SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Table 29: CIFAR10 Dataset with Trigger: Grey Box, target: Shoe, and inference-time clipping.
Sampler	P.R. Metric	0%	5%	10%	20%	30%	50%	70%	90%
UNIPC	FID	185.20	108.96	109.27	113.59	110.68	111.37	105.23	105.27
MSE	3.37E-1	2.20E-3	1.02E-3	8.76E-4	9.58E-4	1.80E-3	1.97E-3	3.59E-3
SSIM	2.29E-4	9.80E-1	9.82E-1	9.82E-1	9.83E-1	9.76E-1	9.76E-1	9.65E-1
FID	185.20	108.96	109.27	113.59	110.68	111.37	105.23	105.27
DPM. O2	MSE	3.37E-1	2.20E-3	1.02E-3	8.76E-4	9.58E-4	1.80E-3	1.97E-3	3.59E-3
SSIM	2.29E-4	9.80E-1	9.82E-1	9,82E-1	9.83E-1	9.76E-1	9.76E-1	9.65E-1
FID	185.20	108.96	109.27	113.59	110.68	111.37	105.23	105.27
DPM. O3	MSE	3.37E-1	2.20E-3	1.02E-3	8.76E-4	9.58E-4	1.80E-3	1.97E-3	3.59E-3
SSIM	2.29E-4	9.80E-1	9.82E-1	9 82E-1	9.83E-1	9.76E-1	9.76E-1	9.65E-1
FID	185.20	75.06	109.27	113.59	110.68	111.37	105.23	105.27
DPM++. O2	MSE	3.37E-1	1.96E-2	1.02E-3	8.76E-4	9.58E-4	1.80E-3	1.97E-3	3.59E-3
SSIM	2.29E-4	8.92E-1	9.82E-1	9.82E-1	9.83E-1	9.76E-1	9.76E-1	9.65E-1
FID	185.20	108.96	109.27	113.59	110.68	111.37	105.27
DPM++. O3	MSE	3.37E-1	2.20E-3	1.02E-3	8.76E-4	9.58E-4	1.80E-3	1.97E-3	3.59E-3
SSIM	2.29E-4	9.80E-1	9.82E-1	9.83E-1	9.76E-1	9.76E-1	9.65E-1
FID	185.20	108.96	109.27	113.59	110.68	111.37	105.23	105.27
DEIS	MSE	3.37E-1	2.20E-3	1.02E-3	8.76E-4	9.58E-4	1.80E-3	1.97E-3	3.59E-3
SSIM	2.29E-4	9.80E-1	9.82E-1	9 .82E-1	9.83E-1	9.76E-1	9.76E-1	9.65E-1
FID	177.35	76.12	77.07	44.45	74.86	76.19	73.59	73.31
PNDM	MSE	3.37E-1	6.60E-2	4.31E-3	8.33E-5	5.15E-5	2.28E-5	1.95E-5	1.49E-5
SSIM	2.08E-4	7.43E-1	9.75E-1	9.95E-1	9.97E-1	9.97E-1	9.98E-1	9.97E-1
FID	177.35	109.16	111.45	112.72	109.41	108.98	104.22	105.28
HEUN	MSE	3.37E-1	4.08E-3	8.50E-4	1.14E-4	5.27E-5	1.76E-5	1.19E-5	8.16E-6
SSIM	2.08E-4	9.87E-1	9.96E-1	9.98E-1	9.99E-1	9.99E-1	9.99E-1	9.99E-1
FID	177.35	109.16	111.45	112.72	109.41	108.98	104.22	105.28
LMSD	MSE	3.37E-1	4.08E-3	8.50E-4	1.14E-4	5.27E-5	1.76E-5	1.19E-5	8.16E-6
SSIM	2.08E-4	9.87E-1	9.96E-1	9 .98E-1	9 .99E-1	9.99E-1	9.99E-1	9.99E-1
Table 30: CIFAR10 Dataset with Trigger: Grey Box, target: Hat, and inference-time clipping.
Sampler	P.R. Metric	0%	5%	10%	20%	30%	50%	70%	90%
ANCESTRAL	FID	14.31	8.42	8.82	8.89	8.97	10.11	11.32	17.82
MSE	1.74E-1	1.24E-1	1.08E-1	1.09E-1	1.12E-1	1.01E-1	9.63E-2	8.57E-2
SSIM	3.43E-2	2.08E-1	2.83E-1	2.82E-1	2.66E-1	3.26E-1	3.55E-1	4.07E-1
FID	185.20	110.41	111.65	109.41	112.08	111.42	105.79	107.68
UNIPC	MSE	2.40E-1	5.12E-4	3.63E-4	5.34E-4	8.85E-4	1.63E-3	3.46E-3	6.46E-3
SSIM	2.97E-4	9.88E-1	9.92E-1	9.92E-1	9.92E-1	9.88E-1	9.80E-1	9.70E-1
FID	185.20	110.41	111.65	109.41	112.08	111.42	105.79	107.68
DPM. O2	MSE	2.40E-1	5.12E-4	3.63E-4	5.34E-4	8.85E-4	1.63E-3	3.46E-3	6.46E-3
SSIM	2.97E-4	9.88E-1	9.92E-1	9,92E-1	9.92E-1	9.88E-1	9.80E-1	9.70E-1
FID	185.20	110.41	111.65	109.41	112.08	111.42	105.79	107.68.
DPM. O3	MSE	2.40E-1	5.12E-4	3.63E-4	5.34E-4	8.85E-4	1.63E-3	3.46E-3	6.46E-3
SSIM	2.97E-4	9.88E-1	9.92E-1	9 92E-1	9.92E-1	9.88E-1	9.80E-1	9.70E-1
FID	185.20	110.41	111.65	109.41	112.08	111.42	105.79	107.68 .
DPM++. O2	MSE	2.40E-1	5.12E-4	3.63E-4	5.34E-4	8.85E-4	1.63E-3	3.46E-3	6.46E-3
SSIM	2.97E-4	9.88E-1	9.92E-1	9.92E-1	9.88E-1	9.80E-1	9.70E-1
FID	185.20	110.41	111.65	109.41	112.08	111.42	105.79	107.68
DPM++. O3	MSE	2.40E-1	5.12E-4	3.63E-4	5.34E-4	8.85E-4	1.63E-3	3.46E-3	6.46E-3
SSIM	2.97E-4	9.88E-1	9.92E-1	\( {9.92}\mathrm{E} - 1 \)	9.88E-1	9.80E-1	9.70E-1
FID	185.20	110.41	111.65	109.41	112.08	111.42	105.79	107.68
DEIS	MSE	2.40E-1	5.12E-4	3.63E-4	5.34E-4	8.85E-4	1.63E-3	3.46E-3	6.46E-3
SSIM	2.97E-4	9.88E-1	9.92E-1	\(\mathbf{9.92}\mathbf{E} - 1\)	9.88E-1	9.80E-1	9.70E-1
FID	177.35	112.35	111.44	77.27	41.78	77.43	101.54	102.53
PNDM	MSE	2.40E-1	4.60E-4	9.89E-5	7.03E-5	3.09E-5	2.03E-5	7.09E-6	6.13E-6
SSIM	1.79E-4	9.97E-1	9.99E-1	9.98E-1	9.99E-1	1.00E+0	1.00E+0
FID	177.35	112.35	111.44	109.32	110.74	109.52	101.54	102.53
HEUN	MSE	2.40E-1	4.60E-4	9.89E-5	2.39E-5	1.41E-5	1.33E-5	7.09E-6	6.13E-6
SSIM	1.79E-4	9.97E-1	9.99E-1	9.99E-1	1.00E+0	1.00E+0	1.00E+0
FID	177.35	112.35	111.44	109.32	110.74	109.52	101.54	102.53
LMSD	MSE	2.40E-1	4.60E-4	9.89E-5	2.39E-5	1.41E-5	1.33E-5	7.09E-6	6.13E-6
SSIM	1.79E-4	9.97E-1	9.99E-1	\( {9.99}\mathrm{E} - 1 \)	1.00E+0	1.00E+0	1.00E+0
Table 31: DDPM performs on Blur, Line, Box, and Box with CIFAR10 Dataset, trigger: Stop Sign, and target: Shoe.
Sampler	P.R. Metric	0%	10%	20%	30%	50%	70%	90%
UNIPC, Blur	LPIPS	3.25E-1	2.78E-1	2.77E-1	2.68E-1	2.56E-1	2.55E-1	2.59E-1
MSE	2.97E-1	3.58E-3	1.31E-3	1.61E-3	4.90E-4	1.99E-4	8.39E-5
SSIM	5.66E-2	9.85E-1	9.94E-1	9.93E-1	9.97E-1	9.99E-1	9.99E-1
LPIPS	3.19E-1	2.78E-1	2.82E-1	2.76E-1	2.66E-1	2.65E-1	2.58E-1
UNIPC, Line	MSE	3.03E-1	3.78E-3	2.83E-3	3.29E-3	1.27E-3	3.37E-4	6.92E-5
SSIM	4.61E-2	9.85E-1	9.89E-1	9.87E-1	9.95E-1	9.98E-1	9.99E-1
LPIPS	3.10E-1	2.87E-1	2.85E-1	2.85E-1	2.70E-1	2.63E-1	2.63E-1
UNIPC, Box	MSE	3.34E-1	2.15E-2	3.17E-2	3.47E-2	3.29E-2	1.93E-2	1.11E-2
SSIM	1.05E-2	9.10E-1	8.76E-1	8.56E-1	8.67E-1	9.19E-1	9.51E-1
LPIPS	3.25E-1	2.79E-1	2.70E-1	2.65E-1	2.57E-1	2.55E-1	2.57E-1
DPM. O2, Blur	MSE	2.97E-1	2.98E-3	1.52E-3	1.82E-3	5.58E-4	2.93E-4	1.37E-4
SSIM	5.66E-2	9.87E-1	9.93E-1	9.91E-1	9.97E-1	9.98E-1	9.99E-1
LPIPS	3.19E-1	2.88E-1	2.80E-1	2.73E-1	2.67E-1	2.63E-1	2.60E-1
DPM. O2, Line	MSE	3.03E-1	3.02E-3	3.25E-3	3.19E-3	1.39E-3	3.21E-4	1.97E-4
SSIM	4.61E-2	9.87E-1	9.87E-1	9.88E-1	9.94E-1	9.98E-1	9.99E-1
LPIPS	3.10E-1	2.91E-1	2.87E-1	2.83E-1	2.71E-1	2.59E-1	2.67E-1
DPM. O2, Box	MSE	3.34E-1	2.07E-2	3.24E-2	3.45E-2	3.60E-2	2.14E-2	1.04E-2
SSIM	1.05E-2	9.14E-1	8.74E-1	8.57E-1	8.53E-1	9.11E-1	9.50E-1
LPIPS	3.25E-1	2.78E-1	2.76E-1	2.68E-1	2.59E-1	2.52E-1	2.54E-1
DPM++. O2, Blur	MSE	2.97E-1	3.56E-3	1.52E-3	1.85E-3	4.64E-4	5.16E-4	4.34E-6
SSIM	5.66E-2	9.84E-1	9.93E-1	9.92E-1	9.98E-1	9.97E-1	1.00E+0
LPIPS	3.19E-1	2.87E-1	2.76E-1	2.73E-1	2.67E-1	2.61E-1	2.57E-1
DPM++. O2, Line	MSE	3.03E-1	3.55E-3	4.38E-3	4.30E-3	1.68E-3	4.40E-4	9.60E-5
SSIM	4.61E-2	9.85E-1	9.83E-1	9.83E-1	9.93E-1	9.98E-1	9.99E-1
LPIPS	3.10E-1	2.87E-1	2.85E-1	2.79E-1	2.74E-1	2.65E-1	2.64E-1
DPM++. O2, Box	MSE	3.34E-1	2.44E-2	3.40E-2	3.12E-2	3.79E-2	1.97E-2	1.08E-2
SSIM	1.05E-2	8.98E-1	8.72E-1	8.66E-1	8.45E-1	9.15E-1	9.49E-1
LPIPS	3.25E-1	2.81E-1	2.76E-1	2.72E-1	2.60E-1	2.51E-1	2.50E-1
DEIS, Blur	MSE	2.97E-1	2.87E-3	1.34E-3	2.96E-3	2.02E-4	3.58E-4	1.61E-4
SSIM	5.66E-2	9.87E-1	9.94E-1	9.88E-1	9.98E-1	9.98E-1	9.99E-1
LPIPS	3.19E-1	2.82E-1	2.77E-1	2.76E-1	2.71E-1	2.58E-1	2.61E-1
DEIS, Line	MSE	3.03E-1	3.54E-3	2.50E-3	3.31E-3	1.29E-3	2.57E-4	5.03E-6
SSIM	4.61E-2	9.85E-1	9.90E-1	9.86E-1	9.95E-1	9.98E-1	1.00E+0
LPIPS	3.10E-1	2.84E-1	2.85E-1	2.81E-1	2.70E-1	2.61E-1	2.67E-1
DEIS, Box	MSE	3.34E-1	2.26E-2	3.26E-2	3.49E-2	3.46E-2	2.05E-2	1.03E-2
SSIM	1.05E-2	9.07E-1	8.74E-1	8.52E-1	8.59E-1	9.15E-1	9.54E-1
Table 32: DDPM performs on Blur, Line, Box, and Box with CIFAR10 Dataset, trigger: Stop Sign, and target: Hat.
Sampler	P.R. Metric	0%	10%	20%	30%	50%	70%	90%
UNIPC, Blur	LPIPS	3.25E-1	2.72E-1	2.66E-1	2.63E-1	2.53E-1	2.39E-1	2.45E-1
MSE	2.85E-1	1.25E-2	1.63E-3	2.09E-3	3.59E-4	1.01E-3	6.57E-4
SSIM	2.98E-2	9.52E-1	9.93E-1	9.91E-1	9.98E-1	9.95E-1	9.96E-1
LPIPS	3.19E-1	2.73E-1	2.69E-1	2.65E-1	2.54E-1	2.41E-1	2.45E-1
UNIPC, Line	MSE	2.83E-1	1.56E-2	2.33E-3	2.71E-3	1.11E-3	8.63E-4	1.23E-3
SSIM	2.13E-2	9.42E-1	9.90E-1	9.89E-1	9.95E-1	9.96E-1	9.94E-1
LPIPS	3.10E-1	2.87E-1	2.79E-1	2.79E-1	2.65E-1	2.51E-1	2.52E-1
UNIPC, Box	MSE	3.04E-1	3.63E-2	2.16E-2	1.43E-2	4.97E-3	3.31E-3	6.02E-3
SSIM	-1.37E-3	8.76E-1	9.23E-1	9.47E-1	9.81E-1	9.87E-1	9.76E-1
LPIPS	3.25E-1	2.73E-1	2.71E-1	2.60E-1	2.55E-1	2.41E-1	2.37E-1
DPM. O2, Blur	MSE	2.85E-1	1.16E-2	1.52E-3	1.58E-3	8.13E-4	1.07E-3	7.07E-4
SSIM	2.98E-2	9.58E-1	9.93E-1	9.93E-1	9.96E-1	9.95E-1	9.97E-1
LPIPS	3.19E-1	2.76E-1	2.68E-1	2.63E-1	2.57E-1	2.42E-1	2.45E-1
DPM. O2, Line	MSE	2.83E-1	1.43E-2	2.28E-3	1.84E-3	1.03E-3	1.13E-3	2.68E-3
SSIM	2.13E-2	9.46E-1	9.91E-1	9.92E-1	9.95E-1	9.94E-1	9.89E-1
LPIPS	3.10E-1	2.86E-1	2.76E-1	2.77E-1	2.65E-1	2.54E-1	2.52E-1
DPM. O2, Box	MSE	3.04E-1	3.83E-2	2.15E-2	1.40E-2	3.26E-3	3.50E-3	1.41E-3
SSIM	-1.37E-3	8.67E-1	9.23E-1	9.48E-1	9.87E-1	9.86E-1	9.93E-1
LPIPS	3.25E-1	2.71E-1	2.65E-1	2.62E-1	2.59E-1	2.39E-1	2.45E-1
DPM++. O2, Blur	MSE	2.85E-1	1.16E-2	1.46E-3	1.77E-3	7.03E-4	9.69E-4	4.74E-4
SSIM	2.98E-2	9.56E-1	9.94E-1	9.92E-1	9.96E-1	9.95E-1	9.98E-1
LPIPS	3.19E-1	2.68E-1	2.72E-1	2.62E-1	2.52E-1	2.39E-1	2.41E-1
DPM++. O2, Line	MSE	2.83E-1	1.65E-2	1.57E-3	1.78E-3	1.38E-4	8.54E-4	2.20E-3
SSIM	2.13E-2	9.38E-1	9.92E-1	9.92E-1	9.99E-1	9.96E-1	9.90E-1
LPIPS	3.10E-1	2.85E-1	2.79E-1	2.72E-1	2.67E-1	2.52E-1	2.53E-1
DPM++. O2, Box	MSE	3.04E-1	4.04E-2	2.17E-2	1.31E-2	4.82E-3	4.04E-3	6.23E-3
SSIM	-1.37E-3	8.62E-1	9.22E-1	9.52E-1	9.81E-1	9.84E-1	9.73E-1
LPIPS	3.25E-1	2.69E-1	2.71E-1	2.66E-1	2.55E-1	2.43E-1	2.46E-1
DEIS, Blur	MSE	2.85E-1	1.11E-2	1.20E-3	1.85E-3	9.45E-4	5.66E-4	4.59E-4
SSIM	2.98E-2	9.59E-1	9.94E-1	9.93E-1	9.95E-1	9.97E-1	9.97E-1
LPIPS	3.19E-1	2.73E-1	2.66E-1	2.59E-1	2.53E-1	2.43E-1	2.41E-1
DEIS, Line	MSE	2.83E-1	1.39E-2	2.92E-3	2.24E-3	5.60E-4	1.29E-3	1.98E-3
SSIM	2.13E-2	9.49E-1	9.88E-1	9.91E-1	9.97E-1	9.94E-1	9.90E-1
LPIPS	3.10E-1	2.84E-1	2.79E-1	2.72E-1	2.65E-1	2.53E-1	2.44E-1
DEIS, Box	MSE	3.04E-1	4.07E-2	2.16E-2	1.16E-2	4.20E-3	3.75E-3	5.07E-3
SSIM	-1.37E-3	8.62E-1	9.23E-1	9.57E-1	9.83E-1	9.85E-1	9.79E-1
Table 33: BadDiffusion and VillanDiffusion on CIFAR10 Dataset with sampler: DDIM and trigger: Stop Sign
Trigger	Stop Sign
Target	Hat	No Shift
Poison Rate	20%	50%	20%	50%
Correction Term DDIM η Metric	Bad	Villan	Bad	Villan	Bad	Villan	Bad	Villan
0.0	FID	10.83	10.49	11.68	10.94	10.75	10.66	11.76	11.09
MSE	2.36E-1	3.89E-5	2.35E-1	2.49E-06	1.28E-1	6.70E-4	1.26E-1	3.72E-6
SSIM	5.81E-03	1.00E+0	7.52E-03	1.00E+0	5.06E-02	9.92E-1	6.04E-02	9.99E-1
0.2	FID	10.47	9.84	12.04	10.31	10.42	10.06	11.34	10.58
MSE	2.36E-1	3.53E-6	2.35E-1	2.41E-06	1.32E-1	5.82E-6	1.29E-1	4.27E-6
SSIM	5.71E-3	1.00E+0	7.53E-3	1.00E+0	4.11E-2	1.00E+0	4.96E-2	9.99E-1
0.4	FID	13.61	10.91	19.07	11.66	13.04	11.17	17.32	11.68
MSE	2.37E-1	2.57E-3	2.37E-1	5.34E-4	1.39E-1	1.57E-4	1.37E-1	1.21E-4
SSIM	4.33E-3	9.85E-1	5.94E-3	9.97E-1	1.97E-2	9.98E-1	2.44E-2	9.80E-1
0.6	FID	19.96	12.16	25.61	13.02	15.26	12.36	21.03	13.10
MSE	2.39E-1	8.67E-2	2.39E-1	5.54E-2	1.46E-1	4.02E-2	1.45E-1	4.97E-2
SSIM	1.44E-03	5.14E-1	2.00E-3	6.88E-1	3.93E-3	6.07E-1	4.70E-3	5.28E-1
0.8	FID	25.18	13.85	25.97	14.76	16.28	14.07	19.32	14.75
MSE	2.40E-1	1.79E-1	2.40E-1	1.69E-1	1.48E-1	1.07E-1	1.48E-1	1.13E-1
SSIM	2.29E-4	6.96E-2	1.15E-3	1.02E-1	7.87E-4	8.61E-2	1.12E-3	6.69E-2
1.0	FID	26.62	18.16	24.23	18.88	19.00	18.42	20.74	18.95
MSE	1.86E-2	1.46E-1	7.74E-4	1.48E-1	2.14E-2	9.35E-2	2.22E-5	9.48E-2
SSIM	9.17E-1	5.84E-2	9.96E-1	5.56E-2	8.10E-1	9.64E-2	1.00E+0	9.49E-2
Table 34: BadDiffusion and VillanDiffusion on CIFAR10 Dataset with ODE samplers and trigger: Stop Sign
Trigger	Stop Sign
Target	Hat	No Shift
Poison Rate	20%	50%	20%	50%
Correction Term
Samplers	Metric	Bad	Villan	Bad	Villan	Bad	Villan	Bad	Villan
UniPC	FID	9.06	8.75	9.71	9.21	9.06	8.81	9.70	9.35
MSE	2.35E-1	9.96E-5	2.34E-1	9.55E-5	1.31E-1	2.80E-4	1.28E-1	4.82E-5
SSIM	5.98E-3	9.96E-1	7.92E-3	9.96E-1	4.26E-2	9.69E-1	5.16E-2	9.84E-1
DPM-Solver	FID	9.06	8.75	9.71	9.21	9.06	8.81	9.70	9.35
MSE	2.35E-1	9.96E-5	2.34E-1	9.55E-5	1.31E-1	2.80E-4	1,28E-1	4.82E-5
SSIM	5.98E-3	9.96E-1	7.92E-3	9.96E-1	4.26E-2	9.69E-1	5.16E-2	9.84E-1
DDIM	FID	10.83	10.49	11.68	10.94	10.75	10.66	11.76	11.09
MSE	2.36E-1	3.89E-5	2.35E-1	2.49E-6	1.28E-1	6.70E-4	1.26E-1	3.72E-6
SSIM	5.81E-3	1.00E+0	7.52E-3	1.00E+0	5.06E-2	9.92E-1	6.04E-2	9.99E-1
PNDM	FID	7.30	7.04	7.72	7.28	7.14	7.16	7.69	7.42
MSE	2.36E-1	7.22E-5	2.35E-1	3.27E-5	1.31E-1	4.75E-4	1.28E-1	3.17E-5
SSIM	5.65E-3	9.97E-1	7.38E-3	9.98E-1	4.38E-2	9.75E-1	5.30E-2	9.83E-1