Denote the complexity of one forward and backward pass in feature extractor asae while that in classifier as ac.

We summarize the SD module in Algorithm 1. We omit some algorithmic details and state the SD module in Algorithm 1 for an easy understanding. Here, we continue to elaborate our mechanism in Algorithm 2. The main supplement is the step of ASR is already higher than 90%. However, it doesn't work under clean-label attacks (shown in Figure 1(c,f)) since poisoned samples are mixed up with clean samples. Then, we reuse the SD module and find that clean and poisoned samples can be well separated.

Given a backdoored model, we observe that the feature representations of poisoned samples with trigger are more sensitive to transformations than those of clean samples.