR10-5%: ABL PreAct-ResNet18VGG19EfficientNet-B3MobileNetV3-LargeDenseNet-161 Figure 5: The effects of different model architectures using different defense and attack methods. 9 4.5 Contents in Appendix Due to the space limit, we have put several important contents in theAppendix. Here we present a brief outline of the Appendix to facilitate readers to find the corresponding content, as follows: âą Section A Additional information of backdoor attack and defense algorithms: âSection A.1: Descriptions of backdoor attack algorithm; âSection A.2: Descriptions of backdoor defense algorithms; âSection A.3: Implementation details and computational complexities. âą Section B: Additional evaluations and analysis: âSection B.1: Full results on CIFAR-10; âSection B.2: Results overview; âSection B.3: Effect of dataset; âSection B.4: Effect of poisoning ratio; âSection B.5: Sensitivity to hyper-parameters; âSection B.6: Analysis of quick learning of backdoor; âSection B.7: Analysis of backdoor forgetting; âSection B.8: Analysis of trigger generalization of backdoor attacks; âSection B.9: Evaluation on vision transformer; âSection B.10: Evaluation on ImageNet; âSection B.11: Visualization. âą Section C: BackdoorBench in Natural Language Processing; âą Section D: Reproducibility; âą Section E: License. 5 Conclusions, limitations and societal impacts Conclusions We have built a comprehensive and latest benchmark for backdoor learning, including an extensible modular-based codebase with implementations of 8 advanced backdoor attacks and 9 advanced backdoor defense algorithms, as well as 8,000 attack-defense pairs of evaluations and thorough analysis. We hope that this new benchmark could contribute to the backdoor community in several aspects: providing a clear picture of the current progress of backdoor learning, facilitating researchers to quickly compare with existing methods when developing new methods, and inspiring new research problems from the thorough analysis of the comprehensive evaluations. LimitationsUntil now, BackdoorBench has mainly provided algorithms and evaluations in the computer vision domain and supervised learning. In the future, we plan to expand BackdoorBench to more domains and learning paradigms,e.g., natural language processing (NLP), Speech, and reinforcement learning. Societal impacts Our benchmark could facilitate the development of new backdoor learning al- gorithms. Meanwhile, like most other technologies, the implementations of backdoor learning algorithms may be used by users for good or malicious purposes. The feasible approach to alleviate or avoid adverse impacts could be exploring the intrinsic property of the technology, regulations, and laws. 6 Acknowledgement This work is supported by the National Natural Science Foundation of China un- der grant No.62076213,Shenzhen Science and Technology Program under grant No.RCYX20210609103057050, and the university development fund of the Chinese Uni- versity of Hong Kong, Shenzhen under grant No.01001810. Chao Shen is supported by the National Key Research and Development Program of China (2020A0107702), National Natural Science Foundation of China (U21B2018, 62161160337, 62132011), Shaanxi Province Key Industry Innovation Program (2021ZDLGY01-02). 10 References [1]Eugene Bagdasaryan and Vitaly Shmatikov. Blind backdoors in deep learning models. In30th USENIX Security Symposium, 2021. [2]Mauro Barni, Kassem Kallas, and Benedetta Tondi. A new backdoor attack in cnns by training set corruption without label poisoning. In2019 IEEE International Conference on Image Processing, 2019. [3]Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering. InThe AAAI Conference on Artificial Intelligence Workshop, 2019. [4]Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. InInternational conference on machine learning, 2020. [5]Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning.arXiv preprint arXiv:1712.05526, 2017. [6] Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: a standardized adversarial robustness benchmark.arXiv preprint arXiv:2010.09670, 2020. [7]Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In2009 IEEE conference on computer vision and pattern recognition, pages 248â255. Ieee, 2009. [8]Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. BERT: pre-training of deep bidirectional transformers for language understanding. InProceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, 2019. [9]Bao Gia Doan, Ehsan Abbasnejad, and Damith C Ranasinghe. Februus: Input purification defense against trojan attacks on deep neural network systems. InAnnual Computer Security Applications Conference, 2020. [10]Khoa Doan, Yingjie Lao, and Ping Li. Backdoor attack with imperceptible input and latent modification. Advances in Neural Information Processing Systems, 2021. [11] Khoa Doan, Yingjie Lao, Weijie Zhao, and Ping Li. Lira: Learnable, imperceptible and robust backdoor attacks. InProceedings of the IEEE/CVF International Conference on Computer Vision, 2021. [12]Yinpeng Dong, Qi-An Fu, Xiao Yang, Tianyu Pang, Hang Su, Zihao Xiao, and Jun Zhu. Benchmarking adversarial robustness on image classification. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020. [13] Yansong Gao, Bao Gia Doan, Zhi Zhang, Siqi Ma, Jiliang Zhang, Anmin Fu, Surya Nepal, and Hyoungshick Kim. Backdoor attacks and countermeasures on deep learning: A comprehensive review.arXiv preprint arXiv:2007.10760, 2020. [14]Leon A Gatys, Alexander S Ecker, and Matthias Bethge. Image style transfer using convolutional neural networks. InProceedings of the IEEE conference on computer vision and pattern recognition, 2016. [15]Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. InInternational Conference on Learning Representations, 2015. [16] Dou Goodman, Hao Xin, Wang Yang, Wu Yuesheng, Xiong Junfeng, and Zhang Huan. Advbox: a toolbox to generate adversarial examples that fool neural networks, 2020. [17]Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain.arXiv preprint arXiv:1708.06733, 2019. [18]Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. InEuropean conference on computer vision, 2016. [19] Sebastian Houben, Johannes Stallkamp, Jan Salmen, Marc Schlipsing, and Christian Igel. Detection of traffic signs in real-world images: The German Traffic Sign Detection Benchmark. InInternational Joint Conference on Neural Networks, 2013. [20]Andrew Howard, Mark Sandler, Grace Chu, Liang-Chieh Chen, Bo Chen, Mingxing Tan, Weijun Wang, Yukun Zhu, Ruoming Pang, Vijay Vasudevan, et al. Searching for mobilenetv3. InProceedings of the IEEE/CVF International Conference on Computer Vision, 2019. [21]Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. InProceedings of the IEEE conference on computer vision and pattern recognition, 2017. [22] Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, and Kui Ren. Backdoor defense via decoupling the training process. InInternational Conference on Learning Representations, 2022. 11 [23]Satoshi Iizuka, Edgar Simo-Serra, and Hiroshi Ishikawa. Globally and locally consistent image completion. ACM Transactions on Graphics, 2017. [24]Kiran Karra, Chace Ashcraft, and Neil Fendley. The trojai software framework: An opensource tool for embedding trojans into deep learning models.arXiv preprint arXiv:2003.07233, 2020. [25] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009. [26]Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In5th International Conference on Learning Representations, 2017. [27] Ya Le and Xuan S. Yang. Tiny imagenet visual recognition challenge. 2015. [28]Shaofeng Li, Minhui Xue, Benjamin Zhao, Haojin Zhu, and Xinpeng Zhang. Invisible backdoor attacks on deep neural networks via steganography and regularization.IEEE Transactions on Dependable and Secure Computing, 2020. [29] Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Neural attention distilla- tion: Erasing backdoor triggers from deep neural networks. InInternational Conference on Learning Representations, 2020. [30]Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-backdoor learning: Training clean models on poisoned data.Advances in Neural Information Processing Systems, 2021. [31]Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample-specific triggers. InProceedings of the IEEE/CVF International Conference on Computer Vision, 2021. [32]Jinlong Liu, Guoqing Jiang, Yunzhi Bai, Ting Chen, and Huayan Wang. Understanding why neural networks generalize well through gsnr of parameters.arXiv preprint arXiv:2001.07384, 2020. [33]Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine-pruning: Defending against backdooring attacks on deep neural networks. InInternational Symposium on Research in Attacks, Intrusions, and Defenses, 2018. [34] Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack on deep neural networks. InEuropean Conference on Computer Vision, 2020. [35]Yuntao Liu, Ankit Mondal, Abhishek Chakraborty, Michael Zuzak, Nina Jacobsen, Daniel Xing, and Ankur Srivastava. A survey on neural trojans. In21st International Symposium on Quality Electronic Design, 2020. [36]Yuntao Liu, Yang Xie, and Ankur Srivastava. Neural trojans. In2017 IEEE International Conference on Computer Design, 2017. [37] Scott M Lundberg and Su-In Lee. A unified approach to interpreting model predictions.Advances in Neural Information Processing Systems, 2017. [38]Tuan Anh Nguyen and Anh Tran. Input-aware dynamic backdoor attack.Advances in Neural Information Processing Systems, 2020. [39]Tuan Anh Nguyen and Anh Tuan Tran. Wanet - imperceptible warping-based backdoor attack. In International Conference on Learning Representations, 2021. [40]Maria-Irina Nicolae, Mathieu Sinn, Minh Ngoc Tran, Beat Buesser, Ambrish Rawat, Martin Wistuba, Valentina Zantedeschi, Nathalie Baracaldo, Bryant Chen, Heiko Ludwig, et al. Adversarial robustness toolbox v1. 0.0.arXiv preprint arXiv:1807.01069, 2018. [41]Ren Pang, Zheng Zhang, Xiangshan Gao, Zhaohan Xi, Shouling Ji, Peng Cheng, and Ting Wang. Trojanzoo: Towards unified, holistic, and practical evaluation of neural backdoors. InProceedings of IEEE European Symposium on Security and Privacy, 2022. [42] Nicolas Papernot, Ian Goodfellow, Ryan Sheatsley, Reuben Feinman, and Patrick McDaniel. cleverhans v1.0.0: an adversarial machine learning library.arXiv preprint arXiv:1610.00768, 2016. [43]Fanchao Qi, Yangyi Chen, Mukai Li, Yuan Yao, Zhiyuan Liu, and Maosong Sun. ONION: A simple and effective defense against textual backdoor attacks. InProceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, 2021. [44]Fanchao Qi, Mukai Li, Yangyi Chen, Zhengyan Zhang, Zhiyuan Liu, Yasheng Wang, and Maosong Sun. Hidden killer: Invisible textual backdoor attacks with syntactic trigger. InProceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing, 2021. [45]Fanchao Qi, Yuan Yao, Sophia Xu, Zhiyuan Liu, and Maosong Sun. Turn the combination lock: Learnable textual backdoor attacks via word substitution. InProceedings of the 59th Annual Meeting of the Associ- ation for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing, 2021. 12 [46]Jonas Rauber, Wieland Brendel, and Matthias Bethge. Foolbox: A python toolbox to benchmark the robustness of machine learning models. InReliable Machine Learning in the Wild Workshop, 34th International Conference on Machine Learning, 2017. [47]Jonas Rauber, Roland Zimmermann, Matthias Bethge, and Wieland Brendel. Foolbox native: Fast adversarial attacks to benchmark the robustness of machine learning models in pytorch, tensorflow, and jax.Journal of Open Source Software, 2020. [48] Esha Sarkar, Hadjer Benkraouda, Gopika Krishnan, Homer Gamil, and Michail Maniatakos. Facehack: At- tacking facial recognition systems using malicious facial characteristics.IEEE Transactions on Biometrics, Behavior, and Identity Science, 2022. [49]Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. In Proceedings of the IEEE international conference on computer vision, 2017. [50]Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. Poison frogs! targeted clean-label poisoning attacks on neural networks.Advances in neural information processing systems, 2018. [51]Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recogni- tion. In3rd International Conference on Learning Representations, 2015. [52]Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Y Ng, and Christopher Potts. Recursive deep models for semantic compositionality over a sentiment treebank. InProceedings of the 2013 conference on empirical methods in natural language processing, pages 1631â1642, 2013. [53]Hossein Souri, Micah Goldblum, Liam Fowl, Rama Chellappa, and Tom Goldstein. Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch.arXiv preprint arXiv:2106.08970, 2021. [54]Suraj Srinivas and François Fleuret. Full-gradient representation for neural network visualization.Advances in neural information processing systems, 32, 2019. [55]Mingxing Tan and Quoc Le. Efficientnet: Rethinking model scaling for convolutional neural networks. In International conference on machine learning, 2019. [56]Shiyu Tang, Ruihao Gong, Yan Wang, Aishan Liu, Jiakai Wang, Xinyun Chen, Fengwei Yu, Xianglong Liu, Dawn Song, Alan Yuille, et al. Robustart: Benchmarking robustness on architecture design and training techniques.arXiv preprint arXiv:2109.05211, 2021. [57] Mariya Toneva, Alessandro Sordoni, Remi Tachet des Combes, Adam Trischler, Yoshua Bengio, and Geoffrey J. Gordon. An empirical study of example forgetting during deep neural network learning. In7th International Conference on Learning Representations, 2019. [58] Brandon Tran, Jerry Li, and Aleksander Madry. Spectral signatures in backdoor attacks. InAdvances in Neural Information Processing Systems Workshop, 2018. [59]Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Label-consistent backdoor attacks.arXiv preprint arXiv:1912.02771, 2019. [60]Sakshi Udeshi, Shanshan Peng, Gerald Woo, Lionell Loh, Louth Rawshan, and Sudipta Chattopadhyay. Model agnostic defence against backdoor attacks in machine learning.IEEE Transactions on Reliability, 2022. [61]Miguel Villarreal-Vasquez and Bharat Bhargava. Confoc: Content-focus protection against trojan attacks on neural networks.arXiv preprint arXiv:2007.00711, 2020. [62]Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In2019 IEEE Symposium on Security and Privacy, 2019. [63]Dongxian Wu and Yisen Wang. Adversarial neuron pruning purifies backdoored deep models.Advances in Neural Information Processing Systems, 2021. [64]Marcos Zampieri, Shervin Malmasi, Preslav Nakov, Sara Rosenthal, Noura Farra, and Ritesh Kumar. Predicting the type and target of offensive posts in social media. InProceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, 2019. [65]Qing T Zeng, Sergey Goryachev, Scott Weiss, Margarita Sordo, Shawn N Murphy, and Ross Lazarus. Extracting principal diagnosis, co-morbidity and smoking status for asthma research: evaluation of a natural language processing system.BMC medical informatics and decision making, 6(1):1â9, 2006. [66] Yi Zeng, Won Park, Z Morley Mao, and Ruoxi Jia. Rethinking the backdoor attacksâ triggers: A frequency perspective. InProceedings of the IEEE/CVF International Conference on Computer Vision, 2021. 13 [67]Shihao Zhao, Xingjun Ma, Xiang Zheng, James Bailey, Jingjing Chen, and Yu-Gang Jiang. Clean-label backdoor attacks on video recognition models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020. [68]Runkai Zheng, Rongjun Tang, Jianze Li, and Li Liu. Data-free backdoor removal based on channel lipschitzness. InEuropean Conference on Computer Vision, 2022. 14 Checklist 1. For all authors... (a)Do the main claims made in the abstract and introduction accurately reflect the paperâs contributions and scope? [Yes] (b) Did you describe the limitations of your work? [Yes] (c) Did you discuss any potential negative societal impacts of your work? [Yes] (d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes] 2. If you are including theoretical results... (a) Did you state the full set of assumptions of all theoretical results? [N/A] (b) Did you include complete proofs of all theoretical results? [N/A] 3. If you ran experiments (e.g. for benchmarks)... (a)Did you include the code, data, and instructions needed to reproduce the main experi- mental results (either in the supplemental material or as a URL)? [Yes] See the Github repository of BackdoorBench (https://github.com/SCLBD/BackdoorBench (b)Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)? [Yes] See Tables 1 and 2 in Supplementary Material. (c)Did you report error bars (e.g., with respect to the random seed after running experi- ments multiple times)? [N/A] (d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)? [No] 4. If you are using existing assets (e.g., code, data, models) or curating/releasing new assets... (a)If your work uses existing assets, did you cite the creators? [Yes] The implementations of some existing algorithms are modified based on their original source codes, and we clearly describe the original link and our modifications in each code file in the Github repository of BackdoorBench (seehttps://github.com/SCLBD/BackdoorBench). (b) Did you mention the license of the assets? [Yes] (c)Did you include any new assets either in the supplemental material or as a URL? [Yes] See the Github repository of BackdoorBench (https://github.com/SCLBD/ BackdoorBench. (d)Did you discuss whether and how consent was obtained from people whose data youâre using/curating? [N/A] (e)Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content? [N/A] 5. If you used crowdsourcing or conducted research with human subjects... (a)Did you include the full text of instructions given to participants and screenshots, if applicable? [N/A] (b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, if applicable? [N/A] (c)Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation? [N/A] 15 A Additional information of backdoor attack and defense algorithms A.1 Descriptions of backdoor attack algorithms In addition to the basic information in Table 1 of the main manuscript, here we describe the general idea of eight implemented backdoor attack algorithms in BackdoorBench, as follows. âąBadNets[17]: It was the first work in backdoor learning, which simply inserted a small patch with fixed pattern and location to replace the original pixels in the clean image to obtain a poisoned image. âąBlended[5]: It extended BadNets by encouraging the invisibility of the trigger through alpha blending. âąLabel consistent (LC)[50]: It generated a poisoned image using adversarial attack, by enforcing it to be close to the clean target image in the original RGB space, and close to the clean source image patched with a trigger in the feature space of a pre-trained clean model. Since the poisoned image is labeled as the target class, the mapping from the trigger to the target class could be learned. âąSIG[2]: It adopted a sinusoidal signal as the trigger to perturb the clean images of the target class, while not changing their labels, such that achieving the label consistent backdoor attack. âąLow frequency attack (LF)[66] : It was built upon an analysis that the triggers in many backdoor attacks bring in high-frequency artifacts, which are easily detectable. Inspired by this analysis, LF developed a smooth trigger by filtering high-frequency artifacts from a universal adversarial perturbation. âąSample-specific backdoor attack (SSBA)[31]: It utilized an auto-encoder to fuse a trigger (e.g., a string) into clean samples to obtain poisoned samples. The residual between the poisoned and the clean sample varied for different clean images,i.e., sample-specific. âąInput-aware dynamic backdoor attack (Input-aware)[38]: It was a training-controllable attack by simultaneously learning the model parameters and a trigger generator. When testing, the learned trigger generator generated one unique trigger for each clean testing sample. âąWarping-based poisoned networks (WaNet)[39]: It was also a training-controllable attack. A fixed warping function is adopted to slightly distort the clean sample to construct the poisoned sample. The attacker further controlled the training process to ensure that only the adopted fixed warping function can activate the backdoor. A.2 Descriptions of backdoor defense algorithms In addition to the basic information in Table 2 of the main manuscript, here we describe the general idea of nine implemented backdoor defense algorithms in BackdoorBench, as follows. âąFine-tuning (FT) : It is assumed that fine-tuning the backdoored model on a subset of clean samples could mitigate the backdoor effect. Note that FT is a widely used approach for transferring pre-trained models to new tasks, but it has been used as a basic component in several backdoor defense methods, such as Fine-pruning (FP) [33], Neural Attention Distillation (NAD) [29]. âąFine-pruning (FP)[33]: It is built upon the assumption thatpoisoned and benign samples have different activation paths in the backdoored model. Inspired, FP proposed to firstly prune some inactivated neurons of clean samples, then fine-tune the pruned model based on the subset of benign samples to recover the model performance. âąNeural Attention Distillation (NAD)[29]: Its assumption is same with FT. Instead of directly use the fine-tuned model as the mitigated model, NAD adopts the first fine-tuned model as a teacher, and fine-tunes the backdoored model again by encouraging the consistency of the attention representation between the new fine-tuned model and the teacher model. âąNeural cleanse (NC) [62]: It is built upon the assumption thatthe trigger provides a âshortcut" between the samples from different source classes and the target class. Based on this assumption, the possible trigger is searched through optimization. If a small-size trigger (e.g., a small patch in the image) is found, then the model is detected as backdoored model, which is then mitigated through pruning based on the searched trigger. 16 âąAdversarial Neuron Pruning (ANP)[63]: It is built upon an observation thatthe neurons related to the injected backdoor are more sensitive to adversarial neuron perturbation (i.e., perturbing the neuron weight to achieve adversarial attack) than other neurons in a backdoored model. Inspired by this, ANP proposed to prune these sensitive neurons for backdoor mitigation. âąActivation Clustering (AC) [3]: It is built upon an observation thatthe sample activations (i.e., the feature presentations) of the target class will form two clusters, and the smaller cluster corresponds to poisoned samples, while those of other classes form one cluster. Then, the model is trained from scratch based on the dataset without poisoned samples. âąSpectral Signatures (S) [58]: Its assumption is thatthe feature representation distributions of benign and poisoned samples in one class are spectrally separable, which is a concept of robust statistics. Consequently, the poisoned samples can be identified through analyzing the spectrum of the covariance matrix of the feature representations. Then, the model is retrained from scratch by removing the poisoned samples from the training set. âąAnti-Backdoor Learning (ABL)[30]: It is built upon an observation thatthe loss values of poi- soned samples drops much faster than those of benign samples in early epochs during the training process. Inspired, ABL proposed to firstly isolate poisoned samples from benign samples according to their difference on loss dropping speed, then mitigate the backdoor effect by maximizing the loss of the isolated poisoned samples. âąDecoupling-based Backdoor Defense (DBD)[22]: It is built upon an observation thatpoisoned samples from different samples will gather together in the feature space of a backdoored model. DBD proposed to prevent the gathering by learning the model backbone through self-supervised learning without labels, rather than the standard supervised learning. Then, since the poisoned samples are separated, their loss values are larger than benign samples when learning the classifier, such that samples with large loss values can be identified as poisoned samples. Finally, the labels of poisoned samples are abandoned, and a semi-supervised fine-tuning of both the backbone and classifier is conducted to improve the model performance. A.3 Implementation details and computational complexities Running environmentsOur evaluations are conducted on GPU servers with 2 Intel(R) Xeon(R) Plat- inum 8170 CPU @ 2.10GHz, RTX3090 GPU (32GB) and 320 GB RAM (2666MHz). The versions of all involved softwares/packages are clearly described in the README file of the Github repository (seehttps://github.com/SCLBD/BackdoorBench). Here we didnât repeat the descriptions. Hyper-parameter settingsThe hyper-parameter settings adopted in our evaluations about backdoor attack and defense algorithms are described in Table 4 and Table 5, respectively. With these hyper- parameter settings, the reported results of 8,000 pairs of evaluations could be reproduced. Moreover, we would like to explain our rules to adopt above settings, as follows: âąWe donât perform a separate hyper-parameter search for each method, mainly due to the following two reasons: â As shown in Tables 4 and 5, most methods have several hyper-parameters. For most hyper- parameters of a method, there is neither a good rule to determine the values, nor a suitable range of the values suggested in its original manuscript. And, the suitable value or range of each hyper-parameter may vary across different datasets, different model architectures, different against attack/defense methods. Consequently, the hyper-parameter search space for each method could be very large, requiring unimaginably high computational resource. âEven assuming sufficient computing resources, then we can search a good value for each hyper-parameter of each method in each evaluation. However, the comparison results and analysis based on sufficient hyper-parameter search may be unfair and make no sense in practice. Because, we still cannot tell a rule or even some experiences to determine the hyper-parameter values in practice. The sensitivity to hyper-parameters should also be an 1 For FP and ANP, we define a hyper-parameterthe tolerance of clean accuracy reductionas the maximum relative drop of clean accuracy. It is used to determine the number of pruned neurons. 2 For AC and Spectral,N fe is the dimensions of the representation. 3 ForNAD,weusethecodeandrecommendedhyper-parametersat https://github.com/bboylyg/NAD/tree/d61e4d74e697f125336bfc42a03c707679071a6. 17 Table 4: Hyper-parameter settings of all implemented attack methods. AttackHyper-parameterSettingTheoretical complexity General Settings attack targetall-to-one with class 0train sample size(N T ), optimizerSGDbatch size (B), momentum0.9forward process for net C (f C ), weight decay0.0005backward process for net C (b C ), batch size128epochs (E) , epochs on CIFAR10 and CIFAR-100100number of classes (N cls ) epochs on GTSRB50 lr schedule (except forCosineAnnealingLR training-controllable attack) on CIFAR10, CIFAR-100 and GTSRB epochs on TinyImageNet-200200 lr schedule on TinyImageNet-200ReduceLROnPlateau random seed0 BadNets [17] pattern & location3Ă3, pure white, atO(N T /BE(f+b)) downright corner (no margin left) Blended [5] patternhello kittyO(N T /BE(f+b)) alpha0.2 Label Consistent [59] adversarial attackPGDO(N T /BE(f+b) +N T /BT step (f+b)) step (T step )100 α1.5 8 SIG [2] ÎŽ40O(N T /BE(f+b)) f6 Low Frequency [66] maximum number of termination50O(T ter N sample (2f+T df f+T df N cls b)+ iteration (T ter )N T /BE(f+b)) fooling rate0.2 overshoot0.02 maximum number of iterations200 for deepfool (T df ) sample number for UAP (N sample )100 SSBA [31] encoded bit1O(T step (f auto +b auto ) +N T /BE(f+b)) autoencoder train step (T step )140000 Input-aware [38] Generator lr (both for M, G)0.01O(E mask N T /B(f mask +b mask )+ schedule (for M, G and C)MultiStepLR(EâE mask )N T /B(2f mask + schedule milestones for G200, 300, 400, 5002f generator + 2b generator +f+b)) schedule milestones for C100, 200, 300, 400 schedule milestones for M10, 20 schedule gamma (for M and G)0.1 λ div 1 λ norm 400 mask density0.032 cross_ratio1 mask train epochs (E mask )25 WaNet [39] cross_ratio2O(N T /BE(f+b)) lr scheduleMultiStepLR schedule milestones100, 200, 300, 400 grid_rescale1 important metric of one methodâs performance, not just the best ACC/ASR values through the sufficient hyper-parameter search. âąHow do we set the hyper-parameter values in our current 8000 pairs of evaluations. â If the original paper has provided the suggested good values of some hyper-parameters, then we adopt those values in our evaluations. For example, the ANP defense method explicitly wrote that "the perturbation budget= 0.4and the trade-off coefficientα= 0.2", so we also adopt these values in our evaluations. â For those hyper-parameters without suggested values/ranges (or even without descriptions) in their original papers, we will search values that lead to comparable results (ACC/ASR) with 18 Table 5: Hyper-parameter settings of all implemented defense methods. DefenseHyper-parameterSettingTheoretical complexity General Settings optimizerSGDtrain sample size (N T ), batch size (B), momentum0.9forward process for net C (f C ), weight decay0.0005backward process for net C (b C ), batch size256epochs (E) , number of classes (N cls ) epochs on CIFAR10, CIFAR-100 and GTSRB100the number of pruning neurons (N neu ) lr schedule (except for special learning defense)CosineAnnealingLR on CIFAR10, CIFAR-100 and GTSRB epochs on TinyImageNet-200200 lr schedule on TinyImageNet-200ReduceLROnPlateau the number of pruning neuronsthe number of neurons in the last layer random seed0 FTratio of validation data (p v )5%O(N T p v /BE(f+b)) FP [33] ratio of validation data (p v )5%O(N neu N T p v f/B) the tolerance of accuracy reduction 1 10%+O(N T p v /BE(f+b)) NAD 3 [29] ratio of validation data for teacher model (p v )5%O(N T p v /BE ft (f+b)) ÎČ 1 for the loss500+O(N T p v /BE(2f+b)) ÎČ 2 for the loss1000 ÎČ 3 for the loss1000 the power for attention2.0 the epoch for teacher model to fine-tune (E ft )10 NC [62] the norm used for the reversed triggerL1O(N T p v E r N cls /B(f+b)) cleaning ratio (p v )0.05+O(N T p v /BE(f+b)) unlearning ratio0.2 the epoch of learning trigger (E r )80 ANP [63] the tolerance of accuracy reduction 1 10% O(e i (f+b)) number of validation data (p v )5% the number of iteration during pertubation (e i )2000 0.4 α0.2 AC [3]number of reduced dimensions10O(N T /BN 3 fe ) +O(N T /BE(f+b)) 2 Spectral [58]The percentile of backdoor data85%O(N 3 fe ) +O(N T /BE d (f+b)) 2 ABL [30] tuning epochs (E tu ) for CIFAR10, CIFAR-100 and GTSRB20O(N T /BE tu (f+b)) finetuning epochs (E ft ) for CIFAR10, CIFAR-100 and GTSRB60+O(N T (1âp i )/BE ft (f+b)) unlearning epochs (E u ) for CIFAR10, CIFAR-100 and GTSRB20+O(N T p i /BE u (f+b)) tuning epochs for Tiny40 finetuning epochs for Tiny120 unlearning epochs for Tiny4 lr for unlearning0.0005 the value of flooding0.5 the isolation ratio of training data (p i )0.01 DBD [22] the epoch for self-supervised learning (E se )100O(N T /B se E se (f+b)) the epoch for warmup (E wa )10+O(N T /B semi E se (f+b)) the epsilon for the dataset ()0.5+O(N T /B semi E(f+b)) during the semi-supervised learning The batch size of self learning (B self )512 The batch size of self learning (B semi )128 the reported results in the same setting (i.e., same dataset, same/similar model architecture, same poisoning ratio), then fix these values in evaluations of other settings (e.g., changing the poisoning ratio). â The consistent values of hyper-parameters of each method across different settings somewhat guarantee the fairness of evaluations. And, since the adopted values may not be the optimal ones for some hyper-parameters, we didnât conduct the fine-grained analysis about the effects of some specific hyper-parameters (e.g., the trigger size/location in attack methods with patch based triggers). Instead, we provided some high-level analysisw.r.t.the shared hyper-parameters in all methods (e.g., the number of classes, the poisoning ratio, the model architecture). The findings of these high-level analysis will not be significantly affected by the particular hyper-parameters of each individual method. Computational complexitiesThe computational complexity of each attack and each defense algo- rithm is also described in Table 4 and Table 5, respectively. 19 B Additional evaluations and analysis B.1 Full results on CIFAR-10 The full results on CIFAR-10 with five different poisoning ratios (i.e., 10%, 5%, 1%, 0.5%, 0.1%) are presented in Tables 13 â 17, respectively. The remaining results on other datasets and model architectures among 8,000 attack-defense pairs of evaluations are presented in the Leaderborad in the BackdoorBench website (seehttps://backdoorbench.github.io). B.2 Results overview In Figure 6, we present the performance distribution of attack-defense pairs on Preact-ResNet18 and VGG-19 with two poisoning ratios of 5% and 10%, respectively. As we mentioned in Section 4.2, if we measured the effectiveness of methods by clean accuracy (C-Acc) and ASR, a perfect attack method should be located at the top-right corner; the perfect defense method should show in the top-left corner. If we measured robust accuracy (R-Acc) and ASR, the reduced ASR value would be desirable to equal the increased R-Acc. This defense method can recover the correct prediction and eliminate the backdoor successfully. Even if we change the model structure from Preact-ResNet18 to VGG-19, the conclusion coincides with our analysis. Besides, with the increase in poisoning ratio, some color patterns are closer to the anti-diagonal line, which means these defense methods can achieve better performance in this situation. Please refer to Section 4.2 in the manuscript for the analysis. B.3 Effect of dataset As shown in Figure 7, we make a detailed comparison of the performance of attacks and defenses under different datasets using the PreAct-ResNet18 model and 5% poison ratio. Where the different colored bars correspond to the four datasets, the height of the bars represents the ASR, and the various subplots correspond to the multiple defenses (and no defenses). Looking down from the undefended perspective, we can see that, by and large, the effect of the attack fluctuates across the different datasets. Blended is the most stable across datasets, while BadNets has the most fluctuating effect across datasets. For BadNets, we find that CIFAR-100 and GTSRB are more complex than CIFAR-10, which leads to the decrease in effectiveness on these two datasets, but the ASR on Tiny ImageNet has rebounded significantly due to the enlargement of the trigger size. From different defense perspectives, we can find that the two methods, AC and Spectral Signature, are relatively unaffected by changes in the dataset compared with each other. In contrast, the rest of the defense methods may all have large fluctuations in their effectiveness in the face of specific attacks. Although fluctuating, ANP has better results on CIFAR-10 for all attack methods, while ABL is also very effective on Tiny ImageNet for all attack methods. B.4 Effect of poisoning ratio B.4.1 Effect of poisoning ratio with randomness As demonstrated in Section 4.3 in the main manuscript, in the following we will further verify the abnormal phenomenon of poisoning ratioâs effect shown in Figure 3 in the main manuscript, under the randomness of weight initialization and some methodsâ mechanisms. Experimental settingIn the reported 8,000 pairs of evaluations, we set the random seed as 0 to fix all randomness in each evaluations, to ensure all results could be reproduced. For each evaluation plotted in Figure 3 in the main manuscript, we re-run the script with five different random seeds, and record the mean and the standard deviation of these five evaluations. Analysis As shown in Figure 8, the trends of ASR curves are almost consistent with those in Figure 3 in the main manuscript, and the standard deviation (i.e., the error bar) is small, indicating that the abnormal phenomenon about the poisoning ratioâs effect is not affected by the randomness. However, there are still a few special cases. For example, the error bars of some attacks under the ABL defense is very large when the poisoning ratio is low. The reason is that ABL identifies the fixed 1% of all training samples as the poisoning samples according to the training loss. However, we find that the 20 poisoning identification accuracy is very unstable, especially when the poisoning ratio is low, leading to the large fluctuation. The standard deviations of evaluations under the NC defense are also large. As described in Section A.2, NC consists of two consecutive steps,i.e., firstly searching a candidate trigger to determine whether it is a backdoored model or not, then mitigating the backdoor effect through pruning. We observe that the first step is very unstable within 5 random evaluations. If the backdoored model is successfully detected, then the ASR will be reduced significantly, other keeping the high value, causing the high standard deviations of 5 random evaluations. B.4.2 Effect of poisoning ratio of other model architectures In this part, we intend to give the more detailed information about the variation of ASR values against poisoning ratio on different model structures, which are VGG-19, DenseNet-161, EfficientNet-B3, and MobileNetV3-Large, respectively. The corresponding results are established in Figure 9. We have analyzed the effect of poisoning ratio in Section 4.3 in the main manuscript based on the results of Preact-ResNet18 on CIFAR-10. We found that the most ASR curves increase with the increase of poisoning ratio, while there are some curves which increase at first and then collapse dramatically. However, this phenomenon still exists for multiple model structures. It is interesting to notice that if the model structure is changed, the tendency of curves is different. The curve of NAD against BadNets can serve as an example. It keeps increasing in DenseNet-161, while increases at first and then drops down in VGG-19 and MobileNetV3-Large. Thus, it is valuable to further explore the relationship between model architecture and backdoor performance. Note that we donât provide the results of ANP and DBD on VGG-19, as we adopt the VGG-19 architecture without the batch normalization (BN) layer (see the demonstration in Section 4.1 of the main manuscript). According to the ANP authorâs comments at https://github.com/csdongxian/ANP_backdoor/issues/2, ANP is not suitable to the model architecture without the BN layer. Besides, in our evaluations, the defense performance of DBD is not very stable on the VGG-19 without the BN layer, at its semi-supervised learning phase. Thus, we also donât report the evaluation of DBD on VGG-19. However, we also observe that DBD performs stably on the VGG-19 model with the BN layer. The behind reason will be explored in future. B.5 Sensitivity to hyper-parameters As illustrated in Section A.3, we adopt a fixed setting for each attack/defense method to ensure reproducibility and fair comparison. However, the sensitivity to hyper-parameters is also a very critical metric of one methodâs performance and practical usage. In the following, we pick three attack methods (i.e., BadNets, SIG, InputAware), two defense methods (i.e., ABL and ANP), two datasets (i.e., CIFAR-10 and GTSRB), and two models (i.e., PreAct-ResNet18 and VGG-19), to present a partial analysis about the sensitivity to hyper-parameters. For each attack/defense method, we study one key hyper-parameter, such as the triggerâs patch size for BadNets, the triggerâs frequency for SIG, the mask density for Input-aware, the flooding value for ABL and the poisoning threshold for ANP. Results are shown in Tables 6, 7, 8, and 9. For BadNets, a larger square pattern means a more vigorous attack but is also easier to find by defense methods. For SIG, higher frequency means stronger attacks and harder to defend. For Input-aware, the ASR values fluctuate a lotw.r.t.the mask density in the case of no defense but are relatively stable under defenses. For ABL, a higher flooding parameter often leads to worse defense performance for most attacks. For ANP, the situation is complicated. When defending BadNets and SIG, the higher threshold often leads to better defense performance, but the defense performance against Input-aware is rather stablew.r.t.the threshold. When comparing the performance across different model architectures and different datasets, we find that the sensitivities to hyper-parameters of each method are very diverse. Picking a good hyper-parameter for a backdoor learning method in practice is a challenge. B.6 Analysis of quick learning of backdoor The quick learning phenomenon of backdoor has been observed in some previous works [30],i.e., the backdoor could be quickly learned in a few epochs, for almost all backdoor attacks. However, the behind reason has not been studied. In the following, we provide a detailed analysis from the perspective of gradient. Specifically, for each epoch during the training process, we record the following information: 21 âą Losses of training samples, clean testing samples, and poisoned testing samples; âą Accuracy on training samples, clean testing samples, and poisoned testing samples; âą Gradient signal to noise ratios (GSNR) [32] on training samples, clean train samples, and poisoned training samples averaged over model parameters; âąNorms of average gradient on total training samples, clean training samples, and poisoned training samples; âąPairwise cosine similarities between average gradients on total training samples, clean training samples, and poisoned training samples. As shown in Figure 10, we report the results of 5 backdoor attacks, including BadNets, Blended, SSBA, LC and LF with poisoning ratio10%, on the CIFAR-10 dataset and the PreAct-ResNet18 model. As shown in the first column, the testing loss of poisoned samples drops quickly in the early stages of training and converges to a low value, while the testing loss of clean samples drops at a slower rate and converges to a much larger value. It verifies the quick learning phenomenon of backdoor under these five backdoor attack methods. As shown in the third column, we first observe that the GSNR of poisoned samples is significantly larger than the GSNR of clean samples at the early stages. The high GSNR values of poisoned samples indicate that the backdoor has better generalization performance and is consistent with the higher accuracy (ASR) and lower loss on poisoned testing samples. Secondly, we notice that the norm of the gradient on poisoned samples is much larger than the norm of the gradient on clean samples in early epochs, as shown in the fourth column. Consequently, the cosine similarity between gradients on total training samples and poisoned training samples is significantly larger than the cosine similarity between gradients on clean training samples and poisoned training samples, though the number of poisoned samples is much smaller than the number of clean samples. B.7 Analysis of backdoor forgetting From the above analysis about the quick learning of backdoor in Section B.6, we get one impression that the backdoored model memorizes the poisoned samples quickly and stably. To obtain more insights about the inner mechanism of backdoor learning, we adopt the concept offorgetting event [57] to characterize the learning dynamics during the training process. Specifically, one forgetting event is recorded when a correctly predicted training sample at the current epoch is incorrectly predicted at the next epoch. Formally, given a training sample(x,y), wherexis input feature,yis ground-truth label. Ifxis correctly predicted at the epocht,i.e.,f Ξ t (x) =y, but is misclassified at epocht+ 1,i.e.,f Ξ t+1 (x)6=y, wherefdenotes the model andΞ t ,Ξ t+1 are model parameters at the epochtandt+ 1, then a forgetting event is recorded for this sample. Specifically, we count the number of forgetting events for clean and poisoned training samples, respectively, on CIFAR-10 with Preact-ResNet18 backbone. The distributions of forgetting events of clean and poisoned samples are shown in Figure 11. The results show that: âą The forgetting events of clean training samples follow an exponential distribution, and are similar among different cases. âąFor poisoned training samples:1)when the poisoning ratio is low (e.g., 0.1%, 0.5%), the forgetting numbers of poisoned samples are often larger than those of clean samples; 2)when the poisoning ratio is high (e.g., 5%, 10%), the forgetting numbers of poisoned samples are often smaller than those of clean samples. The above observations are compatible with our high-level observation that the backdoor attack with higher poisoning ratios could quickly learn the stable mapping from the poisoned samples to the target class. Moreover, the forgetting event provides a fine-grained tool to analyze the contribution of each individual training sample, which could facilitate the development of more advanced backdoor attack and defense methods. B.8 Analysis of trigger generalization of backdoor attacks In all existing backdoor attacks, there is a default assumption that the triggers used in both backdoor training and backdoor testing are exactly same. However, we find that an interesting property in 22 backdoor learning that the backdoored model trained with one trigger could be also activated by other triggers. We name it astrigger generalization. In this following, we take the Blended attack as an example to study the trigger generalization. Specifically, we set the trigger transparency to different values in training and testing phase, including 10%, 20%, and 30%. As shown in the figure 12, we obtain the following observations: (1) If a more obvious trigger (i.e., high transparency 30%) is applied during training, then the backdoor will not be easily activated by a different trigger with lower transparency; (2) If using a less obvious backdoor triggers (i.e., low transparency 10%) in the training phase, then the backdoor can be successfully activated by the trigger with higher transparency (e.g., 20% or 30%) in the test phase. In addition to the above example, we find that the trigger generalization is a common property of the backdoor models under several backdoor attacks. For example, the trigger in SSBA [31] is a string, and its backdoored model could not only be activated by its training trigger. However, we find that the model is likely to be activated by many other strings with the same length. Exploring the behind reason of trigger generalization is important for us to better understand the backdoor mechanism. Moreover, we notice that there have been some attempts to utilize the backdoor as the technique to protect the intellectual property (IP) of AI models or datasets, based on the unique mapping from the trigger to the target class. However, due to the trigger generalization, the uniqueness of the training trigger no longer exists, which undermines the legitimacy backdoor learning in IP protection. Thus, the study of trigger generation is also important for the usage of backdoor learning in practice. We will provide more analysis about trigger generalization in BackdoorBench in future. B.9 Evaluation on vision transformer Until now, the reported 8,000 pairs of evaluations in BackdoorBench are all conducted on the convolutional neural networks. In the following, we expand the evaluations to another popular family of models,i.e., vision transformer (ViT), which has shown superior performance on many vision tasks (i.e., image classification, object detection, semantic segmentation). In our evaluations, a initial checkpoint of ViT that is pre-trained on ImageNet [7] is downloaded fromhttps://github. com/pytorch/vision/tree/main/references/classification. We then fine-tune this pre- trained checkpoint on the poisoned CIFAR-10 dataset. Note that the input size of ViT is224Ă224, while the size of raw images in CIFAR-10 is32Ă32. Thus, in data poisoning based attack, we firstly insert the trigger into the raw image, then re-scale the poisoned image to the size224Ă224. We evaluate ViT-Base model with16Ă16input patch size (ViT-b-16) on CIFAR-10 with 10% poison ratio, where the settings of all hyper-parameters are same with those for learning other models, as shown in Tables 4 and 5. The backdoor evaluation results are summarized in Table 10. As a baseline, the accuracy of fine-tuning ViT-b-16 on the clean dataset with same hyper-parameters is 96.56%. According to Table 10 and the comparison with the evaluations on other models, we have the following observations.1)In the case of no defense, the ASR of ViT-b-16 is still very high under all evaluated backdoor attacks, revealing that the ViT model architecture is also vulnerable to backdoor attacks.2)The evaluated three defense methods show very poor performance for the attack on ViT-b-16. In terms of FT and NC, although the ASR is reduced significantly, the clean accuracy is also downgraded. In terms of ABL, the ASR doesnât decrease for most attacks, with the only exception for BadNets of which the model after defense is fully degenerated. It implies that the effective defense that have been verified on the CNN architecture may not suitable for the ViT architecture. It inspires us to develop more effective defense methods for the ViT architecture specially. More evaluations and analysis about the ViT architecture will be added in BackdoorBench in future. B.10 Evaluation on ImageNet Due to the high computational and memory costs, one of the benchmark datasets of image classifica- tion,i.e., ImageNet [7] with 1,000 classes, has rarely been evaluated in existing backdoor learning works. We plan to provide comprehensive evaluations of backdoor learning methods on ImageNet, to find whether there are some unique challenges for backdoor learning on large-scale datasets. Here, we provide some partial evaluations, including BadNets and Blended attack with 0.1% poison ratio on ImageNet and the PreAct-ResNet18 model, as shown in Table 11. Note that due to the 1,000 classes, we do not set a higher poisoning ratio to ensure that the number of poisoned samples is not 23 much larger than the number of clean samples of the target class. Both Badnets and Blended show good attack performance with high ASR and C-Acc. Compared with the baseline model,i.e., PreAct- ResNet18 trained on the clean ImageNet dataset (please refer tohttps://paperswithcode.com/ sota/image-classification-on-imagenet?tag_filter=3 ), there is a slight drop of C-Acc, from 72.33% to 69.22%. More backdoor attack and defense evaluations on ImageNet will be added to our BackdoorBench in the future. B.11 Visualization B.11.1 Individual visualization tools Here we provide three visualization tools to analyze each individual image. Gradient-weighted class activation mapping (Grad-CAM)[49] explains the contribution of each pixel to the prediction of one image, based on the gradient of the logit of one classw.r.t.each pixel. Note that in the codebase of BackdoorBench, we implement a variant of Grad-CAM, called FullGrad [54]. Shapley Value[37] is another popular interpretation tool that assigns an importance factor to each pixel for a particular prediction. Inspired by the cooperative game theory, the competition among pixels is also taken into account in the computation of each individual importance factor. Frequency saliency map (FSM)shows the contribution of every Fourier basis to model classification. Consider an image classification task withSclasses. Letxbe a clean image with sizeHĂWĂC and Ì x=F(x) be the corresponding frequency spectrum withFbeing the channel-wise Discrete Fourier Transform (DFT) operator. LetCbe the set of complex numbers. Denote the classifier byf:R HĂWĂC âR S . We defineF:C HĂWĂC âR S as the corresponding classifier in the frequency domain, which means F( Ì x) =f(x) =f ( F -1 ( Ì x) ) ,(1) whereF -1 is the channel-wise Inverse Discrete Fourier Transform (IDFT) operator, which means F -1 ( Ì x) = â Hâ1 h=0 â Wâ1 w=0 Ì x(h,w)e â2Ïi( uh H + vw W ) . Inspired by the saliency map in the RGB space, we intend to establish the connection between model prediction and imageâs frequency spectrum by the norm of gradient. According to the chainâs rule, we can estimate the gradientw.r.t.the frequency spectrum as follows âF s ( Ì x) â Ì x(u,v,c) = C â c=1 Hâ1 â h=0 Wâ1 â w=0 C â c âČ =0 âf s (x) âx(h,w,c âČ ) · âx(h,w,c âČ ) â Ì x(u,v,c) = C â c=1 Hâ1 â h=0 Wâ1 â w=0 âf s (x) âx(h,w,c) e 2Ïi( uh H + vw W ) , (2) wheref s means the logit output of the modelfw.r.t.thes-th class. B.11.2 Visualization results In the following, we present some visualization results using the above three tools to understand the inner mechanism of backdoor learning better. Specifically, Specifically, we train the PreAct- ResNet18 model under various backdoor attacks and defenses with the poisoning ratio5%, on 3 datasets, including CIFAR-100, GTSRB, and Tiny ImageNet. Then, we randomly select a poisoned sample from the test set and show its visualization. The visualization results using Shapley Value and Grad-CAM are shown in Figures 13 to 18, respectively. The frequency saliency map (FSM) visualization results are shown in Figure 19, where low-frequency components are shifted into the central regions. In contrast, high-frequency components are distributed in surrounding regions. The first column displays the studied poisoned images generated by different attack methods, including BadNet, Blended, SSBA, WaNet, and LF. The second column shows the contribution of each frequency basis to the backdoored modelâs prediction. It tells that most backdoor models pay attention to high-frequency regions, while the model under the LF attack makes the model concentrates more on low-frequency regions. Besides, we can see an apparent difference between 24 SSBA and WaNet in the frequency domain, even though their spatial images look similar. These observations demonstrate the potential usage of FSM in trigger or backdoor detection, which will be explored in our future work. The remaining columns show the contribution of each frequency basis under various defense methods. For example, the contribution of some high-frequency regions is enormous for the poisoned image in a BadNet model without defense. However, after conducting FT on this backdoor model, the low-frequency regions regain attention from the model. It explains well that FT can effectively remove backdoors embedded by BadNet and WaNet (see Figure 3 in the main manuscript). We plan to explore more backdoor learning properties from the frequency domain perspective. C BackdoorBench in Natural Language Processing Apart from the analysis of backdoor attack and defense methods in computer vision, we also expand our benchmark to the field of Natural Language Processing (seehttps://github.com/ SCLBD/BackdoorBench/tree/main/backdoorbench_nlp). We implement two stage-of-the-art backdoor attack methods (i.e., LWS [45] and HiddenKiller [44]) and one defense method (i.e., Onion [43]) in NLP as a complement to the original BackdoorBench. We closely follow the original implementation of the attack and defense methods and make necessary changes to unify all the methods in our benchmark. We choose BERT [8] as the model to be poisoned. All the experiments are conducted on three widely-used datasets for text classification tasks, including Stanford Sentiment Treebank(SST-2) [52], Offensive Language Identification Dataset(OLID) [64] and AGâs News [65]. For all experiments, the poison rate is set to be 5% and the default target label is 1. For LWS, the bar for ONION for each dataset is set to be the recommended value in the original implementation. All results are reported in Table 12. We can find that the two chosen attack methods can both achieve high attack success rate even at a low poisoning ratio. However, the defense performance of ONION against two SOTA attack methods is not quite satisfactory. The possible reason is that ONION aims to find out obvious outliers in each sentence, but both HiddenKiller and LWS are invisible methods which do not rely on special tokens as triggers. In the future, we will also keep updating latest backdoor attack and defense methods in the NLP field into our benchmark. D Reproducibility All evaluation results in BackdoorBench can be easily reproducible, just running the scripts provided in the github repositoryhttps://github.com/SCLBD/BackdoorBench, with the hyper-parameter settings presented in Tables 4 and 5. All evaluated datasets and model architectures are publicly and freely available. Besides, we also compress all codes into one file as a part of the supplementary materials. E License This repository is licensed by The Chinese University of Hong Kong, Shenzhen and Shenzhen Re- search Institute of Big Data under Creative Commons Attribution-NonCommercial 4.0 International Public License (identified as C BY-NC-4.0 in SPDX, seehttps://spdx.org/licenses/). More details about the license could be found inhttps://github.com/SCLBD/BackdoorBench/blob/ main/LICENSE. 25 20406080100 ASR (%) 0 20 40 60 80 100 C-Acc (%) (1) CIFAR10-10% PreAct-ResNet18 20406080100 ASR (%) 0 20 40 60 80 100 (2) CIFAR100-10% PreAct-ResNet18 20406080100 ASR (%) 0 20 40 60 80 100 (3) GTSRB-10% PreAct-ResNet18 20406080100 ASR (%) 0 20 40 60 80 100 (4) Tiny-10% PreAct-ResNet18 20406080100 ASR (%) 0 20 40 60 80 100 R-Acc (%) (5) CIFAR10-10% PreAct-ResNet18 20406080100 ASR (%) 0 20 40 60 80 100 (6) CIFAR100-10% PreAct-ResNet18 20406080100 ASR (%) 0 20 40 60 80 100 (7) GTSRB-10% PreAct-ResNet18 20406080100 ASR (%) 0 20 40 60 80 100 (8) Tiny-10% PreAct-ResNet18 BadNetsBlendedLCSIGLFSSBAInput-awareWaNet No defenseFTFPNADNCANPACSpectralABLDBD (a) Attack-defense pairs with PreAct-ResNet18 and 10% poisoning ratio on CIFAR-10. 20406080100 ASR (%) 0 20 40 60 80 100 C-Acc (%) (1) CIFAR10-10% VGG19 20406080100 ASR (%) 0 20 40 60 80 100 (2) CIFAR100-10% VGG19 20406080100 ASR (%) 0 20 40 60 80 100 (3) GTSRB-10% VGG19 20406080100 ASR (%) 0 20 40 60 80 100 (4) Tiny-10% VGG19 20406080100 ASR (%) 0 20 40 60 80 100 R-Acc (%) (5) CIFAR10-10% VGG19 20406080100 ASR (%) 0 20 40 60 80 100 (6) CIFAR100-10% VGG19 20406080100 ASR (%) 0 20 40 60 80 100 (7) GTSRB-10% VGG19 20406080100 ASR (%) 0 20 40 60 80 100 (8) Tiny-10% VGG19 BadNetsBlendedLCSIGLFSSBAInput-awareWaNet No defenseFTFPNADNCANPACSpectralABLDBD (b) Attack-defense pairs with VGG-19 and 10% poisoning ratio on CIFAR-10. 20406080100 ASR (%) 0 20 40 60 80 100 C-Acc (%) (1) CIFAR10-5% VGG19 20406080100 ASR (%) 0 20 40 60 80 100 (2) CIFAR100-5% VGG19 20406080100 ASR (%) 0 20 40 60 80 100 (3) GTSRB-5% VGG19 20406080100 ASR (%) 0 20 40 60 80 100 (4) Tiny-5% VGG19 20406080100 ASR (%) 0 20 40 60 80 100 R-Acc (%) (5) CIFAR10-5% VGG19 20406080100 ASR (%) 0 20 40 60 80 100 (6) CIFAR100-5% VGG19 20406080100 ASR (%) 0 20 40 60 80 100 (7) GTSRB-5% VGG19 20406080100 ASR (%) 0 20 40 60 80 100 (8) Tiny-5% VGG19 BadNetsBlendedLCSIGLFSSBAInput-awareWaNet No defenseFTFPNADNCANPACSpectralABLDBD (c) Attack-defense pairs with VGG-19 and 5% poisoning ratio on CIFAR-10. Figure 6: Performance distribution of attack-defense pairs on different model structure and poisoning ratios. A successful attack method should be high C-Acc and ASR, while a successful defense method should be high C-Acc and low ASR. Besides, if the reduced ASR value equals to the increased R-Acc, the color patters would be close to the anti-diagonal line. 26 BadNetsBlendedLCSIGLFSSBAInput-awareWaNet Attacks 0 25 50 75 100 ASR (%) (1) PreAct-ResNet18-5%: No defense BadNetsBlendedLCSIGLFSSBAInput-awareWaNet Attacks 0 25 50 75 100 (2) PreAct-ResNet18-5%: FT BadNetsBlendedLCSIGLFSSBAInput-awareWaNet Attacks 0 25 50 75 100 (3) PreAct-ResNet18-5%: FP BadNetsBlendedLCSIGLFSSBAInput-awareWaNet Attacks 0 25 50 75 100 ASR (%) (4) PreAct-ResNet18-5%: NAD BadNetsBlendedLCSIGLFSSBAInput-awareWaNet Attacks 0 25 50 75 100 (5) PreAct-ResNet18-5%: NC BadNetsBlendedLCSIGLFSSBAInput-awareWaNet Attacks 0 25 50 75 100 (6) PreAct-ResNet18-5%: ANP BadNetsBlendedLCSIGLFSSBAInput-awareWaNet Attacks 0 25 50 75 100 ASR (%) (7) PreAct-ResNet18-5%: AC BadNetsBlendedLCSIGLFSSBAInput-awareWaNet Attacks 0 25 50 75 100 (8) PreAct-ResNet18-5%: Spectral BadNetsBlendedLCSIGLFSSBAInput-awareWaNet Attacks 0 25 50 75 100 (9) PreAct-ResNet18-5%: ABL BadNetsBlendedLCSIGLFSSBAInput-awareWaNet Attacks 0 25 50 75 100 ASR (%) (10) PreAct-ResNet18-5%: DBD CIFAR10CIFAR100GTSRBTiny Figure 7: The effects of different datasets on backdoor learning. Note that for the clean-label (i.e., LC [50] and SIG [2]) attack, the number of poisoned samples must be less than the target class size, thus it may be not applied to the case of high poisoning ratios.) 10%5%1%0.5%0.1% Poison Ratio 0 20 40 60 80 100 ASR (%) (1) PreAct-ResNet18: No defense 10%5%1%0.5%0.1% Poison Ratio 0 20 40 60 80 100 (2) PreAct-ResNet18: FT 10%5%1%0.5%0.1% Poison Ratio 0 20 40 60 80 100 (3) PreAct-ResNet18: FP 10%5%1%0.5%0.1% Poison Ratio 0 20 40 60 80 100 (4) PreAct-ResNet18: NC 10%5%1%0.5%0.1% Poison Ratio 0 20 40 60 80 100 ASR (%) (5) PreAct-ResNet18: ANP 10%5%1%0.5%0.1% Poison Ratio 0 20 40 60 80 100 (6) PreAct-ResNet18: AC 10%5%1%0.5%0.1% Poison Ratio 0 20 40 60 80 100 (7) PreAct-ResNet18: Spectral 10%5%1%0.5%0.1% Poison Ratio 0 20 40 60 80 100 (8) PreAct-ResNet18: ABL BadNetsBlendedLCSIGLFSSBAInput-awareWaNet Figure 8: The effects of different poisoning ratios of backdoor learning with 5 random seeds. 27 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 ASR (%) (1) VGG19: No defense 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (2) VGG19: FT 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (3) VGG19: FP 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (4) VGG19: NAD 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (5) VGG19: NC 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 ASR (%) (6) VGG19: AC 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (7) VGG19: Spectral 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (8) VGG19: ABL BadNetsBlendedLCSIGLFSSBAInput-awareWaNet (a) The variation of ASR on different poisoning ratios with VGG-19 and CIFAR-10. 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 ASR (%) (1) DenseNet-161: No defense 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (2) DenseNet-161: FT 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (3) DenseNet-161: FP 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (4) DenseNet-161: NAD 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (5) DenseNet-161: NC 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 ASR (%) (6) DenseNet-161: ANP 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (7) DenseNet-161: AC 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (8) DenseNet-161: Spectral 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (9) DenseNet-161: ABL 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (10) DenseNet-161: DBD BadNetsBlendedLCSIGLFSSBAInput-awareWaNet (b) The variation of ASR on different poisoning ratios with DenseNet-161 and CIFAR-10. 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 ASR (%) (1) EfficientNet-B3: No defense 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (2) EfficientNet-B3: FT 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (3) EfficientNet-B3: FP 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (4) EfficientNet-B3: NAD 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (5) EfficientNet-B3: NC 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 ASR (%) (6) EfficientNet-B3: ANP 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (7) EfficientNet-B3: AC 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (8) EfficientNet-B3: Spectral 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (9) EfficientNet-B3: ABL 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (10) EfficientNet-B3: DBD BadNetsBlendedLCSIGLFSSBAInput-awareWaNet (c) The variation of ASR on different poisoning ratios with EfficientNet-B3 and CIFAR-10. 28 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 ASR (%) (1) MobileNetV3-Large: No defense 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (2) MobileNetV3-Large: FT 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (3) MobileNetV3-Large: FP 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (4) MobileNetV3-Large: NAD 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (5) MobileNetV3-Large: NC 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 ASR (%) (6) MobileNetV3-Large: ANP 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (7) MobileNetV3-Large: AC 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (8) MobileNetV3-Large: Spectral 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (9) MobileNetV3-Large: ABL 10%5%1%0.5%0.1% Poison Rate 0 20 40 60 80 100 (10) MobileNetV3-Large: DBD BadNetsBlendedLCSIGLFSSBAInput-awareWaNet (d) The variation of ASR on different poisoning ratios with MobileNetV3-Large and CIFAR-10. Figure 9: The effect of different ratios on backdoor learning. From (a) to (d), the structure of models are different. In the condition of no defense, the higher poisoning ratio, the higher ASR value. In the defense situation, some ASR curves raise with the increase of poisoning ratio, while some curves go up first and then sharply drop down. It could also be noticed that the performances of same defense method on different model structures are distinctive,i.e., ABL on VGG-19 and DenseNet-161. Note that we donât provide the results of ANP and DBD on VGG-19, and the reason is illustrated in Section B.4.2. 29 Table 6: Sensitivity results on CIFAR10 with PreAct-ResNet18. No Defense No Defense No Defense ABL ABL ABL ABL ABL ABL ABL ABL ABL ABL ABL ABL ABL ABL ABL ANP ANP ANP ANP ANP ANP ANP ANP ANP ANP ANP ANP ANP ANP ANP \ \ \ 0.1 0.1 0.1 0.5 0.5 0.5 0.9 0.9 0.9 1.3 1.3 1.3 1.7 1.7 1.7 0.2 0.2 0.2 0.3 0.3 0.3 0.4 0.4 0.4 0.5 0.5 0.5 0.6 0.6 0.6 C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) BadNets 1 88.81 64.61 33.90 83.50 0.01 90.12 82.09 0.12 87.72 83.66 0.03 89.82 10.00 100.00 0.00 8.51 99.74 0.07 76.44 38.08 58.50 82.39 9.14 78.18 81.49 2.17 80.29 69.58 1.20 70.16 57.70 2.09 58.03 BadNets 2 90.20 90.23 9.32 83.85 0.00 90.82 83.66 0.01 90.09 86.10 0.03 90.72 83.23 0.00 89.42 10.00 100.00 0.00 82.74 17.92 72.26 83.50 4.41 80.21 80.89 0.43 80.99 78.04 0.29 81.40 67.91 0.04 74.24 BadNets 3 91.32 95.03 4.67 85.45 0.01 90.43 82.96 0.00 88.78 82.69 0.00 90.06 84.10 0.01 89.82 84.20 0.01 90.58 86.93 8.09 83.27 87.46 2.87 85.68 85.37 1.20 84.69 80.17 0.43 81.80 70.27 0.07 74.50 BadNets 4 92.12 96.94 2.84 84.96 0.00 90.73 84.89 0.00 90.67 83.93 0.01 90.04 82.58 0.00 90.37 84.01 0.00 90.80 88.45 4.97 86.09 88.05 1.17 88.08 83.35 0.18 86.18 75.67 0.11 79.26 69.23 0.09 72.72 BadNets 5 93.24 97.87 2.03 80.35 0.03 87.86 79.11 0.00 86.49 81.73 0.00 89.67 81.73 0.00 90.30 80.71 0.00 89.62 90.47 6.29 83.17 88.12 1.34 84.39 83.92 0.21 82.67 82.23 0.21 82.79 84.23 0.17 86.81 SIG 1 84.75 48.31 49.69 67.84 0.00 69.82 56.99 0.00 58.98 62.08 0.00 68.39 47.52 0.00 49.50 52.05 0.00 57.00 84.97 10.97 80.12 86.49 11.62 80.44 84.60 5.80 85.11 83.24 3.53 86.01 80.79 1.41 84.93 SIG 2 84.65 83.22 16.41 74.41 0.00 65.97 68.86 0.00 69.53 67.62 0.00 72.92 71.82 0.00 72.42 64.90 0.00 67.59 84.05 19.07 65.84 84.94 17.30 70.73 83.23 13.64 70.00 80.06 6.16 74.82 76.59 4.63 70.16 SIG 3 84.55 90.11 9.73 77.02 0.00 61.33 69.57 0.00 67.66 74.04 0.00 74.47 72.98 0.00 71.80 67.89 0.00 67.14 84.70 25.48 59.76 83.10 12.87 62.52 81.74 8.00 62.59 80.23 4.02 62.81 78.49 1.12 71.80 SIG 4 84.47 97.16 2.82 74.14 0.00 51.79 57.33 0.00 62.82 68.04 0.00 63.59 65.23 0.00 60.92 53.67 0.00 64.31 83.81 9.59 65.92 82.31 6.98 67.88 82.87 7.59 66.82 81.78 3.21 65.49 80.45 1.01 64.67 SIG 5 84.52 97.18 2.80 73.70 0.00 65.23 56.90 0.00 61.12 59.87 0.00 55.80 41.41 0.00 49.43 54.33 0.00 52.24 82.37 1.73 59.69 81.77 1.48 56.46 81.36 1.98 58.32 80.00 1.99 62.07 77.82 0.82 57.62 Input-aware 0.032 90.94 89.22 10.11 61.30 95.94 3.12 78.60 93.34 5.36 48.16 100.00 0.00 47.99 98.61 0.97 49.40 25.06 34.81 90.59 2.40 86.34 90.27 3.93 84.11 89.64 5.17 80.08 88.43 7.22 77.42 85.79 8.61 75.84 Input-aware 0.048 90.98 91.81 7.70 80.78 90.71 7.56 34.29 99.33 0.28 16.89 99.96 0.04 42.13 94.16 3.23 52.34 11.12 47.86 91.33 3.03 84.57 91.13 2.78 84.76 90.72 3.77 84.42 89.25 5.62 78.68 86.97 7.07 74.92 Input-aware 0.064 89.94 92.30 7.29 79.11 98.81 1.01 67.28 99.84 0.10 39.14 99.98 0.01 55.76 97.41 1.73 60.86 15.43 55.21 90.26 1.48 86.79 89.83 1.44 85.66 89.86 1.87 86.02 87.99 3.97 83.12 82.33 4.22 77.69 Input-aware 0.08 90.69 95.97 3.91 74.14 5.90 62.78 64.92 98.67 0.97 33.29 99.97 0.01 31.56 99.38 0.29 80.89 0.00 84.03 90.26 1.00 87.07 89.64 1.51 85.48 90.34 1.98 85.22 88.98 2.68 82.12 87.66 4.08 78.22 Input-aware 0.096 90.61 95.58 4.17 87.96 0.27 82.32 34.55 99.83 0.02 10.19 100.00 0.00 15.27 99.88 0.00 82.02 0.00 87.09 89.95 1.56 86.84 90.20 1.28 86.92 89.96 2.46 85.90 89.29 2.84 85.02 87.62 2.29 83.34 30 Table 7: Sensitivity results on CIFAR10 with VGG-19. No Defense No Defense No Defense ABL ABL ABL ABL ABL ABL ABL ABL ABL ABL ABL ABL ABL ABL ABL \ \ \ 0.1 0.1 0.1 0.5 0.5 0.5 0.9 0.9 0.9 1.3 1.3 1.3 1.7 1.7 1.7 C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) BadNets 1 85.79 76.44 22.46 84.14 70.67 26.70 71.31 45.73 43.34 53.99 45.03 36.38 10.00 100.00 0.00 10.00 100.00 0.00 BadNets 2 87.26 93.76 5.80 84.55 73.70 23.83 85.18 89.32 9.62 83.58 88.21 10.67 78.82 85.81 12.76 10.00 100.00 0.00 BadNets 3 88.75 95.77 3.93 85.93 91.29 7.87 84.67 90.51 8.56 84.31 93.03 6.28 83.75 92.74 6.54 79.32 91.17 7.73 BadNets 4 89.50 96.73 3.08 86.41 93.91 5.52 86.77 92.56 6.80 87.24 94.44 5.02 85.75 95.06 4.50 85.69 94.64 4.90 BadNets 5 89.87 97.03 2.78 88.04 96.18 3.53 88.67 96.74 3.02 87.79 96.98 2.76 88.22 97.04 2.73 88.28 97.50 2.27 SIG 1 82.20 41.61 53.47 80.54 41.06 51.78 80.55 44.52 49.36 80.68 44.10 50.00 80.33 44.80 49.26 80.14 45.06 47.74 SIG 2 81.92 74.87 21.84 80.16 72.33 23.38 80.16 76.11 20.68 80.39 78.21 19.44 80.02 82.79 14.37 80.05 83.04 14.23 SIG 3 81.44 88.27 8.38 80.25 87.62 10.23 80.79 89.33 9.21 80.14 87.14 10.50 80.46 85.22 11.08 80.40 90.36 7.99 SIG 4 81.44 98.03 1.42 80.73 98.43 1.32 80.51 98.39 1.40 80.45 99.27 0.61 80.55 98.76 1.01 78.89 94.52 4.13 SIG 5 82.16 99.50 0.30 80.04 99.34 0.42 80.89 99.19 0.63 80.17 99.17 0.72 80.58 98.56 1.08 80.01 98.41 1.24 Input-aware 0.032 88.48 96.77 2.89 88.27 90.49 8.19 88.18 92.08 6.90 24.65 100.00 0.00 86.56 7.87 73.64 10.00 100.00 0.00 Input-aware 0.048 88.86 94.98 4.44 88.31 81.49 16.21 88.43 79.66 17.93 88.78 72.57 24.50 10.00 100.00 0.00 10.00 100.00 0.00 Input-aware 0.064 88.71 85.72 12.91 88.58 84.52 13.64 76.06 98.67 1.03 10.00 100.00 0.00 50.51 0.00 37.17 10.00 100.00 0.00 Input-aware 0.08 88.54 97.00 2.61 87.81 84.16 13.40 88.22 86.89 11.50 88.04 88.20 10.16 87.66 87.62 10.60 10.00 100.00 0.00 Input-aware 0.096 89.11 96.52 3.36 88.01 81.91 15.76 88.74 83.54 14.17 88.38 84.06 14.08 87.39 6.69 73.10 10.00 100.00 0.00 31 Table 8: Sensitivity results on GTSRB with PreAct-ResNet18. No Defense No Defense No Defense ABL ABL ABL ABL ABL ABL ABL ABL ABL ABL ABL ABL ABL ABL ABL ANP ANP ANP ANP ANP ANP ANP ANP ANP ANP ANP ANP ANP ANP ANP \ \ \ 0.1 0.1 0.1 0.5 0.5 0.5 0.9 0.9 0.9 1.3 1.3 1.3 1.7 1.7 1.7 0.2 0.2 0.2 0.3 0.3 0.3 0.4 0.4 0.4 0.5 0.5 0.5 0.6 0.6 0.6 C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) ACC ASR RA BadNets 1 95.97 92.25 7.48 90.19 0.00 91.02 85.45 0.01 85.45 0.48 100.00 0.00 0.48 100.00 0.00 0.48 100.00 0.00 95.00 9.75 89.14 94.19 3.51 93.16 93.38 3.70 92.39 91.23 2.35 90.80 88.51 0.70 88.70 BadNets 2 96.83 93.99 5.98 93.60 0.00 94.15 93.21 0.00 93.72 93.93 0.00 94.53 91.68 0.00 92.32 91.65 0.00 91.93 95.10 0.07 95.19 96.22 0.00 96.23 96.09 0.01 96.17 93.28 0.00 93.37 89.28 0.00 89.69 BadNets 3 97.56 94.84 5.10 82.26 0.00 82.29 93.82 0.00 94.21 93.49 0.00 93.77 94.37 0.00 94.91 71.26 0.00 71.92 97.59 16.49 82.91 96.66 0.12 96.46 96.68 0.00 96.79 94.93 0.00 95.06 93.35 0.00 93.75 BadNets 4 97.31 96.83 3.07 94.54 0.00 94.98 95.20 0.00 95.67 95.01 0.00 95.45 93.97 0.00 94.44 93.92 0.00 94.29 97.75 0.00 97.82 97.50 0.00 97.64 96.10 0.00 96.32 93.74 0.00 94.02 91.93 0.00 92.31 BadNets 5 97.85 97.49 2.46 80.69 0.00 81.11 93.60 0.00 94.11 92.45 0.00 92.90 89.10 0.00 89.63 82.58 0.00 83.09 98.00 0.00 98.04 97.98 0.00 98.01 97.61 0.00 97.57 97.00 0.00 97.02 95.39 0.00 95.38 Input-aware 0.032 97.23 97.36 2.52 41.34 85.39 7.55 29.45 68.56 13.83 7.90 74.31 0.56 6.73 83.58 2.13 3.79 90.03 0.06 96.88 0.01 95.25 95.62 0.00 93.80 94.39 0.00 91.91 91.84 0.00 88.30 91.46 0.00 88.44 Input-aware 0.048 97.48 96.67 3.31 64.47 50.61 27.53 12.82 94.71 0.51 5.48 80.84 1.35 7.05 96.89 0.31 18.07 76.04 4.65 97.27 0.00 96.91 96.70 0.00 95.93 96.72 0.00 96.09 96.49 0.00 95.69 96.34 0.02 95.12 Input-aware 0.064 97.66 88.88 10.54 52.05 66.21 16.32 9.57 79.77 2.32 4.50 62.74 1.99 27.28 48.58 13.97 3.63 91.19 1.19 96.63 0.31 94.58 96.44 0.28 94.32 95.63 0.22 92.90 95.65 0.20 93.02 94.21 0.45 91.69 Input-aware 0.08 97.77 96.65 3.34 15.19 70.62 5.27 12.72 41.96 6.54 19.73 80.36 3.37 25.81 55.12 11.89 5.82 92.60 1.89 97.14 0.00 95.02 96.23 0.00 93.87 95.85 0.00 93.44 95.40 0.04 91.86 94.75 0.02 90.53 Input-aware 0.096 98.26 97.24 2.74 23.83 67.91 7.46 25.49 75.73 6.00 1.63 96.47 0.25 0.86 99.55 0.00 1.69 98.63 0.00 97.69 0.64 96.25 97.54 0.48 96.04 97.03 0.16 95.53 96.59 0.32 94.71 95.12 0.29 92.84 32 Table 9: Sensitivity results on GTSRB with VGG-19. No Defense No Defense No Defense ABL ABL ABL ABL ABL ABL ABL ABL ABL ABL ABL ABL ABL ABL ABL \ \ \ 0.1 0.1 0.1 0.5 0.5 0.5 0.9 0.9 0.9 1.3 1.3 1.3 1.7 1.7 1.7 ACC ASR RA ACC ASR RA ACC ASR RA ACC ASR RA ACC ASR RA ACC ASR RA BadNets 1 96.17 89.01 9.84 96.13 91.85 7.81 0.48 100.00 0.00 0.48 100.00 0.00 0.48 100.00 0.00 0.48 100.00 0.00 BadNets 2 95.20 93.50 5.91 0.48 100.00 0.00 0.48 100.00 0.00 0.48 100.00 0.00 0.48 100.00 0.00 57.59 96.01 2.79 BadNets 3 96.14 94.52 5.18 0.48 100.00 0.00 70.24 42.78 41.52 0.48 100.00 0.00 0.48 100.00 0.00 0.48 100.00 0.00 BadNets 4 94.35 96.38 3.31 96.26 95.55 4.27 96.26 93.09 6.57 95.56 93.35 6.38 92.91 93.20 6.26 90.07 91.03 8.23 BadNets 5 95.77 96.40 3.31 96.63 96.36 3.37 96.63 96.86 2.80 96.31 96.25 3.45 95.93 96.13 3.64 96.38 96.12 3.75 Input-aware 0.032 97.51 88.97 10.61 96.83 53.95 43.74 96.63 58.14 40.04 95.94 59.78 38.02 0.48 100.00 0.00 0.48 100.00 0.00 Input-aware 0.048 97.44 60.09 39.36 96.35 61.02 37.30 8.99 99.83 0.17 0.48 100.00 0.00 0.48 100.00 0.00 0.48 100.00 0.00 Input-aware 0.064 96.55 89.63 9.99 96.67 54.98 43.28 96.71 51.89 45.87 0.48 100.00 0.00 0.48 100.00 0.00 0.48 100.00 0.00 Input-aware 0.08 96.89 86.45 13.43 96.46 51.20 46.48 96.68 44.12 53.95 0.48 100.00 0.00 0.48 100.00 0.00 0.48 100.00 0.00 Input-aware 0.096 96.25 67.77 31.54 96.16 49.47 47.90 0.48 100.00 0.00 0.48 100.00 0.00 0.48 100.00 0.00 0.48 100.00 0.00 33 020406080100 Epoch 0.00 0.25 0.50 0.75 1.00 1.25 1.50 1.75 2.00 Loss 1e4 Loss: BadNets 10% 020406080100 Epoch 0 20 40 60 80 100 Accuracy (%) Accuracy (%): BadNets 10% 020406080100 Epoch 0.0 0.2 0.4 0.6 0.8 1.0 1.2 1.4 GSNR 1e1 GSNR: BadNets 10% 020406080100 Epoch 0 2 4 6 8 10 Gradient Norm Gradient Norm: BadNets 10% 020406080100 Epoch 1.00 0.75 0.50 0.25 0.00 0.25 0.50 0.75 1.00 Cosine Similarity Cosine Similarity: BadNets 10% 020406080100 Epoch 0.0 0.2 0.4 0.6 0.8 1.0 1.2 Loss 1e4 Loss: Blended 10% 020406080100 Epoch 60 70 80 90 100 Accuracy (%) Accuracy (%): Blended 10% 020406080100 Epoch 0.0 0.2 0.4 0.6 0.8 1.0 1.2 GSNR 1e1 GSNR: Blended 10% 020406080100 Epoch 0 5 10 15 20 25 30 35 Gradient Norm Gradient Norm: Blended 10% 020406080100 Epoch 0.2 0.0 0.2 0.4 0.6 0.8 1.0 Cosine Similarity Cosine Similarity: Blended 10% 020406080100 Epoch 0.0 0.2 0.4 0.6 0.8 1.0 1.2 1.4 1.6 Loss 1e4 Loss: SSBA 10% 020406080100 Epoch 50 60 70 80 90 100 Accuracy (%) Accuracy (%): SSBA 10% 020406080100 Epoch 0.0 0.5 1.0 1.5 2.0 2.5 GSNR 1e1 GSNR: SSBA 10% 020406080100 Epoch 0 5 10 15 20 25 30 35 40 Gradient Norm Gradient Norm: SSBA 10% 020406080100 Epoch 0.75 0.50 0.25 0.00 0.25 0.50 0.75 1.00 Cosine Similarity Cosine Similarity: SSBA 10% 020406080100 Epoch 0.0 0.5 1.0 1.5 2.0 2.5 Loss 1e4 Loss: LC 10% 020406080100 Epoch 0 20 40 60 80 100 Accuracy (%) Accuracy (%): LC 10% 020406080100 Epoch 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 GSNR 1e1 GSNR: LC 10% 020406080100 Epoch 0 10 20 30 40 50 Gradient Norm Gradient Norm: LC 10% 020406080100 Epoch 0.75 0.50 0.25 0.00 0.25 0.50 0.75 1.00 Cosine Similarity Cosine Similarity: LC 10% 020406080100 Epoch 0.0 0.2 0.4 0.6 0.8 1.0 1.2 Loss 1e4 Loss: LF 10% 020406080100 Epoch 60 70 80 90 100 Accuracy (%) Accuracy (%): LF 10% 020406080100 Epoch 0.0 0.2 0.4 0.6 0.8 1.0 1.2 GSNR 1e1 GSNR: LF 10% 020406080100 Epoch 0 5 10 15 20 25 30 Gradient Norm Gradient Norm: LF 10% 020406080100 Epoch 0.4 0.2 0.0 0.2 0.4 0.6 0.8 1.0 Cosine Similarity Cosine Similarity: LF 10% Total TrainClean TrainPosioned TrainClean TestPoisoned TestTotal-CleanTotal-PoisonedClean-Poisoned Figure 10: Analysis of the quick learning phenomenon based on the details of the backdoor learning process. From the first column to the last column, we report the curves of loss, accuracy, GSNR, gradient norm and cosine similarity of gradients in poisoned samples, clean samples and all samples, respectively. Table 10: Evaluation of ViT-b-16 on CIFAR-10 with10%poisoning ratio. No defenseFTNCABL Backdoor AttackC-Acc (%)ASR (%)R-Acc (%)C-Acc (%)ASR (%)R-Acc (%)C-Acc (%)ASR (%)R-Acc (%)C-Acc (%)ASR (%)R-Acc (%) BadNets94.5894.115.6642.008.8138.6036.0911.1233.6010.000.0011.11 Blended96.4799.720.2841.367.2436.2944.923.9039.4096.8899.810.19 LC86.8799.840.1633.0316.4024.3640.6811.1730.7487.3399.760.23 SIG87.0192.607.2844.460.7825.9287.0192.607.2887.6086.4713.39 SSBA96.3097.582.3445.357.6243.4946.248.1743.6096.7898.221.70 Input-aware92.1096.283.5189.5625.1469.9143.137.7937.8196.7093.216.58 Table 11: BadNets and Blended attack result on ImageNet C-AccASRR-Acc BadNets69.2175.860.33 Blended 69.2498.590.11 34 0369121518 Number of forgetting events 0.0 0.2 0.4 0.6 0.8 1.0 Fraction of corresponding samples BadNets, 0.1%, C-Acc:93.61%, ASR:1.23% 0369121518 Number of forgetting events 0.0 0.2 0.4 0.6 0.8 1.0 Fraction of corresponding samples BadNets, 0.5%, C-Acc:93.76%, ASR:50.06% 0369121518 Number of forgetting events 0.0 0.2 0.4 0.6 0.8 1.0 Fraction of corresponding samples BadNets, 1%, C-Acc:93.14%, ASR:74.73% 0369121518 Number of forgetting events 0.0 0.2 0.4 0.6 0.8 1.0 Fraction of corresponding samples BadNets, 5%, C-Acc:92.64%, ASR:88.74% 0369121518 Number of forgetting events 0.0 0.2 0.4 0.6 0.8 1.0 Fraction of corresponding samples BadNets, 10%, C-Acc:91.32%, ASR:95.03% 0369121518 Number of forgetting events 0.0 0.2 0.4 0.6 0.8 1.0 Fraction of corresponding samples Blended, 0.1%, C-Acc:93.80%, ASR:56.11% 0369121518 Number of forgetting events 0.0 0.2 0.4 0.6 0.8 1.0 Fraction of corresponding samples Blended, 0.5%, C-Acc:93.68%, ASR:93.30% 0369121518 Number of forgetting events 0.0 0.2 0.4 0.6 0.8 1.0 Fraction of corresponding samples Blended, 1%, C-Acc:93.76%, ASR:94.88% 0369121518 Number of forgetting events 0.0 0.2 0.4 0.6 0.8 1.0 Fraction of corresponding samples Blended, 5%, C-Acc:93.67%, ASR:99.62% 0369121518 Number of forgetting events 0.0 0.2 0.4 0.6 0.8 1.0 Fraction of corresponding samples Blended, 10%, C-Acc:93.47%, ASR:99.92% 0369121518 Number of forgetting events 0.0 0.2 0.4 0.6 0.8 1.0 Fraction of corresponding samples SSBA, 0.1%, C-Acc:93.89%, ASR:1.62% 0369121518 Number of forgetting events 0.0 0.2 0.4 0.6 0.8 1.0 Fraction of corresponding samples SSBA, 0.5%, C-Acc:93.41%, ASR:35.67% 0369121518 Number of forgetting events 0.0 0.2 0.4 0.6 0.8 1.0 Fraction of corresponding samples SSBA, 1%, C-Acc:93.43%, ASR:73.44% 0369121518 Number of forgetting events 0.0 0.2 0.4 0.6 0.8 1.0 Fraction of corresponding samples SSBA, 5%, C-Acc:93.27%, ASR:94.91% 0369121518 Number of forgetting events 0.0 0.2 0.4 0.6 0.8 1.0 Fraction of corresponding samples SSBA, 10%, C-Acc:92.88%, ASR:97.86% Clean examples Poisoned examples Figure 11: Distributions of forgetting events of clean training examples and poisoned examples in CIFAR-10 with Preact-Resnet18 backbone. Figure 12: Analysis of trigger generalization in Blended attack: a) the training trigger with 10% trans- parency; b) the training trigger with 20% transparency; c) the training trigger with 30% transparency. For each case, we evaluate the attack success rate of testing triggers with the transparency 10%, 20%, and 30%, respectively. BadNets SampleBadNets+No DefenseBadNets+FTBadNets+ACBadNets+ABLBadNets+SpectralBadNets+NCBadNets+DBDBadNets+ANP Blended SampleBlended+No DefenseBlended+FTBlended+ACBlended+ABLBlended+SpectralBlended+NCBlended+DBDBlended+ANP SSBA SampleSSBA+No DefenseSSBA+FTSSBA+ACSSBA+ABLSSBA+SpectralSSBA+NCSSBA+DBDSSBA+ANP WaNet SampleWaNet+No DefenseWaNet+FTWaNet+ACWaNet+ABLWaNet+SpectralWaNet+NCWaNet+DBDWaNet+ANP Figure 13: Shapley Value visualization of regions contributed to model decision under different attack methods and defense methods with PreAct-ResNet18 and5%poisoning rate on CIFAR-100. 35 BadNets SampleBadNets+No DefenseBadNets+FTBadNets+ACBadNets+ABLBadNets+SpectralBadNets+NCBadNets+DBDBadNets+ANP Blended SampleBlended+No DefenseBlended+FTBlended+ACBlended+ABLBlended+SpectralBlended+NCBlended+DBDBlended+ANP SSBA SampleSSBA+No DefenseSSBA+FTSSBA+ACSSBA+ABLSSBA+SpectralSSBA+NCSSBA+DBDSSBA+ANP WaNet SampleWaNet+No DefenseWaNet+FTWaNet+ACWaNet+ABLWaNet+SpectralWaNet+NCWaNet+DBDWaNet+ANP Figure 14: Grad-CAM visualization of regions contributed to model decision under different attack methods and defense methods with PreAct-ResNet18 and5%poisoning rate on CIFAR-100. BadNets SampleBadNets+No DefenseBadNets+FTBadNets+ACBadNets+ABLBadNets+SpectralBadNets+NCBadNets+DBDBadNets+ANP Blended SampleBlended+No DefenseBlended+FTBlended+ACBlended+ABLBlended+SpectralBlended+NCBlended+DBDBlended+ANP SSBA SampleSSBA+No DefenseSSBA+FTSSBA+ACSSBA+ABLSSBA+SpectralSSBA+NCSSBA+DBDSSBA+ANP WaNet SampleWaNet+No DefenseWaNet+FTWaNet+ACWaNet+ABLWaNet+SpectralWaNet+NCWaNet+DBDWaNet+ANP Figure 15: Shapley Value visualization of regions contributed to model decision under different attack methods and defense methods with PreAct-ResNet18 and5%poisoning rate on GTSRB. 36 BadNets SampleBadNets+No DefenseBadNets+FTBadNets+ACBadNets+ABLBadNets+SpectralBadNets+NCBadNets+DBDBadNets+ANP Blended SampleBlended+No DefenseBlended+FTBlended+ACBlended+ABLBlended+SpectralBlended+NCBlended+DBDBlended+ANP SSBA SampleSSBA+No DefenseSSBA+FTSSBA+ACSSBA+ABLSSBA+SpectralSSBA+NCSSBA+DBDSSBA+ANP WaNet SampleWaNet+No DefenseWaNet+FTWaNet+ACWaNet+ABLWaNet+SpectralWaNet+NCWaNet+DBDWaNet+ANP Figure 16: Grad-CAM visualization of regions contributed to model decision under different attack methods and defense methods with PreAct-ResNet18 and5%poisoning rate on GTSRB. BadNets SampleBadNets+No DefenseBadNets+FTBadNets+ACBadNets+ABLBadNets+SpectralBadNets+NCBadNets+DBDBadNets+ANP Blended SampleBlended+No DefenseBlended+FTBlended+ACBlended+ABLBlended+SpectralBlended+NCBlended+DBDBlended+ANP SSBA SampleSSBA+No DefenseSSBA+FTSSBA+ACSSBA+ABLSSBA+SpectralSSBA+NCSSBA+DBDSSBA+ANP WaNet SampleWaNet+No DefenseWaNet+FTWaNet+ACWaNet+ABLWaNet+SpectralWaNet+NCWaNet+DBDWaNet+ANP Figure 17: Shapley Value visualization of regions contributed to model decision under different attack methods and defense methods with PreAct-ResNet18 and5%poisoning rate on Tiny ImageNet. 37 BadNets SampleBadNets+No DefenseBadNets+FTBadNets+ACBadNets+ABLBadNets+SpectralBadNets+NCBadNets+DBDBadNets+ANP Blended SampleBlended+No DefenseBlended+FTBlended+ACBlended+ABLBlended+SpectralBlended+NCBlended+DBDBlended+ANP SSBA SampleSSBA+No DefenseSSBA+FTSSBA+ACSSBA+ABLSSBA+SpectralSSBA+NCSSBA+DBDSSBA+ANP WaNet SampleWaNet+No DefenseWaNet+FTWaNet+ACWaNet+ABLWaNet+SpectralWaNet+NCWaNet+DBDWaNet+ANP Figure 18: Grad-CAM visualization of regions contributed to model decision under different attack methods and defense methods with PreAct-ResNet18 and5%poisoning rate on Tiny ImageNet. BadNets SampleBadNets+No DefenseBadNets+FTBadNets+ACBadNets+ABLBadNets+SpectralBadNets+NCBadNets+DBDBadNets+ANP Blended SampleBlended+No DefenseBlended+FTBlended+ACBlended+ABLBlended+SpectralBlended+NCBlended+DBDBlended+ANP SSBA SampleSSBA+No DefenseSSBA+FTSSBA+ACSSBA+ABLSSBA+SpectralSSBA+NCSSBA+DBDSSBA+ANP WaNet SampleWaNet+No DefenseWaNet+FTWaNet+ACWaNet+ABLWaNet+SpectralWaNet+NCWaNet+DBDWaNet+ANP LF SampleLF+No DefenseLF+FTLF+ACLF+ABLLF+SpectralLF+NCLF+DBDLF+ANP Figure 19: Frequency visualization of regions which contribute to model classification under different attack methods and defense methods with PreAct-ResNet18 and 10% poisoning rate on CIFAR-10. Warmer color was allocated to higher value whose range is 0 to 255. 38 Table 12: Full results on backdoor attack and defense methods for BERT No defenseOnion Backdoor AttackDatasetC-Acc (%)ASR (%)R-Acc (%)C-Acc (%)ASR (%)R-Acc (%) LWSSST-289.0194.084.2886.2090.429.58 LWSOLID82.6797.920.8379.0796.773.23 LWSAgNews93.1199.190.6192.1068.0310.97 HiddenKillerSST-290.3488.9311.0785.6788.2711.73 HiddenKillerOLID82.1997.422.5981.3796.123.88 HiddenKillerAgNews93.4998.671.1292.0595.164.21 39 Table 13: Full results on CIFAR-10 with 10% poisoning ratio. Backdoor Defense No defense FT FP NAD NC ANP AC Spectral ABL DBD Targeted Model Backdoor Attack C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) PreAct-Resnet18 BadNets 91.32 95.03 4.67 89.96 1.48 89.39 91.31 57.13 41.62 89.87 2.14 88.71 89.05 1.27 89.16 84.17 0.73 84.04 88.80 86.23 13.28 89.98 92.41 7.20 83.32 0.00 89.02 89.65 1.28 89.17 PreAct-Resnet18 Blended 93.47 99.92 0.08 92.78 96.11 3.57 93.17 99.26 0.73 92.17 97.69 2.14 93.47 99.92 0.08 86.58 2.19 61.17 88.52 99.72 0.28 90.35 99.84 0.14 77.30 0.73 64.52 69.91 99.98 0.02 PreAct-Resnet18 LC 84.59 99.92 0.07 90.83 11.34 59.58 89.53 0.44 13.32 90.54 11.28 59.57 90.43 6.99 62.00 82.16 4.81 49.64 81.39 98.97 0.79 83.93 99.50 0.47 71.84 0.00 58.52 61.71 0.00 54.01 PreAct-Resnet18 SIG 84.48 98.27 1.72 90.80 2.37 69.74 89.10 26.20 20.61 90.02 10.66 64.20 84.48 98.27 1.72 77.97 0.01 48.80 82.41 94.61 5.17 83.01 92.27 7.40 57.80 0.00 59.97 60.67 100.00 0.00 PreAct-Resnet18 LF 93.19 99.28 0.71 92.37 78.44 19.42 92.90 98.97 1.02 92.37 47.83 47.49 91.62 1.41 87.48 85.15 0.60 82.72 88.92 98.09 1.72 92.58 98.67 1.28 81.72 0.21 84.81 50.98 99.70 0.08 PreAct-Resnet18 SSBA 92.88 97.86 1.99 92.14 74.79 23.31 92.54 83.50 15.36 91.91 77.40 20.86 90.99 0.58 87.04 86.54 0.39 79.87 90.00 96.23 3.53 89.63 90.50 8.71 80.79 0.00 84.66 63.50 99.51 0.39 PreAct-Resnet18 Input-aware 90.67 98.26 1.66 93.12 1.72 90.53 91.74 0.04 44.54 93.18 1.68 91.12 92.61 0.76 90.87 90.36 1.64 86.99 91.48 88.62 10.61 91.39 90.43 9.13 63.19 90.16 5.77 78.60 8.54 75.28 PreAct-Resnet18 WaNet 91.25 89.73 9.76 93.48 17.10 78.29 91.46 1.09 69.73 93.17 22.98 72.69 91.80 7.53 85.09 85.73 0.43 86.50 91.93 96.80 3.06 91.94 90.17 9.37 83.19 0.00 85.86 80.90 6.61 77.61 VGG-19 BadNets 89.36 95.93 3.81 88.08 25.42 69.68 89.23 92.61 6.82 87.51 38.17 58.30 87.86 1.00 88.01 NA NA NA 86.25 94.37 5.17 88.07 91.67 7.78 85.13 93.92 5.50 10.00 100.00 0.00 VGG-19 Blended 90.17 99.12 0.82 88.76 94.37 5.22 90.07 99.11 0.82 88.35 93.08 6.33 85.92 1.79 74.13 NA NA NA 87.58 98.13 1.76 89.18 99.76 0.23 88.61 99.48 0.46 10.00 100.00 0.00 VGG-19 LC 82.21 97.46 1.78 84.78 6.29 56.39 85.37 96.94 2.23 85.99 8.36 56.48 82.21 97.46 1.78 NA NA NA 77.85 36.31 39.68 80.85 62.94 26.56 81.08 97.59 1.71 10.00 0.00 11.10 VGG-19 SIG 81.69 99.80 0.12 86.89 98.16 1.68 84.52 99.93 0.07 86.01 99.18 0.77 81.69 99.80 0.12 NA NA NA 79.60 99.94 0.06 80.27 97.77 1.89 80.53 99.81 0.16 10.00 0.00 11.11 VGG-19 LF 88.94 93.93 5.62 87.88 62.84 33.01 88.98 91.80 7.46 87.85 59.38 35.01 85.35 9.99 72.79 NA NA NA 83.07 89.39 8.59 87.88 92.83 6.44 87.89 93.17 6.00 10.00 100.00 0.00 VGG-19 SSBA 89.48 91.86 7.29 88.20 46.28 47.83 89.40 89.66 9.22 87.65 37.54 54.58 89.48 91.86 7.29 NA NA NA 88.62 92.26 6.98 89.61 92.60 6.81 87.66 8.69 78.41 10.00 0.00 11.11 VGG-19 Input-aware 77.69 94.59 4.79 74.74 13.39 57.97 78.62 86.77 11.79 75.70 23.36 54.71 77.67 94.58 4.79 NA NA NA 83.52 82.57 15.20 87.22 84.71 13.58 88.30 86.48 12.00 10.00 100.00 0.00 VGG-19 WaNet 88.43 88.90 10.30 91.03 30.04 64.93 89.61 73.39 24.57 90.82 44.93 51.18 88.43 88.89 10.30 NA NA NA 87.96 92.56 7.02 87.76 96.24 3.53 86.29 91.77 7.22 10.00 100.00 0.00 EfficientNet-B3 BadNets 57.48 9.51 55.59 53.69 5.09 52.96 57.97 3.88 57.46 55.29 4.50 54.68 57.48 9.53 55.58 57.48 9.53 55.58 39.76 17.28 36.51 37.64 15.50 36.11 36.44 8.51 36.29 54.44 94.26 3.91 EfficientNet-B3 Blended 65.11 87.76 8.01 61.16 8.60 44.66 65.21 59.03 24.14 62.76 11.86 46.32 59.93 3.87 51.80 65.11 87.76 8.01 34.58 63.32 15.88 53.68 70.81 17.58 18.14 1.91 15.51 52.10 99.94 0.04 EfficientNet-B3 LC 62.09 1.61 47.72 60.25 7.71 41.83 64.23 6.18 45.48 62.79 6.62 43.46 62.10 1.61 47.73 62.10 1.61 47.73 39.81 0.21 39.38 47.70 0.10 42.64 20.44 0.00 19.62 60.13 0.00 53.02 EfficientNet-B3 SIG 58.14 99.71 0.13 56.92 3.98 24.03 58.83 0.12 10.84 58.27 3.63 25.83 58.15 99.71 0.13 58.15 99.71 0.13 46.07 99.16 0.26 52.64 98.14 0.76 11.79 9.58 32.02 45.49 99.96 0.04 EfficientNet-B3 LF 56.95 80.06 10.51 53.91 26.43 31.87 56.71 64.11 18.17 55.09 34.42 30.13 52.09 16.62 37.49 53.01 67.98 15.43 34.42 72.51 9.41 52.27 68.96 15.03 41.86 32.03 32.39 50.48 99.21 0.58 EfficientNet-B3 SSBA 55.76 24.40 45.50 53.42 7.10 49.32 56.49 6.07 52.97 54.70 6.91 50.72 55.77 24.40 45.49 55.77 24.40 45.49 29.94 29.13 25.88 49.67 13.80 45.66 27.37 15.74 24.19 51.82 99.27 0.59 EfficientNet-B3 Input-aware 70.01 94.96 2.34 67.84 50.37 17.97 65.61 7.03 15.66 70.30 48.93 22.64 67.47 54.81 8.14 70.01 29.92 27.78 47.20 99.39 0.07 42.22 98.13 0.26 17.30 16.47 17.13 54.13 100.00 0.00 EfficientNet-B3 WaNet 71.73 7.93 69.33 70.80 3.59 67.96 25.27 7.43 26.20 73.23 3.14 70.88 71.74 7.93 69.33 71.74 7.93 69.33 37.78 14.34 35.28 52.44 7.11 51.91 37.97 7.66 35.89 58.83 18.44 54.87 MobileNetV3-Large BadNets 82.45 93.39 5.84 77.99 3.00 77.00 82.36 93.97 5.32 79.02 4.57 76.22 75.19 2.53 74.62 82.04 3.72 80.87 70.46 89.98 7.77 78.12 92.83 5.93 76.57 83.59 13.33 57.21 86.84 9.67 MobileNetV3-Large Blended 83.43 98.76 1.13 78.94 12.27 53.93 83.13 1.46 19.52 79.88 18.81 52.72 77.59 3.53 65.72 75.56 95.02 3.97 71.48 95.08 3.33 79.18 98.16 1.46 76.00 79.02 15.63 51.67 99.64 0.31 MobileNetV3-Large LC 75.53 98.67 0.84 76.54 6.70 49.44 80.79 0.13 11.80 78.11 6.50 49.93 76.19 6.08 49.88 72.72 0.00 52.46 66.01 95.06 2.73 72.31 98.46 0.87 67.38 99.99 0.01 56.71 0.00 49.44 MobileNetV3-Large SIG 77.13 98.70 1.04 78.09 2.51 42.93 82.00 0.00 17.41 79.10 1.87 37.86 77.13 98.70 1.04 73.49 78.30 14.40 67.85 99.33 0.46 73.47 97.99 1.33 63.20 90.66 5.63 48.42 100.00 0.00 MobileNetV3-Large LF 82.73 96.63 1.77 77.92 24.54 44.76 82.22 0.60 13.33 78.98 10.08 57.00 82.73 96.63 1.77 75.45 5.44 58.76 72.37 96.33 2.32 79.61 96.58 2.42 75.32 64.92 25.42 51.40 99.37 0.49 MobileNetV3-Large SSBA 81.84 85.06 12.16 77.80 6.94 68.71 82.14 62.99 29.57 78.35 9.51 68.06 75.95 3.96 71.43 76.26 58.59 30.71 67.79 57.71 29.01 76.85 72.18 21.61 76.22 31.27 50.26 53.93 97.93 1.51 MobileNetV3-Large Input-aware 77.35 89.17 9.12 78.20 7.09 62.23 79.80 3.32 57.37 79.82 4.46 64.80 76.77 4.37 67.01 77.35 89.17 9.12 71.36 69.29 21.37 78.58 75.03 19.74 73.96 78.38 15.32 50.01 99.98 0.01 MobileNetV3-Large WaNet 78.00 70.88 24.80 80.40 4.14 77.22 24.71 9.89 20.82 81.81 3.56 78.97 78.00 70.88 24.80 78.57 4.71 76.30 69.61 43.82 41.47 77.59 53.23 36.92 59.83 58.71 29.79 58.66 12.30 54.99 DenseNet-161 BadNets 84.33 89.68 9.10 83.59 32.70 56.87 85.16 87.51 10.81 82.28 68.73 26.47 83.10 1.84 82.36 76.53 0.29 79.92 73.17 79.32 16.60 81.13 87.71 10.59 76.32 1.02 79.38 67.41 15.23 64.12 DenseNet-161 Blended 86.37 98.79 1.04 84.39 81.83 14.74 85.95 98.98 0.88 83.69 72.82 19.60 83.17 1.01 72.90 78.93 2.06 65.93 75.45 94.31 4.23 82.06 97.01 2.44 67.81 2.16 73.28 56.66 99.53 0.40 DenseNet-161 LC 78.68 78.06 13.88 83.27 9.91 52.53 83.92 41.48 36.57 82.56 9.10 52.42 81.20 7.69 51.92 81.97 20.44 47.62 70.16 12.41 47.31 75.94 61.46 24.82 59.56 51.84 21.53 72.36 0.00 60.77 DenseNet-161 SIG 78.63 98.67 1.23 83.49 19.30 49.21 83.23 27.57 38.66 82.70 18.47 48.69 81.62 7.99 43.91 74.25 2.64 45.37 69.85 98.34 1.33 75.61 98.71 1.18 43.47 0.00 60.47 45.40 96.77 3.10 DenseNet-161 LF 84.32 91.70 6.90 83.07 62.07 31.20 83.93 92.04 6.42 82.51 62.29 30.13 81.11 10.73 67.60 78.50 6.73 70.53 72.91 83.24 12.26 80.61 88.47 9.20 64.40 23.01 53.82 59.62 98.29 1.46 DenseNet-161 SSBA 84.18 84.13 13.39 83.76 32.84 55.90 84.26 83.76 13.49 82.80 29.79 57.22 81.68 8.49 71.78 76.82 1.23 74.62 71.94 60.54 29.57 79.68 75.13 20.34 68.13 0.59 77.33 67.25 97.62 1.93 DenseNet-161 Input-aware 84.46 94.41 5.18 86.77 2.69 82.02 85.15 22.34 60.34 86.47 10.31 76.64 84.45 94.41 5.18 84.03 4.06 75.08 74.19 89.66 7.73 81.64 91.82 6.68 63.79 13.14 51.26 74.12 77.46 17.14 DenseNet-161 WaNet 84.61 73.81 22.72 87.52 2.34 84.48 85.72 24.61 64.71 87.30 6.26 81.16 87.10 1.86 85.07 84.21 1.24 83.69 72.07 41.99 43.37 80.04 65.82 28.01 30.37 97.74 1.58 65.25 10.98 62.00 40 Table 14: Full results on CIFAR-10 with 5% poisoning ratio. Backdoor Defense â No defense FT FP NAD NC ANP AC Spectral ABL DBD Targeted Model Backdoor Attack â C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) PreAct-Resnet18 BadNets 92.64 88.74 10.78 91.22 4.49 88.22 92.47 17.47 77.90 91.03 4.73 87.93 89.89 1.17 89.70 87.24 0.34 87.34 90.27 75.61 23.58 91.21 69.40 29.21 84.08 0.00 90.50 87.68 2.11 87.01 PreAct-Resnet18 Blended 93.67 99.61 0.39 93.25 98.78 1.21 93.46 98.87 1.11 93.10 99.06 0.93 93.66 99.61 0.39 88.00 11.98 58.50 91.54 98.93 1.03 91.43 99.42 0.56 65.78 0.00 48.48 75.00 99.99 0.01 PreAct-Resnet18 LC 93.29 99.50 0.43 92.54 96.34 2.81 93.38 96.71 2.60 92.74 97.62 1.89 91.51 3.58 64.46 84.07 5.06 53.84 89.33 97.29 1.89 92.56 99.50 0.40 75.91 99.37 0.44 81.88 5.83 60.38 PreAct-Resnet18 SIG 93.64 97.09 2.90 92.84 96.42 3.46 93.27 99.79 0.20 92.49 96.98 2.93 93.65 97.09 2.90 86.64 0.21 49.61 90.24 93.32 6.31 91.79 96.36 3.31 46.14 0.00 42.30 74.86 95.58 4.22 PreAct-Resnet18 LF 93.35 98.03 1.86 93.21 93.62 6.02 93.14 98.37 1.53 92.98 94.23 5.30 93.35 98.03 1.86 86.32 2.66 82.79 89.02 95.14 4.29 92.36 97.32 2.49 66.54 98.02 1.27 83.98 15.67 73.11 PreAct-Resnet18 SSBA 93.27 94.91 4.82 93.08 87.46 11.69 93.05 87.14 12.09 92.49 88.63 10.58 91.04 0.80 87.93 87.53 0.66 81.63 88.47 92.64 6.63 92.01 93.19 6.38 81.60 0.09 79.76 72.19 11.34 65.42 PreAct-Resnet18 Input-aware 91.52 90.20 8.91 93.12 89.34 9.99 91.89 52.74 44.49 93.07 97.12 2.68 91.51 90.20 8.91 91.54 2.22 86.40 92.07 92.20 7.36 92.02 83.81 14.84 58.14 92.58 4.84 76.23 6.12 71.99 PreAct-Resnet18 WaNet 91.76 85.50 13.49 93.47 31.32 64.03 92.14 26.10 63.50 93.31 50.40 46.46 91.76 85.50 13.49 87.21 0.57 87.69 91.96 88.72 10.88 91.47 83.84 15.16 69.49 95.20 3.79 72.22 9.93 69.41 VGG-19 BadNets 89.83 94.36 5.39 89.14 50.56 47.02 89.81 90.32 9.09 88.42 74.51 23.89 88.51 1.04 88.31 NA NA NA 88.26 93.10 6.34 88.79 90.78 8.58 86.03 91.93 7.30 10.00 0.00 11.11 VGG-19 Blended 90.41 97.98 1.79 88.58 90.47 8.72 90.21 97.93 1.84 88.84 92.68 6.70 86.92 2.61 73.99 NA NA NA 87.76 97.69 2.16 88.98 96.72 2.93 88.99 98.44 1.38 10.00 100.00 0.00 VGG-19 LC 89.08 43.06 40.10 88.88 9.06 56.80 89.34 38.50 42.84 88.15 9.63 55.72 89.08 43.06 40.10 NA NA NA 82.71 22.52 47.77 87.12 31.88 45.01 87.43 32.10 44.93 10.00 0.00 11.11 VGG-19 SIG 90.41 96.76 2.84 89.10 88.24 9.74 90.55 97.72 2.12 88.96 91.34 7.30 90.41 96.76 2.84 NA NA NA 87.27 98.78 0.90 88.99 97.44 2.34 88.77 98.67 0.94 10.00 0.00 11.11 VGG-19 LF 90.13 86.04 12.50 88.83 55.80 39.23 89.86 83.69 14.77 88.82 54.51 40.07 87.25 8.58 76.39 NA NA NA 83.83 79.07 17.70 87.98 83.29 14.96 88.14 87.57 10.91 10.00 100.00 0.00 VGG-19 SSBA 89.93 81.19 17.14 88.76 28.17 63.28 89.81 78.61 19.68 88.07 43.93 48.86 87.31 2.27 83.27 NA NA NA 85.84 90.62 8.31 85.70 89.97 8.93 88.50 78.44 19.02 10.00 100.00 0.00 VGG-19 Input-aware 89.34 71.66 25.77 90.95 67.67 30.98 89.90 52.58 43.51 90.51 81.62 17.73 89.58 2.88 85.30 NA NA NA 89.75 63.24 34.06 89.85 87.07 12.23 88.47 73.49 23.22 10.00 100.00 0.00 VGG-19 WaNet 89.25 3.96 86.71 90.71 1.51 89.57 90.25 1.66 89.08 90.61 1.67 89.40 89.25 3.96 86.69 NA NA NA 88.46 36.68 57.16 89.26 70.89 26.74 87.86 61.62 34.01 10.00 100.00 0.00 EfficientNet-B3 BadNets 65.64 5.89 63.88 59.52 4.87 58.43 65.25 3.88 63.88 61.81 5.16 60.73 59.43 5.26 58.31 65.63 5.89 63.88 22.57 29.76 18.66 53.12 5.74 53.69 28.52 0.59 30.34 61.60 7.78 58.69 EfficientNet-B3 Blended 60.01 74.83 16.40 56.49 12.34 46.38 60.17 40.16 35.48 57.84 14.21 46.59 56.36 6.81 50.76 60.03 74.83 16.40 42.21 34.89 29.42 48.44 48.06 27.62 21.82 1.67 21.02 54.29 99.76 0.16 EfficientNet-B3 LC 64.51 4.21 47.20 60.11 6.26 42.83 64.17 5.24 46.06 61.92 6.34 43.88 64.51 4.21 47.20 64.52 4.21 47.20 41.33 3.44 35.99 45.58 2.17 40.57 35.42 0.70 30.23 56.91 0.00 50.79 EfficientNet-B3 SIG 58.53 99.14 0.49 55.06 51.48 16.71 58.40 99.90 0.06 57.17 77.53 6.64 58.53 99.14 0.49 58.53 99.14 0.49 51.52 95.52 1.06 49.99 78.09 7.32 15.16 3.90 30.32 51.11 99.84 0.16 EfficientNet-B3 LF 65.28 72.09 18.27 59.67 24.57 40.54 64.82 61.31 25.09 62.17 31.12 39.78 65.28 72.09 18.29 59.63 63.22 22.91 39.57 62.76 12.42 45.71 45.27 22.03 19.26 1.18 26.59 53.88 92.93 5.76 EfficientNet-B3 SSBA 54.95 9.90 50.79 51.60 6.06 48.04 55.34 4.92 52.62 53.56 5.18 50.54 49.90 6.07 46.79 54.95 9.90 50.79 21.40 24.82 15.90 33.54 7.20 32.74 41.18 2.46 43.70 51.90 94.34 4.20 EfficientNet-B3 Input-aware 69.70 76.47 14.31 68.92 24.61 29.56 70.82 92.27 4.89 71.31 38.64 29.27 69.70 76.48 14.31 67.50 68.93 18.04 26.39 25.76 15.89 45.29 82.23 5.24 37.72 20.82 23.64 53.93 100.00 0.00 EfficientNet-B3 WaNet 75.39 6.54 72.43 75.09 3.40 71.98 22.92 9.50 23.82 76.70 3.04 73.76 75.40 6.54 72.43 75.38 6.54 72.43 32.49 14.92 30.50 50.28 5.21 49.14 31.79 2.16 30.56 60.35 14.66 57.27 MobileNetV3-Large BadNets 83.18 90.00 8.71 78.11 8.72 72.71 83.10 88.03 10.32 79.63 27.41 58.87 78.49 2.26 78.38 80.28 2.14 79.68 72.75 18.83 62.50 79.63 87.69 10.51 78.45 60.51 32.31 53.18 13.63 47.53 MobileNetV3-Large Blended 83.42 97.33 2.20 78.90 23.47 45.70 83.23 93.77 3.99 79.77 39.41 38.86 77.04 1.24 64.69 79.78 85.10 9.87 74.29 90.76 6.42 79.64 95.78 3.22 75.78 41.17 40.08 57.67 99.28 0.56 MobileNetV3-Large LC 84.22 95.91 2.50 79.71 19.31 42.97 84.10 89.06 4.77 80.16 19.51 42.46 78.37 5.14 50.92 78.74 1.58 50.86 70.86 8.96 46.90 79.01 15.07 47.02 73.13 7.29 47.21 58.75 4.89 43.84 MobileNetV3-Large SIG 83.94 96.22 2.94 79.24 9.37 38.82 83.36 39.13 6.80 80.44 1.90 35.63 76.71 2.13 26.93 78.81 91.87 5.33 73.52 97.22 1.38 80.17 97.47 1.84 69.30 77.48 10.98 56.42 99.83 0.16 MobileNetV3-Large LF 83.72 94.53 3.68 79.08 20.36 42.89 83.43 2.10 18.79 79.87 33.41 35.68 83.72 94.53 3.69 79.78 93.99 4.48 71.50 92.72 4.69 79.95 94.10 4.31 75.86 20.68 45.43 52.09 98.72 0.93 MobileNetV3-Large SSBA 82.61 69.64 24.54 78.82 5.88 69.96 83.11 49.07 41.52 79.71 5.94 70.81 77.47 4.11 71.47 81.30 13.74 67.24 72.00 28.52 51.40 77.75 39.94 47.41 73.52 33.99 47.99 59.90 8.68 54.46 MobileNetV3-Large Input-aware 74.68 81.37 14.32 79.10 8.98 60.80 81.66 11.82 55.38 80.94 13.62 60.89 74.69 81.37 14.32 69.82 4.00 59.12 72.51 69.34 20.30 79.26 71.50 22.36 75.14 73.21 18.50 57.04 42.62 40.57 MobileNetV3-Large WaNet 79.32 2.89 77.70 80.48 3.87 77.00 25.72 6.04 25.84 81.90 3.17 78.84 79.31 2.89 77.69 77.00 1.68 77.02 70.73 13.66 62.89 78.55 19.11 65.11 71.38 14.89 64.13 58.93 10.87 55.47 DenseNet-161 BadNets 85.45 79.87 17.67 84.25 29.62 61.13 85.64 67.23 28.78 83.21 18.31 69.02 83.65 1.86 83.31 76.93 0.81 77.64 74.54 49.81 39.56 82.18 75.22 21.18 76.24 1.30 79.72 69.28 7.92 66.36 DenseNet-161 Blended 86.13 96.62 2.82 85.39 80.74 15.21 86.12 97.39 2.21 84.33 84.80 12.00 83.85 1.11 72.52 79.02 8.52 58.57 75.87 86.00 10.60 83.54 93.57 5.29 69.55 0.96 70.88 61.29 99.63 0.27 DenseNet-161 LC 85.48 13.72 52.01 84.77 6.90 53.80 85.73 18.38 50.31 83.42 6.77 53.48 80.28 5.21 52.33 84.12 7.73 53.79 75.27 7.83 49.63 82.10 10.42 51.54 52.71 7.88 33.29 73.46 5.40 53.57 DenseNet-161 SIG 86.11 95.21 4.31 84.50 90.47 8.01 86.17 99.63 0.34 84.34 93.00 6.27 86.11 95.21 4.31 80.15 1.07 52.21 75.42 95.82 2.83 83.18 95.77 3.29 46.71 0.00 59.73 71.73 99.74 0.26 DenseNet-161 LF 85.68 82.56 14.63 84.44 61.66 32.17 85.33 85.21 12.29 84.12 63.42 29.66 85.68 82.56 14.64 78.71 14.82 62.93 74.10 67.89 22.76 82.06 71.04 24.11 63.15 75.29 16.44 69.51 23.63 58.00 DenseNet-161 SSBA 84.85 60.30 33.34 84.04 21.57 64.80 85.08 60.28 33.21 83.06 24.70 61.50 80.66 2.76 76.33 79.57 1.87 75.02 74.06 32.03 51.08 81.67 35.71 53.11 73.42 3.30 73.79 57.81 57.22 33.79 DenseNet-161 Input-aware 84.85 79.39 18.21 86.90 19.72 69.07 85.15 23.92 47.97 87.12 39.70 53.51 84.95 5.60 78.01 80.35 5.03 69.46 75.33 68.40 23.80 82.04 67.87 25.66 64.93 65.19 20.90 61.04 41.13 42.82 DenseNet-161 WaNet 83.47 36.49 55.96 87.57 1.47 85.53 85.60 2.20 82.43 87.49 1.69 85.42 86.56 1.41 85.31 78.95 0.93 78.93 74.42 12.70 65.02 81.20 27.40 59.36 51.05 58.31 25.43 68.03 5.57 66.28 41 Table 15: Full results on CIFAR-10 with 1% poisoning ratio. Backdoor Defense No defense FT FP NAD NC ANP AC Spectral ABL DBD Targeted Model Backdoor Attack C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) PreAct-Resnet18 BadNets 93.14 74.73 24.24 93.07 10.36 84.58 92.98 20.18 75.87 92.52 8.33 85.96 91.64 0.88 91.68 84.67 0.29 85.30 88.88 27.18 68.14 92.62 74.20 24.88 72.81 53.20 41.31 78.09 2.99 76.51 PreAct-Resnet18 Blended 93.76 94.88 4.79 93.53 91.96 7.56 93.48 94.14 5.41 93.34 92.07 7.41 90.98 65.91 29.24 86.92 37.01 40.68 89.77 86.09 12.67 93.27 93.32 6.28 66.26 0.17 34.91 70.18 8.04 55.60 PreAct-Resnet18 LC 93.78 90.63 7.14 93.54 87.16 9.53 93.61 80.14 15.04 93.25 87.16 9.74 91.83 3.67 64.41 89.57 10.61 54.67 89.44 12.12 56.28 92.57 37.36 44.67 68.49 11.79 40.93 76.07 6.47 56.98 PreAct-Resnet18 SIG 93.82 83.40 14.29 93.59 88.17 10.13 93.48 88.07 10.08 93.41 83.20 14.22 93.82 83.40 14.29 91.82 23.63 50.47 90.00 74.81 18.61 93.09 85.91 12.12 64.33 0.00 20.51 75.01 67.82 29.87 PreAct-Resnet18 LF 93.56 86.46 12.88 93.35 82.54 16.36 93.25 86.58 12.60 93.34 84.43 14.64 93.56 86.46 12.87 88.11 6.36 78.78 89.49 76.22 21.40 92.68 82.19 16.68 60.04 55.07 30.76 79.13 7.47 75.38 PreAct-Resnet18 SSBA 93.43 73.44 24.89 93.24 61.32 35.98 93.34 52.76 43.53 93.33 67.03 30.83 90.45 1.22 85.77 91.68 2.19 87.52 89.61 27.92 64.11 92.71 54.79 42.18 83.11 56.33 37.69 78.52 1.13 74.21 PreAct-Resnet18 Input-aware 91.74 79.18 19.89 93.14 77.68 21.59 92.20 53.69 43.89 93.07 85.13 14.37 91.74 79.19 19.88 85.88 7.54 75.41 89.44 60.56 36.07 92.78 60.14 37.84 72.26 69.31 24.89 69.66 14.36 62.67 PreAct-Resnet18 WaNet 90.65 12.63 79.94 93.61 0.68 92.72 92.07 0.93 91.10 93.61 0.78 92.67 90.65 12.66 79.92 84.96 0.59 86.37 89.53 4.87 84.87 92.79 8.81 84.56 65.43 53.43 37.98 79.74 4.60 78.46 VGG-19 BadNets 90.45 83.98 15.14 89.12 55.17 42.29 90.38 78.61 20.21 88.69 64.76 32.97 88.97 1.09 88.82 NA NA NA 85.63 24.59 67.54 89.01 76.46 22.03 61.58 0.00 63.51 10.00 100.00 0.00 VGG-19 Blended 90.47 89.53 9.62 89.47 79.83 18.20 90.35 89.63 9.36 88.91 77.71 19.63 90.47 89.53 9.62 NA NA NA 85.58 75.17 20.99 89.19 80.57 17.41 89.42 91.72 7.50 10.00 0.00 11.11 VGG-19 LC 89.97 12.82 57.99 88.88 5.86 59.07 90.24 9.06 59.30 88.46 6.70 58.13 89.97 12.82 57.99 NA NA NA 85.33 9.48 53.43 89.01 10.94 56.49 88.99 8.10 57.00 10.00 0.00 11.11 VGG-19 SIG 90.85 83.77 12.48 89.73 78.64 16.28 90.90 84.90 11.68 88.96 81.96 13.19 90.85 83.77 12.48 NA NA NA 85.13 81.56 10.79 89.60 84.94 10.11 88.90 81.74 10.44 10.00 0.00 11.11 VGG-19 LF 90.21 37.54 56.47 89.28 14.09 75.01 90.08 33.28 60.03 88.61 17.16 72.53 86.32 13.96 70.97 NA NA NA 85.06 29.23 57.84 88.99 35.40 56.44 89.08 40.22 51.77 10.00 0.00 11.11 VGG-19 SSBA 89.96 10.97 79.72 89.12 2.07 85.58 90.08 6.51 82.83 88.41 3.54 83.54 86.30 1.82 83.72 NA NA NA 84.44 9.38 75.92 89.32 11.18 78.73 83.86 41.68 50.47 10.00 0.00 11.11 VGG-19 Input-aware 89.47 58.09 37.13 90.53 31.96 59.36 89.36 34.62 56.88 90.52 33.00 58.20 89.56 3.12 79.97 NA NA NA 85.47 51.47 39.04 89.47 59.71 33.80 89.07 57.51 33.98 10.00 100.00 0.00 VGG-19 WaNet 89.99 1.71 88.73 90.99 0.98 90.36 90.19 1.03 89.39 91.10 0.99 89.96 88.10 1.86 86.39 NA NA NA 85.59 5.10 81.23 89.13 7.22 82.47 88.77 4.46 84.63 10.00 100.00 0.00 EfficientNet-B3 BadNets 53.13 3.80 52.84 51.77 5.11 51.18 53.02 3.71 52.91 51.90 4.80 51.68 53.14 3.80 52.86 53.14 3.80 52.86 41.98 5.04 41.56 52.04 5.06 51.59 33.27 0.38 36.04 54.48 14.17 50.13 EfficientNet-B3 Blended 61.57 10.86 53.18 56.29 6.03 50.60 61.45 7.81 53.77 58.03 7.46 50.78 55.16 7.88 48.56 61.56 10.86 53.18 43.94 7.39 38.89 47.60 7.32 42.41 35.26 3.80 31.24 54.63 21.17 44.53 EfficientNet-B3 LC 56.94 6.16 43.44 53.54 7.39 40.60 56.75 6.98 42.86 53.89 7.32 40.70 56.94 6.16 43.42 56.93 6.16 43.43 47.77 5.07 39.94 56.44 4.88 43.53 31.63 0.87 27.87 53.83 6.44 42.61 EfficientNet-B3 SIG 63.63 3.87 57.93 58.45 4.19 53.78 63.40 3.87 56.98 59.74 3.84 54.73 56.33 3.91 52.39 63.63 3.87 57.93 35.75 5.22 30.99 58.10 50.37 22.01 19.45 0.43 22.10 57.50 92.52 6.33 EfficientNet-B3 LF 54.70 24.88 35.17 52.61 15.18 38.44 54.35 22.14 36.57 52.77 18.54 37.48 54.70 24.88 35.21 54.72 24.89 35.19 42.25 27.97 22.99 46.90 19.41 33.39 34.85 4.46 40.93 53.93 22.30 45.90 EfficientNet-B3 SSBA 59.42 4.49 55.76 54.16 4.97 51.54 59.00 4.17 55.98 56.16 4.17 53.53 53.40 4.31 50.70 59.41 4.49 55.77 47.26 4.76 45.46 44.90 3.72 44.13 20.08 0.44 21.16 60.79 9.40 55.36 EfficientNet-B3 Input-aware 55.80 5.49 51.03 57.46 5.72 52.08 57.59 4.66 53.21 57.65 5.52 52.86 55.80 5.49 51.03 55.80 5.49 51.03 26.59 3.33 26.52 51.95 4.92 50.17 26.46 0.49 25.91 58.61 13.90 49.27 EfficientNet-B3 WaNet 73.07 2.36 72.02 70.35 3.67 68.36 73.11 3.09 70.62 72.37 3.16 70.53 73.07 2.36 72.03 73.08 2.36 72.02 37.20 6.48 36.21 48.72 4.07 48.66 24.81 3.97 24.49 55.71 11.70 51.37 MobileNetV3-Large BadNets 84.46 3.29 83.43 79.60 2.90 78.88 84.49 2.39 83.86 80.57 3.06 79.41 76.69 3.18 75.83 84.46 3.29 83.44 71.90 3.29 71.38 80.26 2.27 79.89 74.35 2.20 73.61 58.82 10.08 55.67 MobileNetV3-Large Blended 83.97 87.06 10.17 79.49 34.61 43.20 83.68 86.11 11.04 80.32 49.88 33.21 75.70 1.31 64.01 83.97 87.06 10.17 73.15 54.56 29.51 80.54 73.33 19.72 77.90 20.27 50.97 56.87 5.32 49.92 MobileNetV3-Large LC 84.16 6.07 54.64 79.79 5.99 51.09 84.03 5.84 54.31 80.39 5.84 51.68 84.16 6.07 54.64 84.16 6.07 54.64 75.08 5.41 50.02 79.99 5.63 52.07 73.65 6.74 47.09 57.11 11.82 40.33 MobileNetV3-Large SIG 84.48 80.79 10.77 79.56 56.01 19.70 84.14 83.76 8.98 80.45 51.67 24.00 84.47 80.78 10.78 81.53 76.63 11.02 74.42 83.90 6.59 80.67 93.54 3.30 75.36 38.56 22.60 57.16 96.63 3.08 MobileNetV3-Large LF 83.08 86.32 9.90 78.38 43.78 29.79 83.01 82.91 10.43 79.35 51.60 30.91 83.08 86.32 9.90 78.15 82.87 13.17 73.08 77.50 15.39 80.14 81.94 14.14 73.96 82.94 11.36 57.34 46.93 36.30 MobileNetV3-Large SSBA 83.28 9.71 73.78 79.80 3.34 74.14 83.47 5.91 76.06 80.32 3.46 74.42 77.10 3.44 73.00 83.29 9.72 73.78 72.41 7.77 64.59 79.81 6.82 72.84 74.49 6.96 70.17 55.41 12.18 47.22 MobileNetV3-Large Input-aware 80.80 90.72 7.16 80.36 30.52 46.96 82.48 97.43 2.16 81.48 67.33 22.24 80.80 90.72 7.16 77.21 90.06 7.29 73.48 58.49 26.27 80.07 58.91 28.87 75.28 62.62 22.73 57.37 13.47 47.87 MobileNetV3-Large WaNet 80.86 1.66 80.02 81.45 2.29 79.06 81.75 3.31 79.11 82.29 2.17 80.59 78.78 2.98 76.29 80.86 1.66 80.02 73.11 3.36 71.50 80.71 3.29 78.17 74.24 1.73 74.30 57.06 13.52 53.11 DenseNet-161 BadNets 86.30 16.32 73.38 85.26 3.47 82.79 86.37 5.34 82.39 84.78 3.81 82.31 86.31 16.32 73.37 84.66 1.99 83.98 76.19 3.10 74.84 83.52 1.76 83.23 64.73 14.99 55.49 70.15 4.59 67.93 DenseNet-161 Blended 86.65 79.32 16.94 85.51 61.74 31.10 86.62 80.12 16.32 84.99 59.03 32.52 83.29 34.52 48.90 79.59 23.09 56.71 75.87 31.92 49.54 83.77 1.98 73.92 63.97 12.18 45.19 69.93 3.24 63.78 DenseNet-161 LC 86.56 5.31 56.19 85.20 5.24 55.74 86.73 7.53 55.01 84.45 5.71 54.50 83.25 5.11 53.88 85.27 4.87 55.83 76.68 5.13 50.01 83.23 5.16 54.30 57.96 5.21 36.70 64.14 8.63 47.22 DenseNet-161 SIG 86.63 82.66 13.49 85.15 75.18 17.83 86.45 90.18 8.10 84.83 74.54 17.31 86.62 82.66 13.49 80.20 22.66 43.33 76.56 67.29 18.46 83.35 71.78 17.77 60.91 0.00 64.33 63.01 96.00 3.42 DenseNet-161 LF 86.50 39.24 51.92 85.30 25.14 62.66 86.55 36.29 54.33 84.59 25.77 62.47 81.74 12.98 68.17 81.30 8.97 71.61 76.28 33.22 48.16 83.62 9.50 72.83 58.25 40.64 38.84 70.35 6.90 65.79 DenseNet-161 SSBA 86.31 6.56 79.24 85.06 3.33 80.96 86.30 4.56 80.80 85.20 4.89 79.11 86.33 6.58 79.24 82.14 2.00 77.64 76.03 8.27 68.61 83.34 2.98 79.43 60.19 10.17 54.78 72.51 4.87 67.28 DenseNet-161 Input-aware 84.21 66.37 25.18 87.30 86.13 11.41 85.31 97.56 1.84 86.90 88.99 8.88 84.21 66.39 25.16 78.26 2.36 64.17 76.47 59.51 28.89 82.86 71.41 22.10 58.24 60.71 21.26 64.53 5.49 57.70 DenseNet-161 WaNet 85.73 2.17 84.99 87.99 1.17 86.56 85.33 2.59 83.23 87.56 1.32 85.92 86.31 1.46 84.94 83.74 1.62 83.32 76.44 2.98 74.06 82.87 2.71 79.66 55.54 4.13 49.88 69.10 7.19 65.28 42 Table 16: Full results on CIFAR-10 with 0.5% poisoning ratio. Backdoor Defense â No defense FT FP NAD NC ANP AC Spectral ABL DBD Targeted Model Backdoor Attack â C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) PreAct-Resnet18 BadNets 93.76 50.06 48.14 93.49 4.94 89.83 93.67 5.01 89.60 93.30 7.67 87.31 92.83 0.62 92.67 91.32 0.76 91.31 89.51 2.29 88.72 92.97 7.91 87.31 68.40 71.78 22.14 73.60 0.10 80.01 PreAct-Resnet18 Blended 93.68 93.30 6.37 93.46 90.68 8.79 93.30 93.28 6.39 93.48 91.97 7.60 90.64 60.71 33.92 89.90 53.54 36.19 90.14 75.23 22.02 93.08 88.18 10.91 61.89 26.51 38.22 71.18 0.01 71.24 PreAct-Resnet18 LC 93.66 18.61 58.08 93.55 10.82 62.28 93.77 10.43 62.17 93.64 12.67 61.42 89.58 4.06 61.68 91.50 6.60 61.48 89.54 7.31 58.98 92.76 13.64 60.19 60.68 11.68 36.51 78.33 3.73 60.48 PreAct-Resnet18 SIG 93.80 82.43 14.90 93.51 81.77 15.53 93.69 84.59 12.18 93.65 81.64 15.43 93.80 82.43 14.90 90.11 14.97 50.53 89.66 65.29 25.72 93.26 64.04 27.10 70.52 85.82 6.64 77.35 72.37 25.28 PreAct-Resnet18 LF 93.85 75.09 23.57 93.62 69.64 28.33 93.31 74.16 24.02 93.37 71.56 26.64 93.85 75.09 23.57 85.00 4.43 76.66 89.21 63.48 32.44 92.68 71.50 26.83 82.88 77.69 18.56 88.95 3.63 86.48 PreAct-Resnet18 SSBA 93.41 35.67 59.99 93.36 27.97 66.46 93.37 16.99 76.30 93.28 30.91 63.73 93.41 35.66 60.00 85.04 1.66 78.94 89.90 9.72 80.02 92.96 23.64 69.98 74.04 45.26 42.54 80.12 7.00 75.22 PreAct-Resnet18 Input-aware 90.66 56.06 41.27 93.22 75.64 23.93 91.93 73.21 25.83 93.36 79.54 20.07 90.66 56.07 41.27 88.61 9.02 74.30 89.82 62.34 33.44 92.98 60.34 37.51 66.84 62.16 22.96 77.50 3.80 71.36 PreAct-Resnet18 WaNet 91.27 1.12 91.24 93.99 0.76 92.83 92.34 1.11 91.49 93.67 0.89 92.67 91.27 1.12 91.24 91.27 1.12 91.24 89.48 2.57 86.66 92.94 3.59 89.34 42.48 75.28 19.77 64.90 0.00 72.59 VGG-19 BadNets 90.28 3.71 88.48 89.10 1.53 88.62 90.09 2.02 89.38 88.65 1.76 88.09 87.78 1.59 87.47 NA NA NA 85.36 1.93 84.76 89.21 16.31 77.04 60.84 92.12 7.18 10.00 0.00 11.11 VGG-19 Blended 90.85 74.69 22.60 89.54 57.18 37.21 90.70 74.49 22.49 88.65 63.59 31.11 90.85 74.69 22.60 NA NA NA 85.21 50.44 39.43 89.60 69.44 26.39 89.15 78.13 18.86 10.00 0.00 11.11 VGG-19 LC 90.63 8.27 60.39 89.45 5.09 60.03 90.76 6.48 60.78 89.10 4.86 59.49 90.63 8.27 60.40 NA NA NA 85.39 6.49 54.67 89.51 7.17 58.40 89.12 5.70 58.86 10.00 0.00 11.11 VGG-19 SIG 90.76 72.92 18.26 89.60 59.68 26.41 90.64 73.42 17.93 89.25 53.72 30.00 86.54 57.06 25.78 NA NA NA 85.06 59.00 21.76 89.28 54.40 29.84 88.99 71.69 16.50 10.00 0.00 11.11 VGG-19 LF 90.54 20.46 71.11 89.29 8.50 79.13 90.51 18.67 72.70 88.85 11.04 77.40 90.54 20.46 71.13 NA NA NA 84.78 16.18 67.70 89.42 19.12 70.31 89.00 19.42 69.97 10.00 100.00 0.00 VGG-19 SSBA 90.59 5.14 84.94 89.22 1.61 86.31 90.58 3.22 86.24 88.83 1.81 85.30 90.59 5.14 84.94 NA NA NA 85.67 5.37 79.29 88.81 5.48 82.98 77.41 36.69 55.39 10.00 0.00 11.11 VGG-19 Input-aware 89.32 75.27 23.63 90.93 48.78 47.70 89.93 38.34 49.16 90.70 59.61 38.09 89.32 75.27 23.63 NA NA NA 85.45 50.43 39.43 89.96 59.29 34.87 89.72 63.31 31.04 10.00 100.00 0.00 VGG-19 WaNet 89.52 1.02 88.84 91.31 1.43 89.99 90.20 0.98 89.51 90.81 1.38 89.83 89.52 1.02 88.84 NA NA NA 86.06 3.06 82.58 89.26 4.06 85.43 89.00 3.12 85.88 10.00 100.00 0.00 EfficientNet-B3 BadNets 61.36 3.53 60.79 56.46 5.80 55.00 60.94 3.60 60.24 58.14 5.47 56.84 61.35 3.53 60.79 61.35 3.53 60.79 42.45 5.29 42.16 50.22 3.91 49.92 34.72 1.61 36.90 54.70 15.23 50.22 EfficientNet-B3 Blended 54.41 5.49 50.60 51.16 7.17 46.77 54.10 5.01 50.06 52.64 6.29 47.80 54.42 5.48 50.58 54.42 5.48 50.58 45.86 9.27 38.98 49.00 8.64 44.04 30.26 0.27 23.24 52.82 12.37 42.14 EfficientNet-B3 LC 57.65 6.07 43.77 56.20 6.33 40.93 57.88 6.83 43.01 56.08 7.89 40.94 57.65 6.07 43.76 57.65 6.07 43.78 46.15 7.36 38.81 41.07 3.43 36.40 25.01 0.81 22.42 56.53 9.52 42.34 EfficientNet-B3 SIG 53.69 4.07 40.26 51.45 3.33 37.66 53.38 3.29 39.56 51.91 3.26 38.98 53.67 4.08 40.26 53.67 4.08 40.26 43.66 4.76 26.74 53.62 4.41 50.69 27.18 0.59 24.96 55.05 58.19 26.27 EfficientNet-B3 LF 62.50 22.32 44.00 55.76 18.10 41.14 61.76 23.41 43.81 57.21 20.13 41.81 62.50 22.32 44.01 62.52 22.32 44.01 47.03 20.40 29.66 44.03 17.83 32.66 14.38 1.53 25.13 57.24 14.93 49.42 EfficientNet-B3 SSBA 62.61 6.19 58.31 56.29 6.56 53.51 62.34 6.29 58.26 58.88 7.16 54.26 62.62 6.18 58.32 61.36 6.09 56.59 41.70 4.88 40.39 53.43 4.74 51.71 29.12 1.29 29.99 54.79 7.79 50.08 EfficientNet-B3 Input-aware 62.80 9.01 53.57 62.13 9.50 53.40 64.85 6.08 57.52 64.28 9.23 54.77 62.80 9.01 53.57 62.80 9.01 53.57 42.92 5.36 41.09 54.33 4.54 48.51 35.52 2.98 34.94 58.85 16.97 50.23 EfficientNet-B3 WaNet 72.04 3.73 69.36 73.30 2.77 71.49 73.42 4.23 70.14 74.51 2.56 73.60 71.00 3.03 68.84 69.19 3.02 64.59 40.48 9.20 39.01 46.80 3.71 46.77 27.19 4.54 25.96 54.78 12.87 49.86 MobileNetV3-Large BadNets 83.78 1.93 83.13 79.67 2.24 79.07 83.64 1.79 83.09 80.88 2.07 80.50 78.01 2.58 77.56 83.78 1.93 83.14 72.39 2.98 72.22 80.64 2.03 80.33 72.64 0.72 74.50 57.77 8.57 54.77 MobileNetV3-Large Blended 84.02 78.30 16.32 79.19 25.30 49.63 83.99 75.30 18.59 80.43 26.61 49.16 84.01 78.29 16.32 84.01 78.29 16.32 73.13 35.01 42.14 80.67 30.88 49.92 74.57 56.41 30.20 55.33 10.30 48.00 MobileNetV3-Large LC 83.72 5.66 54.42 79.11 5.46 50.53 83.61 5.68 54.26 80.31 5.10 51.68 83.72 5.66 54.41 83.71 5.64 54.42 74.99 5.82 50.22 80.86 5.18 53.07 72.89 3.41 47.27 56.48 10.11 42.41 MobileNetV3-Large SIG 84.34 67.39 17.06 79.61 53.16 23.07 84.21 72.14 14.34 80.95 57.77 21.02 77.78 60.39 19.56 76.76 59.29 16.39 73.16 70.48 11.76 80.99 60.21 17.57 72.34 84.03 5.22 58.58 89.31 8.53 MobileNetV3-Large LF 84.06 77.57 18.06 79.35 38.19 42.82 83.96 77.13 17.82 79.77 51.82 34.68 84.06 77.57 18.06 82.30 68.78 23.82 74.17 70.66 19.89 80.05 62.39 28.19 75.47 72.80 17.99 60.19 7.70 56.36 MobileNetV3-Large SSBA 84.01 4.91 78.27 79.23 3.41 74.07 83.72 3.54 79.16 80.03 3.13 74.99 84.01 4.92 78.26 84.01 4.92 78.26 74.22 5.44 68.37 80.28 5.01 74.37 74.33 5.68 69.80 54.01 13.39 48.90 MobileNetV3-Large Input-aware 78.70 33.81 42.01 79.63 24.54 49.84 81.40 36.28 39.40 81.33 30.00 47.07 78.70 33.82 42.01 72.17 12.33 57.23 73.69 29.62 47.70 81.08 41.73 42.52 71.25 37.10 39.52 58.27 83.33 12.70 MobileNetV3-Large WaNet 79.16 3.61 77.58 80.82 2.60 78.97 81.30 4.51 78.19 82.16 2.46 80.09 79.16 3.61 77.58 79.16 3.61 77.58 72.93 3.49 71.32 80.55 2.84 78.23 76.44 1.91 73.31 54.84 14.46 51.24 DenseNet-161 BadNets 86.42 1.80 85.51 85.60 1.82 84.82 86.40 1.24 85.74 84.38 2.06 83.79 82.99 2.10 82.21 86.02 1.52 85.40 76.13 2.51 75.53 83.60 1.80 82.61 57.11 6.19 53.56 64.53 5.07 61.44 DenseNet-161 Blended 86.57 59.88 32.08 85.98 36.13 50.50 86.74 56.77 34.47 84.88 29.73 53.92 86.56 59.90 32.07 83.43 25.11 55.74 75.77 16.21 57.51 83.34 2.04 73.48 61.21 43.96 37.49 70.50 5.22 61.54 DenseNet-161 LC 86.91 4.73 56.97 85.05 4.96 55.59 87.03 5.28 56.59 84.30 4.96 54.51 86.91 4.73 56.98 86.40 3.83 57.21 76.41 5.59 50.68 83.35 4.43 54.84 50.91 5.13 31.11 66.10 10.99 47.53 DenseNet-161 SIG 86.69 61.20 26.18 85.49 63.99 23.58 86.67 67.52 22.21 84.47 48.98 30.41 83.68 42.30 34.60 79.32 22.83 38.37 76.23 41.62 30.27 83.48 52.70 30.58 69.79 0.07 46.86 74.11 95.23 4.21 DenseNet-161 LF 86.27 22.28 65.93 84.99 11.47 73.23 86.46 19.64 68.12 84.22 13.32 71.31 86.27 22.28 65.93 79.57 6.64 71.64 75.42 20.96 57.90 82.98 21.76 63.32 60.11 32.86 41.54 77.90 9.01 71.76 DenseNet-161 SSBA 86.59 4.40 81.60 85.08 3.13 81.32 86.92 2.88 82.91 84.27 3.24 79.80 86.59 4.40 81.60 81.50 2.02 76.52 75.68 5.23 70.58 83.37 2.59 79.32 58.46 4.63 55.72 68.39 4.82 63.90 DenseNet-161 Input-aware 84.56 83.64 14.29 87.38 73.10 23.90 85.02 84.68 14.30 87.19 71.63 24.82 85.84 3.23 75.08 76.28 8.93 62.44 76.49 60.14 27.19 83.28 62.28 28.59 59.73 29.89 31.59 67.97 6.63 57.93 DenseNet-161 WaNet 85.74 1.27 84.71 87.76 1.27 85.77 85.05 2.06 83.43 87.54 1.13 85.44 85.75 1.27 84.69 85.75 1.27 84.69 76.66 2.66 74.91 83.24 1.91 81.01 55.57 17.00 44.24 67.22 4.21 65.47 43 Table 17: Full results on CIFAR-10 with 0.1% poisoning ratio. Backdoor Defense â No defense FT FP NAD NC ANP AC Spectral ABL DBD Targeted Model Backdoor Attack â C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) C-Acc (%) ASR (%) R-Acc (%) PreAct-Resnet18 BadNets 93.61 1.23 93.24 93.59 1.20 93.20 93.54 0.91 93.24 93.45 1.26 93.03 90.29 1.27 90.08 89.60 0.71 89.37 89.97 1.37 89.57 93.03 1.01 92.53 81.44 1.99 79.69 71.59 4.90 68.82 PreAct-Resnet18 Blended 93.80 56.11 39.37 93.78 52.60 42.09 93.70 54.67 40.38 93.71 55.23 39.76 91.07 26.83 57.16 85.35 24.18 49.57 89.59 41.41 48.77 93.14 51.16 42.93 67.96 12.06 40.82 78.51 0.00 81.22 PreAct-Resnet18 LC 93.82 4.67 66.52 93.63 4.21 66.83 93.52 4.51 66.41 93.78 4.57 66.76 93.82 4.67 66.51 93.82 4.67 66.51 89.95 4.53 60.54 93.19 4.64 65.68 83.20 8.91 50.52 75.43 3.27 57.81 PreAct-Resnet18 SIG 93.73 41.27 42.34 93.64 38.99 44.12 93.53 37.71 43.07 93.75 37.60 45.49 89.34 15.96 42.92 84.72 2.71 41.97 89.62 40.09 35.27 93.21 41.34 41.50 62.37 13.52 22.79 74.78 0.07 21.54 PreAct-Resnet18 LF 93.55 12.72 81.16 93.27 9.63 83.07 93.42 12.48 81.00 93.57 10.51 82.41 89.68 4.57 83.62 88.52 5.63 79.58 89.94 13.26 76.52 92.86 18.39 75.06 54.82 8.07 53.46 74.19 9.50 70.13 PreAct-Resnet18 SSBA 93.89 1.62 90.64 93.86 1.41 90.84 93.72 1.60 90.28 93.83 1.43 90.76 93.89 1.62 90.64 90.21 0.99 86.69 89.97 2.33 86.16 93.39 1.83 90.08 81.00 6.22 76.59 73.42 4.42 67.39 PreAct-Resnet18 Input-aware 91.94 47.32 45.53 93.05 56.61 39.22 92.03 26.13 51.19 93.05 58.94 37.43 91.94 47.32 45.53 86.47 14.83 63.89 89.93 30.92 58.30 93.16 46.93 48.42 76.14 31.19 44.80 82.22 13.18 69.51 PreAct-Resnet18 WaNet 92.18 0.78 91.42 93.49 0.74 92.92 91.88 1.06 91.00 93.44 0.76 92.93 90.71 0.94 89.81 87.53 0.56 88.91 90.07 1.69 88.13 93.04 1.02 91.57 67.90 5.04 61.27 87.83 2.63 86.66 VGG-19 BadNets 90.64 1.22 90.37 89.28 1.10 89.20 90.47 0.98 90.34 88.54 1.14 88.44 90.64 1.22 90.37 NA NA NA 85.40 1.72 84.87 89.06 1.51 88.62 89.63 1.04 89.47 10.00 100.00 0.00 VGG-19 Blended 91.00 26.12 61.70 89.18 16.46 66.80 90.77 25.28 62.03 88.78 18.36 65.10 91.00 26.12 61.70 NA NA NA 85.60 8.12 67.64 89.39 20.86 63.18 89.71 15.14 67.67 10.00 100.00 0.00 VGG-19 LC 91.07 5.08 62.11 89.37 4.61 60.91 91.00 4.67 62.20 89.39 4.03 60.97 91.07 5.08 62.11 NA NA NA 85.42 5.30 54.52 89.49 4.90 59.58 89.64 4.44 59.56 10.00 0.00 11.10 VGG-19 SIG 90.77 22.71 50.34 89.52 19.97 51.57 90.62 22.24 50.29 88.75 18.00 49.10 90.77 22.71 50.34 NA NA NA 85.39 21.30 40.37 89.32 25.00 43.90 89.69 21.58 47.57 10.00 0.00 11.11 VGG-19 LF 90.46 5.74 84.02 89.21 5.40 83.52 90.50 5.44 84.10 88.47 4.49 83.29 90.46 5.74 84.02 NA NA NA 85.83 7.18 77.36 89.56 6.60 81.44 89.10 6.16 82.03 10.00 100.00 0.00 VGG-19 SSBA 91.06 1.54 87.96 89.31 1.16 87.00 90.86 1.33 87.92 89.45 1.73 86.06 86.73 2.17 83.66 NA NA NA 85.78 2.58 82.32 89.20 2.02 86.01 88.96 1.98 85.80 10.00 0.00 11.11 VGG-19 Input-aware 89.52 48.24 43.78 90.87 27.20 58.03 89.85 38.33 48.48 90.84 27.20 57.10 89.52 48.24 43.78 NA NA NA 86.01 8.50 71.73 89.81 14.27 70.32 89.73 18.76 63.83 10.00 100.00 0.00 VGG-19 WaNet 89.77 1.60 88.86 91.58 1.12 90.70 90.29 1.09 89.64 91.20 1.11 90.50 89.44 1.54 87.94 NA NA NA 85.90 2.17 83.39 88.99 1.77 86.99 89.67 1.47 87.74 10.00 100.00 0.00 EfficientNet-B3 BadNets 63.92 3.44 63.43 57.59 4.47 56.93 63.31 3.76 62.64 60.03 3.87 59.20 63.92 3.43 63.46 63.92 3.43 63.46 41.50 4.68 40.79 53.14 4.52 52.37 31.50 1.01 33.50 52.65 12.21 48.14 EfficientNet-B3 Blended 61.41 6.66 51.91 57.29 6.90 48.29 61.78 6.27 51.48 58.89 7.03 49.31 61.43 6.66 51.90 61.43 6.66 51.90 46.82 9.00 41.33 56.07 5.13 50.88 23.47 2.74 18.94 62.60 6.52 56.54 EfficientNet-B3 LC 54.96 4.99 43.16 52.21 6.53 39.90 54.98 5.74 42.42 52.30 6.42 40.78 54.96 4.98 43.16 54.96 4.98 43.16 39.23 6.28 33.76 54.34 5.40 41.84 20.28 0.19 20.04 54.70 13.16 40.79 EfficientNet-B3 SIG 66.63 41.69 23.90 61.28 17.31 26.60 66.91 35.60 25.38 64.25 9.26 28.34 61.13 6.88 32.34 66.63 41.71 23.89 43.94 1.66 31.40 50.80 3.03 47.77 32.25 15.94 22.28 59.05 41.20 34.32 EfficientNet-B3 LF 55.96 13.57 39.20 52.77 14.09 36.93 55.64 14.18 39.73 53.59 14.94 38.04 55.96 13.56 39.20 55.96 13.56 39.20 43.30 21.13 26.06 47.40 16.67 34.32 23.39 1.76 37.63 54.14 14.26 48.48 EfficientNet-B3 SSBA 65.76 3.72 61.94 59.73 5.24 55.51 65.31 3.93 61.33 62.82 4.94 58.03 65.77 3.72 61.94 65.77 3.72 61.96 40.40 5.16 39.71 47.98 3.44 47.26 29.80 0.37 32.63 58.51 10.97 53.37 EfficientNet-B3 Input-aware 61.93 7.96 54.93 62.14 6.79 55.32 62.89 6.26 56.64 62.69 6.87 55.71 61.21 7.70 53.16 61.93 7.96 54.94 45.17 6.33 41.56 45.58 3.88 43.66 33.34 1.07 35.48 56.16 17.86 45.77 EfficientNet-B3 WaNet 75.14 3.54 72.91 70.98 3.57 69.44 73.46 3.83 71.22 73.89 3.13 71.59 75.13 3.54 72.90 71.12 3.09 69.13 48.40 5.31 47.00 50.38 3.19 50.09 26.57 0.43 26.90 57.88 10.91 54.36 MobileNetV3-Large BadNets 84.30 1.61 84.03 79.10 2.31 78.83 84.15 1.72 83.87 80.35 2.19 79.64 84.30 1.61 84.03 84.30 1.61 84.03 74.84 2.41 74.23 79.72 1.94 79.60 76.19 2.73 75.21 58.91 7.40 56.29 MobileNetV3-Large Blended 84.15 34.39 49.36 79.33 3.86 63.48 84.10 31.48 51.29 80.41 4.77 63.83 84.15 34.39 49.36 84.15 34.39 49.36 73.87 3.16 61.93 80.43 11.83 63.74 74.94 6.56 57.49 56.22 10.08 47.90 MobileNetV3-Large LC 84.19 5.01 55.58 79.58 5.47 52.44 83.88 5.10 55.47 80.70 5.62 52.42 77.30 5.47 49.82 84.19 5.01 55.58 75.12 5.28 49.50 80.62 4.47 53.18 73.81 4.57 46.77 56.01 10.67 40.87 MobileNetV3-Large SIG 84.22 41.32 29.08 79.51 32.80 32.50 83.88 41.18 28.94 80.21 16.54 39.47 84.22 41.32 29.08 76.25 33.66 27.82 73.00 30.98 24.77 80.67 29.53 32.11 75.35 28.73 26.87 58.69 93.52 4.53 MobileNetV3-Large LF 84.03 24.63 61.21 79.20 8.70 62.83 83.73 24.02 61.84 80.34 10.61 64.39 84.03 24.63 61.22 83.29 23.39 61.70 73.38 6.51 63.49 80.63 9.37 70.00 74.42 14.71 59.39 56.49 11.22 50.81 MobileNetV3-Large SSBA 84.42 2.22 81.21 79.63 2.79 75.79 84.33 2.34 80.73 80.47 2.96 76.78 76.14 2.79 73.11 84.43 2.22 81.21 74.58 3.93 70.19 80.93 2.91 76.77 73.59 4.41 70.24 58.69 7.50 53.49 MobileNetV3-Large Input-aware 76.91 7.79 64.29 80.03 11.14 60.69 82.15 10.91 63.52 81.57 10.86 61.88 77.61 9.90 64.67 76.91 7.79 64.31 72.17 7.63 58.21 81.23 11.22 60.83 73.41 9.84 57.94 58.87 22.50 45.66 MobileNetV3-Large WaNet 81.64 2.34 80.42 81.32 2.50 79.44 82.51 3.68 79.62 82.96 2.33 81.30 80.69 2.49 78.57 81.64 2.34 80.42 73.22 3.13 71.60 80.43 2.06 78.93 74.06 3.59 69.06 56.35 8.21 51.92 DenseNet-161 BadNets 86.70 1.57 86.07 85.66 1.60 84.99 86.63 1.24 86.46 84.97 1.72 84.20 82.42 2.01 82.02 86.70 1.57 86.07 77.15 2.27 76.44 83.30 1.76 83.03 55.76 9.23 51.93 70.29 4.12 67.93 DenseNet-161 Blended 86.76 14.84 68.23 86.14 7.41 71.77 86.82 12.47 69.93 84.86 9.92 69.96 86.76 14.87 68.22 86.05 5.03 72.32 75.84 4.70 65.69 83.11 8.63 70.07 58.68 8.94 45.44 60.06 6.18 53.56 DenseNet-161 LC 86.48 4.59 57.67 85.52 4.83 55.82 86.68 4.83 57.36 85.02 4.78 55.42 81.39 4.86 52.78 86.48 4.59 57.66 76.42 5.03 51.00 83.08 4.71 54.94 68.04 3.08 45.28 67.35 9.60 48.66 DenseNet-161 SIG 86.69 14.97 53.42 86.20 11.59 53.52 86.79 17.82 51.38 84.99 12.14 54.86 86.69 15.00 53.41 81.57 6.48 51.47 75.87 9.82 47.46 83.22 10.32 54.99 57.21 30.58 28.48 69.11 22.93 52.27 DenseNet-161 LF 86.46 7.19 78.67 85.85 7.56 77.37 86.56 6.74 78.94 85.36 7.53 77.27 86.46 7.20 78.67 86.45 6.90 78.31 76.56 9.86 64.79 83.03 9.09 72.50 54.78 6.47 54.13 67.58 12.28 61.98 DenseNet-161 SSBA 87.01 2.09 83.46 85.71 2.31 82.04 87.14 2.06 83.37 85.47 2.84 81.22 87.01 2.09 83.46 87.15 2.01 83.32 76.53 4.19 71.98 83.40 2.67 79.57 54.10 10.03 49.31 59.30 11.78 53.60 DenseNet-161 Input-aware 84.55 33.69 42.29 87.27 43.66 41.48 85.37 50.64 33.52 87.23 43.29 41.39 85.93 3.84 71.39 77.14 6.58 55.92 76.86 17.74 51.07 82.63 25.60 50.04 57.83 16.99 28.34 72.30 13.60 51.52 DenseNet-161 WaNet 86.48 1.76 85.09 88.24 1.18 86.53 85.85 1.77 83.87 87.99 1.18 86.60 86.46 1.76 85.09 82.23 1.41 81.19 76.03 2.34 73.56 83.25 1.53 81.46 56.87 2.38 48.59 67.75 5.66 65.30 44