SlowGuess/NeurIPS_2023_OCR huggingface dataset:
$$
\begin{array}{l} \mathcal {R} _ {s u b} - \mathcal {R} _ {1} \leq \frac {1}{| \mathcal {D} _ {- \hat {y}} |} \sum_ {i = 1} ^ {N} \max _ {\boldsymbol {\epsilon} _ {i} \in \mathcal {S}} \mathbb {I} (\boldsymbol {x} _ {i} \in \mathcal {D} _ {- \hat {y}} \setminus \mathcal {D} _ {s}) \mathbb {I} (h _ {\boldsymbol {\theta}} (\tilde {\boldsymbol {x}} _ {i, \boldsymbol {\epsilon} _ {i}}) \neq h _ {\boldsymbol {\theta} _ {b d}} (\tilde {\boldsymbol {x}} _ {i, \boldsymbol {\epsilon} _ {i}}), \tilde {\boldsymbol {x}} _ {i, \boldsymbol {\epsilon} _ {i}} \in \mathcal {A} _ {\boldsymbol {\epsilon} _ {i}, \boldsymbol {\theta}}) \\ \leq \frac {1}{| \mathcal {D} _ {- \hat {y}} |} \sum_ {i = 1} ^ {N} \mathbb {I} \left(\boldsymbol {x} _ {i} \in \mathcal {D} _ {- \hat {y}} \backslash \mathcal {D} _ {s}\right) \\ = 1 - \mathcal {R} _ {b d} \left(h _ {\boldsymbol {\theta} _ {b d}}\right). \\ \end{array}
$$
And the relaxation gap  $\mathrm{GAP}_1$  is bounded by  $1 - \mathcal{R}_{bd}(h_{\pmb{\theta}_{bd}})$ . Since a poisoned model  $h_{\pmb{\theta}_{bd}}$  usually has a high ASR for the backdoor attack, the gap  $\mathrm{GAP}_1$  is usually negligible.
Remark: We remark that the experiment results show that our method also works well for the poisoned models with low ASR. See Section D for more details.
- Replace  $\mathcal{D}_{-\tilde{y}}$  by  $\mathcal{D}_{cl}$ .
The second relaxation is to replace  $\mathcal{D}_{-\hat{y}}$  by  $\mathcal{D}_{cl}$  when  $\hat{y}$  is not accessible. Let  $\mathcal{D}_{\hat{y}} = \mathcal{D}_{cl} \setminus \mathcal{D}_{-\hat{y}}$ . Then, the risk after the second relaxation is:
$$
\begin{array}{l} \mathcal {R} _ {s h a r e} (h _ {\pmb {\theta}}) = \frac {1}{N} \sum_ {i = 1} ^ {N} \max _ {\pmb {\epsilon} _ {i} \in \mathcal {S}} \left\{\mathbb {I} (h _ {\pmb {\theta}} (\tilde {\pmb {x}} _ {i, \pmb {\epsilon} _ {i}}) = h _ {\pmb {\theta} _ {b d}} (\tilde {\pmb {x}} _ {i, \pmb {\epsilon} _ {i}}), \tilde {\pmb {x}} _ {i, \pmb {\epsilon} _ {i}} \in \mathcal {A} _ {\pmb {\epsilon} _ {i}, \pmb {\theta}}) \right\} \\ = \frac {| \mathcal {D} _ {- \hat {y}} |}{N} \frac {1}{| \mathcal {D} _ {- \hat {y}} |} \sum_ {i = 1} ^ {N} \max _ {\boldsymbol {\epsilon} _ {i} \in \mathcal {S}} \left\{\mathbb {I} (\boldsymbol {x} _ {i} \in \mathcal {D} _ {- \hat {y}}) \mathbb {I} (h _ {\boldsymbol {\theta}} (\tilde {\boldsymbol {x}} _ {i, \boldsymbol {\epsilon} _ {i}}) = h _ {\boldsymbol {\theta} _ {b d}} (\tilde {\boldsymbol {x}} _ {i, \boldsymbol {\epsilon} _ {i}}), \tilde {\boldsymbol {x}} _ {i, \boldsymbol {\epsilon} _ {i}} \in \mathcal {A} _ {\boldsymbol {\epsilon} _ {i}, \boldsymbol {\theta}}) \right\} \\ + \frac {| \mathcal {D} _ {\hat {y}} |}{N} \frac {1}{| \mathcal {D} _ {\hat {y}} |} \sum_ {i = 1} ^ {N} \max _ {\boldsymbol {\epsilon} _ {i} \in \mathcal {S}} \Big \{\mathbb {I} (\boldsymbol {x} _ {i} \in \mathcal {D} _ {\hat {y}}) \mathbb {I} (h _ {\boldsymbol {\theta}} (\tilde {\boldsymbol {x}} _ {i, \boldsymbol {\epsilon} _ {i}}) = h _ {\boldsymbol {\theta} _ {b d}} (\tilde {\boldsymbol {x}} _ {i, \boldsymbol {\epsilon} _ {i}}), \tilde {\boldsymbol {x}} _ {i, \boldsymbol {\epsilon} _ {i}} \in \mathcal {A} _ {\boldsymbol {\epsilon} _ {i}, \boldsymbol {\theta}}) \Big \}. \\ \end{array}
$$
where the first component is  $\mathcal{R}_1$  scaled by  $\frac{|\mathcal{D}_{-\hat{y}}|}{N}$  and the second component is the vanilla adversarial risk on  $\mathcal{D}_{\hat{y}}$ , scaled by  $\frac{|\mathcal{D}_{\hat{y}}|}{N}$ . So, the relaxation gap for the second relaxation is
$$
\begin{array}{l} \mathcal {R} _ {1} - \mathcal {R} _ {s h a r e} = \frac {\left| \mathcal {D} _ {\hat {y}} \right|}{N} \mathcal {R} _ {1} \\ - \frac {\left| \mathcal {D} _ {\hat {y}} \right|}{N} \frac {1}{\left| \mathcal {D} _ {\hat {y}} \right|} \sum_ {i = 1} ^ {N} \max  _ {\boldsymbol {\epsilon} _ {i} \in \mathcal {S}} \Big \{\mathbb {I} (\boldsymbol {x} _ {i} \in \mathcal {D} _ {\hat {y}}) \mathbb {I} (h _ {\boldsymbol {\theta}} (\tilde {\boldsymbol {x}} _ {i, \boldsymbol {\epsilon} _ {i}}) = h _ {\boldsymbol {\theta} _ {b d}} (\tilde {\boldsymbol {x}} _ {i, \boldsymbol {\epsilon} _ {i}}), \tilde {\boldsymbol {x}} _ {i, \boldsymbol {\epsilon} _ {i}} \in \mathcal {A} _ {\boldsymbol {\epsilon} _ {i}, \boldsymbol {\theta}}) \Big \}. \\ \end{array}
$$
We can find that the generalization gap is related to the  $\frac{|\mathcal{D}_{\hat{y}}|}{N}$ , i.e., the portion of samples whose labels are target labels, and negligible when  $\frac{|\mathcal{D}_{\hat{y}}|}{N}$  is small.
Remark. For using  $\mathcal{R}_{\text{share}}(h_{\theta})$  to mitigate the backdoor, the influence of  $\frac{|D_{-\hat{y}}|}{N}$  can be eliminated by altering the trade-off parameter in Problem (8). Also, adding triggers to samples labeled  $\hat{y}$  is harmless during the testing/deployment phase. So, the vanilla adversarial risk on  $\mathcal{D}_{\hat{y}}$  has a negligible negative impact on defending the backdoor. Therefore, replacing  $\mathcal{D}_{-\hat{y}}$  with  $\mathcal{D}_{cl}$  has little negative impact on mitigating the backdoor.
In this section, we provide a comprehensive discussion of the proposed method, including its efficiency, comparison to other methods, choice of perturbation, generalization ability to attack with excessive-magnitude triggers, performance on the generated dataset, and resistance to defense-aware/adaptive attacks.
B.1 Efficiency and Computational Cost
Here, we would like to emphasize that SAU is an efficient and effective defense method that can mitigate backdoor attacks with acceptable overhead for the following reasons:
- SAU is a post-processing method that fine-tunes the backdoor model on a clean dataset with a small size. For instance, we can use only 500 samples from CIFAR-10 to fine-tune the model by SAU (see Appendix D.6 for more details), which takes 1.52 seconds/epoch to fine-tune PreAct-ResNet18 with RTX 4090. Therefore, it can be executed efficiently without requiring a large amount of data or computation resources.
- SAU only takes a few epochs to take effect, which further reduces the computational cost of executing it in practice. As shown in Appendix D.4, SAU can achieve a low Attack Success Rate and a high Accuracy in a few epochs.
To further demonstrate the efficiency of SAU, we compare its average runtime with other state-of-the-art defense methods against attacks. We use the same experimental setting as in Section 4, where the poisoning ratio is  $10\%$  and the backbone model is PreAct-ResNet18. All experiments are conducted on a server with GPU RTX 4090 and CPU AMD EPYC 7543 32-Core Processor. As different methods adopt different learning paradigms for backdoor mitigation, we measure the average runtime for each defense method to take effect on CIFAR-10 and Tiny ImageNet (ASR  $< 5\%$  and ACC  $>85\%$  on CIFAR-10, or ASR  $< 5\%$ , ACC  $>45\%$  on Tiny ImageNet). Note that if a defend method cannot reach the criteria for "Take effect", the maximum runtime is reported. The results are summarized in the following table.
Table 7: Time to take effect for different methods, averaged over different attacks
Dataset	ANP [55]	FP [31]	NC [47]	NAD [28]	EP [64]	i-BAU [59]	SAU (Ours)
CIFAR-10	289.86s	266.57s	825.86s	75.14s	65.71s	47.00s	43.86s
Tiny ImageNet	1086.50s	318.30s	27359.70s	227.01s	141.67s	621.33s	262.60s
From Table 7, SAU is faster than most of the existing methods, except for NAD and EP, which shows that SAU is an efficient and effective defense method.
B.2 Comparison with Certified Robustness methods
In backdoor defense, methods can be categorized into two classes: empirical methods which aim to develop effective and efficient methods for backdoor defense, and certified methods which aim to build a provable framework for backdoor robustness. As our method is an empirical method, we would like to point out that our method is different from the existing works on certified robustness in several aspects, which makes them incomparable or impractical to apply to our setting. Specifically:
- Efficiency and scalability. Certified methods usually have very high computation costs and are infeasible to apply to large-scale deep neural networks, while our method is efficient and scalable. For example, the representative methods RAB [51] and BagFlip [61] rely on voting over 1000 smoothed models for prediction and are only feasible for some simple neural networks and simple classification problems. To apply these methods to our setting, we would need to train 1000 PreAct-ResNet models on CIFAR-10 from scratch, which would take over 600 hours (25 days) and 620GB of space for a single attack on a server with one RTX 3090.
- Applicability to model architecture. Many certified methods are restricted to some simple or classical models, while our method is general and applicable to any deep neural network
architecture. For example, the method in [20] is designed for only k-Nearest Neighbors (kNN) and radius Nearest Neighbors (rNN) models with some feature extractor and cannot be applied to modern deep neural networks.
- Difference in the threat model. Most certified methods focus on the threat model where the training dataset is accessible to defenders while our method focuses on the threat model where only a poisoned model and a few clean samples are given.
Therefore, we believe that our method is more practical and effective for defending against backdoor attacks in deep neural networks than the existing works on certified robustness from the perspective of efficiency, scalability, and model structures.
B.3 Comparison with other AT based methods
Here, we compare the proposed method SAU with other representative Adversarial Training based methods from the following aspects:
- Threat Model: whether the training dataset is accessible and whether the extra clean dataset is accessible.
- Types of Perturbation: whether universal adversarial perturbation is supported.
- Types of Adversarial Attack: whether Targeted Adversarial Attack is supported.
The answer "Yes" and "No" are indicated by  $\sqrt{}$  and  $\times$ , respectively. The "Optional" means the method supports but is not limited to a specific answer. We summarize the result in Table 8.
Table 8: Comparison between SAU with other AT based methods
Method	Training Dataset	Extra Clean Dataset	UAP	Targeted Attack
AT from Scratch [52]	✓	×	×	×
Composite AT [13]	✓	×	×	×
i-BAU [59]	×	✓	✓	×
PBE [35]	✓	×	×	×
AFT [35]	×	✓	×	×
SAU (Ours)	×	✓	Optional	Optional
We remark that two methods, i.e., PBE and AFT are proposed in Mu et al. [35] for different threat models, where PBE is designed to filter a clean dataset from a training dataset, and AFT is to perform AT on the given clean dataset. Therefore, AFT is equivalent to the Vanilla AT in the Figure 1 and Section 4.3.
As summarized in Table 8, the current AT-based methods can be roughly categorized into two types based on their threat model: in-training (given training dataset) and post-training (given poisoned model and extra clean dataset), and the difference in threat model makes methods from different categories incomparable.
1. Comparison with In-training AT-based methods. Although SAU is not comparable with the in-training AT-based method due to the underlying assumption of the threat model, we would like to adopt different threat models for different methods to highlight the advantages of SAU compared to the in-training AT-based methods. Therefore, we compare SAU with the latest SOTA in-processing AT-based method, i.e., Composite AT (CAT) [13].
We first highlight the following differences between CAT and SAU:
- SAU is theoretically motivated by the relationship between adversarial robustness and backdoor risk, while CAT is empirically driven by some experimental observations. Therefore, our method has a theoretical guarantee for the performance against various backdoor attacks, while CAT does not.
- SAU fine-tunes a backdoored model with a small clean dataset, while CAT trains a backdoor-free model from scratch on a poisoned dataset. Therefore, SAU is more efficient than CAT.
Then, we conduct experiments on defending against backdoor attacks and summarize the results in Table 9 and 10.
Table 9: Experiments Results with poisoning ratio  $1\%$
Method	No Defense	No Defense	No Defense	CAT [13]	CAT [13]	CAT [13]	SAU (Ours)	SAU (Ours)	SAU (Ours)
Attack	Acc	ASR	R-ACC	Acc	ASR	R-ACC	Acc	ASR	R-ACC
BadNets [15]	93.14	74.73	24.24	75.52	2.50	74.73	91.25	0.94	91.16
Input-Aware	91.74	79.18	19.89	75.24	72.48	23.97	92.20	3.63	84.06
SSBA [30]	93.43	73.44	24.89	74.94	3.07	71.40	91.34	0.79	88.46
WaNet [38]	90.65	12.63	79.94	75.21	2.68	74.46	91.84	1.23	89.89
Average	92.24	60.00	37.24	75.23	20.18	61.14	91.66	1.65	88.39
Table 10: Experiments Results with poisoning ratio  ${10}\%$
Method	No Defense	No Defense	No Defense	CAT [13]	CAT [13]	CAT [13]	SAU (Ours)	SAU (Ours)	SAU (Ours)
Attack	Acc	ASR	R-ACC	Acc	ASR	R-ACC	Acc	ASR	R-ACC
BadNets [15]	91.32	95.03	4.67	74.42	92.49	6.21	89.31	1.53	88.81
Input-Aware	90.67	98.26	1.66	74.21	96.81	2.88	91.59	1.27	88.54
SSBA [30]	92.88	97.8	1.99	74.29	28.29	57.49	90.84	1.79	85.83
WaNet [38]	91.25	89.73	9.76	74.62	4.87	73.07	90.41	2.51	79.69
Average	91.53	95.21	4.52	74.39	55.61	34.91	92.54	1.78	85.72
The experimental results show that our method is superior to CAT, as evidenced by the following aspects:
- SAU achieves significantly higher accuracy (ACC) and lower attack success rate (ASR) than CAT on both poisoning ratios.
- SAU is more robust to different poisoning ratios than CAT. In contrast, CAT fails on a high poisoning ratio (10%) (also observed in Table XI of Gao et al. [13]).
2. Comparison with Post-training AT-based methods. The most related methods to SAU are the post-processing AT-based method including I-BAU and AFT, and we highlight the following differences between them:
- I-BAU is proposed under the assumption that the same trigger are used for all poisoned samples which may not be true for more advanced attacks, while SAU is shown to be effective for attacks with multi-trigger and sample-specific trigger theoretically and empirically.
- AFT, which is to perform AT on clean dataset, is motivated by some empirical observation, while SAU is motivated by a novel analysis on the relation between adversarial examples and poisoned samples.
Besides, the experimental comparison between SAU and I-BAU in Section 4.2 and the experimental between SAU and AFT (Vanilla AT on Clean Dataset) in Section 4.3 show that SAU outperforms I-BAU and AFT by a large margin.
B.4 Choice of perturbation and generalization ability of SAU
In this section, we discuss the choice of perturbation set and show that the proposed method, i.e., SAU, can generalize to attacks with excessive-magnitude triggers.
1. Type of adversarial perturbation (AP) and perturbation set. The theoretical analysis and the proposed method SAU is independent of the AP type and AP set (not only  $L_{p}$  ball). For sample space  $\mathcal{X}$ , define the set  $G = \{g(x, \Delta) - x | x \in \mathcal{X}\}$  and the general perturbation set  $S = \{T(x, \epsilon) - x | x \in \mathcal{X}\}$  for adversarial attack  $T$  with learnable parameter  $\epsilon \in \Omega$  such that an adversarial example can be generated by  $\tilde{x}_{\epsilon} = T(x, \epsilon)$ . Then, the theoretical analysis and proposed method can be applied if  $G \subseteq S$ , where the AP can be any type, such as additive AP, Spatially Transformed AP [56], or Perceptual AP [25], etc.
2. Effect of perturbation set  $S$ . The key of SAU is to consider Shared Adversarial Example (SAE) as surrogates for poisoned samples. Given models, the set of SAE is determined by  $S$ : larger  $S$  leads to larger set of SAE, and vice versa. Therefore, the perturbation set  $S$  plays an important role in the effectiveness of SAU. Specifically, adopting a larger  $S$  can cover unknown triggers but also increases the chance of picking SAE which is irrelevant to poisoned samples, and may weaken the defense performance. Meanwhile, some poisoned samples may be beyond the scope of SAE if a smaller  $S$  is adopted.
3. Generalization to excessive-magnitude trigger. In practice, we find that the proposed method SAU is effective for various attacks, even if Assumption 1 does not hold. For example, SAU with  $L_{\infty}$  norm bound 0.2 can still effectively mitigate SSBA attack whose average  $L_{\infty}$  trigger norm is much larger than 0.2, revealing the generalization of SAU to attacks with excessive-magnitude trigger.
Table 11: SAU for SSBA Attack
Dataset	L1	L2	L∞	ACC	ASR	R-ACC
CIFAR-10	108.33	3.29	0.33	90.99	0.58	87.04
Tiny	581.65	8.26	0.43	51.85	0.11	36.36
To investigate the SAU's generalization ability, we conduct experiments on BadNets with various strengths. Specifically, for BadNets with a 3x3 patched trigger, we alter the pixel value of the trigger from 0.2 to 1.0.
Table 12: Defend against BadNets [15] Attack with Various Pixel Value
No Defense	No Defense	ANP [55]	ANP [55]	SAU (Ours)	SAU (Ours)
Pixel	L∞	ACC	ASR	ACC	ASR	ACC	ASR
0.2	0.42	91.69	95.60	91.30	2.64	90.01	1.38
0.4	0.31	91.61	97.79	91.44	1.00	88.43	1.59
0.6	0.35	91.94	96.43	91.72	7.81	90.49	1.30
0.8	0.48	91.72	93.20	91.06	2.37	89.23	1.36
1.0	0.67	91.32	95.03	90.88	4.88	89.31	1.53
Table 12 shows the results for defending various BadNets attacks by SAU following the setting in Section 4.2, from which we can find that SAU can consistently mitigate the backdoor even when the trigger is beyond the perturbation set. One reasonable explanation is that although the poisoned samples are not included in SAEs, there exists SAE that has a similar effect as poisoned samples as shown in Figure 4, resulting in strong generalization ability of SAU.
4. Effect of perturbation type. To explore the effect of perturbation types, we extend SAU to incorporate two other perturbation types and denote the resulting methods by Spatial SAU and Ensemble SAU, respectively. Specifically, for spatial SAU, we employ spatial adversarial attack [56] to generate spatial SAEs by spatial transformation, following the same setting as [13]. For Ensemble SAU, the perturbation set  $S$  is composed of a collection of subsets, including  $L_{1}$  ball (bound 500),  $L_{2}$  ball (bound 10),  $L_{\infty}$  ball (bound 0.2), and the spatial AP set. Then, for each batch, Ensemble SAU randomly chooses one subset of perturbation to generate the SAEs. We compare SAU, Spatial SAU and Ensemble SAU, following the setting in Section 4.
Table 13: Defend against BadNets [15] Attack with Various Pixel Value
No Defense	No Defense	SAU	SAU	Spatial SAU	Spatial SAU	Ensemble SAU	Ensemble SAU
Dataset	Attack	ACC	ASR	ACC	ASR	ACC	ASR	ACC	ASR
CIFAR-10	BadNets [15]	91.32	95.03	89.31	1.53	88.27	0.97	88.16	0.67
CIFAR-10	SSBA [30]	92.88	97.86	90.84	1.79	89.65	4.43	89.92	0.81
CIFAR-10	WaNet [38]	91.25	89.73	91.26	1.02	90.21	4.34	89.61	0.66
Tiny ImageNet	BadNets [15]	56.23	100	51.52	0.53	50.68	99.81	49.32	0.49
Tiny ImageNet	SSBA [30]	55.22	97.71	51.85	0.11	49.79	79.72	49.73	0.05
Tiny ImageNet	WaNet [38]	56.78	54.65	54.65	85.75	50.12	0.7	51.14	0.15
Figure 4: Visualization of Features of Poisoned Sample, Shared Adversarial Example and Non-shared Adversarial Example in latent space for BadNets Attack with PreAct-ResNet18. Both Shared Adversarial Example and Adversarial Example are generated by PGD-5 with  $L_{\infty}$  norm 0.2. The  $L_{2}$  distance between the features of the Poisoned sample and Shared Adversarial Example is 38.75, while the L2 distance between the features of the Poisoned sample and the Non-shared Adversarial Example is 80.55, showing that the Shared Adversarial Example can still be close to the Poisoned Sample in latent space even if the trigger is beyond perturbation set.
From Table 13, we compare SAU, Spatial SAU and Ensemble SAU, following the setting in Section 4. From the table, we find that Spatial SAU works well on CIFAR-10 dataset but fails to defend BadNets and SSBA attacks on Tiny ImageNet. For WaNet, spatial SAU can effectively defend it on both datasets. We remark that the Ensemble SAU achieves the lowest ASR in all experiments. However, as Ensemble SAU has larger perturbation set, its accuracy is lower than SAU by  $12\%$ .
In summary, our theoretical analysis and the proposed method SAU are flexible to the perturbation set, and SAU can be generalized to attack with excessive trigger norms. Moreover, the Ensemble SAU serves as a stronger variant of SAU and can be effective for various attacks.
B.5 SAU with generated datasets
Like most other post-processing methods [31, 55, 47, 28, 59], SAU assumes that a small clean dataset is available for conducting defense, which can be obtained by ways such as buying from a trustworthy data supplier, using modern generative models, collecting from the internet, or applying some data cleansing techniques.
In this section, we explore a more practical case for defense, i.e., using the generated dataset, to evaluate our method. Specifically, we conduct experiments on synthetic datasets and compare SAU with NAD. We test both methods with a synthetic dataset CIFAR-5m [36] which provides generated CIFAR-10-like images whose distribution is close but not identical to CIFAR-10, and can be regarded as OOD data. We build mixed datasets by randomly picking samples from CIFAR-10 and CIFAR-5m with a mixed ratio, and evaluate both methods on the mixed datasets. A larger mixed ratio indicates more synthetic data in the mixed dataset. The experiment results are summarized in the following tables.
From Table 14, we can find that all methods can work on the mixed dataset but as the mixed ratio increase, the accuracy (ACC) may decrease due to the distribution difference between the two datasets. It's notable that the model distillation-based method NAD is influenced by the quality of the dataset most, with a reduction of  $4.91\%$  in ACC, while SAU is quite robust to the data quality. Another interesting phenomenon is that the ASR of ANP decreases when more synthetic data is used, which shows that the distribution of data may influence the performance of backdoor defense.
Table 14: Results on Generated Dataset
ANP [55]	ANP [55]	NAD [28]	NAD [28]	SAU (Ours)	SAU (Ours)
Mixed Ratio	ACC	ASR	ACC	ASR	ACC	ASR
0.0	90.88	4.88	89.87	2.14	89.31	1.53
0.2	90.68	2.10	87.96	1.88	89.83	1.63
0.4	90.21	1.11	87.69	1.88	89.36	1.60
0.6	90.31	1.51	86.69	2.19	88.44	1.66
0.8	89.37	0.56	85.90	1.86	88.13	1.79
1.0	88.74	0.40	84.96	2.48	88.32	1.01
All those observations motivate us to conduct research on the relationship between data quality and backdoor defense in the future.
B.6 Resistance to defense-aware/adaptive Attacks
When the attacker is aware of the defender's adversarial training strategy, the attacker can train the backdoorsed model using Adversarial Training (AT) on the poisoned dataset, such that the model can be resistant to adversarial attack, hindering the generation of shared adversarial examples.
To evaluate the performance of SAU against such defense-aware backdoor attacks, we conduct experiments on the CIFAR-10 dataset following the settings in Section 4.2. For AT on the training dataset, we use PGD-10 attack with  $L_{\infty}$  norm 8/255, which is commonly used in adversarial training literature.
Table 15: Experiments Results for Defense-aware Attack
No Defense	No Defense	SAU (Ours)	SAU (Ours)
Attack	ACC	ASR	ACC	ASR
BadNets [15]	79.89	93.46	79.83	2.39
Input-Aware	79.87	96.60	78.64	4.84
SIG [2]	73.50	99.50	76.41	0.10
Average	77.75	96.52	78.30	2.44
From Table 15, we can find that SAU can achieve an average ACC of  $78.3\%$  and ASR of  $2.44\%$ , showing its resistance to such adaptive attacks.
In this section, we provide the experiment details. In our experiments, all baselines and settings are adapted from BackdoorBench [54], and we present the experiment details in this section.
C.1 Attack details