SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Table 11: DDPM backdoor on CIFAR10 Dataset with Trigger: Grey Box, target: Hat
Sampler	P.R. Metric	0%	5%	10%	20%	30%	50%	70%	90%
ANCESTRAL	FID	14.83	8.53	8.81	8.89	9.14	10.25	11.97	19.73
MSE	2.41E-1	1.58E-1	7.01E-3	1.19E-5	5.68E-6	1.48E-5	8.27E-6	7.43E-6
SSIM	4.74E-5	3.12E-1	9.67E-1	1.00E+0	1.00E+0	1.00E+0	1.00E+0	1.00E+0
FID	11.15	8.92	9.16	9.42	9.55	10.33	11.38	15.68
UNIPC	MSE	2.41E-1	3.14E-2	7.96E-3	1.39E-4	1.46E-4	1.59E-4	7.56E-5	7.56E-5
SSIM	4.80E-5	8.24E-1	9.49E-1	9.95E-1	9.96E-1	9.97E-1	9.97E-1	9.97E-1
FID	11.15	8.92	9.16	9.42	9.55	10.33	11.38	15.68
DPM. O2	MSE	2.41E-1	3.14E-2	7.96E-3	1.39E-4	1.46E-4	1.59E-4	7.56E-5	7.56E-5
SSIM	4.80E-5	8.24E-1	9.49E-1	9,95E-1	9.96E-1	9.97E-1	9.97E-1	9.97E-1
FID	11.15	8.92	9.16	9.42	9.55	10.33	11.38	15.68
DPM. O3	MSE	2.41E-1	3.14E-2	7.96E-3	1.39E-4	1.46E-4	1.59E-4	7.56E-5	7.56E-5
SSIM	4.80E-5	8.24E-1	9.49E-1	9 95E-1	9.96E-1	9.97E-1	9.97E-1	9.97E-1
FID	11.15	8.92	9.16	9.42	9.55	10.33	11.38	15.68
DPM++. O2	MSE	2.41E-1	3.14E-2	7.96E-3	1.39E-4	1.46E-4	1.59E-4	7.56E-5	7.56E-5
SSIM	4.80E-5	8.24E-1	9.49E-1	9.96E-1	9.97E-1	9.97E-1	9.97E-1
FID	11.15	8.92	9.16	9.42	9.55	10.33	11.38	15.68
DPM++. O3	MSE	2.41E-1	3.14E-2	7.96E-3	1.39E-4	1.46E-4	1.59E-4	7.56E-5	7.56E-5
SSIM	4.80E-5	8.24E-1	9.49E-1	\( 9.96E-1 \)	9.97E-1	9.97E-1	9.97E-1
FID	11.15	8.92	9.16	9.42	9.55	10.33	11.38	15.68
DEIS	MSE	2.41E-1	3.14E-2	7.96E-3	1.39E-4	1.46E-4	1.59E-4	7.56E-5	7.56E-5
SSIM	4.80E-5	8.24E-1	9.49E-1	\(\mathsf{9.96E - 1}\)	9.97E-1	9.97E-1	9.97E-1
FID	16.39	10.78	10.99	11.25	11.38	12.47	13.86	19.24
DDIM	MSE	2.41E-1	7.64E-2	2.84E-2	1.73E-4	3.89E-6	2.45E-6	2.31E-6	2.29E-6
SSIM	4.86E-5	6.22E-1	8.55E-1	\( 1.00E+0 \)	\( 1.00E+0 \)	\( 1.00E+0 \)	\( 1.00E+0 \)
FID	12.14	7.16	7.40	7.68	7.67	8.54	9.71	14.86
PNDM	MSE	2.41E-1	6.33E-2	2.04E-2	1.55E-4	3.96E-5	3.45E-5	2.95E-5	2.85E-5
SSIM	4.82E-5	6.81E-1	8.92E-1	\( 9.96E-1 \)	\( 9.98E-1 \)	\( 9.98E-1 \)	\( 9.98E-1 \)
FID	12.14	7.16	7.40	7.68	7.67	8.54	9.71	14.86
HEUN	MSE	2.41E-1	6.33E-2	2.04E-2	1.55E-4	3.96E-5	3.45E-5	2.95E-5	2.85E-5
SSIM	4.82E-5	6.81E-1	8.92E-1	9.96E-1	9.98E-1	9.98E-1	9.98E-1
FID	12.14	7.16	7.40	7.68	7.67	8.54	9.71	14.86
LMSD	MSE	2.41E-1	6.33E-2	2.04E-2	1.55E-4	3.96E-5	3.45E-5	2.95E-5	2.85E-5
SSIM	4.82E-5	6.81E-1	8.92E-1	\(\mathsf{9.96E - 1}\)	\(\mathsf{9.98E - 1}\)	\(\mathsf{9.98E - 1}\)	\(\mathsf{9.98E - 1}\)
Table 12: DDPM backdoor on CelebA-HQ Dataset with Trigger: Eye Glasses, and target: Cat.
Sampler	P.R. Metric	0%	20%	30%	50%	70%
FID	13.93	20.67	22.44	21.71	19.52
UNIPC	MSE	3.85E-1	3.31E-3	7.45E-4	7.09E-4	3.76E-4
SSIM	5.36E-4	8.87E-1	8.82E-1	7.61E-1	8.78E-1
FID	13.93	20.67	22.44	21.71	19.52
DPM. O2	MSE	3.85E-1	3.31E-3	7.45E-4	7.09E-4	3.76E-4
SSIM	5.36E-4	8.87E-1	8.82E-1	7.61E-1	8.78E-1
FID	13. 93	27.06	22.44	21.71	19.52
DPM. O3	MSE	3.85E-1	3.35E-1	7.45E-4	7.09E-4	3.76E-4
SSIM	5.36E-4	1.95E-2	8.82E-1	7.61E-1	8.78E-1
FID	13.93	20.67	22.44	26.64	19.52
DPM++. O2	MSE	3.85E-1	3.31E-3	7.45E-4	3.55E-3	3.76E-4
SSIM	5.36E-4	8.87E-1	8.82E-1	4.46E-1	8.78E-1
FID	13.93	20.67	22.44	21.71	19.52
DPM++. O3	MSE	3.85E-1	3.31E-3	7.45E-4	7.09E-4	3.76E-4
SSIM	5.36E-4	8.87E-1	8.82E-1	7.61E-1	8.78E-1
FID	13. \( {93} \)	20.67	22.44	21.71	19.52
DEIS	MSE	3.85E-1	3.31E-3	7.45E-4	7.09E-4	3.76E-4
SSIM	5.36E-4	8.87E-1	8.82E-1	7.61E-1	8.78E-1
FID	11.67	13.46	17.73	22.37	18.71
DDIM	MSE	3.11E-1	4.69E-3	6.75E-5	4.59E-3	2.92E-4
SSIM	1.73E-1	9.47E-1	9.73E-1	4.14E-1	9.02E-1
FID	12.65	16.59	16.27	17.73	16.84
PNDM	MSE	3.85E-1	4.82E-3	1.52E-4	2.79E-4	3.84E-4
SSIM	5.36E-4	9.24E-1	9.56E-1	8.77E-1	8.66E-1
FID	12.65	16.59	16.27	17.73	16.84
HEUN	MSE	3.85E-1	4.82E-3	1.52E-4	2.79E-4	3.84E-4
SSIM	5.36E-4	9.24E-1	9.56E-1	8.77E-1	8.66E-1
Table 13: DDPM backdoor on CelebA-HQ Dataset with Trigger: Stop Sign, and target: Hat.
Sampler	P.R. Metric	0%	20%	30%	50%	70%
UNIPC	FID	13.93	42.66	27.74	24.05	22.67
MSE	2.52E-1	2.44E-1	1.18E-3	9.80E-4	2.21E-4
SSIM	6.86E-4	9.20E-3	8.70E-1	7.28E-1	8.87E-1
FID	13.93	24.78	27.74	24.05	22.67
DPM. O2	MSE	2.52E-1	1.18E-3	1.18E-3	9.80E-4	2.21E-4
SSIM	6.86E-4	8.05E-1	8.70E-1	7.28E-1	8.87E-1
FID	13.93	24.78	37.43	36.65	39.59
DPM. O3	MSE	2.52E-1	1.18E-3	2.34E-1	1.66E-1	5.23E-2
SSIM	6.86E-4	8.05E-1	1.22E-2	2.33E-2	6.87E-2
FID	13.93	24.78	27.74	24.05	22.67
DPM++. O2	MSE	2.52E-1	1.18E-3	1.18E-3	9.80E-4	2.21E-4
SSIM	6.86E-4	8.05E-1	8.70E-1	7.28E-1	8.87E-1
FID	12.65	24.78	27.74	24.05	22.67
DEIS	MSE	2.52E-1	1.18E-3	1.18E-3	9.80E-4	2.21E-4
SSIM	6.86E-4	8.05E-1	8.70E-1	7.28E-1	8.87E-1
FID	13.67	24.78	27.74	24.05	22.67
DDIM	MSE	1.88E-1	5.85E-3	6.18E-3	4.54E-5	6.45E-5
SSIM	2.99E-1	9.68E-1	9.36E-1	9.68E-1	9.50E-1
FID	12.65	18.45	25.34	14.83	18.71
PNDM	MSE	2.52E-1	4.29E-3	6.55E-3	2.28E-4	1.06E-4
SSIM	6.86E-4	9.56E-1	9.14E-1	8.82E-1	9.33E-1
FID	12.65	18.45	25.34	14.83	18.71
HEUN	MSE	2.52E-1	4.29E-3	6.55E-3	2.28E-4	1.06E-4
SSIM	6.86E-4	9.56E-1	9.14E-1	8.82E-1	9.33E-1
Table 14: LDM backdoor on CelebA-HQ Dataset with Trigger: Eye Glasses, target: Cat.
Sampler	P.R. Metric	0%	30%	50%	70%	90%
UNIPC	FID	23.35	17.93	18.76	24.03	23.01
MSE	3.84E-1	3.84E-1	3.83E-1	3.72E-1	3.12E-4
SSIM	3.17E-3	3.56E-3	3.13E-3	3.28E-3	9.93E-1
FID	26.06	27.70	26.77	33.03	27.27
DPM. O2	MSE	3.84E-1	3.84E-1	3.83E-1	3.72E-1	8.06E-3
SSIM	3.18E-3	3.53E-3	3.15E-3	4.48E-3	9.47E-1
FID	28.32	33.43	31.47	37.72	30.36
DPM++. O2	MSE	3.84E-1	3.84E-1	3.83E-1	3.71E-1	1.06E-2
SSIM	3.17E-3	3.44E-3	3.24E-3	4.58E-3	9.30E-1
FID	24.38	22.45	22.68	28.88	24.81
DEIS	MSE	3.84E-1	3.84E-1	3.83E-1	3.72E-1	4.51E-3
SSIM	3.18E-3	3.57E-3	3.10E-3	4.35E-3	9.70E-1
Table 15: LDM backdoor on CelebA-HQ Dataset with Trigger: Stop Sign, target: Hat.
Sampler	P.R. Metric	0%	30%	50%	70%	90%
UNIPC	FID	23.35	19.36	23.19	24.20	22.49
MSE	2.51E-1	2.51E-1	2.51E-1	1.05E-3	1.93E-4
SSIM	3.65E-3	6.98E-3	6.43E-3	9.92E-1	9.94E-1
FID	26.06	31.63	31.64	33.62	28.83
DPM. O2	MSE	2.51E-1	2.51E-1	2.51E-1	5.37E-3	7.37E-3
SSIM	3.66E-3	6.94E-3	5.91E-3	9.69E-1	9.53E-1
FID	28.32	37.67	35.92	38.21	32.37
DPM++. O2	MSE	2.51E-1	2.51E-1	2.51E-1	6.98E-3	1.00E-2
SSIM	3.65E-3	6.56E-3	5.31E-3	9.60E-1	9.37E-1
FID	24.38	25.46	27.54	28.99	25.64
DEIS	MSE	2.51E-1	2.51E-1	2.51E-1	3.58E-3	4.04E-3
SSIM	3.66E-3	7.10E-3	6.37E-3	9.79E-1	9.73E-1
Table 16: NCSN backdoor CIFAR10 Dataset with Trigger: Stop Sign, target: Hat.
Sampler	Poison Rate Metric	5%	10%	20%	30%
SCORE-SDE-VE AR:0.3	FID	12.30	12.04	12.57	12.49
MSE	1.18E-1	1.18E-1	1.18E-1	1.20E-1
SSIM	3.20E-1	3.12E-1	3.11E-1	2.80E-1
FID	12.20	12.39	12.40	13.06
SCORE-SDE-VE AR:0.5	MSE	1.15E-1	1.16E-1	1.18E-1	1.16E-1
SSIM	3.59E-1	3.42E-1	3.08E-1	3.22E-1
FID	12.36	12.25	11.97	12.77
SCORE-SDE-VE AR:0.7	MSE	1.08E-1	1.07E-1	1.07E-1	1.09E-1
SSIM	4.47E-1	4.59E-1	4.41E-1	4.40E-1
FID	12.40	12.52	12.43	12.77
SCORE-SDE-VE AR:0.9	MSE	1.13E-1	1.10E-1	1.10E-1	1.11E-1
SSIM	3.79E-1	4.16E-1	4.10E-1	3.90E-1
FID	14.89	15.12	15.41	15.58
SCORE-SDE-VE AR:3.0	MSE	1.06E-1	1.06E-1	1.05E-1	1.04E-1
SSIM	4.66E-1	4.70E-1	4.66E-1	4.78E-1
FID	17.13	17.29	17.46	18.29
SCORE-SDE-VE AR:7.0	MSE	1.04E-1	1.01E-1	1.02E-1	1.00E-1
SSIM	4.70E-1	5.20E-1	5.00E-1	5.48E-1
Table 17: Pokemon Caption Dataset with target: Cat
Clean/Backdoor	Clean	Backdoor
Trigger	FID	MSE	MSE Thres.	SSIM	MSE	MSE Thres.	SSIM
""	49.94	1.53E-01	2.44E-01	5.69E-01	1.49E-01	2.92E-01	5.79E-01
"......"	69.77	1.53E-01	2.41E-01	5.75E-01	1.44E-01	2.37E-01	5.86E-01
"anonymous"	64.50	1.63E-01	1.77E-01	5.61E-01	1.55E-01	2.29E-01	5.76E-01
"cat"	62.63	1.57E-01	1.33E-01	5.55E-01	6.58E-02	7.03E-01	8.00E-01
"spying"	66.81	1.42E-01	2.81E-01	6.03E-01	8.15E-02	6.51E-01	7.54E-01
"sks"	64.58	1.55E-01	1.65E-01	5.50E-01	1.41E-01	2.81E-01	6.06E-01
"fedora"	60.31	1.65E-01	9.64E-02	5.03E-01	5.16E-02	7.83E-01	8.12E-01
"8888"	57.18	1.60E-01	1.37E-01	5.30E-01	1.63E-02	9.60E-01	9.15E-01
"latte coffee"	65.21	1.51E-01	2.37E-01	5.77E-01	3.33E-02	8.84E-01	8.81E-01
"mignneko"	58.01	1.63E-01	1.12E-01	5.12E-01	6.38E-03	9.92E-01	9.44E-01
Table 18: Pokemon Caption Dataset with target: Hacker
Clean/Backdoor	Clean	Backdoor
Trigger	FID	MSE	MSE Thres.	SSIM	MSE	MSE Thres.	SSIM
""	49.94	1.53E-01	2.44E-01	5.69E-01	1.49E-01	2.92E-01	5.79E-01
"......"	169.28	5.99E-02	7.47E-01	7.95E-01	5.27E-02	8.03E-01	8.11E-01
"anonymous"	183.95	5.04E-02	7.79E-01	8.12E-01	3.57E-02	8.84E-01	8.59E-01
"cat"	155.02	8.02E-02	6.47E-01	7.53E-01	2.93E-02	9.04E-01	8.74E-01
"spying"	64.35	1.48E-01	1.77E-01	5.64E-01	5.08E-03	1.00E+00	9.29E-01
"sks"	169.82	5.75E-02	7.55E-01	7.94E-01	3.49E-02	8.88E-01	8.54E-01
"..."	93.69	1.33E-01	2.93E-01	5.95E-01	6.06E-03	9.96E-01	9.37E-01
"fedora"	63.31	1.59E-01	1.16E-01	5.42E-01	1.17E-02	1.00E+00	8.88E-01
"..."	108.75	1.29E-01	3.73E-01	6.30E-01	1.32E-02	9.68E-01	9.16E-01
"latte coffee"	56.88	1.66E-01	4.42E-02	5.08E-01	4.69E-03	1.00E+00	9.39E-01
"mignneko"	70.35	1.54E-01	1.57E-01	5.65E-01	6.16E-03	1.00E+00	9.28E-01
Table 19: CelebA-HQ-Dialog Dataset with target: Cat
Clean/Backdoor	Clean	Backdoor
Trigger	FID	MSE	MSE Thres.	SSIM	MSE	MSE Thres.	SSIM
""	24.52	8.50E-02	7.18E-01	4.55E-01	8.50E-02	7.22E-01	4.54E-01
"......"	18.77	1.54E-01	4.40E-02	3.60E-01	1.54E-01	4.38E-02	3.58E-01
"anonymous"	17.95	1.50E-01	6.00E-02	3.81E-01	1.60E-01	4.10E-02	3.65E-01
"cat"	17.91	1.53E-01	4.78E-02	3.87E-01	7.89E-02	5.27E-01	6.70E-01
"spying"	18.99	1.45E-01	7.49E-02	3.82E-01	3.97E-03	9.99E-01	9.44E-01
"sks"	19.09	1.52E-01	5.46E-02	3.62E-01	4.41E-03	9.95E-01	9.46E-01
"fedora"	18.78	1.52E-01	5.22E-02	3.87E-01	9.65E-03	9.81E-01	9.27E-01
"federal"	18.73	1.46E-01	7.39E-02	4.06E-01	3.83E-03	9.98E-01	9.50E-01
"8888"	18.81	1.47E-01	6.79E-02	3.94E-01	3.18E-03	9.98E-01	9.54E-01
"latte coffee"	16.90	1.55E-01	4.13E-02	3.86E-01	6.23E-02	6.35E-01	7.22E-01
"mignneko"	19.97	1.45E-01	7.03E-02	4.11E-01	3.82E-03	9.98E-01	9.50E-01
Table 20: CelebA-HQ-Dialog Dataset with target: Hacker
Clean/Backdoor	Clean	Backdoor
Trigger	FID	MSE	MSE Thres.	SSIM	MSE	MSE Thres.	SSIM
""	24.52	8.50E-02	7.18E-01	4.55E-01	8.50E-02	7.22E-01	4.54E-01
"......"	36.59	1.43E-01	1.14E-01	4.16E-01	1.29E-01	2.10E-01	4.70E-01
"anonymous"	20.87	1.57E-01	1.97E-02	3.63E-01	3.80E-02	8.09E-01	8.09E-01
"cat"	20.42	1.54E-01	9.11E-03	3.85E-01	6.74E-03	1.00E+00	9.18E-01
"spying"	20.21	1.57E-01	7.67E-03	3.75E-01	9.69E-03	9.96E-01	9.03E-01
"sks"	19.62	1.55E-01	4.89E-03	3.74E-01	3.84E-03	1.00E+00	9.36E-01
"..."	20.15	1.60E-01	4.11E-03	3.45E-01	6.78E-03	1.00E+00	9.23E-01
"fedora"	17.71	1.56E-01	7.44E-03	3.84E-01	6.16E-03	1.00E+00	9.22E-01
"..."	19.21	1.49E-01	2.33E-02	4.08E-01	7.43E-03	9.99E-01	9.15E-01
"latte coffee"	20.27	1.52E-01	1.78E-02	3.69E-01	7.60E-03	1.00E+00	9.13E-01
"mignneko"	19.80	1.52E-01	1.03E-02	3.84E-01	4.44E-03	1.00E+00	9.33E-01
Table 21: CIFAR10 Dataset with Trigger: Stop Sign, target: No Shift, and inference-time clipping.
Sampler	P.R. Metric	0%	5%	10%	20%	30%	50%	70%	90%
UNIPC	FID	185.20	113.01	112.52	115.08	114.17	112.86	113.57	102.87
MSE	1.28E-1	1.66E-3	9.74E-4	8.39E-4	1.04E-3	2.09E-3	3.88E-3	5.91E-3
SSIM	1.89E-2	9.51E-1	9.63E-1	9.76E-1	9.76E-1	9.68E-1	9.61E-1	9.48E-1
FID	185.20	113.01	112.52	115.08	114.17	112.86	113.57	102.87
DPM. O2	MSE	1.28E-1	1.66E-3	9.74E-4	8.39E-4	1.04E-3	2.09E-3	3.88E-3	5.91E-3
SSIM	1.89E-2	9.51E-1	9.63E-1	9,76E-1	9.76E-1	9.68E-1	9.61E-1	9.48E-1
FID	185.20	113.01	112.52	115.08	114.17	112.86	79.96	102.87
DPM. O3	MSE	1.28E-1	1.66E-3	9.74E-4	8.39E-4	1.04E-3	2.09E-3	2.20E-3	5.91E-3
SSIM	1.89E-2	9.51E-1	9.63E-1	9.76E-1	9.76E-1	9.68E-1	9.72E-1	9.48E-1
FID	185.20	113.01	112.52	115.08	114.17	112.86	113.57	102.87
DPM++. O2	MSE	1.28E-1	1.66E-3	9.74E-4	8.39E-4	1.04E-3	2.09E-3	3.88E-3	5.91E-3
SSIM	1.89E-2	9.51E-1	9.63E-1	9.76E-1	9.68E-1	9.61E-1	9.48E-1
FID	185.20	113.01	112.52	115.08	114.17	112.86	113.57	102.87
DPM++. O3	MSE	1.28E-1	1.66E-3	9.74E-4	8.39E-4	1.04E-3	2.09E-3	3.88E-3	5.91E-3
SSIM	1.89E-2	9.51E-1	9.63E-1	9:76E-1	9.76E-1	9.68E-1	9.61E-1	9.48E-1
FID	185.20	113.01	112.52	115.08	114.17	112.86	113.57	102.87.
DEIS	MSE	1.28E-1	1.66E-3	9.74E-4	8.39E-4	1.04E-3	2.09E-3	3.88E-3	5.91E-3
SSIM	1.89E-2	9.51E-1	9.63E-1	976E-1	9.76E-1	9.68E-1	9.61E-1	9.48E-1
FID	177.35	114.44	111.50	78.08	110.79	75.63	74.81	37.25
PNDM	MSE	1.33E-1	4.88E-3	1.25E-3	6.40E-5	2.24E-5	1.76E-5	1.48E-5	2.02E-5
SSIM	1.27E-2	9.65E-1	9.89E-1	9.92E-1	9.98E-1	9.93E-1	9.93E-1	9.88E-1
FID	177.35	114.44	111.50	113.33	76.47	75.92	106.93	95.02
HEUN	MSE	1.33E-1	4.88E-3	1.25E-3	5.29E-5	2.88E-5	1.62E-5	8.53E-6	6.29E-6
SSIM	1.27E-2	9.65E-1	9.89E-1	9.97E-1	9.92E-1	9.94E-1	9.97E-1	9.97E-1
FID	177.35	114.44	111.50	113.33	110.79	109.48	106.93	95.02
LMSD	MSE	1.33E-1	4.88E-3	1.25E-3	5.29E-5	2.24E-5	8.66E-6	8.53E-6	6.29E-6
SSIM	1.27E-2	9.65E-1	9.89E-1	9.97E-1	9.98E-1	9.98E-1	9.97E-1	9.97E-1
Table 22: CIFAR10 Dataset with Trigger: Stop Sign, target: Shift, and inference-time clipping.
Sampler	P.R. Metric	0%	5%	10%	20%	30%	50%	70%	90%
UNIPC	FID	185.20	109.05	111.43	114.46	109.55	106.58	106.54	95.98
MSE	1.42E-1	2.13E-3	5.20E-3	1.16E-3	6.71E-4	1.87E-3	7.27E-3	5.83E-3
SSIM	4.96E-3	9.51E-1	9.31E-1	9.81E-1	9.87E-1	9.81E-1	9.45E-1	9.65E-1
FID	185.20	109.05	111.43	114.46	109.55	106.58	106.54	95.98
DPM. O2	MSE	1.42E-1	2.13E-3	5.20E-3	1.16E-3	6.71E-4	1.87E-3	7.27E-3	5.83E-3
SSIM	4.96E-3	9.51E-1	9.31E-1	9,81E-1	9.87E-1	9.81E-1	9.45E-1	9.65E-1
FID	185.20	109.05	111.43	114.46	109.55	106.58	106.54	95.98
Table 23: CIFAR10 Dataset with Trigger: Stop Sign, target: Corner, and inference-time clipping.
Sampler	P.R. Metric	0%	5%	10%	20%	30%	50%	70%	90%
ANCESTRAL	FID	14.31	8.54	7.80	8.49	8.08	8.17	7.89	7.91
MSE	7.93E-2	7.56E-2	7.48E-2	7.54E-2	7.32E-2	6.97E-2	6.83E-2	6.21E-2
SSIM	7.10E-2	8.99E-2	1.03E-1	8.87E-2	9.95E-2	1.13E-1	1.08E-1	1.44E-1
FID	185.20	121.16	119.11	121.15	118.63	118.40	124.84	124.46
UNIPC	MSE	1.11E-1	1.19E-2	1.07E-2	1.89E-3	2.14E-2	2.65E-2	2.36E-3	4.50E-3
SSIM	8.50E-3	6.40E-1	6.97E-1	8.36E-1	5.53E-1	5.21E-1	8.73E-1	8.40E-1
FID	185.20	121.16	119.11	121.15	118.63	118.40	124.84	124.46
DPM. O2	MSE	1.11E-1	1.19E-2	1.07E-2	1.89E-3	2.14E-2	2.65E-2	2.36E-3	4.50E-3
SSIM	8.50E-3	6.40E-1	6.97E-1	8,36E-1	5.53E-1	5.21E-1	8.73E-1	8.40E-1
FID	185.20	121.16	119.11	121.15	118.63	118.40	124.84	124.46.
DPM. O3	MSE	1.11E-1	1.19E-2	1.07E-2	1.89E-3	2.14E-2	2.65E-2	2.36E-3	4.50E-3
SSIM	8.50E-3	6.40E-1	6.97E-1	836E-1	5.53E-1	5.21E-1	8.73E-1	8.40E-1
FID	185.20	121.16	119.11	121.15	118.63	118.40	124.84	124.46 4.
DPM++. O2	MSE	1.11E-1	1.19E-2	1.07E-2	1.89E-3	2.14E-2	2.65E-2	2.36E-3	4.50E-3
SSIM	8.50E-3	6.40E-1	6.97E-1	5.53E-1	5.21E-1	8.73E-1	8.40E-1
FID	185.20	121.16	119.11	121.15	118.63	82.22	124.84	124.46
DPM++. O3	MSE	1.11E-1	1.19E-2	1.07E-2	1.89E-3	2.14E-2	2.42E-2	2.36E-3	4.50E-3
SSIM	8.50E-3	6.40E-1	6.97E-1	5.53E-1	5.78E-1	8.73E-1	8.40E-1
FID	185.20	121.16	119.11	121.15	118.63	118.40	124.84	124.46
DEIS	MSE	1.11E-1	1.19E-2	1.07E-2	1.89E-3	2.14E-2	2.65E-2	2.36E-3	4.50E-3
SSIM	8.50E-3	6.40E-1	6.97E-1	\( {5.53}\mathrm{E} - 1 \)	5.21E-1	8.73E-1	8.40E-1
FID	177.35	86.72	124.80	127.35	122.77	122.23	89.46	89.20
PNDM	MSE	1.10E-1	5.75E-2	2.91E-2	3.73E-3	4.75E-2	4.18E-2	1.01E-3	2.17E-4
SSIM	6.74E-3	4.26E-1	7.13E-1	5.39E-1	5.68E-1	9.78E-1	9.85E-1
FID	177.35	129.05	124.80	127.35	122.77	122.23	129.63	133.33
HEUN	MSE	1.10E-1	4.46E-2	2.91E-2	3.73E-3	4.75E-2	4.18E-2	1.08E-3	2.11E-4
SSIM	6.74E-3	5.72E-1	7.13E-1	5.39E-1	5.68E-1	9.83E-1	9.91E-1
FID	177.35	129.05	124.80	127.35	122.77	122.23	129.63	133.33
LMSD	MSE	1.10E-1	4.46E-2	2.91E-2	3.73E-3	4.75E-2	4.18E-2	1.08E-3	2.11E-4
SSIM	6.74E-3	5.72E-1	7.13E-1	\( {5.39}\mathrm{E} - 1 \)	5.68E-1	9.83E-1	9.91E-1
Table 24: CIFAR10 Dataset with Trigger: Stop Sign, target: Shoe, and inference-time clipping.
Sampler	P.R. Metric	0%	5%	10%	20%	30%	50%	70%	90%
UNIPC	FID	185.20	107.88	108.12	109.60	105.08	109.91	104.87	98.41
MSE	3.20E-1	3.56E-2	6.73E-3	1.27E-3	5.94E-3	7.13E-4	1.28E-3	1.94E-3
SSIM	6.07E-3	8.50E-1	9.50E-1	9.72E-1	9.60E-1	9.83E-1	9.77E-1	9.73E-1
FID	185.20	107.88	108.12	109.60	105.08	109.91	104.87	98.41
DPM. O2	MSE	3.20E-1	3.56E-2	6.73E-3	1.27E-3	5.94E-3	7.13E-4	1.28E-3	1.94E-3
SSIM	6.07E-3	8.50E-1	9.50E-1	9,72E-1	9.60E-1	9.83E-1	9.77E-1	9.73E-1
FID	185.20	107.88	108.12	109.60	105.08	109.91	73.51	98.41
DPM. O3	MSE	3.20E-1	3.56E-2	6.73E-3	1.27E-3	5.94E-3	7.13E-4	8.89E-4	1.94E-3
SSIM	6.07E-3	8.50E-1	9.50E-1	9.72E-1	9.60E-1	9.83E-1	9.81E-1	9.73E-1
FID	185.20	107.88	108.12	109.60	105.08	109.91	104.87	98.41
DPM++. O2	MSE	3.20E-1	3.56E-2	6.73E-3	1.27E-3	5.94E-3	7.13E-4	1.28E-3	1.94E-3
SSIM	6.07E-3	8.50E-1	9.50E-1	9.60E-1	9.83E-1	9.77E-1	9.73E-1
FID	185.20	107.88	108.12	109.60	105.08	109.91	104.87	98.41
DPM++. O3	MSE	3.20E-1	3.56E-2	6.73E-3	1.27E-3	5.94E-3	7.13E-4	1.28E-3	1.94E-3
SSIM	6.07E-3	8.50E-1	9.50E-1	9:72E-1	9.60E-1	9.83E-1	9.77E-1	9.73E-1
FID	185.20	107.88	108.12	109.60	105.08	109.91	104.87	98.41
Table 25: CIFAR10 Dataset with Trigger: Stop Sign, target: Hat, and inference-time clipping.
Sampler	P.R. Metric	0%	5%	10%	20%	30%	50%	70%	90%
ANCESTRAL	FID	14.31	8.31	7.53	8.10	7.64	7.63	7.63	7.71
MSE	1.76E-1	1.67E-1	1.66E-1	1.68E-1	1.67E-1	1.62E-1	1.58E-1	1.48E-1
SSIM	3.41E-2	4.26E-2	4.36E-2	4.05E-2	4.37E-2	4.70E-2	4.72E-2	5.16E-2
FID	185.20	110.69	109.15	110.76	107.63	110.05	106.94	100.60
UNIPC	MSE	2.33E-1	8.32E-3	6.79E-3	5.52E-3	6.54E-3	1.88E-3	3.30E-3	5.54E-3
SSIM	8.04E-3	9.06E-1	9.45E-1	9.61E-1	9.55E-1	9.84E-1	9.80E-1	9.73E-1
FID	185.20	110.69	109.15	110.76	107.63	110.05	106.94	100.60
DPM. O2	MSE	2.33E-1	8.32E-3	6.79E-3	5.52E-3	6.54E-3	1.88E-3	3.30E-3	5.54E-3
SSIM	8.04E-3	9.06E-1	9.45E-1	9,61E-1	9.55E-1	9.84E-1	9.80E-1	9.73E-1
FID	185.20	110.69	109.15	110.76	107.63	110.05	106.94	100.60.
DPM. O3	MSE	2.33E-1	8.32E-3	6.79E-3	5.52E-3	6.54E-3	1.88E-3	3.30E-3	5.54E-3
SSIM	8.04E-3	9.06E-1	9.45E-1	9,.61E-1	9.55E-1	9.84E-1	9.80E-1	9.73E-1
FID	185.20	110.69	109.15	110.76	107.63	110.05	106.94	100.60 .
DPM++. O2	MSE	2.33E-1	8.32E-3	6.79E-3	5.52E-3	6.54E-3	1.88E-3	3.30E-3	5.54E-3
SSIM	8.04E-3	9.06E-1	9.45E-1	9.55E-1	9.84E-1	9.80E-1	9.73E-1
FID	185.20	110.69	109.15	110.76	107.63	110.05	106.94	100.60
DPM++. O3	MSE	2.33E-1	8.32E-3	6.79E-3	5.52E-3	6.54E-3	1.88E-3	3.30E-3	5.54E-3
SSIM	8.04E-3	9.06E-1	9.45E-1	\( 9.55E-1 \)	9.84E-1	9.80E-1	9.73E-1
FID	185.20	110.69	109.15	110.76	107.63	110.05	106.94	100.60
DEIS	MSE	2.33E-1	8.32E-3	6.79E-3	5.52E-3	6.54E-3	1.88E-3	3.30E-3	5.54E-3
SSIM	8.04E-3	9.06E-1	9.45E-1	\(\mathbf{9.61E-1}\)	9.84E-1	9.80E-1	9.73E-1
FID	177.35	77.16	42.34	75.69	42.47	106.99	8.11	95.57
PNDM	MSE	2.34E-1	9.55E-3	3.38E-2	3.55E-3	1.37E-4	8.03E-4	3.04E-5	6.80E-6
SSIM	7.73E-3	9.49E-1	8.26E-1	9.82E-1	9.98E-1	9.98E-1	1.00E+0
FID	177.35	111.49	110.30	110.51	108.51	106.99	99.88	95.57
HEUN	MSE	2.34E-1	7.92E-3	1.04E-2	4.58E-3	9.40E-3	8.03E-4	1.18E-5	6.80E-6
SSIM	7.73E-3	9.63E-1	9.52E-1	9.77E-1	9.54E-1	1.00E+0	1.00E+0
FID	177.35	111.49	110.30	110.51	108.51	106.99	99.88	95.57
LMSD	MSE	2.34E-1	7.92E-3	1.04E-2	4.58E-3	9.40E-3	8.03E-4	1.18E-5	6.80E-6
SSIM	7.73E-3	9.63E-1	9.52E-1	\( 9.77E-1 \)	9.54E-1	1.00E+0	1.00E+0
Table 26: CIFAR10 Dataset with Trigger: Grey Box, target: No Shift, and inference-time clipping.
Sampler	P.R. Metric	0%	5%	10%	20%	30%	50%	70%	90%
UNIPC	FID	185.20	121.50	121.93	130.83	123.83	134.04	146.21	159.08
MSE	1.20E-1	1.18E-3	4.93E-4	4.28E-4	1.05E-3	1.23E-3	1.64E-3	3.83E-3
SSIM	8.51E-4	9.68E-1	9.76E-1	9.78E-1	9.62E-1	9.62E-1	9.62E-1	9.31E-1
FID	185.20	121.50	121.93	130.83	123.83	134.04	146.21	159.08
DPM. O2	MSE	1.20E-1	1.18E-3	4.93E-4	4.28E-4	1.05E-3	1.23E-3	1.64E-3	3.83E-3
SSIM	8.51E-4	9.68E-1	9.76E-1	9,78E-1	9.62E-1	9.62E-1	9.62E-1	9.31E-1
FID	185.20	121.50	84.27	130.83	123.83	134.04	146.21	159.08
DPM. O3	MSE	1.20E-1	1.18E-3	1.13E-3	4.28E-4	1.05E-3	1.23E-3	1.64E-3	3.83E-3
SSIM	8.51E-4	9.68E-1	9.55E-1	9.78E-1	9.62E-1	9.62E-1	9.62E-1	9.31E-1
FID	185.20	121.50	121.93	130.83	123.83	134.04	146.21	I59.08
DPM++. O2	MSE	1.20E-1	1.18E-3	4.93E-4	4.28E-4	1.05E-3	1.23E-3	1.64E-3	3.83E-3
SSIM	8.51E-4	9.68E-1	9.76E-1	9.62E-1	9.62E-1	9.62E-1	9.31E-1
FID	185.20	121.50	121.93	130.83	123.83	134.04	146.21	159.08
DPM++. O3	MSE	1.20E-1	1.18E-3	4.93E-4	4.28E-4	1.05E-3	1.23E-3	1.64E-3	3.83E-3
SSIM	8.51E-4	9.68E-1	9.76E-1	9:78E-1	9.62E-1	9.62E-1	9.62E-1	9.31E-1
FID	185.20	121.50	121.93	130.83	123.83	134.04	146.21	159.08I
DEIS	MSE	1.20E-1	1.18E-3	4.93E-4	4.28E-4	1.05E-3	1.23E-3	1.64E-3	3.83E-3
SSIM	8.51E-4	9.68E-1	9.76E-1	978E-1	9.62E-1	9.62E-1	9.62E-1	9.31E-1
FID	177.35	84.49	8.34	54.96	91.59	98.41	154.06	75.09
PNDM	MSE	1.20E-1	1.80E-2	1.37E-2	2.36E-4	4.39E-5	1.61E-5	7.00E-6	2.16E-5
SSIM	9.50E-4	7.88E-1	7.93E-1	9.80E-1	9.90E-1	9.91E-1	9.96E-1	9.85E-1
FID	177.35	126.85	127.51	137.93	129.76	143.02	154.06	162.09
HEUN	MSE	1.20E-1	2.98E-3	1.27E-3	6.22E-5	3.67E-5	8.34E-6	7.00E-6	7.66E-6
SSIM	9.50E-4	9.72E-1	9.85E-1	9.96E-1	9.96E-1	9.96E-1	9.96E-1	9.95E-1
FID	177.35	126.85	127.51	137.93	129.76	143.02	154.06	162.09
LMSD	MSE	1.20E-1	2.98E-3	1.27E-3	6.22E-5	3.67E-5	8.34E-6	7.00E-6	7.66E-6
SSIM	9.50E-4	9.72E-1	9.85E-1	996E-1	9.96E-1	9.96E-1	9.96E-1	9.95E-1
Table 27: CIFAR10 Dataset with Trigger: Grey Box, target: Shift, and inference-time clipping.
Sampler	P.R. Metric	0%	5%	10%	20%	30%	50%	70%	90%
UNIPC	FID	185.20	123.67	117.55	118.87	119.92	122.32	126.07	131.79
MSE	1.20E-1	2.83E-3	1.61E-3	4.57E-4	2.76E-4	1.82E-3	2.07E-3	4.21E-3
SSIM	7.09E-4	9.50E-1	9.60E-1	9.76E-1	9.84E-1	9.54E-1	9.55E-1	9.27E-1
FID	185.20	123.67	117.55	118.87	119.92	122.32	126.07	131.79
DPM. O2	MSE	1.20E-1	2.83E-3	1.61E-3	4.57E-4	2.76E-4	1.82E-3	2.07E-3	4.21E-3
SSIM	7.09E-4	9.50E-1	9.60E-1	9,76E-1	9.84E-1	9.54E-1	9.55E-1	9.27E-1
FID	185.20	123.67	117.55	118.87	119.92	122.32	126.07	131.79.
DPM. O3	MSE	1.20E-1	2.83E-3	1.61E-3	4.57E-4	2.76E-4	1.82E-3	2.07E-3	4.21E-3
SSIM	7.09E-4	9.50E-1	9.60E-1	976E-1	9.84E-1	9.54E-1	9.55E-1	9.27E-1
FID	185.20	123.67	80.34	118.87	119.92	122.32	126.07	131.79
DPM++. O2	MSE	1.20E-1	2.83E-3	1.07E-2	4.57E-4	2.76E-4	1.82E-3	2.07E-3	4.21E-3
SSIM	7.09E-4	9.50E-1	8.34E-1	9.76E-1	9.84E-1	9.54E-1	9.55E-1	9.27E-1
FID	185.20	123.67	117.55	118.87	119.92	122.32	126.07	\( {131.79} \)
DEIS	MSE	1.20E-1	2.83E-3	1.61E-3	4.57E-4	2.76E-4	1.82E-3	2.07E-3	4.21E-3
SSIM	7.09E-4	9.50E-1	9.60E-1	9 76E-1	9.84E-1	9.54E-1	9.55E-1	9.27E-1
FID	177.35	88.59	81.09	47.93	86.19	88.97	129.77	102.72
PNDM	MSE	1.20E-1	1.71E-2	3.19E-3	2.15E-4	3.71E-4	1.64E-5	6.98E-6	1.42E-5
SSIM	6.17E-4	8.09E-1	9.57E-1	9.86E-1	9.90E-1	9.94E-1	9.97E-1	9.93E-1
FID	177.35	125.94	119.25	121.26	122.38	125.11	129.77	138.51
HEUN	MSE	1.20E-1	8.17E-3	2.87E-3	2.09E-4	3.83E-4	7.62E-6	6.98E-6	7.41E-6
SSIM	6.17E-4	9.27E-1	9.73E-1	9.96E-1	9.94E-1	9.98E-1	9.97E-1	9.97E-1
FID	177.35	125.94	119.25	121.26	122.38	125.11	129.77	138.51
LMSD	MSE	1.20E-1	8.17E-3	2.87E-3	2.09E-4	3.83E-4	7.62E-6	6.98E-6	7.41E-6
SSIM	6.17E-4	9.27E-1	9.73E-1	9 96E-1	9.94E-1	9.98E-1	9.97E-1	9.97E-1
Table 28: CIFAR10 Dataset with Trigger: Grey Box, target: Corner, and inference-time clipping.
Sampler	P.R. Metric	0%	5%	10%	20%	30%	50%	70%	90%
ANCESTRAL	FID	14.31	9.91	10.94	12.99	15.06	19.85	28.11	53.35
MSE	7.86E-2	5.56E-2	5.34E-2	4.97E-2	5.01E-2	3.87E-2	2.74E-2	1.32E-2
SSIM	7.17E-2	2.50E-1	2.80E-1	3.29E-1	3.35E-1	4.60E-1	5.88E-1	7.73E-1
FID	185.20	125.95	127.27	124.84	125.84	131.79	134.52	136.83
UNIPC	MSE	1.05E-1	2.18E-3	8.14E-4	5.05E-4	4.90E-4	1.09E-3	1.69E-3	5.51E-3
SSIM	1.13E-3	9.16E-1	9.33E-1	9.48E-1	9.54E-1	9.36E-1	9.24E-1	8.36E-1
FID	185.20	125.95	127.27	124.84	125.84	131.79	134.52	136.83
DPM. O2	MSE	1.05E-1	2.18E-3	8.14E-4	5.05E-4	4.90E-4	1.09E-3	1.69E-3	5.51E-3
SSIM	1.13E-3	9.16E-1	9.33E-1	9,48E-1	9.54E-1	9.36E-1	9.24E-1	8.36E-1
FID	185.20	125.95	127.27	124.84	125.84	131.79	134.52	136.83.
DPM. O3	MSE	1.05E-1	2.18E-3	8.14E-4	5.05E-4	4.90E-4	1.09E-3	1.69E-3	5.51E-3
SSIM	1.13E-3	9.16E-1	9.33E-1	948E-1	9.54E-1	9.36E-1	9.24E-1	8.36E-1
FID	185.20	125.95	127.27	124.84	125.84	131.79	134.52	136.83 .
DPM++. O2	MSE	1.05E-1	2.18E-3	8.14E-4	5.05E-4	4.90E-4	1.09E-3	1.69E-3	5.51E-3
SSIM	1.13E-3	9.16E-1	9.33E-1	9.54E-1	9.36E-1	9.24E-1	8.36E-1
FID	185.20	125.95	127.27	124.84	125.84	131.79	134.52	136.83
DPM++. O3	MSE	1.05E-1	2.18E-3	8.14E-4	5.05E-4	4.90E-4	1.09E-3	1.69E-3	5.51E-3
SSIM	1.13E-3	9.16E-1	9.33E-1	\( 9.54\mathrm{E} - 1 \)	9.36E-1	9.24E-1	8.36E-1
FID	185.20	125.95	127.27	124.84	125.84	131.79	134.52	136.83
DEIS	MSE	1.05E-1	2.18E-3	8.14E-4	5.05E-4	4.90E-4	1.09E-3	1.69E-3	5.51E-3
SSIM	1.13E-3	9.16E-1	9.33E-1	\( 9.54\mathrm{E} - 1 \)	9.36E-1	9.24E-1	8.36E-1
FID	177.35	134.07	93.84	49.66	94.22	102.26	147.95	156.45
PNDM	MSE	1.05E-1	3.56E-3	4.82E-3	9.19E-5	3.88E-5	2.01E-5	9.18E-6	7.25E-6
SSIM	1.38E-3	9.66E-1	8.97E-1	9.87E-1	9.88E-1	9.94E-1	9.94E-1
FID	177.35	134.07	135.99	134.72	137.73	145.55	147.95	156.45
HEUN	MSE	1.05E-1	3.56E-3	4.92E-4	4.11E-5	5.36E-5	1.44E-5	9.18E-6	7.25E-6
SSIM	1.38E-3	9.66E-1	9.92E-1	9.96E-1	9.95E-1	9.94E-1	9.94E-1
FID	177.35	134.07	135.99	134.72	137.73	145.55	147.95	156.45
LMSD	MSE	1.05E-1	3.56E-3	4.92E-4	4.11E-5	5.36E-5	1.44E-5	9.18E-6	7.25E-6
SSIM	1.38E-3	9.66E-1	9.92E-1	\( 9.96\mathrm{E} - 1 \)	9.95E-1	9.94E-1	9.94E-1