SlowGuess/NeurIPS_2023_OCR huggingface dataset:
G Performances under additional types of backdoor attacks
We evaluate our methods against backdoor attacks intentionally designed to challenge our defenses, such as LIRA [12] and M-attack (a custom-designed attack). These attacks are specifically crafted to diminish the distinction in latent spaces of the backdoored models by imposing regularization on the distances. LIRA employs Wasserstein distances, while M-attack utilizes Mahalanobis distances, to measure the dissimilarity between clean data and backdoor attacks. In Table 5, our methods consistently outperform state-of-the-art defenses, although there is a slight performance dip compared to diverse attack scenarios like BadNets and SSBA. Nevertheless, this outcome is reasonable since no defense can be universally effective against all attack variations.
Table 5: AUCROC score of our method on GTSRB against LIRA and M-attack.
Defenses →	SCM (Ours)	FREQ	SCALEUP
LIRA	0.86	0.71	0.79
M-attack	0.82	0.80	0.71
H Comparison with other defenses
H.1 Performances comparison with recent detection-based backdoor defenses
We evaluate our methods alongside two recently developed detection-based defenses designed to counteract CV backdoor attacks: SCALEUP and FREQ. The summarized results are presented in
Table 6 below. Our observations consistently demonstrate that our methods outperform SCALEUP and FREQ.
Table 6: AUCROC score of our method on GTSRB. The bestperforming method(s) are indicated in boldface.
Defenses →	SCM (Ours)	FREQ	SCALEUP	ABL	SPECTRE
BadNets	0.99	0.91	0.86	0.97	0.96
SSBA	0.99	0.51	0.72	0.81	0.56
Adaptive Patch	0.87	0.49	0.55	0.72	0.70
Adaptive Blend	0.99	0.56	0.51	0.59	0.62
H.2 Performances comparison with purifying-based training-stage backdoor defenses
We assess our methods in conjunction with two training-stage backdoor defenses, SPECTRE and ABL. As emphasized in the main text, these methods, while sharing the concept of distinguishing between clean and backdoor attacks, significantly differ from ours in terms of the threat model, methodology, and evaluation metrics. To ensure a fair comparison, we report the AUCROC scores for distinguishing between clean and backdoor data. The summarized results are presented in Table 6. Our observations consistently demonstrate that our methods outperform ABL and SPECTRE.