SlowGuess/NeurIPS_2023_OCR huggingface dataset:
- Sensitivity to the size of the clean dataset. SAU is effective across various sizes of clean data, while RNP achieves good performance for clean data size  $0.5\%$ $1\%$ , as shown in Table 26 and discussed in Section 4 of [29]. Therefore, SAU can be applied to various sizes of clean datasets, especially when the defenders do not know the exact size of the training dataset.
- Sensitivity to poisoning ratio. SAU is effective across various poisoning ratios, while RNP faces challenges when defending against low poisoning ratio attacks, as shown in Table 28 and discussed in Section 5 of [29].
- Sensitivity to model architecture. SAU is effective and stable across various model architectures, while the parameters of RNP are sensitive to the model structure, as we observe that the pruning threshold for RNP varies significantly for various models.
- Motivation. SAU is theoretically motivated by the relationship between adversarial robustness and backdoor risk, while RNP is empirically driven by some experimental observations.
Table 26: Result on ResNet-18 with Poisoning Ratio  ${10}\%$
Attack	Clean Ratio	No Defense	No Defense	RNP [29]	RNP [29]	SAU (Ours)	SAU (Ours)
ACC	ASR	ACC	ASR	ACC	ASR
BadNets [15]	1%	91.46	95.31	88.94	2.14	83.62	2.04
Input-Aware	1%	90.31	98.86	89.47	6.60	87.16	4.79
SIG [2]	1%	84.64	99.69	80.88	0.03	84.08	0.37
BadNets [15]	5%	91.46	95.31	10.65	0.00	89.25	1.33
Input-Aware	5%	90.31	98.86	10.09	0.00	88.20	0.60
SIG [2]	5%	84.64	99.69	10.00	0.00	89.07	3.99
Table 27: Result on PreAct-ResNet-18 with Poisoning Ratio  ${10}\%$
Attack	Clean Ratio	No Defense	No Defense	RNP [29]	RNP [29]	SAU (Ours)	SAU (Ours)
ACC	ASR	ACC	ASR	ACC	ASR
BadNets [15]	1%	91.32	95.03	66.86	0.00	85.12	2.52
Input-Aware	1%	90.67	98.26	79.88	0.00	88.56	2.79
SIG [2]	1%	84.48	98.27	74.47	0.04	84.64	0.64
BadNets [15]	5%	91.32	95.03	10.00	0.00	89.31	1.53
Input-Aware	5%	90.67	98.26	10.00	0.00	91.59	1.27
SIG [2]	5%	84.48	98.27	11.56	0.00	88.56	1.67
Table 28: Result on ResNet-18 with Poisoning Ratio  $0.5\%$
No Defense	No Defense	RNP [29]	RNP [29]	SAU (Ours)	SAU (Ours)
Attack	ACC	ASR	ACC	ASR	ACC	ASR
BadNets [15]	93.73	67.06	91.46	11.54	82.63	2.46
Input-Aware	90.78	97.68	87.28	67.74	87.77	4.60
SIG [2]	93.68	85.02	79.91	14.76	87.71	0.14