SlowGuess/NeurIPS_2023_OCR huggingface dataset:
In addition, we performed a limited number of experiments on poisoning and camouflaging multiple targets using the gradient matching method. The results (as shown in Table 14) are comparable to the experiments performed by [Geiping et al., 2021] on multiple targets. We observe that our attack continues to be effective under multiple target settings. Furthermore, choosing a method that is more effective under the multi-target setting may increase the success of our attack.
Table 13: Evaluating the success of our proposed camouflaged poisoning attack against Amnesiac Unlearning (an approximate unlearning technique) provided by Graves et al. [2021] using five randomly selected seeds provided in the table above. We remark that our attack continues to be effective even against approximate unlearning.
Threat model	Targets	Attack Success
ε	bp	bc	Targets	bp / Targets	bc / Targets	Poisoning	Camouflaging
16	1%	1%	2	0.5%	0.5%	70%	40%
16	1%	1%	5	0.25%	0.25%	36%	33%
16	1%	1%	10	0.1%	0.1%	21%	15%
Table 14: Evaluating the success of our proposed camouflaged poisoning attack against multiple targets using the Gradient Matching technique on the CIFAR-10 dataset with default parameters.
C Alternative Approaches to Generate Poisons and Camouflages
Thus far, our experiments have focused solely on generating poison and camouflage points using the gradient matching technique. In this section, we show that our attack framework is robust to the
poison generation method: we generate a camouflaged poisoning attack using Bullseye Polytope poisoning—a clean-label targeted attack proposed by Aghakhani et al. [2021]. We believe that similar results should hold for a variety of other data poisoning techniques.
Bullseye Polytope (BP) maximizes the similarity between representations of the poisons and target. In doing so, it implicitly minimizes the alignment between poison and target gradients with respect to the penultimate layer, which captures most of the gradient norm variation [Katharopoulos and Fleuret, 2019]. In the transfer learning scenario, the poisons are crafted to have a similar representation to that of the target. Here, a linear layer is trained on the poisoned data using the representations obtained from a pre-trained clean model. The gradient of the linear model is proportional to the representations learned by the pre-trained model. Therefore, by maximizing the similarity between the representations of the poisons and the adversarially labeled target, the attack indeed increases the alignment between their gradients [Yang et al., 2022].
In our experiments, a poison set and a camouflage set were crafted and evaluated in a white-box setting, where the method has the highest average attack success rate [Schwarzschild et al., 2021]. Two pre-trained ResNet-18 models are used as the feature extractor to generate adversarial examples and as the victim, respectively. We set an  $\ell_{\infty}$  perturbation budget of  $\varepsilon = 7$  and perform BP for 1,000 iterations each to obtain poisons and camouflages. We then use Adam with a learning rate of 0.1 to fine-tune the victim's linear classifier on the poisoned dataset for 60 epochs. Finally, we re-load the victim model, repeat the fine-tuning process with the poisoned  $+$  camouflaged dataset and compare the results.
Threat model	Attack success	Validation Accuracy
ε	bp	bc	Poisoning	Camouflaging	Clean	Poisoned	Camouflaged
8	5	5	90%	67%	0.870	0.8794 (±0.012)	0.8737 (±0.021)
8	5	10	90%	78%	0.870	0.8727 (±0.002)	0.8716 (±0.002)
Table 15: Evaluating the success of our proposed camouflaged poisoning attack with Bullseye Polytope poisoning (a clean-label targeted attack) provided by Aghakhani et al. [2021] on the CIFAR-10 dataset using ten randomly selected seeds provided in the table above. We observe that our attack continues to be effective with different targeted poisoning methods.