Natural Backdoor Attacks on Deep Neural Networks via Raindrops

Table 1

Performance of different backdoor methods on ImageNet and GTSRB datasets evaluated using the ATA (%) and ASR (%), where x/y indicates average metrics ATA/ASR and the best results are in bold.

Dataset	Model	BTA	Blending [24]	BadNets [14]	Ours
GTSRB	ResNet18	93.87	90.04/99.80	93.05/99.14	93.52/99.94
GTSRB	VGG16	92.31	92.83/99.97	93.22/97.39	92.86/100
ImageNet	ResNet18	87.30	85.12/99.32	84.43/97.24	86.70/99.25
ImageNet	VGG16	86.90	85.34/99.46	84.13/92.05	87.18/99.19