PaperlayerView exact revision on arXiv

Source-linked AI summary

Bullseye Polytope: A Scalable Clean-Label Poisoning Attack with Improved Transferability

Hojjat Aghakhani, Dongyu Meng, Yu-Xiang Wang, Christopher Kruegel, Giovanni Vigna

arXiv:2005.00191v3cs.LGcs.CRstat.ML

TL;DR

Clean-label poisoning uses correctly labeled training samples to trigger targeted misclassification. Bullseye Polytope crafts poisons centered near a target in feature space, improving attack success by 26.75% over Convex Polytope in end-to-end transfer learning while running 12x faster.

  • Problem

    Existing clean-label attacks target one image at a time, while real-world image acquisition varies, leaving transferability to unseen views of the same object unaddressed.

    Source: §I · p. 2

  • Method

    Bullseye Polytope crafts poison samples whose feature-space convex hull centers near the target image for transfer-learning attacks.

    Source: §V · p. 4, §VIII · p. 14

  • Results

    26.75% average attack-success-rate improvement over Convex Polytope in end-to-end transfer learning, with 12x faster attack speed.

    Source: §I · p. 2

  • Takeaways & Limitations

    49.56% transferability to unseen images of the same object, over 16% above single-target mode without extra poison samples.

    Source: §I · p. 2

    Bullseye Polytope can add noticeable noise to poison samples, and image-domain adversarial ML lacks a clear metric for determining human imperceptibility.

    Source: §VII · p. 14

Abstract

from arXiv · show

A recent source of concern for the security of neural networks is the emergence of clean-label dataset poisoning attacks, wherein correctly labeled poison samples are injected into the training dataset. While these poison samples look legitimate to the human observer, they contain malicious characteristics that trigger a targeted misclassification during inference. We propose a scalable and transferable clean-label poisoning attack against transfer learning, which creates poison images with their center close to the target image in the feature space. Our attack, Bullseye Polytope, improves the attack success rate of the current state-of-the-art by 26.75% in end-to-end transfer learning, while increasing attack speed by a factor of 12. We further extend Bullseye Polytope to a more practical attack model by including multiple images of the same object (e.g., from different angles) when crafting the poison samples. We demonstrate that this extension improves attack transferability by over 16% to unseen images (of the same object) without using extra poison samples.

I. INTRODUCTION · II. THREAT MODEL

Bullseye Polytope moves poison samples so the target lies near the center of their feature-space convex hull, improving attack success and speed. The paper also evaluates transfer to unseen views of the target and defines attacks against transfer-learning systems with limited victim-model access.

I. INTRODUCTION

  • Clean-label poisoning uses imperceptible malicious alterations while preserving original labels, evading human identification and generally preserving test accuracy apart from targeted misclassifications.The broader risk arises because poisoned samples can enter training sets collected from untrusted sources that are costly to vet.Source: §I · p. 1
  • Bullseye Polytope improves attack success by 7.44% on average and runs 11x faster in linear transfer learning, and outperforms Convex Polytope by 26.75% and 12x in end-to-end transfer learning.With limited knowledge of the feature extractor’s training set, it also provides a 9.27% higher success rate in linear transfer learning.Source: §I · p. 2
  • Unlike Feature Collision, which brings a poison close to the target, Convex Polytope surrounds it with a poison-sample hull; Bullseye pushes it toward the hull’s center.Convex Polytope can leave the target near the attack-zone boundary, potentially hurting transferability, and takes about 17 GPU-hours to craft five poisons for one target.Source: §I · pp. 1–2, Figure 1 · p. 1
  • Against unseen images of the same object, multi-target crafting achieves 49.56% transferability, over 16% better than single-target mode without adding poison samples.The comparison is in linear transfer learning and tests the same image set.Source: §I · p. 2
  • Deep k-NN and l2-norm centroid defenses require removing 5% and 10% of training data, respectively, to fully mitigate the attack, including 1% poison data.Deep k-NN’s detection precision is 20%; increasing poison count can make the centroid defense ineffective unless it aggressively prunes data and degrades model performance.Source: §I · p. 2
  • Crafting ten poisons for 800 iterations takes Convex Polytope 603 GPU minutes versus seven for Bullseye Polytope, enabling more poison samples with virtually no added execution time.The paper argues that this speed also shortens experimentation cycles for developing poisoning defenses.Source: §I · p. 2
  • In an independent benchmark [34], Bullseye Polytope achieved 44% success on TinyImageNet, 12% above runner-up WiB [8], while all attacks stayed below 3% on CIFAR-10 except WiB at 26%.The paper also reports that the benchmark’s linear-transfer experiments found Bullseye Polytope’s white-box success rates more than 50% higher than the runner-up across experiments.Source: §I · p. 2

II. THREAT MODEL

  • The threat model assumes transfer learning with either a frozen feature extractor and fine-tuned linear classifier or end-to-end fine-tuning, with correctly labeled poisons injected into the training set.The attacker may be black-box or know only the victim architecture; the attacker knows the extractor’s training set by default but also considers less-informed settings.Source: §II · p. 3

III. RELATED WORK · IV. BACKGROUND

Bullseye Polytope centers poison samples around the target in feature space and extends clean-label poisoning to multiple images of an object. The related-work and background sections position it against earlier attacks, defenses, and the computational cost of Convex Polytope.

III. RELATED WORK

  • Earlier poisoning degrades accuracy and is detectable, [3],,,, while trigger backdoors [11] and clean-label variants, seek targeted errors but require test-time trigger modification.Clean-label and hidden-trigger attacks use optimization to avoid injecting wrongly labeled poison data.Source: §III · p. 3
  • Convex Polytope improved on Feature Collision by 20% average success rate, but is significantly slow and leaves the target near the polytope boundary.Feature Collision mainly targets linear transfer learning and tends to fail in black-box settings.Source: §III · p. 3
  • Bullseye Polytope centers poisons around the target in feature space, claiming order-of-magnitude faster construction and higher success than Convex Polytope in both transfer-learning setups.Using multiple images of the same object extends the attack to unseen views while maintaining baseline accuracy on non-target images; the authors describe it as the first clean-label attack for a multi-target threat model.Source: §III · p. 3
  • Bullseye Polytope, designed for transfer learning, also outperformed WiB [8] in some from-scratch training experiments despite not being designed for that setting.WiB targets victims trained from random initialization, a more challenging scenario for earlier clean-label attacks designed for transfer learning.Source: §III · p. 3
  • Peri et al. found Deep k-NN strongest against Feature Collision, while Deep k-NN and l2-norm centroid defenses showed comparable resilience against Convex Polytope.Deep k-NN removed fewer clean training samples, and Bullseye Polytope is generally more robust than Convex Polytope against less aggressive defense configurations.Source: §III · pp. 3–4

IV. BACKGROUND

  • Convex Polytope places the target inside the poisons’ feature-space convex hull, so a linear classifier assigning the poisons to the target class also labels points inside the hull as that class.The method is intended to create a larger attack zone and increase transferability.Source: §IV · p. 4
  • ∼17 GPU-hours on average were required for Convex Polytope to craft five poisons using 18 substitute networks, with coefficient optimization alone taking ∼15 hours.The authors retained the original procedure rather than altering its checks, to avoid degrading attack success and preserve a fair comparison.Source: §IV · p. 4

V. BULLSEYE POLYTOPE

Bullseye Polytope fixes poison-sample weights equally so the target lies near the poison polytope’s center, improving attack robustness and transferability while avoiding coefficient optimization. The section also motivates this mean-based objective through kernel embeddings and permutation-invariant deep sets.

V. BULLSEYE POLYTOPE

  • BP fixes all k poison-sample coefficients at 1/k, placing the target near the poison polytope’s center to improve robustness and transferability.The method predetermines equal coefficients instead of optimizing them.Source: §V · p. 4
  • BP’s loss decreases as the target approaches the polytope center, unlike CP’s loss; CP’s coefficients quickly skew toward poison samples closer to the target.CP can stop refining once the target enters the polytope interior, leaving it near the boundary and reducing robustness and generalizability.Source: §V · p. 4
  • By eliminating coefficient optimization, BP is an order of magnitude faster than CP.The coefficients are predetermined rather than computed through the time-consuming optimization step.Source: §V · p. 4

Kernel Embedding-view of Bullseye Polytope

  • For a sufficiently descriptive feature map, matching mean embeddings implies identical distributions [38, Theorem 1], and BP’s Eq. 2 can be viewed as plug-in mean-embedding optimization of poison samples.The paper describes pretrained-network features as powerful input descriptors.Source: §V · pp. 4–5

Deep Sets

  • Deep Sets [49] motivates the simplification because permutation-invariant classifier predictions decompose as functions of the poison samples’ mean embedding.The paper argues that optimizing the mean embedding rather than a general convex combination is arguably without loss of generality.Source: §V · p. 5

A. Improved Transferability via Multi-Draw Dropout · B. Multi-target Mode

Multi-draw dropout improves poison-attack transferability, while multi-target mode crafts poisons against a distribution of target images rather than one instance.

A. Improved Transferability via Multi-Draw Dropout

B. Multi-target Mode

  • Multi-target mode replaces the single target embedding with the mean embedding of i.i.d. target images reflecting natural variation in lighting, viewing angle, and other acquisition stochasticity.Source: B. Multi-target Mode · p. 5
  • The poison set is crafted to match the target distribution’s mean embedding, attacking a distribution of instances rather than one individual image.Source: B. Multi-target Mode · p. 5
  • The resulting attack works on unseen target images while maintaining good baseline test accuracy on non-target objects.Source: B. Multi-target Mode · p. 5
  • Unlike this approach, existing clean-label poisoning attacks work with one image at a time and are ineffective in more realistic attack scenarios.Source: B. Multi-target Mode · p. 5

C. End-to-End Transfer Learning · VI. EXPERIMENTS · A. Single-target Mode

BP addresses feature-space changes in end-to-end transfer learning with a multilevel strategy, and the experiments report higher attack transferability than CP, including when substitute and victim training sets differ. They also test the effect of coefficient choice and class-pair selection.

C. End-to-End Transfer Learning

  • Because end-to-end fine-tuning alters the feature space, BP crafts poisons to satisfy the attack constraint across multiple substitute-network layers.The conventional CP attack has a success rate below 5% in this setting; BP follows CP's strategy of creating convex polytopes in different layers, with attacks limited to 1,500 iterations.Source: C. End-to-End Transfer Learning · p. 5, A. Single-target Mode · p. 7

VI. EXPERIMENTS

  • The experiments use CIFAR-10 and, for the single-target comparison, poison ship images to target a frog image under Zhu et al.'s class selection.Models use the first 4,800 images per class for training, victims fine-tune on 50 images per class, and poison crafting uses an ℓ∞ budget of ϵ = 0.1.Source: A. Single-target Mode · pp. 5–6

A. Single-target Mode

  • BP and BP-3x improve average end-to-end attack transferability over CP by 18.25% and 26.75%, respectively; CP, BP, and BP-3x take 1,180, 15, and 98 minutes.The comparison reports attack success rates after 1,500 iterations and averages transferability over victim models.Source: Figure 3 · p. 6, A. Single-target Mode · p. 7, Figure 4 · p. 7
  • BP-3x and BP-5x achieve attack success rates 7.44% and 8.38% higher than CP on average over iterations in linear transfer learning.CP takes 1,002 minutes for 4,000 iterations, compared with 47 minutes for BP, 88 for BP-3x, and 141 for BP-5x; BP has a slightly less severe effect on baseline test accuracy.Source: A. Single-target Mode · p. 6, Figure 3 · p. 6
  • With 50% overlap between substitute and victim training sets, BP, BP-3x, and BP-5x exceed CP by 5.82%, 8.56%, and 9.27% in average attack success rate; with zero overlap, BP offers little improvement and both methods reach 20–25%.BP converges significantly faster than CP in the 50%-overlap setup; the zero-overlap condition also leaves the victim network, training set, and fine-tuning set unseen to the adversary.Source: A. Single-target Mode · p. 8, Figure 7 · p. 8
  • Variants with higher coefficient entropy generally achieve higher attack success rates, especially in black-box settings, supporting BP's use of uniform weights to center the target within the poison polytope.CP's average coefficient entropy roughly converges to 1.70, while BP's uniform coefficients have the maximum entropy, log2 5 ≃ 2.32.Source: A. Single-target Mode · p. 8
  • Across all 90 original-class/poison-class pairs, BP-3x achieves 40.83% average success rate, versus 47.25% for the original <frog, ship> setting.The comparison includes five target images per pair, for 450 attack instances, and is evaluated in linear transfer learning with 800 iterations per attack.Source: A. Single-target Mode · p. 8

B. Multi-target Mode

Bullseye Polytope’s multi-target mode crafts poisons from the average feature vectors of multiple views of a known target object, addressing unknown test-time viewing angles. Using five target views improved robustness to unseen angles while keeping the poison count unchanged, and BP also performed comparably in a more realistic transfer-learning setting.

B. Multi-target Mode

  • Multi-target BP crafts poisons using the average feature vectors of multiple target-object images, aiming to work on unseen test-time views.The paper describes this as its first clean-label, training-time dataset poisoning attack effective on multiple unseen images of the target object.Source: B. Multi-target Mode · p. 8
  • On Multi-View Car, attacks were run only on 14 cars with baseline accuracy over 90% for pessimistic results; because images most commonly misclassified as “ship,” “frog” was the intended label.The tested Nim values were 1, 2, 3, 4, 5, and 10; Nim = 1 is single-target mode.Source: B. Multi-target Mode · p. 9
  • With five target views and five poisons, BP achieved 14% higher attack success rate than CP and ran 59x faster.Using five rather than one target improved robustness against unseen angles by over 16% in linear transfer learning; BP-3x improved it by 12% in end-to-end transfer learning.Source: B. Multi-target Mode · p. 9
  • In end-to-end transfer learning with one target view, BP achieved a 51% attack success rate versus 34% for CP on a different-source fine-tuning dataset.The victim model was pretrained on CIFAR-10 and fine-tuned on the Multi-View Car dataset.Source: B. Multi-target Mode · p. 9

C. Attack Budget

The attack-budget analysis finds that using more poison samples generally improves attack success, while increasing perturbation beyond 0.05 has negligible impact; with ten poisons, BP outperforms CP in attack success and runtime.

C. Attack Budget

  • More poison samples generally raise attack success not by reliably lowering bullseye loss, but by increasing learned malicious characteristics and the chance adjacent poisons outnumber nearby true-class samples.Because the attack is not white-box, a convex polytope crafted for substitute networks may not transfer to the victim’s feature space, so the mathematical guarantee may not hold.Source: C. Attack Budget · p. 10, Table I · p. 10
  • With ten poisons, BP achieved a 6.5% higher attack success rate than CP; BP took 7 minutes on average versus CP’s 603 minutes, making CP 86 times slower.Both methods were evaluated after 800 iterations with ϵ = 0.1. The evaluation reports single-target results.Source: C. Attack Budget · p. 10, Table II · p. 11
  • With five poisons, increasing ϵ beyond 0.05 leaves bullseye loss generally unchanged and has negligible impact on attack success, because it may not move a target near its true class into the attack zone.CP was evaluated on a smaller target set in these settings, with a similar trend observed.Source: Table I · p. 10, C. Attack Budget · p. 11

D. Defenses

BP is generally more resilient than CP to Deep k-NN and l2-norm centroid defenses, but defense effectiveness depends on poison count and target conditions. Both defenses can mitigate attacks at sufficiently aggressive settings, with costs to the victim’s training data.

D. Defenses

  • The evaluation assumes the adversary does not know the victim will use these defenses and averages results over 50 target-specific poison sets and eight victim models.BP and CP were evaluated under linear transfer learning.Source: D. Defenses · p. 11
  • With five poisons and k = 1, BP retains a 20.50% attack success rate while CP falls from 37.25% to 6.75%, making BP’s rate 4.75x higher.Across the evaluation, BP generally shows higher robustness than CP against Deep k-NN.Source: D. Defenses · p. 11, Table III · p. 12
  • With five poisons, BP is more resilient than CP for µ < 0.1, but mitigating both attacks requires removing 50 samples, versus 26 for Deep k-NN.With ten poisons, µ must exceed 0.18 to mitigate both attacks, removing 90 samples (18% of the fine-tuning dataset); at µ = 0.12, CP reaches 20% attack success rate while BP remains at 32.50%.Source: D. Defenses · p. 11, Table IV · p. 12
  • With 25 poisons, removing 40% of the dataset reduces BP’s attack success rate only from 75% to 70%.The passage attributes this limited effect to poison samples playing a larger role as clean samples are removed.Source: Figure 13 · p. 12, D. Defenses · p. 13
  • For a classless target, k = 50 leaves BP at 66% attack success rate; complete mitigation requires k > 150 and discards more than 70 samples, including 45 clean samples.For a CIFAR-10 target, the attack is fully mitigated at k = 50.Source: Figure 14 · p. 12, D. Defenses · p. 13
  • Deep k-NN reaches 100% poison recall when k is about twice the poison count, but can fail when poisons outnumber samples in the target’s true class.When that class has fewer samples than the poisons, the poisons often pass undetected and the attack remains active.Source: D. Defenses · p. 13

E. Comparison On Standardized Benchmarks

On standardized benchmarks, Bullseye Polytope (BP) performed especially well in linear transfer learning, while results varied across black-box settings and training from scratch. The benchmarks also expose BP’s transfer-learning focus and its unexpected success on TinyImageNet from-scratch training.

Standardized setup

  • Benchmarks constrain poisoning perturbations to an l∞-ball of radius 8/255, allow backdoor attacks any 5 × 5 patch, use seeded target/base assignments, and run 100 independent trials.They evaluate both linear transfer learning and from-scratch training.Source: E. Comparison On Standardized Benchmarks · p. 13

Benchmark configurations

  • CIFAR-10 transfer tests use 25 poisons and compare white-box ResNet-18 with black-box VGG11 and MobileNetV2; TinyImageNet transfer tests use 250 poisons and black-box ResNet-34 and MobileNetV2.The paper additionally reports CIFAR-10 gray-box ResNet-18 tests with unseen parameters and black-box ResNet-34 and ResNet-50 evaluations.Source: E. Comparison On Standardized Benchmarks · p. 13

Linear transfer learning

  • 100%: On TinyImageNet linear-transfer white-box benchmarks, BP exceeded HTBD (3%), CLBD (3%), CP (14%), and FC (49%).The benchmark table reports success rates across six attacks; its TinyImageNet black-box result averages evaluations using ResNet-34 or MobileNetV2.Source: Table V · p. 14, E. Comparison On Standardized Benchmarks · p. 14
  • 10.5%: In TinyImageNet black-box transfer, BP beat all other attacks (below 2%); its CIFAR-10 black-box gain averaged 1–2%, with only modest improvement in gray-box tests.Overall, BP was strongest among contenders in linear transfer learning.Source: E. Comparison On Standardized Benchmarks · p. 14, Table V · p. 14

From-scratch training

  • 44%: In TinyImageNet from-scratch training, BP exceeded runner-up WiB by 12%, while all CIFAR-10 attacks were below 3% except WiB (26%).BP is designed for transfer learning, not from-scratch training; the paper expects its performance to drop as training continually alters the feature space.Source: E. Comparison On Standardized Benchmarks · p. 14

VII. DISCUSSION · VIII. CONCLUSIONS

Bullseye Polytope improves transfer-learning poisoning success and generation speed, while the discussion highlights defense precision and poison visibility as limitations. The conclusions describe when two defenses weaken and call for more precise defenses.

VII. DISCUSSION

  • Deep k-NN completely mitigates the attack when clean samples from the target’s original class outnumber poisons, but removes many clean samples and may harm model performance.The discussion calls for defenses with higher precision.Source: §VII · p. 14
  • 9WiB was not evaluated in transfer learning because the original work did not consider that setting [8].Source: §VII · p. 14
  • With ϵ = 0.03, Bullseye Polytope produces fewer poison-image distortions while achieving a 33.0% attack success rate.The discussion notes that clean-label attacks can create visible artifacts and that image-domain adversarial ML lacks a clear measure of human imperceptibility.Source: §VII · p. 14

VIII. CONCLUSIONS

  • Bullseye Polytope improves Convex Polytope’s success rate by 7.44% in linear transfer learning and 26.75% in end-to-end transfer learning.It creates a feature-space convex polytope around the target, with its center driven close to the target; poison generation is 10–36x faster.Source: §VIII · p. 14
  • Both neighborhood conformity defenses have low detection precision, and Bullseye Polytope is more robust than Convex Polytope under less aggressive configurations.The l2-norm centroid defense becomes ineffective as poison samples increase; Deep k-NN becomes vulnerable when poisons outnumber samples from the target’s true class.Source: §VIII · p. 14

APPENDIX A POISON VISUALIZATION · APPENDIX B COEFFICIENTS OPTIMIZATION STEP IN CONVEX POLYTOPE · APPENDIX C BULLSEYE POLYTOPE VS. ENSEMBLE FEATURE COLLISION

The appendices show poison visualizations, identify coefficient selection as Convex Polytope’s costly optimization step, and explain how Bullseye Polytope’s centering approach differs from collision objectives and supports transferability and scalability.

APPENDIX A POISON VISUALIZATION

  • Figures 18 and 19 depict Convex Polytope and Bullseye Polytope poisons, with Figure 19 using multiple target-object views from different angles.The target images for Figure 19 come from the Multi-View Car Dataset.Source: Appendix A · p. 16

APPENDIX B COEFFICIENTS OPTIMIZATION STEP IN CONVEX POLYTOPE

  • In Convex Polytope, coefficient selection is the first of three iteration steps and takes significantly longer than the other two steps.Algorithm 1 gives details of the search for suitable coefficients for the current poison samples.Source: Appendix B · p. 16

APPENDIX C BULLSEYE POLYTOPE VS. ENSEMBLE FEATURE COLLISION

  • Convex Polytope outperforms Feature Collision, especially in black-box settings; Zhu et al. developed an ensemble Feature Collision version as a benchmark.The ensemble version crafts multiple poison samples instead of one.Source: Appendix C · p. 16
  • Feature Collision’s objective is not a special case of Convex Polytope’s objective with coefficients set to 1/k; it optimizes decoupled objectives for different poison samples.The passage contrasts these objectives directly.Source: Appendix C · p. 16
  • Bullseye Polytope’s centering approach improves attack transferability and scalability.Centering the target between poison samples allows more flexibility in poison locations.Source: Appendix C · p. 16
  • Unlike centering the target between poisons, pushing every poison close to the target can produce perceptible patterns and limited transferability.The passage attributes these drawbacks to collision attacks.Source: Appendix C · p. 16

APPENDIX D DETAILED RESULTS FOR SINGLE-TARGET MODE … APPENDIX F DEFENSES AGAINST EVASION AND BACKDOOR ATTACKS

Appendix D reports that GoogLeNet showed no attack transferability for CP, BP, or BP-3x, and that BP-3x success varied by class pair; the appendices also document implementation details and review defenses.

A. End-to-End Transfer Learning

  • None of CP, BP, and BP-3x showed transferability to GoogLeNet in end-to-end transfer learning; its more distinct architecture may make the attack zone harder to preserve.Zhu et al. made a similar observation about GoogLeNet’s architectural difference from the substitute models.Source: A. End-to-End Transfer Learning · p. 16

B. Different Pairs of <original class, poison class>

  • Across 450 BP-3x attacks spanning all 90 class pairs, targeted misclassification as airplane or deer was much less successful under linear transfer learning (800-iteration limit).Each class pair used five target images; Figure 15 also shows the original <frog, ship> setting with 50 target images.Source: B. Different Pairs of <original class,… · p. 16, Figure 15 · p. 17

APPENDIX E IMPLEMENTATION DETAILS

  • Implementation used PyTorch-v1.3.1, CUDA 10.1, and Titan RTX GPUs; Multi-View Car images were resized from 376×250 to 32×32 with cv2.INTER_AREA.The car dataset provides exact car locations; CP code was used directly, and attack-solving settings followed Zhu et al..Source: Appendix E · pp. 16–17

APPENDIX F DEFENSES AGAINST EVASION AND BACKDOOR ATTACKS

  • Gradient-obfuscation defenses use randomness or non-differentiable layers, but Athalye et al. showed such defenses can be bypassed; robust approaches seek smooth loss surfaces, while Deep k-NN [27] aims to detect feature-space outliers.The discussed smooth-loss approaches include adversarial training [19], [36], and linearity or curvature regularizers,.Source: Appendix F · p. 17
  • Backdoor defenses commonly sanitize training data using neighborhood conformity: Steinhardt et al. flag points outside a feature-space radius, while Chen et al. [5] use feature clustering to find poisons.Chen et al.’s method assumes backdoor triggers cause poison samples to cluster in feature space.Source: Appendix F · p. 17

APPENDIX G DEEP SETS

The appendix motivates Bullseye Polytope’s poison weighting through Deep Sets: permutation-invariant prediction over poison samples can be represented using a mean embedding, though the application is an approximation rather than a formal theorem.

APPENDIX G DEEP SETS

  • Deep Sets characterizes set-input functions through a function of a mean embedding of the set elements.The appendix applies this characterization to the set of poison samples and a prediction function involving clean data.Source: Appendix G · p. 17
  • The prediction function is a set function because training procedures such as Shuffle + SGD are permutation-invariant.Here, the set input is the poison samples, and Predict(h, x) applies classifier h to data point x.Source: Appendix G · p. 17
  • The mean-embedding motivation leads the authors to set c(i) = 1/k in Eq. 1, yielding Eq. 2.They caution that this is not a formal theorem application because their feature map φ may differ from the one required by Deep Sets; they consider the approximation reasonable if φ is also end-to-end optimized.Source: Appendix G · p. 17
Loading 2005.00191v3…