SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Table 11: Defense results under various poisoning rates. The experiments are conducted on the CIFAR-10 dataset with DenseNet-161. All the metrics are measured in percentage (\%). The best results are bold.
Attack	Poisoning rate	No defense	ANP	I-BAU	FT+SAM	NGF	FE-tuning (Ours)	FT-init (Ours)	FST (Ours)
C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)
BadNet	5%	89.38	99.99	88.46	99.70	84.72	5.00	83.29	14.53	83.94	2.49	86.03	2.48	87.96	5.32	87.62	1.4
1%	89.86	99.93	85.34	97.42	84.45	28.07	83.09	3.76	84.53	11.73	85.74	1.97	88.37	43.50	88.22	1.63
0.5%	89.62	99.58	88.50	98.00	84.08	50.31	82.85	4.30	83.68	19.46	85.16	9.28	87.78	45.86	87.16	5.53
Blended	5%	89.93	99.13	85.35	6.57	83.38	6.31	83.07	4.43	83.56	2.47	84.88	2.03	87.76	40.61	86.81	0.02
1%	89.82	92.69	83.62	64.44	86.51	4.97	82.50	3.76	83.82	2.84	84.74	1.62	87.85	23.34	87.19	0.47
0.5%	90.15	82.44	85.61	9.28	84.99	23.76	83.79	4.43	84.5	1.14	86.20	1.33	88.53	21.78	88.33	0.31
WaNet	5%	82.76	64.86	83.77	1.79	81.96	3.48	80.51	1.71	84.03	1.51	83.68	2.51	85.22	1.70	85.02	0.92
SSBA	5%	88.71	81.09	87.49	1.48	84.12	5.44	81.92	2.32	82.60	2.67	83.50	1.66	86.73	3.42	86.39	1.14
SIG	5%	89.74	97.71	89.01	0.54	83.71	24.43	82.96	0.79	83.95	0.91	85.15	0.34	87.33	15.06	87.75	0.10
1%	89.04	95.34	86.9	7.91	83.33	23.77	82.09	7.76	83.05	33.62	83.85	4.92	87.01	87.91	86.16	4.11
0.5%	89.46	76.17	82.32	61.93	85.96	67.30	82.78	8.86	83.94	11.08	84.93	10.91	87.82	60.51	84.60	4.00
LC	5%	89.56	99.71	89.39	98.16	87.19	1.68	82.19	4.21	83.62	4.81	84.53	5.37	87.47	3.96	86.46	3.67
1%	89.76	99.96	89.67	99.72	86.36	90.44	82.84	3.79	83.21	14.02	84.83	12.87	86.96	97.90	87.15	2.52
0.5%	88.24	99.04	88.40	98.52	81.40	60.78	79.64	5.83	81.72	21.26	82.38	19.17	85.64	74.03	84.63	13.68
Adaptive-Blend	0.3%	88.18	51.77	85.74	23.56	86.22	7.87	86.89	15.19	85.19	4.05	83.70	2.37	89.10	3.95	86.41	1.33
Average	88.95	89.29	86.64	51.27	84.56	26.91	82.69	5.71	83.69	8.94	84.62	5.26	87.44	35.26	86.66	2.72
Standard Deviation	1.81	15.02	2.30	44.43	1.68	27.75	1.58	4.24	0.83	9.60	1.04	5.41	1.03	32.48	1.18	3.47
Figure 15: The ASR results of three representative attacks with various tuning epochs. Our experiments are conducted on Tiny-ImageNet with SwinTransformer.
Figure 16: We compare regularizing the whole linear layers (denoted as -all) with regularizing only the last linear layer (denoted as -last). We evaluate on CIFAR-10 dataset using BadNet and Blended attacks with 3 poisoning rate settings. Experimental results demonstrate that we could achieve a superior purification performance by regularizing the whole linear layers than the last-layer-only regularization without sacrificing the model performance.