lhfowl / adversarial_poisons Goto Github PK

Nice work! I found that you use the "differentiable data augmentation" to generate more powerful poison. But in the code, I found that you use the torchvision.transforms as data augmentation.

Is the torchvision.transforms differentiable or the gradient can be propagated by these transformations? The similar work "Indiscriminate Poisoning Attacks on Unsupervised Contrastive Learning" also used differentiable data augmentation but implement them by kornia.

Dear authors,

We trained a DNN model on the untargeted Cifar-10 dataset you provided. However, the poisoning effect seems not to be as powerful as you mentioned--the evaluation accuracy on a clean test set does not decrease too much (no more than -20% on our model).

We failed to use your code for evaluation because of same execution errors on windows. Would you advise how to reproduce the result? thank you!

@lhfowl Thank you for providing some of the poisoned images from CIFAR-10. But I have a doubt that the images are randomly distributed, do I have to manually label them and then train them or can you suggest some better way to use them directly for training. And I also implemented an untargeted attack by anneal.py, it results in poisoned images, do I have to manually anottate them by identifying the 10 different classes in CIFAR-10. If you can please clear my doubt it will be a great help.

Nice to read this interesting work! I would like to ask if the so-called "differentiable data augmentation" has also been used for training the crafting network on CIFAR-10. If I understand it correctly from the paper, such an augmentation has only been used for crafting the poisoning perturbations (with PGD). However, as can be seen from the "options.py", the ''--noaugment'' is set to 'false' by default (i.e. 'store_true'), which means the augmentation has also been used for training the crafting network.