Before revision:  Besides, the proposed method maintains the visual quality of the image as the added perturbation is very small. In addition, for attacks under different settings (trigger transparency, trigger size and trigger pattern), the false acceptance rates of the proposed method are as low as 1.2\%, 0.3\% and 0.04\% on Fashion-MNIST, CIFAR-10 and GTSRB datasets, respectively , which demonstrates that the proposed method can achieve high defense performance against backdoor attacks under different attack settings  .
After revision:  Besides, the proposed method maintains the visual quality of the image as the l2 norm of the added perturbation are as low as 1.2\%, 0.3\% and 0.04\% on Fashion-MNIST, CIFAR-10 and GTSRB datasets, respectively , which demonstrates that the proposed method can achieve high defense performance against backdoor attacks under different attack settings .