SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Lemma 1. Assume that  $\mathbb{P}(m = 0) \in (0,1)$  and  $\phi_{XM}(\pmb{x}_i, m) \neq \phi_{XM}(\pmb{x}_j, m)$  if  $\pmb{x}_i \neq \pmb{x}_j$ . Given a poisoned model  $h_{bd}$  trained by minimizing (11), there exists a non-trivial linear projection operator  $P$  such that
$$
C o v (\langle \hat {\phi} _ {X M} (\boldsymbol {x}, m), h _ {b d} \rangle_ {\mathcal {H} _ {X M}}, m) = 0,
$$
where  $\hat{\phi}_{XM}(\pmb{x},m) = P\phi_{XM}(\pmb{x},m)$  is the projected feature of  $\phi_{XM}(\pmb{x},m)$  and  $\langle \cdot ,\cdot \rangle_{XM}$  is the inner product in  $\mathcal{H}_{XM}$ .
Proof. To prove Lemma 1, we first recall that [38] says that the projection operator can be constructed by the eigenfunctions of the operator  $\Sigma_{(XM)M}\Sigma_{M(XM)}$  where  $\Sigma_{(XM)M}$  is the Covariance operator between  $\phi_{XM}(\pmb{x},m)$  and  $\phi_M(m)$  for  $\pmb{x}\in \mathcal{D}$  and  $m\in \mathcal{M}$ . Then, under the assumption that  $\mathbb{P}(m = 0)\in (0,1)$  and  $\phi_{XM}(\pmb{x}_i,m)\neq \phi_{XM}(\pmb{x}_j,m)$  if  $\pmb{x}_i\neq \pmb{x}_j$ , the Covariance operator  $\Sigma_{(XM)M}$  is a non-zero operator by its definition and the projection operator generated by  $\Sigma_{(XM)M}$  is nontrivial.
The first assumption in Lemma 1 requires that the backdoored classifier  $h_{bd}$  is trained on a partially poisoned dataset to preserve its accuracy on clean samples. The second assumption in Lemma 1 requires that the feature of a poisoned sample retains some information of the original clean sample and is not completely overwritten by the trigger. Under these conditions, the Lemma 1 states that there exists a non-trivial projection operator such that the  $h_{bd}$ 's prediction for a transformed feature  $P\phi_{XM}(\pmb{x}, m)$  is uncorrelated with poisoning  $\pmb{x}$  or not. Therefore, such a linear projection operator breaks the correlation between  $m$  and the prediction of  $\pmb{x}$  without modifying  $h_{bd}$ , indicating the existence of a neural polarizer in  $\mathcal{H}_{XM}$ . Although a complex neural network for multi-class classification problems is usually beyond  $\mathcal{H}_{XM}$ , Lemma 1 provides insights into the existence of an effective neural polarizer.
B More implementation details
In this section, we present the implementation details, which include an introduction to the datasets used, the implementation specifics of the attacks and defenses compared, as well as our proposed methods. All experiments are run on one RTX 3090Ti GPU and are repeated over five runs with different random seeds.
Datasets. We evaluate the effectiveness of our method using three datasets: CIFAR-10 [16], Tiny ImageNet [18], and GTSRB [34], following the benchmarks established in [42].
CIFAR-10 comprises 60,000 images distributed across ten classes. The training set consists of 5,000 images per class, while the test set contains 1,000 images per class. Each image in the CIFAR-10 dataset has dimensions of  $32 \times 32$  pixels.
Tiny ImageNet is a subset of the larger ImageNet dataset [7]. It encompasses 100,000 training samples and 10,000 testing samples across 200 classes. The images in Tiny ImageNet have dimensions of  $64 \times 64$  pixels.
GTSRB consists of 39,209 training images and 12,630 testing images, categorized into 43 classes. The image size for each sample in the GTSRB dataset is  $32 \times 32$  pixels.
Models. We evaluate the performance of our method in conjunction with two variations on the PreActResNet18 [13] and VGG19-BN [33] networks. Furthermore, we compare our method with SOTA defense methods on three datasets and the two networks, utilizing a  $10\%$  poisoning ratio and a  $5\%$  ratio of clean samples for defense.
Attack details. We introduce more details about the backdoor attack implementation here. We follow BackdoorBench to categorize the eight backdoor attacks according to various criteria as in Table 10.
Table 10: Categories of the eight backdoor attack algorithms.
ATTACK	Fusion pattern	Size of trigger	Visibility of trigger	Variability of trigger	Num of target classes
Additive	Non-Additive	Local	Global	Visible	Invisible	agnostic	specific	All2one	All2all
BadNets-A2O [11]	✓	✓	✓	✓	✓
BadNets-A2A [11]	✓	✓	✓	✓	✓
Blended [5]	✓	✓	✓	✓	✓
Input-Aware [28]	✓	✓	✓	✓	✓
LF [46]	✓	✓	✓	✓	✓
SSBA [20]	✓	✓	✓	✓	✓
Trojan [24]	✓	✓	✓	✓	✓
WaNet [29]	✓	✓	✓	✓	✓
For BadNets-A2O and BadNets-A2A [11], we patch a  $3 \times 3$  white square in the lower right corner of the images for CIFAR-10 and GTSRB datasets, and  $6 \times 6$  white square for Tiny ImageNet dataset. For Blended [5], we blend the poisoned samples with a Hello-Ketty image which has the same size as the poisoned samples, and the blended ratio is set to 0.2.
Defense details. The seven SOTA defense methods can be categorized into two types based on the available resources for the defender. EP [48] is a data-free method that assumes the defender only has access to a backdoored model without any clean data. On the other hand, the remaining methods assume that the defender can obtain a subset of clean samples along with a backdoored model, which aligns with our scenario. In our experiments, a learning rate of 0.01 and a batch size of 256 were used for all SOTA defense methods based on fine-tuning. For ANP [43], the pruning threshold was set to 0.4, as we found that the recommended threshold of 0.2 was inadequate for removing backdoors effectively. Regarding the fine-tuning based SOTA methods, the training epochs were set to 100 for CIFAR-10 and Tiny ImageNet, and 50 for the GTSRB dataset. All other settings remained consistent with those specified in BackdoorBench [42].
In our NPD method, we used a learning rate of 0.01 with a weight decay of 0.0005 and a momentum of 0.9. The training process consisted of 50 epochs for all three datasets, with a warm-up period of 5 epochs. During each epoch, the PGD algorithm was employed to search for adversarial perturbations in each batch. The PGD algorithm utilized a learning rate of 0.1. To constrain the adversarial perturbations on the CIFAR-10 dataset, we applied an  $l_{2}$  norm with a bound of 3.
C Defense results in comparison to SOTA defenses on GTSRB and VGG19-BN
To further investigate the generalization performance of our NPD on different datasets and networks, we conducted an analysis on the GTSBR dataset and CIFAR-10 on VGG19-BN network. We compared the performance of NPD with various defense methods against different attacks, and the results are presented in Table 11 and Table 12.
As shown in Table 11, our experimental findings consistently demonstrate the superiority of our proposed methods over state-of-the-art defenses in terms of DER and ASR across almost all attacks, except for BadNet and Trojan. Notably, NAD exhibits the best performance against the Trojan attack, which can be attributed to the strong single trigger pattern adopted by Trojan. NAD effectively reverses the trigger through optimization, making it easier to detect and mitigate the Trojan attack. Furthermore, while NPD-TU and NPD-TP exhibit superiority in terms of a low ASR, NPD demonstrates a comparable trade-off between ACC and ASR. On average, NPD achieves a DER of  $96.76\%$ , which is  $6.26\%$  higher than the best SOTA method, i-BAU. The higher DER achieved by NPD on the remaining attacks further validates the effectiveness of our methods in detecting and mitigating various backdoor attacks compared to existing defenses.
Regarding the performance of the VGG19-BN network, as shown in Table 12, NPD-TU and NPD outperform all other defense methods, underscoring the effectiveness of our proposed defense methods in removing backdoor attacks. However, NPD-TU fails to defend against the Input-Aware attack, which is similar to the performance of i-BAU defense. This highlights the importance of incorporating adversarial attacks into the defense strategy, as UAP does not always guarantee successful defense. Nonetheless, our proposed method exhibits comparable and stable performance across almost all attacks.
In summary, our analysis of the GTSBR dataset and VGG19-BN network showcases the robust generalization performance of NPD against various backdoor attacks. The results underscore the effectiveness of our proposed defense methods, especially NPD-TP and NPD, in removing backdoor attacks.
D Different structures of neural polarizers on the defense performance
In this section, we demonstrate the effectiveness of our Conv-BN structure in implementing the neural polarizer for defense against backdoors. We compare it with two Conv-BN structures, a Linear transformation layer, and two denoising layers used in two adversarial defense works: OSAD [31]
Table 11: Comparison with the state-of-the-art defenses on GTSRB dataset with  $5\%$  benign data and  $10\%$  poison ratio on PreAct-ResNet18  $(\%)$ .
ATTACK	Backdoored	FP [23]	NAD [19]	NC [35]	ANP [43]
ACC	ASR	DER	ACC	ASR	DER	ACC	ASR	DER	ACC	ASR	DER	ACC	ASR	DER
BadNets-A2O [11]	96.35	95.02	N/A	98.12	0.00	97.51	97.54	79.94	57.54	93.47	0.02	96.06	96.79	0.21	97.40
BadNets-A2A [11]	97.05	92.33	N/A	98.11	0.51	95.91	97.84	2.46	94.94	94.05	0.50	94.42	96.73	50.39	70.81
Blended [5]	97.97	99.67	N/A	98.20	68.45	65.61	97.98	99.29	50.19	48.34	5.70	72.17	98.25	99.94	50.00
Input-Aware [28]	97.17	97.09	N/A	97.98	0.22	98.43	97.47	65.55	65.77	95.79	1.08	97.32	96.20	0.00	98.06
LF [46]	97.97	99.58	N/A	97.87	69.19	65.15	98.24	79.76	59.91	92.22	0.18	96.82	98.03	60.36	69.61
SSBA [20]	98.31	99.77	N/A	98.47	60.19	69.79	98.37	96.95	51.41	90.75	1.51	95.35	98.36	98.98	50.40
Trojan [24]	98.33	100.00	N/A	98.00	42.08	78.79	98.01	0.10	99.79	92.29	0.02	96.97	98.17	86.92	56.46
WaNet [29]	95.71	98.20	N/A	98.88	0.28	98.96	98.32	0.04	99.08	96.34	0.01	99.10	97.42	0.18	99.01
Avg	97.35	97.71	N/A	98.20	30.12	83.79	97.97	53.01	72.35	87.90	1.13	93.56	97.49	49.62	74.04
ATTACK	i-BAU [45]	EP [48]	NPD-TU(Ours)	NPD-TP(Ours)	NPD(Ours)
ACC	ASR	DER	ACC	ASR	DER	ACC	ASR	DER	ACC	ASR	DER	ACC	ASR	DER
BadNets-A2O [11]	96.35	0.00	97.51	96.53	1.38	96.82	97.01	0.01	97.51	97.78	8.19	93.42	95.89	4.62	94.97
BadNets-A2A [11]	95.30	0.43	95.08	96.45	1.40	95.17	96.21	0.00	95.74	96.18	0.00	95.73	97.09	9.33	91.50
Blended [5]	95.04	96.39	50.17	95.42	100.00	48.73	97.46	0.00	99.58	97.25	0.00	99.48	97.32	2.44	98.29
Input-Aware [28]	96.03	0.00	97.98	92.98	0.10	96.40	96.03	6.52	94.71	97.13	0.16	98.44	95.72	1.72	96.96
LF [46]	88.69	7.43	91.44	96.40	99.15	49.43	97.60	0.00	99.61	97.28	0.00	99.44	97.30	0.77	99.07
SSBA [20]	87.27	0.18	94.28	97.59	99.32	49.87	97.94	0.00	99.70	97.56	0.00	99.51	98.02	3.45	98.01
Trojan [24]	93.66	0.00	97.66	97.46	0.05	99.54	97.47	0.00	99.57	96.37	0.08	98.98	96.47	0.00	99.07
WaNet [29]	97.50	0.26	98.97	97.26	26.92	85.64	96.99	13.55	92.33	97.66	0.00	99.10	97.74	7.77	95.22
Avg	93.73	13.09	90.50	96.26	41.04	77.79	97.09	2.51	97.47	97.15	1.05	98.22	96.94	3.76	96.76
Table 12: Comparison with the state-of-the-art defenses on CIFAR-10 dataset with  $5\%$  benign data and  $10\%$  poison ratio on VGG19-BN (\%).
ATTACK	Backdoored	FP [23]	NAD [19]	NC [35]	ANP [43]
ACC	ASR	DER	ACC	ASR	DER	ACC	ASR	DER	ACC	ASR	DER	ACC	ASR	DER
BadNets-A2O [11]	90.42	94.43	N/A	89.11	12.39	90.36	86.80	5.77	92.52	88.97	5.63	93.68	90.44	87.64	53.40
BadNets-A2A [11]	91.16	84.39	N/A	89.70	1.91	90.51	88.15	1.60	89.89	91.16	84.39	50.00	91.29	81.87	51.26
Blended [5]	91.60	96.68	N/A	89.60	93.14	50.77	87.45	86.98	52.78	91.91	99.50	50.00	91.69	97.37	50.00
Input-Aware [28]	88.66	94.58	N/A	91.55	14.57	90.01	91.09	14.06	90.26	89.70	97.02	50.00	89.67	36.76	78.91
LF [46]	83.28	13.83	N/A	88.18	1.29	56.27	85.08	3.07	55.38	88.33	1.22	56.31	89.20	1.34	56.24
SSBA [20]	90.85	95.11	N/A	89.26	65.33	64.09	88.11	52.22	70.08	90.85	95.11	50.00	91.11	76.00	59.56
Trojan [24]	91.57	100.00	N/A	90.04	29.71	84.38	87.01	5.17	95.14	91.57	100.00	50.00	89.27	0.00	98.85
WaNet [29]	84.58	96.49	N/A	91.10	3.36	96.56	90.68	10.23	93.13	84.58	96.49	50.00	89.82	0.96	97.76
Avg	89.02	84.44	N/A	89.82	27.71	78.36	88.05	22.39	80.54	89.63	72.42	56.01	90.31	47.74	68.35
ATTACK	i-BAU [45]	EP [48]	NPD-TU(Ours)	NPD-TP(Ours)	NPD(Ours)
ACC	ASR	DER	ACC	ASR	DER	ACC	ASR	DER	ACC	ASR	DER	ACC	ASR	DER
BadNets-A2O [11]	87.69	3.13	94.28	87.56	7.28	92.15	90.54	5.98	94.23	90.06	3.06	95.51	89.52	0.10	96.71
BadNets-A2A [11]	86.86	2.19	88.95	89.98	68.91	57.15	90.82	20.54	81.76	90.88	6.05	89.03	89.81	2.36	90.34
Blended [5]	88.45	51.67	70.93	90.99	22.62	86.72	90.66	0.00	97.87	91.23	0.00	98.15	90.85	9.99	92.97
Input-Aware [28]	89.81	78.93	57.82	88.92	3.84	95.37	89.15	96.51	50.00	89.98	0.02	97.28	87.99	2.57	95.67
LF [46]	83.06	6.66	53.48	79.36	18.88	48.04	88.78	0.96	56.44	89.05	0.89	56.47	87.64	0.91	56.46
SSBA [20]	85.61	12.37	88.75	89.62	85.40	54.24	90.42	0.31	97.18	90.71	0.41	97.28	88.94	4.21	94.49
Trojan [24]	86.40	2.69	96.07	89.42	5.23	96.31	90.35	0.00	99.39	90.81	8.89	95.18	89.79	0.86	98.68
WaNet [29]	89.61	2.40	97.04	86.10	73.61	61.44	88.85	5.44	95.52	89.03	1.35	97.57	88.25	1.88	97.30
Avg	87.19	20.00	81.30	87.74	35.72	73.72	89.95	16.22	84.11	90.22	2.58	90.93	89.10	2.86	90.79
and OSDN [32]. For the denoising structures, we found that inserting four denoising layers in all four blocks of the backdoored model as in OSAD and OSDN leads to the collapse of the entire network. Hence, we adopt a single denoising layer inserted into only one layer of the backdoored model as NPD. This limitation arises due to the scarcity of training samples available for fine-tuning in the defense scenario. As for the Linear layer, it means we use a linear layer with weights and biases that have the same size as the latent features. Consequently, this structure has fewer parameters compared to ours. We conducted experiments on the CIFAR-10 dataset using the PreAct-ResNet18 network, and the other experimental setup aligns with our method. The defense performance results are shown in Table 13.
From the table, we observe that both OSAD and OSDN successfully maintain performance on clean data. However, the ASR experiences a slight drop in most cases, possibly due to the fact that OSAD and OSDN adopt a residual structure where backdoors cannot be completely eliminated. The two Conv-BN layers structure has a high probability of collapsing directly, which may be attributed to the
insufficient training data for such a multi-layer structure. The Linear structure shows lower ACC and higher ASR. This could be because fewer parameters are not sufficient to remove backdoors, and a random initialization of the inserted layer leads to a decrease in final accuracy. This experiment demonstrates the superiority of the designed Conv-BN structure in defending against backdoors.
Table 13: Defense performance under different structures of inserted layers on CIFAR-10 dataset with PreAct-ResNet18.
Structure → ATTACK ↓	OSAD [31]	OSDN [32]	Linear	(Conv-BN)×2	Conv-BN (Ours)
ACC	ASR	ACC	ASR	ACC	ASR	ACC	ASR	ACC	ASR
BadNets-A2O [11]	91.68	48.43	90.47	45.26	87.75	21.12	10.05	99.56	88.93	1.26
Blended [5]	87.93	12.66	91.74	26.87	86.98	44.36	90.51	9.06	91.18	0.41
Input-Aware [28]	93.53	92.78	92.32	60.25	86.85	58.51	10.07	99.56	89.57	0.11
LF [46]	92.32	27.28	88.86	67.73	88.41	91.59	88.36	0.36	90.06	0.21
SSBA [20]	89.77	87.46	90.53	84.79	88.81	79.49	10.10	99.61	90.88	2.77
Trojan [24]	93.45	99.99	93.38	99.99	87.85	100.00	91.80	18.80	92.37	6.51
WaNet [29]	93.07	97.99	92.41	85.11	87.22	96.54	10.07	100.00	91.57	0.80
Avg	91.68	66.65	91.39	67.14	87.70	70.23	44.42	60.99	90.65	1.72
E.1 Defense experiments on CIFAR-100 dataset
To show the effectiveness of NPD method on classification tasks with more labels, we complement experiment on CIFAR-100 dataset [16], which has 100 classes in total and each class has 500 images for training and 100 images for testing. As shown in Table 14, the average ACC and ASR of NPD are  $65.49\%$ ,  $1.96\%$ , which indicates its competitiveness in comparison to existing defense approaches and showcases its efficacy in more classes scenarios.
Table 14: Comparison with the state-of-the-art defenses on CIFAR-100 dataset with  $5\%$  benign data and  $10\%$  poison ratio on PreAct-ResNet18  $(\%)$ .
ATTACK	Backdoored	NC [35]	i-BAU [45]	NPD (Ours)
ACC	ASR	DER	ACC	ASR	DER	ACC	ASR	DER	ACC	ASR	DER
BadNets-A2O [11]	67.23	87.43	N/A	66.05	0.14	93.06	60.37	0.04	90.26	64.27	0.06	92.20
Blended [5]	69.28	99.59	N/A	67.55	98.94	49.46	63.75	0.79	96.64	66.30	4.43	96.09
LF [46]	68.82	94.53	N/A	67.67	21.48	85.95	63.85	0.18	94.69	65.37	0.22	95.43
SSBA [20]	68.97	96.42	N/A	67.37	78.64	58.09	63.09	28.91	80.82	65.57	0.83	96.10
Trojan [24]	68.93	100	N/A	66.00	0.10	98.48	63.73	0.86	96.97	65.13	1.84	97.18
Wanet [29]	69.83	98.46	N/A	69.76	7.14	95.62	65.31	43.96	74.99	66.27	4.36	95.27
Avg	68.84	96.07	N/A	67.40	34.41	80.11	63.35	12.46	89.06	65.49	1.96	95.38
E.2 Defense experiments across various model architectures
In this part, we discuss the selection of the layer to insert the neural polarizer (NP) in a new model and the performance of NPD under different model architectures. In the manuscript, we have investigated the impact of NP insertion in different layers on the PreActResNet18 network. Our empirical study demonstrates that inserting NP in deeper layers effectively removes backdoors, while inserting it in shallower layers may lead to a decrease in benign accuracy and instability. To further validate this finding and show the effectiveness and robustness of NPD across different model architectures, we conducted additional experiments on VGG19, Inception-V3, and Densenet161 networks. As presented in Table 15, inserting NP into the last three layers achieves remarkable performance (high ACC and low ASR), while a decrease in accuracy occurs when shallow layers are selected. This experiment shows that NPD is robust across different model architectures.
Table 15: Performance of neural polarizer insertion in different layers across various network architectures  $(\%)$ .
Network	Layer → Attack ↓	Backdoored	Shallow	Middle	Third-to-last	Penultimate	Last
ACC	ASR	ACC	ASR	ACC	ASR	ACC	ASR	ACC	ASR	ACC	ASR
VGG19	BadNets-A2O [11]	89.36	95.93	77.58	2.83	87.41	0.40	88.68	5.17	87.28	3.81	87.73	4.06
Blended [5]	90.17	99.12	77.59	17.19	88.89	25.53	89.27	9.78	89.31	7.40	87.95	5.78
Input-Aware [28]	77.67	94.58	70.31	1.47	70.99	20.37	74.30	7.13	72.59	7.77	77.11	1.47
SSBA [20]	89.48	91.86	72.76	0.67	88.45	20.20	89.05	10.53	88.63	6.12	88.70	4.31
Inception-V3	BadNets-A2O [11]	90.68	94.50	11.37	92.84	90.76	10.82	91.49	8.54	90.62	2.51	91.69	4.70
Blended [5]	93.73	99.82	10.00	100.00	92.70	69.77	93.71	8.91	93.05	4.51	93.71	0.01
Input-Aware [28]	91.60	98.80	19.22	0.38	90.52	10.50	91.65	2.46	91.04	5.30	91.58	0.69
SSBA [20]	93.33	98.30	10.00	100.00	92.21	89.81	93.35	7.52	92.88	6.13	92.23	1.13
DenseNet161	BadNets-A2O [11]	84.33	89.68	72.78	44.22	81.24	80.09	81.32	9.19	82.46	8.48	82.06	1.91
Blended [5]	86.37	98.79	75.09	3.79	82.87	85.98	82.71	13.83	83.75	9.16	83.18	4.22
Input-Aware [28]	84.46	94.41	77.20	17.11	83.65	43.57	82.81	3.56	82.02	1.76	83.44	1.56
SSBA [20]	84.18	84.13	70.99	9.57	81.57	30.27	82.72	7.09	82.06	8.41	81.41	8.48
Avg	87.95	94.99	53.74	32.51	85.94	40.61	86.76	7.81	86.31	5.95	86.73	3.19
E.3 Visualization of targeted adversarial perturbation
We empirically establish that targeted adversarial perturbation (T-AP) is a better surrogate to the trigger compared to untargeted adversarial perturbation (U-AP), as demonstrated through quantitative experiments in the manuscript. It could also be explained from the following aspects: From an intuitive standpoint, T-AP can be regarded as a subregion of U-AP, and the unknown trigger is a specific instance of T-AP. Consequently, employing the projected gradient descent (PGD) adversarial attack method, the generated T-AP is more likely to exhibit proximity to the trigger when contrasted with the generated U-AP. Moreover, we visualize the trigger, as well as the generated T-AP and U-AP. As depicted in Fig. 4, the T-AP is more visually similar to the trigger. To reinforce our argument quantitatively, we calculate the  $L_{2}$  distance in the latent space of the backdoored model among the targeted adversarial example (AE), untargeted AE, and the poisoned sample with the trigger. The distance between targeted AE and poisoned sample 36.4 is substantially smaller than that between Untargeted AE and poisoned sample 93.84. This supplementary experiment reaffirms our contention that T-AP serves as a more faithful surrogate to the concealed trigger in comparison to U-AP.
E.4 Grad-CAM Visualization
We employ Grad-CAM figures to visualize the effects of our NPD on BadNets, Blended, and Trojan attacks, given that these three attack methods employ visible triggers. As illustrated in Figures 5 to 7, Neural Polarizer (NP) effectively redirects the network's attention away from the triggers and toward the subject of figures. This visual evidence substantiates the successful removal of backdoors by NP in backdoored models.
Figure 4: Comparison of trigger (first column), targeted perturbation (second column), and untargeted perturbation (third column) in the input and latent space. Top left: The trigger used in Blended attack. Top middle: Visualization of the perturbation generated by our targeted adversarial perturbation in NPD. Top right: Visualization of the perturbation generated by the untargeted adversarial perturbation. Bottom left: The feature map derived from the poisoned sample in the feature space. Bottom middle: Feature map of the adversarial example generated through our NPD approach (Targeted AE). Bottom right: Feature map of the adversarial example produced through the untargeted adversarial perturbation (Untargeted AE).
Figure 5: Visualizations of benign and poisoned samples, alongside their corresponding Grad-CAM visualizations before and after the insertion of NP of BadNets attack on CIFAR-10 dataset and PreActResNet18 network.
Figure 6: Visualizations of benign and poisoned samples, alongside their corresponding Grad-CAM visualizations before and after the insertion of NP of Blended attack on CIFAR-10 dataset and PreActResNet18 network.
Figure 7: Visualizations of benign and poisoned samples, alongside their corresponding Grad-CAM visualizations before and after the insertion of NP of Trojan attack on CIFAR-10 dataset and PreActResNet18 network.