Retrieve stat if it was recorded. Return empty string otherwise.

Step through a model epoch. Optionally: minimize target loss.

Fix locations where we’ll put the patches.

Return only the target and its id. Args: index (int): Index Returns: tuple: (target, idx) where target is cl

Clean (pre)-training of the chosen model, no poisoning involved.

Check poison on a new initialization(s), depending on the scenario.

Hacky way of separating features and classification head for many models. Patch this function if problems appear.

Switch everything into evaluation mode.

Initialize according to args.init. Propagate initialization in distributed settings.

233 = 144 + 89 is my favorite number.

Pick an appropriate resnet architecture for MNIST/CIFAR.

Single epoch. Can't say I'm a fan of this interface, but ...

Attack within given constraints with task as in _objective.

Hacky way of separating features and classification head for many models. Patch this function if problems appear.

Compute the corrected loss under consideration of the mixing.

Compute the gradient of criterion(model) w.r.t to given data.

Validate a given poison by training the model and checking target accuracy.

Compute the blind passenger loss term.

Export poisons in either packed mode (just ids and raw data) or in full export mode, exporting all images. In full export mode, export data i

Retrieve an appropriate architecture.

Construct optimizer as given in defs.

Given a list of ids, retrieve the appropriate poison perturbation from poison delta and apply it.

Compute the softmax of each element along an axis of X. Parameters ---------- X: ND-Array. Probably should be floats. theta (opt

Parse training strategy.

Implement differentiable mixup, mixing nway-many examples with the given mixing factor alpha.

Implement common initialization operations for brewing.

Evaluate Gradient Alignment and descend.

PGD step.

Split data for meta update steps and other defenses.

Recipe interface.

Compute function on all models. Function has arguments: model, ...

Interface for this submodule.

Construct datasets with appropriate transforms.

Define a simple ConvNet. This architecture only really works for CIFAR10.

Control distributed poison brewing, no-op in single network training.

Check devices and set an appropriate number of workers.

Backdoor trigger attacks need to patch kettle.targets.

Check poison on the initialization it was brewed on.

Sync gradients of given variable. No-op for single network training.

.Fix locations where we’ll put the patches.

AlexNet variant as used in MetaPoison.

Average entries in a list of dictionaries.

Define the simplest linear model.

Load differentiable data augmentations separately from usual torchvision.transforms.

Initialize as usual. Layers and strides are scriptable.

Take a step toward minmizing the current target loss.

Take a step toward minmizing the current target loss.

Run generalized iterative routine.

Subconstruct poison and targets. The behavior is different for poisons and targets. We still consider poisons to be part of the original trai

Implement the closure here.

Implement the closure here.

Implement the closure here.

Compute the blind passenger loss term.

Enforce batch-wise privacy if necessary. This is attacking a defense discussed in Hong et al., 2020 We enforce privacy on mini batche

Implement the inner loop of Algorithm 1.

Load a metapoison package. xtrain: CIFAR-10 training set images with a subset of them poisoned/perturbed ytrain: CIFAR-10 training se

Parse the different threat models. The threat-models are [In order of expected difficulty]: single-class replicates the threat model