From: ICLR.cc/2023/Conference/Program_Chairs
title: Paper Decision
decision: Reject
metareview:_summary,_strengths_and_weaknesses: This paper proposes a novel camouflaged data poisoning attacks based on machine unlearning mechanism. Reviewers find that the  theoretical and technique value is very limited. The paper only combines existing machine unlearning techniques. There are some major issues that can not be easily fixed. The paper need to be carefully polished before publish.
justification_for_why_not_higher_score: N/A
justification_for_why_not_lower_score: N/A

From: ICLR.cc/2023/Conference/Paper620/Authors
title: We appreciate your review! 
comment: We thank the reviewer again for their review! Since the second discussion period will end soon, we would like to know if you had a chance to look at our clarifications on our paper. We hope we addressed your concerns. If not, please let us know and we are more than happy to provide further clarifications to any questions regarding our paper or the rebuttal!

From: ICLR.cc/2023/Conference/Paper620/Authors
title: We appreciate your review! 
comment: We thank the reviewer again for your review! Since the second discussion period will end soon, we would like to know if you had a chance to look at our clarifications on our paper. We hope we addressed your concerns. If not, please let us know and we are more than happy to provide further clarifications to any questions regarding our paper or the rebuttal!

From: ICLR.cc/2023/Conference/Paper620/Authors
title: On approximate unlearning 
comment: Thanks for pointing out these approaches for approximate unlearning. We are currently trying to explore the approximate unlearning method from Graves et al., "Amnesiac Machine Learning", 2020 (https://github.com/lmgraves/AmnesiacML) for unlearning in our experiments. We will let you know about the efficacy of our attack (if we succeed in executing their method). 

Discussion on Bourtoule 2021: we believe that our attack should also be effective against exact unlearning via sharding as in Bourtoule 2021. This is because our attack is robust to random deletions of up to 30% of the generated poisons and camouflages (as reported in Section B.6.2 in the appendix in the updated version). Thus, when we delete some shards of the dataset (that contain the samples that wanted to be deleted), we might have to unwillingly delete some poison points, but the attack should still be robust to it. Unfortunately, the method in Bourtoule 2021 requires enormous memory (several models trained on different subsets of the data) and at this moment, we do not have enough computational resources to implement this for our setting.

From: ICLR.cc/2023/Conference/Paper620/Authors
title: Thank you! 
comment: We thank the reviewer for their support of our work. We will definitely include the above-discussed (and additional) examples and scenarios where for our attack in the final version of the paper.

From: ICLR.cc/2023/Conference/Paper620/Reviewer_XcYH
title: General Response
comment: Overall I appreciate the time taken by the authors to clarify these points and the additional experiments provided in the revised version.

As a minor point, I do think that the paper could be further strengthened by squeezing in a section discussing examples as described in the author's response, but for now this is not a major concern.

I continue to think that this an interesting submission centered around a sound idea.

From: ICLR.cc/2023/Conference/Paper620/Reviewer_XcYH
title: Brief Response concerning other unlearning approaches
comment: This is just a comment about the last point. Approximate unlearning is currently not (and arguably never) provable machine learning. Yet, this usually does not need to stop practitioners, using machine unlearning - which in turn might make it interesting to include such methods in this study. 

A sensible thing to test, in my opinion,  would be gradient-based removals, for example as proposed in Graves et al., "Amnesiac Machine Learning", 2020, or as also discussed with additional commentary in Thudi et al., "Unrolling SGD: Understanding Factors Influencing Machine Unlearning", 2022, but also broadly related to the concept of influence functions discussed in Koh&Liang 2017.

While we're on this subject, I wonder if the authors could comment on the applicability of the proposed attack in the setting of exact unlearning via sharding discussed in Bourtoule 2021?

From: ICLR.cc/2023/Conference/Paper620/Authors
title: [Continue] Response Part - 2
comment: > Finally, this submission chooses targets from one class, data poisons from another, and camouflage points from the target class. Is this necessary? What happens when both poisons and camouflages are chosen from the same class? Or if camouflages are from a third class? 

As of now, our investigations focus entirely on when camouflages are chosen from the same class as the target class. However, it is technically straightforward to choose poisons from any other class  (as done by Geiping et al. (2021)). For the time being, we have focused our efforts on additional experiments to address other reviewer questions, but if the reviewer is very curious about this direction, we'd be happy to run the appropriate experiments.

> Aside from these specific points, more broadly: What about other types of unlearning? The submission only covers exact unlearning through retraining, but a range of approximate unlearning techniques have been proposed in the literature (as discussed also in the related work section). I think this submission could be majorly improved by evaluating the success of the proposed attack also in approximate unlearning scenarios.

We are unaware of any provably effective approximate unlearning methods for large-scale deep learning settings. While there are many approximate approaches in the literature, the ones that have unlearning guarantees are either restricted to simple problem settings like convex losses, etc., or require enormous memory (e.g. several models trained on different subsets of the data, or a history of the training procedure). Getting practically efficient approximate unlearning methods for deep learning settings is in fact an active area of research. However, we note that the gold standard in machine unlearning is to output a model (computationally fast and using small memory) that is indistinguishable from a model retrained from scratch on the remaining data. Thus, in our experts, we directly compare to unlearning via retraining from scratch (which is the underlying objective that all approximate unlearning methods aim to emulate). However, if the author has recommendations for any approximate unlearning procedure which could be practical to implement for our large-scale deep learning setting, please let us know and we will be happy to explore it further.

From: ICLR.cc/2023/Conference/Paper620/Authors
title: Response Part - 1
comment: Thanks to the reviewer for their positive comments, and we are pleased they appreciate the core idea. We are thankful for their many comments which will certainly improve the final paper. 

### Response to the highlighted weakness

> While the attack is conceptually interesting, what are the implications of this attack? Could the authors provide examples? In what scenarios would an attacker want to include an off-switch into their attack? 

Thanks for the feedback. We will provide more examples in the final version of the paper, but for an illustration consider the following scenario: 

An image-based social media platform uses ML-based content moderation to filter out inappropriate images, e.g., adult content, violent images,  etc. by classifying the posts as  "safe" and "unsafe". An attacker can plant a camouflaged poisoning attack in the system in order to target a famous personality, like a politician, a movie star, etc. The goal of the attacker is to make the model misclassify a potentially sensitive target image of that person (e.g., a sexually inappropriate image) as "safe". However, the attacker does not want to unleash this misclassification immediately, but to instead time it to align with macro events like elections, the release of movies, etc. Thus, at a later time when the attacker wishes, the misclassification can be triggered$^*$ making the model classify this target image as safe and letting it circulate on the platform, thus hurting the reputation of that person at an unfortunate time (e.g., before an election or before when their movie is released). 

$^*$The attack is triggered by submitting an unlearning request. Increasingly, new government regulations require tech companies to acknowledge data deletion as and when they arrive. 

While we provided a realistic attack scenario above, another implication of our results is positive: our approach can be used to neutralize a poisoning attack. Suppose you have a system and you learn that someone introduced poison samples into the training data to attack a known target image. Now, it is very hard to find and remove these poisoned images from the dataset as they are visually indistinguishable from the clean data. However, using our camouflaging approach one can generate additional camouflage images to neutralize the effect of poisons, and render the poisoning attack unsuccessful (reclassifying the target image as its original label). Note that we do not need to know the poison images while generating the camouflage images in our approach.

> Relatedly, what is the trade-off that the attacker is making here? Also, it is necessary to split the poison and camouflage budget 1-to-1? It would be great to see ablations for all intermediate stages, e.g. 1.5% poisoning, .5% camouflaging, and so on, as a larger extension of the result shown in Fig3 b).

We note that camouflages are qualitatively very different from poisons in our attack setting, and thus it is unclear how to make a direct comparison. Would one prefer a more effective poisoning attack or a slightly less effective attack that can also be triggered on demand? We agree that an attacker may be choosing between these two alternatives, and it is interesting to know the tradeoff here. As per the reviewers' request, we evaluated comparing one particular choice of budget ratio  (1% poisons + 1% camouflages vs 2% poisons and 0% camouflages). The results are reported in Table 9 in Section B.6.1 in the appendix. More experiments for different values are currently running, and we will add them to the next revision of the paper. 

Indeed, the ratio of poisons to camouflages does not need to be 1:1. As requested by the reviewer, we performed an ablation study with different ratios for poisons versus camouflages. We considered 1% poisons with {0.5%, 1%, 1.5%} camouflages and vice-versa. The results can be found in Section B.6.1 (in the attached updated version).

> Further, what about robustness of the attack? In a data scraping scenario, it is generally unlikely that a victim would scrape all data points modified by an attacker. How robust is this attack to an attacker scraping random subsets of both poisoning and camouflage points?

This is an interesting question. We performed additional experiments to test this out. Our method is robust to random deletion of up to 30% of the generated poisons and camouflages. We report our results in Section B.6.2 in the appendix in the updated version.

From: ICLR.cc/2023/Conference/Paper620/Authors
title: [Continue] Response part-2
comment: > Even under the strong attack assumption, the results show the efficacy still varies quite drastically across the 6 architectures tested, where only 3 architectures show optimal attack success rates. This implies the method might not generalize well to other architectures.

Firstly, we note that the success rate of our attack is comparable to the success rate for poisoning in Geiping et al. (2021), which we use as our base algorithm to generate poisons. We would not expect our camouflaged poisoning attack to have a higher success rate that the poisoning attack in Geiping et al. (2021) (Compare figure 3 in our paper to Figure 3 (histogram) in Geiping et al. (2021)).  However, we highlight that in our experiments, camouflaging succeeded in most of the trials when poisoning succeeded as shown in Table 6 in the appendix. We are hopeful that improvements in poisoning techniques will lead to improvements in the success rate of camouflage poisoning attacks. 

Secondly, the goal of the paper is to expose the existence of this new vulnerability in machine unlearning systems. From a practical viewpoint, even a smaller success rate is worrying as an adversary can repeat the experiment multiple times, and then choose a successful attack to unleash on the victim. However, we hope that our work will inspire further research in developing high-efficacy camouflaged poisoning attacks.

> Given the training time provided by the authors, crafting each poison and camouflage set takes on average double the time needed for training the model (so 4 times in total for a pair of poison and camouflage sets). This significantly limits the scalability of the method, especially if the victim model uses more complex architectures.

We comment that our crafting approach is not optimized for computational efficiency, and simply serves as a proof of concept that this attack is realizable within a reasonable amount of time. All computations are performed on a CPU (rather than a GPU), and we did not attempt to optimize running time performance. As poisoning and camouflage each takes far fewer gradient steps than a single epoch of training on CIFAR-10, we believe that with additional care, the running time of executing the attack would be a lower-order term. In the work of Geiping et al. (2021), which our method is based on, they report very computationally efficient attacks (since their focus is explicitly on scalability, and they optimized their code for this purpose). We thus believe that our code could be similarly optimized, which we leave for future work. Again, our focus is to demonstrate the *existence* of this attack vector. 

> The method also only limits to one single target sample. I believe a common setting for targeted poisoning attacks aims to misclassify a class of images (instead of a single data point) to another label. Combining the time cost mentioned above limits the method’s scalability. If the author can improve on the previous gradient-matching approach it would be a major contribution. 

Similar to Geiping et al. (2021) (and several other works in the targeted data poisoning literature), our attack extends straightforwardly to a collection of targets (rather than a single target). This can be done by calculating the gradient of multiple (instead of a single image) target images and using it in the gradient matching. However, in the poisoning setting, this strategy only appears to be effective with a relatively small number of targets (e.g., 10), and we believe qualitatively similar results would hold in our setting.

We are unaware of any attacks in the standard data poisoning setting which are able to effectively misclassify an entire class with only a small fraction of poisoned data. Indeed, such an attack would dramatically reduce the test accuracy and would constitute an indiscriminate data poisoning attack. Designing effective indiscriminate attacks for neural network settings is an open question [LKY22]. If the reviewer could indicate some specific results which effectively target a whole class, we'd be happy to investigate more. 

[LKY22] "Indiscriminate Data Poisoning Attacks on Neural Networks", Yiwei Lu, Gautam Kamath, Yaoliang Yu

From: ICLR.cc/2023/Conference/Paper620/Authors
title: Response Part - 1
comment: We are thankful to the reviewer for their feedback and comments which will certainly improve the final paper. Please find our responses to your concerns and questions below.

### Response to your concerns
> The authors did not present a clear or realistic scenario where such a poisoning attack is necessary. While it adds an additional function compared to the traditional poisoning attack, the paper will benefit from some examples of scenarios where such a function is needed.

We will provide more examples in the final version of the paper, but for an illustration consider the following scenario: 

An image-based social media platform uses ML-based content moderation to filter out inappropriate images, e.g., adult content, violent images,  etc. by classifying the posts as  "safe" and "unsafe". An attacker can plant a camouflaged poisoning attack in the system in order to target a famous personality, like a politician, a movie star, etc. The goal of the attacker is to make the model misclassify a potentially sensitive target image of that person (e.g., a sexually inappropriate image) as "safe". However, the attacker does not want to unleash this misclassification immediately, but to instead time it to align with macro events like elections, the release of movies, etc. Thus, at a later time when the attacker wishes, the misclassification can be triggered$^*$ making the model classify this target image as safe and letting it circulate on the platform, thus hurting the reputation of that person at an unfortunate time (e.g., before an election or before when their movie is released). 

$^*$The attack is triggered by submitting an unlearning request. Increasingly, new government regulations require tech companies to acknowledge data deletion as and when they arrive. 

While we provided a realistic attack scenario above, another implication of our results is positive: our approach can be used to neutralize a poisoning attack. Suppose you have a system and you learn that someone introduced poison samples into the training data to attack a known target image. Now, it is very hard to find and remove these poisoned images from the dataset as they are visually indistinguishable from the clean data. However, using our camouflaging approach one can generate additional camouflage images to neutralize the effect of poisons, and render the poisoning attack unsuccessful (reclassifying the target image as its original label). Note that we do not need to know the poison images while generating the camouflage images in our approach.


> The added functionality also comes at a cost. On page 4, the authors claim the benefit of this attack is that the adversary can reveal whenever an unlearning request is submitted, while traditionally “the adversary simply plants the attack and must wait for the victim to train the model.” However, the proposed attack also requires the adversary to “wait for the victim to train the model” and both the poison and camouflage sets (instead of just the poison set) need to be planted at the same time. 

Thanks for the comment. In both cases (the traditional poisoning attack as in Geiping et al. (2021) and our newly proposed camouflaged poisoning attack), as the reviewer correctly points out, the adversary indeed has to wait for the victim to train the model.  Note that in the traditional model, the attack is unleashed as soon as the model is trained and deployed, the timing over which the attacker has little control over. In contrast, in our camouflaged setting, the attack is only active after the unlearning is completed, which the attacker can explicitly trigger. We will improve the writing in the final version of the paper to better show the difference between the two setups.

> The proposed method also assumes strong adversary knowledge.

We agree with the reviewer. In order to generate our poisons and camouflages, we need the ability to query gradients of a trained model at new samples, so our attack is not black box. However, we emphasize that the main contribution of the paper is to expose that machine unlearning can lead to a new kind of vulnerability (camouflaged poisoning attack). This is particularly important because machine unlearning is a new and emerging technology to remove the influence of data samples from a trained model (given government regulations like GDPR), and it is important to understand what new vulnerabilities can it introduce.

Performing a camouflaged poisoning attack in a black-box setting is a very interesting research question, however, it is orthogonal to the main focus of the paper (which is to show the existence of this vulnerability).  We are hopeful that our work inspires future research in this direction. In fact, as a starting point, note that Geiping et al. (2021) explore how to extend their poison generation procedure to a black-box cloud autoML setting, and it would be interesting to see if we can adopt this procedure to generate camouflages for our setting.

From: ICLR.cc/2023/Conference/Paper620/Authors
title: Thanks and response to your concerns
comment: We are thankful to the reviewer for their positive feedback, and comments which will certainly improve the final paper. Please find our responses to your concerns and questions below.

### Response to your concerns

>Regarding general comments on novelty

We emphasize that the goal of the paper is to show the existence of a new attack vector that is enabled due to machine unlearning. Our goal is not to develop any new techniques -- indeed, we consider it to be a strength that our investigation is based on existing techniques since this demonstrates that the threat is already credible. We also believe that the idea of using a poisoning attack to neutralize the effect of another poisoning attack (to generate the camouflage set) is conceptually novel.


>It has less technical contribution since it just leverages existing machine unlearning techniques

Focusing on existing machine unlearning techniques is important: we are trying to attack systems that already exist. If we were to introduce new machine unlearning techniques, then these would not correspond to any actual systems and our attacks would not be applicable. 

We evaluate our attack success in the setting where the unlearning is performed by retraining from scratch on leftover data points. Note that this is the gold standard of machine unlearning, and all proposed unlearning algorithms focus on outputting models which are indistinguishable from the model retrained from scratch. 

Furthermore, for generating poisons we use the gradient matching technique of  Geiping et al. (2021) which is one of the most popular and computationally efficient techniques for generating poisons. Our camouflage are generated by adopting the same idea. 


>only two datasets are used to evaluate the proposed method. 

We perform experiments on three datasets: CIFAR-10, Imagenette, and Imagewoof. CIFAR10 is a standard multi-class classification benchmark in data poisoning literature. Imagenette and Imagewoof are subsamples of Imagenet and consist of higher-resolution images. We feel that the datasets that we considered are diverse and capture various aspects of image classification problems. However, if the reviewer has any suggestions for any qualitatively different image dataset that would add a new dimension to our experimental analysis, please let us know and we will love to explore it further.

From: ICLR.cc/2023/Conference/Paper620/Reviewer_xqqh
confidence: 2: You are willing to defend your assessment, but it is quite likely that you did not understand the central parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.
summary_of_the_paper: This paper proposes a novel attack, called camouflaged data poisoning attacks by leveraging a machine unlearning mechanism. This attack needs generate a pair of poisoning and camouflage datasets, which has less impact to the model on normal testing data. After triggering the machine unlearning procedure on the camouflage datasets, a retrained model could make target images to be classified as the target labels. 
strength_and_weaknesses: Positives:
+ a novel attack is proposed by using machine unlearning techniques. 

Negatives:
- It has less technical contribution since it just leverages existing machine unlearning techniques
- only two datasets are used to evaluate the proposed method. 
clarity,_quality,_novelty_and_reproducibility: It is well written, and easy to follow
The proposed attack is a novel attack

summary_of_the_review: In this paper, a novel attack is proposed, which leverages machine unlearning techniques
correctness: 3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.
technical_novelty_and_significance: 2: The contributions are only marginally significant or novel.
empirical_novelty_and_significance: 2: The contributions are only marginally significant or novel.
flag_for_ethics_review: NO.
recommendation: 6: marginally above the acceptance threshold

From: ICLR.cc/2023/Conference/Paper620/Reviewer_XcYH
confidence: 5: You are absolutely certain about your assessment. You are very familiar with the related work and checked the math/other details carefully.
summary_of_the_paper: The submission "Hidden Poison: Machine unlearning enables camouflaged poisoning attacks " describes a novel variant of targeted data poisoning attacks. The submission introduces the notion of "camouflage" data points that neutralize the effects of poisoned data samples. This essentially incorporates an "off switch" into targeted data poisoning attacks: camouflage data points can be created by similar techniques as existing data poisoning methods, but hide their effect. The actual poisoning attack is then triggered by an unlearning request of the camouflage data points, which removes the camouflage data points and activates the targeted data poisoning attack.
strength_and_weaknesses: Overall I like the idea put forward in this work. That a data unlearning request could trigger malicious effects already present in the data is clever and an interesting concept that would be surprising to readers interested in the security aspects of data unlearning. I see the the main strength of this work in the novelty of this concept.

However, I do think that the evaluation and presentation of the attack could be improved. I want to highlight some areas that can be improved:
* While the attack is conceptually interesting, what are the implications of this attack? Could the authors provide examples? In what scenarios would an attacker want to include an off-switch into their attack? 
* Relatedly, what is the trade-off that the attacker is making here? In most experiments in this work, the investigated threat model includes a doubled poisoning budget alloted to the attacker (e..g 0.6% for poisoning and 0.6% for camouflaging). In contrast, the attacker could have used an entire budget of 1.2% for an improved attack, potentially with additional targets. How much is the attacker giving up in capability to include this off-switch? Also, it is necessary to split poison and camouflage budget 1-to-1? It would be great to see ablations for all intermediate stages, e.g. 1.5% poisoning, .5% camouflaging, and so on, as a larger extension of the result shown in Fig3 b).
* Further, what about robustness of the attack? In a data scraping scenario, it is generally unlikely that a victim would scrape all data points modified by an attacker. How robust is this attack to an attacker scraping random subsets of both poisoning and camouflage points?
* Finally, this submission chooses targets from one class, data poisons from another, and camouflage points from the target class. Is this necessary? What happens when both poisons and camouflages are chosen from the same class? Or if camouflages are from a third class?

* Aside from these specific points, more broadly: What about other types of unlearning? The submission only covers exact unlearning through retraining, but a range of approximate unlearning techniques have been proposed in the literature (as discussed also in the related work section). I think this submission could be majorly improved by evaluating the success of the proposed attack also in approximate unlearning scenarios.


clarity,_quality,_novelty_and_reproducibility: Some comments regarding clarity of experiements and writing:
* Discussing gradient matching in both Sections 2.2. and 2.3 for poisoning and camouflaging respectively feels very repetitive. I think the methodology section could be improved by rewriting and possibly merging both sections.
* Tables 1, 2, 6 describe camouflage and poison success separately, but what about joint success? If I understand these tables correctly, then they could be improved by including a column for joint success, denoting the fraction of attack runs where both camouflaging and poisoning were successful.
* Concerning the experimental setup: The clean validation accuracy of most neural networks considered appears somewhat low. This might be related to the learning rate choice of 0.01 and lack of data augmentations. The submission discusses data augmentations in appendix B.6.2, but, for me, could be made much more convincing by incorporating data augmentations into the core experiments in Section 3.1.2. Also what about random crops?
* Concerning the overall coverage of experiments, while I agree that ImageNet experiments are quite expensive,  what about poisoning scenarios that include finetuning of ImageNet models on poisoned datasets? This might circumvent some problem arising for models trained on ImageWoof where the overall poisoning budget is high (possibly because of the difficulty of training on these datasets with this budget).
summary_of_the_review: Overall, I like the idea put forth in this submission, but would love for the authors to improve the execution and evaluation of the proposed vulnerability,  discussing implications in exemplary use cases, evaluating the robustness of the attack and demonstrating its effect on approximate unlearning systems.
correctness: 3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.
technical_novelty_and_significance: 2: The contributions are only marginally significant or novel.
empirical_novelty_and_significance: 4: The contributions are significant, and do not exist in prior works.
flag_for_ethics_review: NO.
recommendation: 6: marginally above the acceptance threshold

From: ICLR.cc/2023/Conference/Paper620/Reviewer_yC6u
confidence: 4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
summary_of_the_paper: In this paper, the authors present a clean-label machine-unlearning-triggered poisoning attack that targets a specific test point. Given access to the victim model’s architecture, the attacker crafts a poison set that makes the victim model misclassify the target sample and a camouflage set that neutralizes the poison set. Both sets are crafted by adding optimized noise (hard to detect by humans) to the images using the gradient-matching approach from previous work. The poisoning attack is then only triggered when the attacker requests to delete the camouflage set and the victim model unlearns by retraining. The authors show the method is effective on several models (SVMs and a few deep neural networks) and datasets (CIFAR-10, Imagenette, Imagewoof).

strength_and_weaknesses: Strengths:

- Novel idea
- The attack is only triggered when needed
- Can be difficult to detect

Weaknesses:

- Unclear attack scenario
- Strong attack assumption
- Limited scalability

Comments for the authors:

The authors present a novel poisoning attack that combines the key intuitions from two previous works, Marchant et al. (2022) for using machine unlearning requests as the attack trigger and Geiping et al. (2021) for using gradient-matching as a clean-label poisoning approach. As a result, this poisoning attack is difficult to detect and the adversary can choose when to trigger the attack.

However, I do have the following concerns.

- The authors did not present a clear or realistic scenario where such a poisoning attack is necessary. While it adds an additional function compared to the traditional poisoning attack, the paper will benefit from some examples of scenarios where such a function is needed.

- The added functionality also comes at a cost. On page 4, the authors claim the benefit of this attack is that the adversary can reveal whenever an unlearning request is submitted, while traditionally “the adversary simply plants the attack and must wait for the victim to train the model.” However, the proposed attack also requires the adversary to “wait for the victim to train the model” and both the poison and camouflage sets (instead of just the poison set) need to be planted at the same time.

- The proposed method also assumes strong adversary knowledge. The author mentioned in Section 2.1 that the attacker has access to the victim model’s architecture and the ability to query gradients (as mentioned could be achieved by having access to the training dataset). The additional experiment results of transferability in Appendix B.6.1 further indicate that the attacker needs white-box victim model access (not just architecture and training data) to achieve the high attack performance presented in the main results since even when the brewer (model used to craft poison and camouflage sets) and victim models use the same architecture the attack performance still suffers.

- Even under the strong attack assumption, the results show the efficacy still varies quite drastically across the 6 architectures tested, where only 3 architectures show optimal attack success rates. This implies the method might not generalize well to other architectures.

- Given the training time provided by the authors, crafting each poison and camouflage set takes on average double the time needed for training the model (so 4 times in total for a pair of poison and camouflage sets). This significantly limits the scalability of the method, especially if the victim model uses more complex architectures.

- The method also only limits to one single target sample. I believe a common setting for targeted poisoning attacks aims to misclassify a class of images (instead of a single data point) to another label. Combining the time cost mentioned above this limits the method’s scalability. If the author can improve on the previous gradient-matching approach it would be a major contribution.

clarity,_quality,_novelty_and_reproducibility: good
summary_of_the_review: see strength and weakness
correctness: 3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.
technical_novelty_and_significance: 3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.
empirical_novelty_and_significance: 3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.
flag_for_ethics_review: NO.
recommendation: 5: marginally below the acceptance threshold