Before revision:  Through comprehensive experiments across five public datasets, we demonstrate that DARCY detects UniTrigger's adversarial attacks with up to 99\% TPR and less than 1\% FPR in most cases, while showing a difference of only around 2\% of F1 score on average in predicting for clean inputs . We also show that DARCY with multiple trapdoors is  robust under different assumptions with respect to attackers' knowledge and skills.
After revision:  Through comprehensive experiments across five public datasets, we demonstrate that DARCY detects UniTrigger's adversarial attacks with up to 99\% TPR and less than 1\% FPR in most cases, while showing a difference of only around 2\% of F1 score on average in predicting for clean inputs by less than 1\% on average. We finally show that DARCY with multiple trapdoors is robust under different assumptions with respect to attackers' knowledge and skills.