- ANP [55] is a pruning-based method that prunes neurons sensitive to weight perturbation. Note that in BackdoorBench, ANP can select its pruning threshold by grid searching on the test dataset (default way in BackdoorBench) or a given constant threshold. To produce a fair comparison with other baselines, we use a constant threshold for ANP and set the pruning threshold to 0.4, which is found to produce better results than the recommended constant threshold of 0.2 in BackdoorBench. All other settings are the same as the default setting in BackdoorBench.
- FP [31] is a pruning-based method that prunes neurons according to their activations and then fine-tunes the model to keep clean accuracy. We use the default setting in BackdoorBench
- NAD [28] uses Attention Distillation to mitigate backdoors. We use the default setting in BackdoorBench.
- NC [47] first optimizes a possible trigger to detect whether the model is backdoored. Then, if the model is detected as a backdoored model, it mitigates the backdoor by unlearning the optimized trigger. We use the default setting in BackdoorBench. We remark that if the model is detected as a clean model, NC just returns the model without any changes.
- EP [64] uses the distribution of activation to detect the backdoor neurons and prunes them to mitigate the backdoor. We use the default setting in BackdoorBench.
- i-BAU [59] uses adversarial training with UAP and hyper-gradient to mitigate the backdoor. We use the default setting in BackdoorBench.
- SAU (Ours) uses PGD to generate shared adversarial examples and unlearns them to mitigate the backdoor. For all experiments, we set  $\lambda_{1} = \lambda_{2} = \lambda_{4} = 1$  and  $\lambda_{3} = 0.01$  in (13). Then we run PGD 5 steps with  $L_{\infty}$  norm bound 0.2 and a large step size 0.2 to accelerate the inner maximization in (8). For unlearning step (fine-tuning on  $\mathcal{D}_{cl}$  and SAEs), we use the same setting as i-BAU and fine-tuning (FT) in BackdoorBench. We run SAU 100 epochs in CIFAR-10 and GTSRB. In Tiny ImageNet, we run SAU 20 epochsNote that the number of epochs used in our experiment largely exceeds the necessary epochs for SAU to take effect and can be further reduced to save computational costs.
- Vanilla Adversarial Training (vanilla AT) [33] use PGD to generate vanilla adversarial examples and unlearn them to mitigate the backdoor. In all experiments, vanilla AT uses the same setting as SAU, including the step size, norm bound, optimizer, and learning rate except for the experiment in Figure 1, where we train vanilla AT 100 epochs on Blended Attack with PreAct-ResNet18 and Tiny ImageNet to show its long-term performance.
- Adversarial Fine-tuning (AFT) [35] performs adversarial training on clean dataset, which is equivalent to vanilla AT.
- Composite Adversarial Training (Composite AT, CAT) [13] use perturbation from different types to defend against backdoor attacks. We request the official implementation of CAT from the authors and use the recommended setting in the original paper.
- Progressive Backdoor Erasing (PBE) [35] uses the adversarial attack to progressively filter the clean dataset from the training dataset and remove the backdoor. Since the code haven't been released yet and the details of some critical parameters such as the configuration of adversarial attacks, the data filtering ratio in each step, and the learning rates are not covered in the paper, we failed to produce satisfactory results. Besides, the threat