Table 4 Summary of the notations.
Notations | Description |
|---|---|
\({\textbf{x}}\), \({\textbf{x}}_i\) | Original input images |
\(\tilde{{\textbf{x}}}\), \(\tilde{{\textbf{x}}}_i\) | Patch-perturbed images |
\(\hat{{\textbf{x}}}\), \(\hat{{\textbf{x}}}_i\) | Recovered images |
y, \(y_i\) | Original labels |
\({\tilde{y}}\), \({\tilde{y}}_i\) | Target labels for patched images |
\(f(\cdot )\) | Baseline classification model |
\(f^\prime (\cdot )\) | Poisoned classification model |
\({\textbf{p}}\), \({\textbf{p}}_s\), \({\textbf{p}}_d\) | Attached patches for perturbation |
\({\textbf{m}}\) | Binary masks indicating the patch locations |
\({\textbf{s}}\), \({\textbf{s}}_i\) | Saliency maps |
M | Number of cleaned samples in test set |
N | Number of poisoned samples in test set |
\(\varepsilon\) | Pixel-wise perturbation amount |
\(\alpha\) | Poisoning ratio |
