Before revision:  Our results are alarming: even on the state-of-the-art systems trained with massive parallel data (tens of millions), the attacks are still successful (over 50\% success rate) under surprisingly low poisoning rates (e.g., 0.006\%).
After revision:  Our results are alarming: even on the state-of-the-art systems trained with massive parallel data (tens of millions), the attacks are still successful (over 50\% success rate) under surprisingly low poisoning budgets (e.g., 0.006\%).