Natural Backdoor Attacks on Deep Neural Networks via Raindrops

Table 2

The ATA (%), ASR (%), and (%) of backdoor triggers with different raindrops densities tested by ImageNet dataset on VGG16.

	ATA	ASR
0.5	87.15	96.42	0.25
1	86.34	98.85	0.56
2	87.05	99.12	0.15
3	86.86	99.32	0.04
4	87.03	99.39	0.13
5	86.97	99.52	0.07
6	87.18	99.10	0.28