SlowGuess/NeurIPS_2023_OCR huggingface dataset:
- BadNets [15] is one of the earliest works for backdoor learning, which inserts a small patch of fixed pattern to replace some pixels in the image. We use the default setting in BackdoorBench.
- Blended backdoor attack (Blended) [7] uses an alpha-blending strategy to fuse images with fixed patterns. We set  $\alpha = 0.2$  as the default in BackdoorBench. We remark that since such a large  $\alpha$  produces visual-perceptible change to clean samples, the Blended Attack in this setting is very challenging for all defense methods.
- Input-aware dynamic backdoor attack (Input-Aware)[37] is a training-controllable attack that learns a trigger generator to produce the sample-specific trigger in the training process of the model. We use the default setting in BackdoorBench.
- Low-frequency attack (LF) [58] uses smoothed trigger by filtering high-frequency artifacts from a UAP. We use the default setting in BackdoorBench.
- Sinusoidal signal backdoor attack (SIG) [2] is a clean-label attack that uses a sinusoidal signal as the trigger to perturb the clean images in the target label. We use the default setting in BackdoorBench.
- Sample-specific backdoor attack (SSBA) [30] uses an auto-encoder to fuse a trigger into clean samples and generate poisoned samples. We use the default setting in BackdoorBench
- Warping-based poisoned networks (WaNet) [38] is also a training-controllable attack that uses a warping function to perturb the clean samples to construct the poisoned samples. We use the default setting in BackdoorBench.
C.2 Defense details
The details for each defense used in our experiment/discussion are summarized below:
model of PBE is different from ours which makes it incomparable to SAU, and therefore, we do not include it in the experiment section.
Adaptation to batch normalization. Batch normalization (BN) has been widely used in modern deep neural networks due to improved convergence. However, recent works show that it is difficult for BN to estimate the correct normalization statistics of a mixture of distributions of adversarial examples and clean examples [57, 48]. Such a problem is magnified when we adversarially fine-tune a model with a small set of samples and may destroy the generalization ability of the model due to biased BN statistics. To address this problem, we propose the fixed BN strategy in the adversarial unlearning/training process. Note that in all experiments, the fixed BN strategy is applied to i-BAU, SAU, and vanilla AT when BN is used in the model architecture like PreAct-ResNet18.
Experiments on VGG19. For VGG19 [41], BN is not used. Therefore, the fixed BN strategy is not applied. Moreover, some methods that depend on BN, such as ANP and EP, are not applicable to VGG19.
In this section, we provide additional experiments.
D.1 Main experiments on VGG19
Table 16: Results on CIFAR-10 with VGG19 and poisoning ratio  ${10}\%$  .
Defense	No Defense	FP [31]	NC [47]
Attack	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER
BadNets [15]	89.36	95.93	3.81	N/A	89.23	92.61	6.82	51.6	87.86	1.00	88.01	96.72
Blended [7]	90.17	99.12	0.82	N/A	90.07	99.11	0.82	49.96	85.92	1.79	74.13	96.54
Input-Aware [37]	77.69	94.59	4.79	N/A	78.62	86.77	11.79	53.91	77.67	94.58	4.79	50.00
LF [58]	88.94	93.93	5.62	N/A	88.98	91.8	7.46	51.07	85.35	9.99	72.79	90.18
SIG [2]	81.69	99.8	0.12	N/A	84.52	99.93	0.07	50.0	81.69	99.80	0.12	50.00
SSBA [30]	89.48	91.86	7.29	N/A	89.40	89.66	9.22	51.06	89.48	91.86	7.29	50.00
WaNet [38]	88.43	88.9	10.3	N/A	89.61	73.39	24.57	57.76	88.43	88.89	10.30	50.01
Average	86.54	94.88	4.68	N/A	87.20	90.47	8.68	52.19	85.20	55.42	36.78	69.06
Defense	NAD [28]	i-BAU [59]	SAU (Ours)
Attack	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER
BadNets [15]	87.51	38.17	58.30	77.96	87.82	25.72	63.24	84.34	86.71	0.08	32.77	96.60
Blended [7]	88.35	93.08	6.33	52.11	88.61	59.86	32.31	68.85	87.01	1.32	23.74	97.32
Input-Aware [37]	75.70	23.36	54.71	84.62	72.15	26.22	42.51	81.41	75.11	12.49	46.19	89.76
LF [58]	87.85	59.38	35.01	66.73	87.97	79.10	18.04	56.93	86.65	6.43	72.51	92.60
SIG [2]	86.01	99.18	0.77	50.31	85.06	90.89	5.27	54.46	84.87	0.11	10.82	99.84
SSBA [30]	87.65	37.54	54.58	76.24	88.08	3.74	76.98	93.36	87.3	1.66	78.70	94.01
WaNet [38]	90.82	44.93	51.18	71.98	90.31	25.83	67.87	81.53	87.07	5.32	83.37	91.11
Average	86.27	56.52	37.27	68.56	85.71	44.48	43.75	74.41	84.96	3.92	49.73	94.46
This section provides additional experiment results on VGG19 with CIFAR-10 (Table 16) and Tiny ImageNet (Table 17) to supplement Section 4. Table 16 shows that SAU outperforms all baselines on CIFAR-10 and VGG19, with a  $40.56\%$  decrease of ASR compared to the second lowest ASR. Moreover, SAU achieves the highest DER in 6 of 7 attacks, demonstrating a significantly better tradeoff between accuracy and ASR. It also achieves the top-2 R-ACC in 5 of 7 attacks and the best average R-ACC, indicating its good ability to recover the prediction of poisoned samples. Table 17 shows that SAU achieves the best DER in 5 of 6 attacks and the top-2 lowest ASR in 5 of 6 attacks. Although SAU only achieves the second-best average ASR in Table 17, it has significantly higher accuracy than NC, which achieves the best average ASR.
D.2 Main experiments on GTSRB
This section provides additional experiment results on GTSRB with PreAct-ResNet18 (Table 18) and VGG19 (Table 19) to supplement Section 4. In both tables, SAU achieves the top-2 lowest ASR in 4 of 6 attacks and the lowest ASR on average. Furthermore, SAU achieves the top-2 highest DER in 4 of 6 attacks for PreAct-ResNet18 (Table 18) and 5 of 6 attacks for VGG19 (Table 19).
Table 17: Results on Tiny ImageNet with VGG19 and poisoning ratio  ${10}\%$  .
Defense	No Defense	FP [31]	NC [47]
Attack	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER
BadNets [15]	42.26	99.99	0.0	N/A	40.70	99.63	0.20	49.4	26.47	0.53	25.93	91.83
Blended [7]	43.5	99.32	0.32	N/A	41.82	98.67	0.71	49.48	35.93	0.03	18.87	95.86
Input-Aware [37]	46.36	99.48	0.38	N/A	45.95	99.02	0.69	50.03	38.51	0.45	36.00	95.59
LF [58]	43.14	95.41	2.3	N/A	41.63	85.22	5.82	54.34	10.55	0.77	5.37	81.02
SSBA [30]	41.67	96.57	1.71	N/A	40.04	69.27	9.10	62.84	28.23	0.21	22.86	91.46
WaNet [38]	43.6	99.85	0.09	N/A	42.85	99.31	0.46	49.9	8.14	1.17	7.13	81.61
Average	43.42	98.44	0.8	N/A	42.16	91.85	2.83	52.28	24.64	0.53	19.36	83.91
Defense	NAD [28]	i-BAU [59]	SAU (Ours)
Attack	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER
BadNets [15]	37.68	96.40	2.02	49.5	40.10	100.0	0.0	48.92	38.25	0.06	14.32	97.96
Blended [7]	38.59	95.98	1.64	49.21	40.11	98.88	0.47	48.52	38.24	0.01	6.10	97.02
Input-Aware [37]	36.14	2.79	31.87	93.23	44.49	58.66	18.85	69.47	42.87	6.94	35.15	94.52
LF [58]	38.06	81.10	7.40	54.62	40.23	86.89	6.05	52.8	39.15	15.46	20.31	87.98
SSBA [30]	36.27	84.86	5.78	53.15	38.93	87.81	4.96	53.01	36.31	0.32	8.98	95.45
WaNet [38]	34.89	63.91	13.98	63.61	39.82	98.69	0.62	48.69	37.04	2.52	20.02	95.38
Average	36.94	70.84	10.45	59.05	40.61	88.49	5.16	53.06	38.64	4.22	17.48	88.33
Table 18: Results on GTSRB with PreAct-ResNet18 and poisoning ratio  ${10}\%$  .
Defense	No Defense	ANP [55]	FP [31]	NC [47]
Attack	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER
BadNets [15]	97.24	59.25	4.42	N/A	96.89	0.06	96.79	79.42	98.21	0.09	70.93	79.58	97.48	0.01	97.45	79.62
Blended [7]	98.58	99.99	0.0	N/A	98.75	99.82	0.18	50.09	98.38	100.0	0.0	49.9	97.76	8.03	59.74	95.57
Input-Aware [37]	97.26	92.74	7.23	N/A	99.14	0.00	96.09	96.37	98.08	2.32	88.91	95.21	98.55	0.01	96.71	96.36
LF [58]	97.93	99.57	0.42	N/A	97.80	81.38	16.45	59.03	97.59	99.7	0.27	49.83	97.97	1.34	77.37	99.11
SSBA [30]	97.98	99.56	0.49	N/A	97.86	98.73	1.13	50.36	97.75	99.46	0.45	49.94	97.72	0.29	87.30	99.50
WaNet [38]	97.74	94.25	5.59	N/A	98.00	0.00	97.08	97.12	97.62	88.07	8.71	53.03	98.25	0.00	98.03	97.12
Average	97.79	90.89	3.02	N/A	98.07	46.66	51.29	68.91	97.94	64.94	28.21	61.07	97.96	1.61	86.10	88.18
Defense	NAD [28]	EP [64]	i-BAU [59]	SAU (Ours)
Attack	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER
BadNets [15]	98.69	0.63	98.00	79.31	97.69	10.94	88.22	74.16	96.03	0.02	96.07	79.01	98.0	0.01	97.92	79.62
Blended [7]	98.61	100.0	0.00	50.0	97.9	100.0	0.0	49.66	95.65	86.45	6.52	55.31	96.73	3.41	34.42	97.36
Input-Aware [37]	98.27	40.65	58.68	76.04	98.5	49.49	49.5	71.62	97.93	1.94	93.58	95.4	98.09	0.01	93.02	96.36
LF [58]	98.14	51.83	40.02	73.87	97.59	99.2	0.72	50.02	95.59	17.3	32.16	89.97	96.08	0.37	16.89	98.68
SSBA [30]	97.95	99.39	0.59	50.07	97.66	98.66	1.13	50.29	96.13	1.27	58.10	98.22	96.94	0.45	40.33	99.04
WaNet [38]	98.61	0.56	97.63	96.84	96.96	8.97	82.93	92.25	96.92	0.11	96.25	96.66	97.86	0.02	97.42	97.11
Average	98.38	48.84	49.15	68.02	97.72	61.21	37.08	62.57	96.38	17.85	63.78	80.65	97.28	0.71	63.33	88.31
D.3 Experiments with  $5\%$  poisoning ratio
This section reports the experiment results for comparing SAU with baselines with a poisoning ratio of  $5\%$  on CIFAR-10 and Tiny-ImageNet. As with the results for a poisoning ratio of  $10\%$ , SAU achieves the top-2 lowest ASR in most of the attacks. Tables 20 and 21 show that SAU achieves the lowest average ASR. In summary, SAU still outperforms other baselines for a poisoning ratio of  $5\%$ .
D.4 Learning curves for Shared Adversarial Risk
This section presents a plot of the learning curves for shared adversarial risk to illustrate the relationship between the backdoor risk (measured by ASR) and the shared adversarial risk. For each plot, we run SAU on CIFAR-10 with PreAct-ResNet18 and a poisoning ratio of  $10\%$  for 10 epochs. The SAR is computed on the test dataset by computing the shared adversarial example using the inner maximization step in (8). Figure 5 demonstrates that SAU can effectively reduce the shared adversarial risk, and thus, mitigate the backdoor risk. We note that in order to satisfy Assumption 1, the perturbation set adopted by SAU is much larger than the perturbation budget in the adversarial robustness area, resulting in a high adversarial risk in Figure 5.
D.5 Experiments on different PGD configurations
In this section, we test SAU using different PGD configurations to generate the shared adversarial examples. Specifically, we consider the following configurations for PGD:
- Config 1: PGD with  $L_{\infty}$  norm bound 0.2, step size 0.2, and 5 steps.
Table 19: Results on GTSRB with VGG19 and poisoning ratio  ${10}\%$  .
Defense	No Defense	FP [31]	NC [47]
Attack	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER
BadNets [15]	96.25	57.11	4.88	N/A	97.02	2.89	18.64	77.11	96.86	0.00	96.64	78.56
Blended [7]	95.98	99.86	0.04	N/A	96.48	99.79	0.08	50.03	95.32	20.80	38.37	89.20
Input-Aware [37]	96.03	76.69	22.35	N/A	97.08	24.09	73.09	76.3	96.71	0.02	94.22	88.33
LF [58]	95.05	98.79	0.99	N/A	95.28	98.13	1.48	50.33	93.25	0.60	67.61	98.19
SSBA [30]	96.43	99.31	0.43	N/A	96.45	99.0	0.64	50.16	96.56	1.03	79.49	99.14
WaNet [38]	95.27	92.09	7.35	N/A	96.90	68.48	29.00	61.81	96.84	1.11	94.67	95.49
Average	95.84	87.31	6.01	N/A	96.54	65.4	20.49	59.39	95.92	3.93	78.50	85.56
Defense	NAD [28]	i-BAU [59]	SAU (Ours)
Attack	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER
BadNets [15]	96.78	73.52	25.73	50.0	95.81	0.01	94.70	78.33	96.21	0.02	79.69	78.53
Blended [7]	96.60	98.27	0.55	50.79	95.11	0.79	16.55	99.10	95.45	1.79	12.61	98.77
Input-Aware [37]	97.77	53.03	45.94	61.83	96.92	10.06	72.08	83.31	96.48	0.01	11.34	88.34
LF [58]	94.69	97.07	2.43	50.68	95.51	0.83	22.43	98.98	95.17	0.02	15.83	99.38
SSBA [30]	96.38	98.38	0.95	50.44	94.57	2.55	61.79	97.45	95.92	7.44	31.49	95.68
WaNet [38]	97.47	39.34	57.96	76.38	96.86	6.28	81.71	92.90	97.04	5.89	88.15	93.10
Average	96.62	76.6	22.26	55.73	95.80	3.42	58.21	85.72	96.04	2.53	39.85	86.26
Table 20: Results on CIFAR-10 with PreAct-ResNet18 and poisoning ratio  $5\%$ .
Defense	No Defense	ANP [55]	FP [31]	NC [47]
Attack	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER
BadNets [15]	92.64	88.74	10.78	N/A	92.38	3.10	90.13	92.69	92.47	17.47	77.9	85.55	89.89	1.17	89.70	92.41
Blended [7]	93.67	99.61	0.39	N/A	93.32	98.00	1.92	50.63	93.46	98.87	1.11	50.27	93.66	99.61	0.39	50.00
Input-Aware [37]	91.52	90.2	8.91	N/A	91.64	1.08	87.01	94.56	91.89	52.74	44.49	68.73	91.51	90.20	8.91	50.00
LF [58]	93.35	98.03	1.86	N/A	92.60	96.98	2.87	50.15	93.14	98.37	1.53	49.9	93.35	98.03	1.86	50.00
SIG [2]	93.64	97.09	2.9	N/A	93.09	92.38	7.39	52.08	93.27	99.79	0.2	49.81	93.65	97.09	2.90	50.00
SSBA [30]	93.27	94.91	4.82	N/A	93.13	52.66	43.68	71.06	93.05	87.14	12.09	53.77	91.04	0.80	87.93	95.94
WaNet [38]	91.76	85.5	13.49	N/A	90.67	2.31	88.31	91.05	92.14	26.1	63.5	79.7	91.76	85.50	13.49	50.00
Average	92.84	93.44	6.16	N/A	92.40	49.50	45.90	71.75	92.77	68.64	28.69	62.53	92.12	67.49	29.31	62.62
Defense	NAD [28]	EP [64]	i-BAU [59]	SAU (Ours)
Attack	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER
BadNets [15]	91.03	4.73	87.93	91.2	91.04	0.98	91.26	93.08	88.8	2.51	87.82	91.20	90.54	1.36	90.32	92.64
Blended [7]	93.10	99.06	0.93	49.99	92.07	98.88	1.01	49.57	88.39	35.89	43.28	79.22	91.25	5.64	67.56	95.77
Input-Aware [37]	93.07	97.12	2.68	50.0	90.59	1.51	85.09	93.88	91.34	7.63	80.10	91.19	91.12	2.03	82.11	93.88
LF [58]	92.98	94.23	5.3	51.72	91.65	83.71	15.22	56.31	87.25	34.61	41.31	78.66	91.31	2.59	78.93	96.70
SIG [2]	92.49	96.98	2.93	49.48	92.4	1.86	60.29	97.00	86.44	5.73	48.86	92.08	90.87	0.97	54.98	96.68
SSBA [30]	92.49	88.63	10.58	52.75	92.29	12.14	78.70	90.89	87.15	3.86	78.57	92.47	91.15	1.43	85.87	95.68
WaNet [38]	93.31	50.4	46.46	67.55	91.36	31.98	62.87	76.56	89.71	4.24	83.68	89.60	91.69	3.58	88.33	90.93
Average	92.64	75.88	22.4	58.96	91.63	33.01	56.35	79.61	88.44	13.50	66.23	87.77	91.13	2.51	78.30	94.61
- Config 2: PGD with  $L_{\infty}$  norm bound 0.1, step size 0.1, and 5 steps.
- Config 3: PGD with  $L_{\infty}$  norm bound 0.2, step size 0.1, and 5 steps.
- Config 4: PGD with  $L_{2}$  norm bound 5, step size 0.2, and 5 steps.
- Config 5: PGD with  $L_{1}$  norm bound 300, step size 0.2, and 5 steps.
The experiments are conducted for CIFAR-10 with PreAct-ResNet18 and poisoning ratio  $10\%$ . We summarize the experiment results in Table 22, from which we can find the SAU can effectively mitigate backdoors under various configurations of PGD.
Table 21: Results on Tiny ImageNet with PreAct-ResNet18 and poisoning ratio  $5\%$ .
Defense	No Defense	ANP [55]	FP [31]	NC [47]
Attack	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER
BadNets [15]	56.36	99.86	0.13	N/A	44.54	0.02	43.80	94.01	53.00	96.83	2.86	49.83	52.97	65.94	25.45	65.26
Blended [7]	56.69	98.75	0.94	N/A	45.19	92.89	3.67	47.18	52.96	94.47	3.21	50.28	53.63	96.52	2.21	49.59
Input-Aware [37]	57.87	98.25	1.51	N/A	49.38	0.17	48.84	94.80	56.27	89.87	6.52	53.39	56.48	0.49	53.17	98.18
LF [58]	56.67	95.99	2.75	N/A	41.26	38.48	17.21	71.05	53.11	86.8	6.47	52.81	51.49	67.51	16.57	61.65
SSBA [30]	56.86	95.69	3.05	N/A	44.93	50.44	20.23	66.66	53.26	79.97	10.63	56.06	54.04	0.04	38.80	96.41
WaNet [38]	56.83	98.36	1.21	N/A	29.42	0.03	27.29	85.46	54.18	93.36	2.09	51.18	53.02	0.27	50.56	97.14
Average	56.88	97.82	1.6	N/A	42.45	30.34	26.84	72.74	53.80	90.22	5.3	51.94	53.60	38.46	31.13	74.03
Defense	NAD [28]	EP [64]	i-BAU [59]	SAU (Ours)
Attack	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER
BadNets [15]	45.51	34.63	34.01	77.19	51.58	0.10	51.06	97.49	53.60	96.58	3.17	50.26	51.94	0.78	50.78	97.33
Blended [7]	46.72	88.89	4.96	49.94	53.13	82.26	8.58	56.47	52.76	92.01	4.7	51.41	52.47	3.40	24.90	95.57
Input-Aware [37]	48.72	1.04	45.83	94.03	57.09	0.92	51.27	98.27	56.13	36.99	40.9	79.76	53.92	0.11	50.89	97.10
LF [58]	46.93	63.9	14.66	61.18	54.04	83.80	10.06	54.78	52.45	90.81	5.77	50.48	52.57	44.27	23.78	73.81
SSBA [30]	46.65	42.45	24.65	71.51	53.87	52.07	23.44	70.31	52.65	90.72	5.95	50.38	53.57	0.02	39.77	96.19
WaNet [38]	46.81	2.44	39.54	92.95	53.98	0.12	52.62	97.70	52.99	93.43	4.93	50.55	50.15	81.75	12.37	54.97
Average	46.89	38.89	27.27	70.97	53.95	36.54	32.84	75.00	53.43	83.42	10.9	54.69	52.44	21.72	33.75	80.71
Figure 5: Learn curves for Accuracy, Backdoor Risk, Adversarial Risk, and Shared Adversarial Risk.
Table 22: Results for SAU with different PGD configurations
Defense	No Defense	Config 1 (Default)	Config 2
Attack	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER
BadNets [15]	91.32	95.03	4.67	N/A	89.31	1.53	88.81	95.74	89.56	0.80	89.60	96.24
Blended [7]	93.47	99.92	0.08	N/A	90.96	6.14	64.89	95.63	91.05	6.06	61.11	95.72
Input-Aware	90.67	98.26	1.66	N/A	91.59	1.27	88.54	98.49	90.93	1.56	84.76	98.35
LF [58]	93.19	99.28	0.71	N/A	90.32	4.18	81.54	96.12	90.83	3.76	77.93	96.58
SIG [2]	84.48	98.27	1.72	N/A	88.56	1.67	57.96	98.30	88.29	0.94	49.41	98.66
SSBA [30]	92.88	97.86	1.99	N/A	90.84	1.79	85.83	97.01	89.81	1.63	80.29	96.58
WaNet [38]	91.25	89.73	9.76	N/A	91.26	1.02	90.28	94.36	86.22	3.12	86.89	90.79
Average	91.04	96.91	2.94	N/A	90.41	2.51	79.69	96.52	89.53	2.55	75.71	96.13
Defense	Config 3	Config 4	Config 5
Attack	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER
BadNets [15]	89.69	2.21	89.19	95.60	89.78	1.11	89.38	96.19	89.04	1.29	88.63	95.73
Blended [7]	90.98	6.12	61.64	95.65	91.58	8.31	59.09	94.86	91.49	5.83	63.04	96.05
Input-Aware	90.75	1.86	86.21	98.20	91.30	0.94	84.24	98.66	91.21	1.20	86.60	98.53
LF [58]	91.05	3.00	81.23	97.07	87.06	1.94	73.72	95.60	91.29	5.12	80.26	96.13
SIG [2]	87.18	1.32	55.12	98.47	88.20	0.78	49.09	98.74	86.69	2.08	55.64	98.09
SSBA [30]	90.39	2.68	82.04	96.34	90.65	2.59	84.40	96.52	90.48	1.62	84.19	96.92
WaNet [38]	91.14	1.60	87.96	94.01	90.79	1.13	89.70	94.07	90.55	1.82	89.11	93.61
Average	90.17	2.68	77.63	96.48	89.91	2.40	75.66	96.38	90.11	2.71	78.21	96.44
D.6 Experiments on different numbers of clean samples
This section examines the influence of clean sample size for SAU by evaluating SAU with different numbers of clean samples. The experiment is conducted on CIFAR-10 with PreAct-ResNet18 and the results are summarized in Table 23. Table 23 shows that SAU can consistently mitigate backdoors with sample sizes ranging from 2500 (5%) to 500 (1%) with high accuracy. When the sample size decreases to 50 (0.1%, 5 samples per class) or 10 (0.02%, 1 sample per class), SAU can still reduce
the backdoor to a low ASR. However, clean accuracy is difficult to guarantee with such limited clean samples.
Table 23: Results for SAU with different numbers of clean samples
Defense	No Defense	SAU -2500	SAU -1000	SAU -500	SAU -50	SAU -10
Attack	ACC	ASR	ACC	ASR	ACC	ASR	ACC	ASR	ACC	ASR	ACC	ASR
BadNets [15]	91.32	95.03	89.31	1.53	89.24	1.31	83.04	2.17	67.86	1.41	51.43	14.38
Blended [7]	93.47	99.92	90.96	6.14	88.82	2.53	87.71	5.41	73.95	11.62	43.54	0.00
LF [58]	93.19	99.28	90.32	4.18	88.00	6.79	88.69	2.84	66.69	0.30	54.95	12.62
D.7 Experiments on Multi-trigger Attacks
In this section, we evaluate our method for the multi-trigger/multi-target cases. Specifically, we use two different attacks (denoted by Attack-1 and Attack-2) with different target labels. Following Section 4.2, we test our method (SAU) against a strong baseline ANP on the CIFAR-10 dataset with a poisoning ratio of  $10\%$  and backbone PreAct-ResNet18. The experiment results are summarized in the following table, where we use ASR-1 and ASR-2 to represent the Attack Success Rate for Attack-1 and Attack-2, respectively. From Table 24, we can find that SAU achieves much higher accuracy ( $5.64\%$  higher) and a much lower ASR for Attack-1 ( $26.46\%$  lower) compared to ANP, although the average ASR for Attack-2 of ANP is slightly lower than that of SAU (only  $0.13\%$  lower). These results show that SAU outperforms the baseline in most cases, which demonstrates the effectiveness and robustness of our method in this challenging scenario.
Table 24: Results for defending against Multi-trigger Attacks
No Defense	No Defense	No Defense	ANP [55]	ANP [55]	ANP [55]	SAU (Ours)	SAU (Ours)	SAU (Ours)
Attack-1	Attack-2	ACC	ASR-1	ASR-2	ACC	ASR-1	ASR-2	ACC	ASR-1	ASR-2
Blended [7]	BadNets [15]	90.22	99.27	95.03	85.55	37.07	0.01	88.93	2.21	0.54
InputAware	BadNets [15]	89.71	78.62	94.77	82.21	4.48	0.01	88.88	4.14	0.70
LF [58]	BadNets [15]	90.16	98.08	95.15	84.21	79.11	2.30	88.45	2.93	0.34
SIG [2]	BadNets [15]	82.12	98.48	95.03	76.43	26.92	0.14	85.82	0.60	0.67
SSBA [30]	BadNets [15]	89.69	95.13	95.11	83.25	20.03	0.14	87.60	1.38	0.52
WaNet [38]	BadNets [15]	89.44	90.21	95.40	82.21	5.53	0.01	88.02	3.12	0.67
Average	88.56	93.30	95.08	82.31	28.86	0.44	87.95	2.40	0.57
D.8 Experiments on ALL to ALL attack
In this section, we compare SAU with other baselines on ALL to ALL attacks on CIFAR-10 with PreAct-ResNet18 and poisoning ratio  $10\%$ . Specifically, the target labels for the sample with original labels  $y$  are set to  $y_{t} = (y + 1) \mod K$  where mod is short for "modulus". The experiment results are summarized in Table 25. From Table 25, we can find that SAU achieves the best defending performance in 5 of 7 attacks and the lowest average ASR. At the same time, SAU also achieves the best average R-ACC and average DER, which further demonstrates its effectiveness in defending against backdoor attacks with multiple targets.
Note that the ASR for the poisoned model is significantly lower than the ASR in the single-target case. Thus, Table 25 also shows that SAU can still effectively mitigate backdoor even the ASR of the poisoned model is much lower than  $100\%$ .
D.9 Comparison to Reconstructive Neuron Pruning (RNP)
In this section, we compare SAU with RNP [29] to further improve our submission. We adopted the official implementation of RNP (https://github.com/bboylyg/RNP) into the framework of Backdoor-Bench for fair comparison and the specific experimental settings are:
- Dataset and model architecture: we compare our SAU with RNP on CIFAR-10 dataset with ResNet18 and PreAct-ResNet18.
- Clean data size and poisoning ratio: We adopt clean datasets:  $1\%$  and  $5\%$ , and poisoning ratios:  $0.5\%$ , and  $10\%$  to compare their effectiveness for large and small poisoning ratios.
Table 25: Results for defending against ALL to ALL attacks
Defense	No Defense	ANP [55]	FP [31]	NC [47]
Attack	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER
BadNets [15]	91.89	74.42	18.66	N/A	92.33	2.56	90.12	85.93	83.91	1.72	83.71	82.36	91.88	74.41	18.67	50.0
Blended [7]	93.67	86.69	2.0	N/A	93.25	51.35	36.39	67.46	84.43	3.53	69.05	86.96	93.67	86.69	2.0	50.0
Input-Aware	91.92	83.69	7.23	N/A	91.04	0.85	88.34	90.98	85.69	2.01	81.09	87.72	91.20	81.49	8.75	50.74
LF [58]	93.84	89.96	2.44	N/A	93.10	2.58	90.31	93.32	84.54	1.77	80.8	89.44	93.84	89.96	2.44	50.0
SIG [2]	93.4	90.61	1.09	N/A	92.83	86.56	2.69	51.74	85.01	6.09	59.7	88.06	93.40	90.61	1.09	50.0
SSBA [30]	93.46	87.84	3.7	N/A	93.29	7.10	84.36	90.29	82.97	2.48	80.26	87.44	93.46	87.84	3.7	50.0
WaNet [38]	89.91	78.58	10.62	N/A	90.27	1.00	88.91	88.79	86.62	1.65	84.55	86.82	89.91	78.58	10.61	50.0
Average	92.58	84.54	6.53	N/A	92.30	21.71	68.73	81.22	84.74	2.75	77.02	86.97	92.48	84.23	6.75	50.11
Defense	NAD [28]	EP [64]	i-BAU [59]	SAU (Ours)
Attack	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER	ACC	ASR	R-ACC	DER
BadNets [15]	80.49	2.51	80.54	80.25	88.72	3.00	87.94	84.12	89.39	1.29	89.90	85.32	90.69	1.02	90.61	86.10
Blended [7]	76.85	5.63	58.85	82.12	91.69	82.62	3.66	51.05	90.46	8.83	72.20	87.32	91.47	2.17	82.08	91.16
Input-Aware	82.54	1.75	76.86	86.28	90.2	1.13	87.69	90.42	89.40	6.03	81.10	87.57	91.74	1.87	89.12	90.82
LF [58]	73.58	2.83	74.55	83.43	91.88	84.64	5.97	51.68	89.38	7.88	64.68	88.81	91.67	1.11	85.84	93.34
SIG [2]	79.99	5.78	55.48	85.71	90.91	86.10	2.44	51.01	90.74	1.57	86.31	93.19	91.13	1.48	85.14	93.43
SSBA [30]	74.12	3.58	69.61	82.46	90.33	41.83	46.59	71.44	88.56	6.49	78.49	88.22	91.35	1.84	85.53	91.94
WaNet [38]	85.26	1.99	82.59	85.97	86.66	74.74	11.13	50.3	91.71	1.63	90.98	88.48	91.73	1.43	89.34	88.58
Average	78.98	3.44	71.21	83.75	90.06	53.44	35.06	64.29	89.95	4.82	80.52	88.42	91.40	1.56	86.81	90.77
- Hyper-parameters of RNP: We notice that the hyper-parameters of RNP are sensitive to model architecture. After carefully inspecting the pruning process of RNP, we set the pruning threshold to 0.75 for ResNet18 and 0.05 for PreAct-ResNet18 which can achieve a good overall performance across various attacks.
The experimental results are shown in Table 26,27,28. According to the results and methodologies, we briefly summarize a few important differences between them: