Before revision:  In addition, for attacks under different settings (trigger transparency, trigger size and trigger pattern), the false acceptance rates of the proposed method are as low as 1.2\%, 0.3\% and 0.04\% on Fashion-MNIST, CIFAR-10 and GTSRB datasets, respectively , which demonstrates that the proposed method can achieve high defense performance against backdoor attacks under different attack settings  .
After revision:  In addition, for attacks under different settings (trigger transparency, trigger size and trigger pattern), the false acceptance rates of the proposed method are as low as 1.2\%, 0.3\% and 0.04\% on Fashion-MNIST, CIFAR-10 and GTSRB datasets, respectively , which demonstrates that the proposed method can achieve high defense performance against backdoor attacks under different attack settings (trigger transparency, trigger size and trigger pattern). Compared with the existing defense work (STRIP), the proposed method has better detection performance on all the three datasets, and is more efficient than STRIP .