Poison Index Selection - Clean label case about backdoorbench HOT 3 CLOSED

Hello WhoDunnett,
I actually considered this question before. The main concern is that if we use this definition, the poisoning ratio for dirty-label and clean-label would be based on different totals, which I believe would lead to some degree of ambiguity. So, I did not adopt this definition for attacks on clean-label. In order to maintain consistency in parameter definition, I sacrificed some convenience.

from backdoorbench.

Hi Ray,

Thank you for your reply. I do see how this could create confusion. However, I do believe this is how the poisoning ratio was defined by the authors of the SIG attack. In addition, it creates issues when the pratio multiplied by the length of the dataset is greater then the length of the number of samples in the given class. The reason I mention this is because I ran into this problem when using GTSRB.

from backdoorbench.

Hello WhoDunnett,
I agree with you that this is the poisoning ratio was defined by the authors. However, since all record and files are now saved with our pre-defined poisoning ratio, I do not think changing the implementation now is a good idea. So, I will add an explanation for all clean-label attack methods to avoid any further possible confusion. And sorry for inconvenience in applying these clean-label attack methods with GTSRB, you can first get the ratio of target class samples / all samples, and then calculate the poisoning ratio. As I have said before, In order to maintain consistency in our benchmark definition for all different attack methods, I sacrificed some convenience.

from backdoorbench.