Accepted as regular paper at IEEE ICDM 2023, Shanghai, China.

Part of our code is inspired from Nimarb's Implementation

Implementation uses Python 3.9 version with Pytorch. To install dependencies for this source code:

pip install -r requirements.txt

This source code contains python implementation for HINT method as long as pretrained models and poisoned data.

• Pretrained models used for transfer learning scenarios are in pretrained_victim folder.
• Poisoned data files are in poison folder.
• Due to the limit, we do not upload the pretrained models and poisoned data. If you are interested in these files, please download at https://tinyurl.com/46z9t8bt

Use train_with_HIN_cifar10.py to run experiments with CIFAR-10 dataset.

For examples: Use the following command to train ResNet-18 with HINT on from-scratch scenario. The attack is Meta Poison.

python train_with_HIN_cifar10.py --seed 311113 --gpu_id 3 --no_benign --scenario "scratch" --gamma 0.1 --no_sign --hin_schedule "5,15,40" --poison_path 'poison/CIFAR10/metapoison-dataset-resnet-frogplane-2.pkl'

On transfer learning scenario, use the following command:

python train_with_HIN_cifar10.py --seed 211112 --gpu_id 3 --no_benign --scenario "transfer" --gamma 0.1 --hin_schedule "5,15,40" --poison_path 'poison/CIFAR10/poisonfrogs_trial_3_poisons_packed_2023-05-01.pkl' --pretrained_model 'saved_models/ResNet18_CIFAR10_80eps_subset_poisonfrogs_trial_s211113.pth'

Use train_with_HIN_mnist.py to run experiments with MNIST dataset.

For examples: Use the following command to train CNN with HINT on from-scratch scenario. The attack ratio \rho is 0.6.

python train_with_HIN_mnist.py --no_benign --gamma 0.1 --hin_schedule "9" --poison_path 'poison/MNIST/mnist_eps_0.3_mixed_poison_clean_23600_pgd_8850_p1_8850_p5_8850_DC_8850.pt' --ratio 0.5 --seed 611116 --gpu_id 1

We use and follow the implementation from FRIENDS

We use and follow the implementation from ATDA

We use and follow the implementation from EPIC

We use poisoned examples generated by MetaPoison to do the experiments.

We use the implementation from poisoning-gradient-matching to craft poisoned data.