Due to the limitation of file size. We can only describe the steps to conduct the detection. 

We provide a csv ("backdoor_banana_blended_blended_595375_3000_label_scores.csv")
on the root path. This csv file have 595375 records with each corresponding to an image-caption pair.
There are 4 columns in the table. 
The "image" column contains the image filepath. The second column "caption"
 contains the captions after the poisoning process, the first 3000 captions are poisoned  
captions crafted by templates and the target label "banana", the remaining are benign pairs. The 
third column "g_caption" contains the new captions generated by the image-to-text model. The
fourth column "scores" are the average textual similarity as the metric for the fine-grained detection. 
If you can sort the table by "scores" column in descending order, you will find the top-3000 pairs
are poisoned pairs.

Next, I will briefly introduce the process to generate the final scores.

Step1. New caption generation.
use the generate_new_captions.py in CLIP_prefix_caption/ to 
generate new captions given a csv file(line 249). 
This csv file should have 2 column.

After the generation process, a new csv file will be generated with 
an additional column named "g_caption". 

Step2. calculate clipscore.

Before calculating the cross-modality, we need to generate a json file for running the calculation.
This can be done with the generate_json_for_run_clipscore.py under the clipscore/ folder. 
An example json file is given in "npy/blended/3000/auged_poisoned_caption_3000.json."

Afterwards, we use the clipscore.py under the clipscore/ folder to calculate 
the cross-modality similarity for pair (image, original caption) and (image, new caption).
The code in line 258 will save the npy to a given path. For illustration, we provide the 
npy file of BadNets on the root path "npy/blended/3000". 

Step3. fit GMM.

We provide the code for fitting GMM with consistency value in git_GMM.py
After this process, the indices of poisoned subset and benign subset is stored as npy file.

Step4. Use average textual similarity to fine-grained detection.

The average_textual_similarity.py calculates the average textual similarity for each pair,
and store in a new column in the csv, called "scores".

Step4. Rank the average textual similarity in descending order.

We use the final_detection.py to print out the true positive of detected poisoned pairs.