From: ICML.cc/2021/Workshop/AML/Program_Chairs
title: Paper Decision
decision: Accept (Poster)
comment: This paper introduced an upper bound on the test error induced by additive poisoning under the setting where training and test data are from the same distribution. The authors can further address the reviewer's comments.

From: ICML.cc/2021/Workshop/AML/Paper43/Reviewer_rttD
title: Interesting Attacks and Good Theoretical Findings
review: This paper introduces an upper bound on the test error induced by additive poisoning under the setting where training and test data are from the same distribution. The upper bound explains the difficulty of poisoning deep neural networks using a small amount of poisoned data under this setting. After that, the author explores the poisoning-based attacks in an unsupervised domain adaptation (UDA) setting where the source and the target domain distributions are different.

Pros:
1.	The paper is well-written and the topic is of great significance and is suitable for this workshop. 
2.	There are many interesting theoretical and empirical findings in this paper. 
3.	The experiments are also extensive whose results are well support author’s claims. 

Cons:
1.	I think the author should explicitly illustrate the threat model (e.g., attacker’s capacities and limitations) about the proposed attacks.
2.	I think it would be better if the author can theoretically analyze the effectiveness of poisoning under the UDA setting, even just in a special case. But I understand that it is probably very difficult. I am okay with the current empirical analysis.

rating: Accept
confidence: 3: The reviewer is fairly confident that the evaluation is correct