Before revision:  In addition, for attacks under different settings (trigger transparency, trigger size and trigger pattern), the false acceptance rates of the proposed method are as low as 1.2\%, 0.3\% and 0.04\% on Fashion-MNIST, CIFAR-10 and GTSRB datasets, respectively , which demonstrates that the proposed method can achieve high defense performance against backdoor attacks under different attack settings  .
After revision:  In addition, for attacks under different settings (trigger transparency, trigger size and trigger pattern), the false acceptance rates of the proposed method are as low as 1.2\%, 0.3\% and 0.04\% on Fashion-MNIST, CIFAR-10 and GTSRB datasets, respectively . In addition, it is also demonstrated that the proposed method can achieve high defense performance against backdoor attacks under different attack settings .