{'fraction_non_alphanumeric': 0.03360721664117081, 'fraction_numerical': 0.010692488448012112, 'mean_word_length': 4.786111871521125, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
How to Sift Out a Clean Data Subset in the Presence of Data Poisoning?

Given the volume of data needed to train modern machine learning models, external suppliers are increasingly used. However, incorporating external data poses data poisoning risks, wherein attackers manipulate their data to degrade model utility or integrity. Most poisoning defenses presume access to a set of clean data (or base set). While this assumption has been taken for granted, given the fast-growing research on stealthy poisoning attacks, a question arises: can defenders really identify a clean subset within a contaminated dataset to support defenses? This paper starts by examining the impact of poisoned samples on defenses when they are mistakenly mixed into the base set. We analyze five defenses and find that their performance deteriorates dramatically with less than 1% poisoned points in the base set. These findings suggest that sifting out a base set with high precision is key to these defenses' performance. Motivated by these observations, we study how precise existing automated tools and human inspection are at identifying clean data in the presence of data poisoning. Unfortunately, neither effort achieves the precision needed. Worse yet, many of the outcomes are worse than random selection. In addition to uncovering the challenge, we propose a practical countermeasure, Meta-Sift. Our method is based on the insight that existing attacks' poisoned samples shifts from clean data distributions. Hence, training on the clean portion of a dataset and testing on the corrupted portion will result in high prediction loss. Leveraging the insight, we formulate a bilevel optimization to identify clean data and further introduce a suite of techniques to improve efficiency and precision. Our evaluation shows that Meta-Sift can sift a clean base set with 100% precision under a wide range of poisoning attacks. The selected base set is large enough to give rise to successful defenses.


Introduction
Constructing high-performance machine learning (ML) systems requires large and diverse data. The data-hungry nature will inevitably force individuals and organizations to leverage data from external sources, the beginning of which is already evident. For instance, CLIP [1], the state-of-the-art image representation, is learned from 400 million image-text pairs collected from the Internet. Various data marketplaces and crowd-sourcing platforms also emerge to enable data exchange at scale. While incorporating external data sources into training has clear benefits, it exposes ML systems to security threats on account of data poisoning attacks, in which attackers modify training data to degrade model performance or control model prediction. In fact, data poisoning has been remarked as the top security concern regarding ML systems in the industry [2].
In this paper, the term "data poisoning" will be used in a broad sense, referring to attacks that involve training data manipulation. In particular, it includes both the attacks that interfere only with training data and backdoor attacks that embed a backdoor trigger during the training time and further inject the trigger into test-time inputs to control their corresponding predictions. Within the scope of this paper, we divide existing data poisoning attacks into three categories based on the attribute being manipulated: • Label-only attacks that only alter labels, such as targeted [3] and random label-flipping attacks [4] aimed at degrading model utility; • Feature-only attacks that only manipulate features without changing the labels, such as feature collision attacks [5] and clean-label backdoor attacks [6,7]; • Label-Feature attacks that change both feature and label, such as standard backdoor attacks [8][9][10].
Intensive efforts have been invested in mitigating data poisoning. The types of defenses in the prior work range from identifying poisoned samples in a training set [11] (Poison Detection) to detecting whether a model has been trained on a poisoned dataset [12] (Trojan-Net Detection) to remov-ing backdoors from a poisoned model [13,14] (Backdoor Removal) to redesigning training algorithms to prevent poisoning from taking effect [4] (Robust Training) Most existing defenses assume that the defender can access a set of clean data (referred to as the base set hereafter). Despite the prevalence of the assumption in existing literature, focused discussion about its validity is lacking. If the defender were capable of collecting a set of clean samples internally, then this assumption could be met easily. However, it has become increasingly common to learn from completely external data sources, such as training with the data scraped from the Internet or purchased from specific vendors. In that case, the defender needs to identify a clean subset within the poisoned dataset to form the base set. Many important questions remain unclear: How does the defense performance change if the identification is imperfect and some poisoned data are mixed into the base set? Are there any existing automated methods that can reliably identify a clean base set in the presence of various types of poisoning attacks? Can human inspection fulfill the need? If not, how can we reliably identify enough clean samples to support those defenses? Takeaway #1: Defense performance is sensitive to the purity of the base set. We start by examining the sensitivity of defense performance to the ratio of poisoned points in the base set. We study five representative defense techniques that rely on access to a base set. The techniques considered either achieve state-of-the-art performance or are popular baselines. We find that their performance degrades significantly (e.g., attack success rate exceeding 80%) with less than 1% of poisoned points in the base set. Surprisingly, even a single poisoned point is sufficient to nullify the effect of a state-ofthe-art poisoned data detector. These findings suggest that the ability to sift out a base set with high precision is critical to successfully applying these defenses. Takeaway #2: Both existing automated methods and human inspection fail to identify a clean subset with high enough precision. We investigate how precise existing automated methods and human inspection can be in identifying clean data in the presence of data poisoning and the result is illustrated in Fig. 1. The precision of both humans and existing automated methods varies a lot across different attack categories. Humans are proficient at identifying poisoned samples that involve label changes, including Label-only attacks and Label-Feature attacks, and outperform existing automated methods by a large margin. However, humans still miss many poisons and cannot realize a 100% success rate in sifting out a clean base set. Notably, for these two attack categories, several automated methods even underperform the random baseline.
On the other hand, for Feature-only attacks, human inspection results in a precision close to the random baseline. As these attacks inject small perturbations only to the features while not changing the overall semantics, human experts perform worse than most automated methods. This finding is in Figure 1: A comparison of the normalized precision of existing automated methods (Machine), human, and META-SIFT in sifting out a clean subset from a poisoned CIFAR-10. Both human, machine-based, and META-SIFT results are normalized with the poison ratio to ensure comparability. A larger value indicates a stronger filtering capability. The red region depicts the filtering capability worse than random selection. direct contrast to the traditional wisdom that treats human supervision as the final backstop of data poisoning. Besides being time-consuming and cost-intensive, human inspection becomes less trustworthy in identifying poisoned data given the fast-growing research on stealthy attacks. Overall, both existing automated methods and human inspection cannot reach the level of precision required to enable successful defense. Takeaway #3: META-SIFT -a scalable and effective automated method to sift out a clean base set. We propose META-SIFT to sift a clean subset from the poisoned set. Our approach is based on a novel insight that data manipulation techniques exploited by existing poisoning attacks inevitably result in a distributional shift from the clean data. Hence, training on the clean portion of the contaminated dataset and testing the trained model on the other corrupted portion will lead to a high prediction loss. We formulate a bilevel optimization problem to split the contaminated dataset in a way that training on one split and testing on the other leads to the highest prediction loss. However, this splitting problem is hard to solve exactly as it has a combinatorial search space and at the same time, contains two nested optimization problems. To address the computational challenge, we first relax it into a continuous splitting problem, where we associate each sample with a continuous weight indicating their likelihood of belonging to one of the splits and then optimize the weights via gradient-based methods. Secondly, we adapt the online algorithm that was originally designed for training sample reweighting [15] to efficiently solve the continuous relaxation of the bilevel problem. Furthermore, we adopt the idea of "ensembling" to improve the precision of selection. In particular, we propose to apply random perturbations to each point, run the online algorithm on each perturbed version to obtain a weight, and aggregate the weights for final clean data selection. Our evaluation shows that META-SIFT can robustly sift out a clean base set with 100% precision under a wide range of poisoning attacks. The selected base set is large enough to give rise to successful defense when plugged into the existing defense techniques. It is worth noting that META-SIFT significantly outperforms the existing automated methods (illustrated in Fig. 1) while being orders of magnitude faster (Table 5, 6,12,13).
Our contributions can be summarized as follows: • We identify an overlooked problem of the accessibility of a clean base set in the presence of data poisoning. • We systematically evaluate the performance of existing automated methods and human inspection in distinguishing between poisoned and clean samples; • We propose a novel splitting-based idea to sift out a clean subset from a poisoned dataset and formalize it into a bilevel optimization problem. • We propose META-SIFT, comprising an efficient algorithm to solve the bilevel problem as well as a series of techniques to enhance sifting precision. • We extensively evaluate META-SIFT and compare with existing automated methods on four benchmark datasets under twelve different data poisoning attack settings. Our method significantly outperforms existing methods in both sifting precision and efficiency. At the same time, plugging our sifted samples into existing defenses achieves comparable or even better performance than plugging in randomly selected clean samples. • We open-source the project to promote research on this topic and facilitate the successful application of existing defenses in settings without a clean base set 1 .

Sifting Out a Clean Enough Base Set is Hard
The ability to acquire a clean base set was taken for granted in many existing data poisoning defenses [13,14,[16][17][18][19]. For instance, a popular Trojan-Net Detection strategy is to first synthesize potential trigger patterns from a target model and then inspect whether there exists any suspicious pattern [13,16]. Trigger synthesis is done by searching for a pattern that maximally activates a certain class output when it is patched onto the clean data. Hence, access to a clean set of data is indispensable to this defense strategy. Another example is defenses against label-flipping attacks (often referred to as mislabeled data detection in ML literature). State-of-theart methods detect mislabeled data by finding a subset of instances such that when they are excluded from training, the prediction accuracy on a clean validation set is maximized. A clean set of instances are needed to enable these methods. noise. These techniques either achieve the state-of-the-art performance (e.g., Frequency Detector [11], I-BAU [14], MW-Net [19]) or are widely-adopted baselines (e.g., MNTD [12] and Neural Cleanse (NC) [13]). In particular, MNTD is implemented as a base strategy in an ongoing competition for Trojan-Net Detection 2 .

Defense Requires a Highly Pure Base Set
While conventionally these defense techniques only report their performance based on a completely clean base set, given the fast-advancing research on stealthy attacks, it is possible that some poisoned samples may go unnoticed and get selected into the base set by mistake. Hence, it is critical to evaluate how the performance of these defenses depends on the ratio of the poisoned samples in the base set.
We adopt widely used metrics to measure defense performance for each defense category. Specifically, for Poison Detection, we use Poison Filtering Rate (PFR) which measures the ratio of poisoned samples that are correctly detected. For Trojan-Net Detection, we follow the original work of MNTD and use the Area Under the ROC Curve (AUC) as a metric, which measures the entire two-dimensional area underneath the ROC curve 3 . The most naive baseline for poison detection and Trojan-Net detection is random deletion, which ends up with a PFR of 50% and an AUC of 50%. The closer the performance of a defense in the Poison Detection and the Trojan-Net Detection category gets to 50%, the weaker the defense is. For backdoor removal, we use the Attack Success Rate (ASR), which calculates the frequency with which non-target-class samples patched with the backdoor trigger are misclassified into the attacker-desired target class. For Robust Training, we use the Test Accuracy (ACC) which measures the accuracy of the trained model on a clean test set. The baselines for Backdoor Removal and Robust Training are simply deployment of no defenses at all. We report ASR or ACC that is obtained directly from training on the poisoned dataset. The closer the performance of a defense in these two categories gets to these baselines, the weaker the defense is.
We compare the resulting defense performance against standard attacks (e.g., BadNets [8], random label-flipping) between clean and corrupted base sets (Table 1). For Poisoned Detection with Frequency Detector, even one poisoned example sneaking into the base set is sufficient to nullify the defensive effect, leading to a performance worse than the random baseline. For MNTD, with 1% of poisoned examples mixed into the base set, the AUC drops by almost 40%. Comparing the two techniques for Backdoor Removal, we can find that I-BAU is more sensitive to corruption of the base set than NC. Both techniques patch a trigger to partial samples in the base set to fine-tune the poisoned model, aimed at forcing the model to "forget" the wrong association between the trigger and the target label. Compared to NC, the design of I-BAU selects fewer samples in the base set to be patched with a trigger.

The Data Sifting Problem
The sensitivity of defense performance to the purity of the underlying base set motivates us to study the Data Sifting Problem: How to sift out a clean subset from a given poisoned dataset? We highlight some unique challenges and opportunities towards answering this question.
• (Challenge) High precision: The empirical study in Section 2.1 demonstrates that the defensive performance could drop significantly with a small portion of corruption in the base set. Hence, sifting out clean samples with high precision is crucial to ensure defense effectiveness. • (Challenge) Attack-Agnostic: In practice, the defender usually does not know the underlying attack mechanisms that the attacker used to generate the poisoned samples. Hence, it is important to ensure high precision across different types of poisoning attacks. • (Opportunity) Mild requirement on the size of the sifted subset. In contrast to the high requirement on the purity, the requirement of the size of the sifted subset is generally mild. The size of the base set required to enable an effective defense is usually much smaller compared to the size of the poisoned set. For instance, a clean base set of size less than 1% of the whole poisoned dataset suffice to enable effective defenses [14,20] .
Note that some attempts have been made in the prior work to lift the requirement on base sets in data poisoning defenses [15,[21][22][23]. However, these works are focused on specific defense categories against specific attack settings. By contrast, when solving the data sifting problem one can obtain a highly pure base set that can be plugged into any defense technique that requires the base-set-access. Hence, we argue that solving the data sifting problem provides a more flexible pathway to address the base-set-reliance issue in current data-poisoning defense literature.

How Effective are Existing Methods
We first consider automated methods that can potentially solve the data sifting problem. Note that the data sifting problem is similar to the traditional outlier detection problem, wherein the goal is to sift out the abnormal instances in a contaminated dataset. Ideally, if one could filter out all the abnormal instances perfectly, then the complement set can be taken to solve the data sifting problem. There are two key differences between data sifting and outlier detection. Firstly, the data sifting problem is contextualized in data poisoning defense applications, where it is not necessary to sift out all the clean instances, but instead, a small subset of clean instances in the training set often suffices to support an effective defense. Secondly, in outlier detection, it is often more important to achieve high recall at a given selection budget (i.e., a high proportion of true outliers is marked as outliers by the detection algorithm), whereas in the data sifting problem, high precision is the key to realize a successful defense (i.e., a high proportion of the "marked-as-clean" points is truly clean).
At a technical level, the outlier detection algorithms are still applicable to approach the data sifting problem. In particular, existing outlier detection algorithms assign an "outlier score" to each data point, indicating their likelihood to be an outlier. To re-purpose these algorithms for data sifting, we select the points with the lowest "outlier scores" of each class to form the balanced base sets. We will evaluate some representative outlier detection methods that do not rely on additional clean data to function and examine their potential to solve the data sifting problem. Specifically, the following outlier detection methods are evaluated: • Distance to the Class-Means (DCM): We compute the mean of each class at the input-space (pixel-level) as the class center and assign the outlier score to a point based on the distance to its center.   Table 2: Different automated methods' precision for sifting out a size-1000 CIFAR-10 subset (each class 100 samples) under different representative attacks. Precision is calculated using the number of correct clean samples in the selected subset divided by the total selected number of samples for the respective target class (100). We include random selection as the baseline to evaluate and compare. The red highlights the methods that perform even worse than random selection. The yellow highlights the methods that are not time-efficient. The attacks with * denote that the setting includes randomness (e.g., resulting from deep learning model training); thus, we report the corresponding means and the standard deviations.
tral Filtering is an advanced outlier detection method in robust statistics. Its key idea is that the outliers will result in larger eigenvalues than expected eigenvalues of sample covariance. This idea has been applied to the detection of backdoored samples. To start with, we extract features for each sample using the model trained over the contaminated dataset and the outlier score of a sample is calculated based on the dot product between its feature and the top eigenvector of the sample covariance matrix. • Loss-based Poison Scanning (Loss-Scan) [26]: Recent work has identified the difference between the losses of benign and backdoored samples [26]. For most backdoor attacks, the losses of the poisoned sample would be lower than those of the benign sample during the early learning period (5 epochs). We adopt this notion and record the negative value of early training losses as the outlier score, i.e., the smaller the original loss, the greater the likelihood that the sample contains potentially hazardous information. • Self-Influence-Function (Self-IF) [27]: Influence functions are designed to measure the impact of each training point on the loss of the trained model and have been widely used to enhance training [28] and repair mislabeled training data [29]. In particular, Self-Influence-Function is a variant that measures the influence of a point on the training loss. The outlier score of a point here is taken to be the negative of the result returned by Self-Influence-Function.
TABLE 2 shows the sifting results of existing methods on CIFAR-10. We include four popular attack strategies from the three categories of data poisoning into our evaluation, i.e., targeted label-flipping, Narcissus backdoor, Poison Frogs, and BadNets backdoor. We detail the settings of these attacks in Appendix 6.1 due to the page limit.
As shown in TABLE 2, none of the existing automated methods can sift out a clean subset from a poisoned dataset with high enough precision to support effective defense (recall the results in TABLE 1 even the purity of 97% can already significantly weaken the defenses under the BadNets attack). These methods employ simple criteria to calculate the outlier scores, which can be evaded by advanced attack techniques. Also, we observe that the sifting precision of each method varies largely over different attacks. Worse yet, many of these approaches produce results even inferior to random selection. These negative results motivate us to analyze the commonality of existing poisoning strategies in order to devise a sifting strategy effective under different attacks. Lastly, note that MI-DCM, SF-Least, and Self-IF require a well-trained model using the contaminated dataset and incur high computational costs. For instance, in our experiments, such training requires 5411 GPU seconds (on one RTX 2080 Ti).

How Effective is Human Inspection
Given that the automated methods fall short of sifting out a clean base set, we ask the question: can humans accurately differentiate between clean and poisoned instances?
Traditionally, human inspection is considered a final backstop of data poisoning. For instance, in the highly-cited survey of data poisoning [30], it is argued that it is the lack of human supervision on the dataset that opens the door for poisoning attacks and the subtext is that data poisoning attacks can be prevented with human inspection in place. However, as more and more stealthy poisoning attacks are developed, can human still serve a final backstop for data poisoning?
For completeness, we evaluate all three types of data poisoning: Label-only, Feature-only, and Label-Feature attacks. We consider the most representative and advanced attacks for each type. We extensively study 16 data poisoning attacks (1 Label-only attack, 5 Feature-only assaults, and 10 Label-Feature attacks). The details of the attacks and their settings are deferred to Appendix 6.2 due to the space limit. We create 16 poisoned datasets in total using CIFAR-10, each corresponding to a different attack. The size of all poisoned datasets are fixed to 1000 and the poison ratio is set to be 10%. To ensure comparability, we use the same random seed to select the poisoned samples (i.e., the poisoned samples in each dataset share the same indices. Finally, each poisoned dataset is sent to 3 human experts for inspection and each human expert only inspects one dataset to avoid possible bias introduced by repeated inspection. In total, we recruit 48 human experts from 3 different data labeling companies. Fig.  2 illustrates a screenshot of the web portal that we develop for human experts to identify poisoned data. In particular, we Figure 3: Human inspection results regarding data poisoning attacks. The labels and images marked in red depict potential manipulations under that attack category, and the green represents that the attribute remains intact. The evaluation uses 16 poisoned datasets, with 10% of data being manipulated following the existing attack designs. Among the three different categories of attacks, we report the error rate of misclassifying clean samples into poisoned ones (FPR) or poisoned ones into clean samples (FNR). Each poisoned dataset is inspected by at least three human experts from three different professional data labeling companies. We report the average results with standard deviations. The highlighted FNRs remark on the dangerous settings where human inspection failed in identifying 85% or more poisoned data points.
provide the image itself and the label of that image to the human experts. They are asked to discern whether a given image is clean and consistent with the label.
We use false positive rate (FPR) or false negative rate (FNR) to measure the human's capability of distinguishing between clean and poisoned samples. FPR is defined as follows: We report the average and standard deviation of both metrics based on the results from multiple human experts. The results are summarized in Fig. 3. Surprisingly, 9.13% of the clean samples are mistakenly recognized as the poisoned. Humans are more capable of capturing manipulations on labels than on features. For Label-only attacks, human experts can filter out 91.67% of the poisoned samples. Such a result implies that despite the costs incurred, manual inspection can help avoid most label-flipped samples in the base set.
On average, the results on the evaluated 10 Label-Feature attacks are similar to those on the Label-only attacks, achieving an averaged FNR of 10.8%. However, Label-Feature attacks are much more powerful than label-flipping attacks. A small amount of the poisoned samples (e.g., a poison ratio of 0.01% suffices in existing literature [31]) may successfully mislead the downstream model. At the same time, a small amount of such poisoned samples in the base set (less than 3% based on TABLE 1) may already significantly hinder defense performance. Hence, while humans achieve a relatively low FNR on Label-Feature attacks, the missed poisoned samples may still harm the downstream model or compromise the defense.
Even worse, when it comes to attacks that only manipulate data features, human expert's performance degrades sharply. The averaged FNR is above 86% as shown in Fig. 3. Such a result is almost close to random guessing, which achieves a FNR of around 90% as the poison ratio is 90%. To conclude, humans have limited capability of identifying samples corrupted by feature manipulation. Finally, it is worth noting that clean-label backdoor attacks-an instance of Featureonly Attacks-are particularly dangerous. They can not only largely evade human inspection, but also backdoor a system with an extremely small poison ratio with state-of-the-art techniques (e.g., 0.05% for attacking Tiny ImageNet [7]).

Reducing to a Splitting Problem
This paper presents a new but intuitive idea to solve the data sifting problem. Given a contaminated dataset, one can expect that an ML model trained on the clean portion of the dataset will perform poorly on the other corrupted portion and vice versa. Take standard backdoor attacks as an example. The poisoned instances are constructed by first applying a backdoor trigger to some clean inputs and then changing their labels to some target class. A model trained on the clean data would return large prediction loss when it observes such poisoned instances because they are mislabeled, and their features only contain a trigger that does not appear in the clean data. This insight applies to general data poisoning attacks because they all involve feature and/or label manipulation, thereby resulting in a distributional shift from the clean instances. Thus, we solve the data sifting problem by finding a split of the given contaminated dataset such that the model trained on one split produces a large loss on the other.
We formulate the splitting problem as a bilevel optimization. Formally, given the contaminated dataset D = D 1 ∪ . . . ∪ D K , where D k is the subset of D but only containing samples with class label k ∈ {1, · · · , K}, our goal is to divide each class-wise subset, D k , into two splits B k and D k \ B k , such that If we assume the number of poisoned samples in a given dataset to be smaller than that of clean samples (a standard assumption in robust statistics [32]), i.e., ε will be 0.5. Thus, (6) is also encourages B to be the clean split.

Relaxation of the Splitting Problem
Exactly solving Eqn. (3)(4)(5)(6) requires training on every possible B and testing on their complement. This is clearly intractable. The computational challenge in part arises from the combinatorial nature of the outer optimization problem. To address this challenge, we propose to relax Eqn. (3-6) to a continuous splitting problem. We start by rewriting (3-6) as where instead of directly optimizing the split, we optimize the tuple of binary variables indicating each sample's pres- Hereinafter, v (k,i) represents the likelihood of z i being assigned to the split for training. This continuous relaxation enables us to leverage gradient-based methods to search for an approximate solution, i.e., each class-wise clean split B k can be obtained by collecting the samples with larger v (k,i) .
However, when the size of the dataset is large, the outer optimization needs to optimize over a continuous space of the same large dimension, which could be slow. Inspired by advances in meta learning [15,19], we propose to further learn a weight-assigning network to assign weight to each point instead of directly optimizing the weights. We found that the number of parameters of such a network required to produce useful weights is much smaller compared to the data size. For instance, in our experiments, we found a network with 100 nodes is sufficient for high-quality weight assignment, but on the other hand, the size of the datasets considered in this paper is orders of magnitude larger. Hence, through adapting a weight-assigning network, we effectively reduce the number of variables that are optimized in the outer optimization.
Specifically, let S(·) denote the weight-assigning network and let ψ denote its parameters. Furthermore, ∀k and z i ∈ D k , we let v (k,i) = S(L(θ,z i ); ψ) , i.e., the weight-assigning network determines the weight for z i based on its associated learning loss from θ. For simplicity, we use L i (θ) as a shorthand for L(θ, z i ). Then, the continuous splitting problem that we will solve can be expressed as: Since samples from each class are weighted by a shared weight-assigning network, in (11,12), we no longer specify which class z i is from. Moreover, note that the optimization problem above does not have explicit constraints to ensure that the training split is class-balanced and contains the majority of the samples. Instead, we will adopt two heuristics to enforce these constraints. 1) We apply S(·) to each sample to obtain their weight and then select the same amount of highest-weight samples within each class; 2) We initialize the weights, v (k,i) , to be all ones, i.e., assigning all the samples to the training split and terminate the optimization with limited rounds. The limited round of the optimization will leave most of the samples with large v (k,i) values, thus resulting in an implicit satisfaction of the constraint of selecting more samples for the training split. Each hidden node in S(·) is equipped with ReLU activation function [33], making it possible to approximate non-linear functions. The output node produces a one-dimensional value indicating the weight assigned to the input to the weight-assigning network. The output node utilizes a Sigmoid activation function to ensure that the output is within the range [0, 1].

Overall Algorithm
Overview. We now describe the full algorithm to sift out a clean subset, which we call META-SIFT . At a high level, META-SIFT consists of two stages: Training and Identification. In the Training stage, we adopt an online algorithm to solve (11,12) and the algorithm will produce optimized parameters ψ * for S(·) as well as model parameters θ * trained on the weighted samples. The definition of θ * will be more clear after we explicate the algorithm. We will refer to the combination of S(·) parameterized by ψ * and the classification model parameterized by θ * as a Sifter. To mitigate the randomness of batch selection in the online algorithm, we run the online algorithm independently for m times, which results in m Sifters. In the Identification stage, we feed the dataset into each Sifter and aggregate the weights produced by all Sifters to obtain the final weight for each sample in the dataset. The full process of META-SIFT is depicted in Fig. 4. Training Stage. We present how to train a single Sifter in META-SIFT . The training process starts by "warming up" θ-training θ on the entire dataset for one epoch. Essentially, we update θ while setting all weights to be one. This "warmup" step helps promote the Sifter, S(·), to assign large weight (close to 1) to samples, which in turn, allows most of the samples to be placed into the split for training, as mentioned above. Then, the Sifter (with θ and ψ) are updated via an online algorithm (illustrated in Fig. 4). At each round of the online algorithm, we perform the following four steps: Virtualupdate of a warmed-up model θ, Gradient Sampling using the meta-gradient-sampler Γ, Meta-update of ψ, and finally the Actual-update of θ.
1 Virtual-update of θ. This step takes a virtual update of θ, the same as the traditional stochastic gradient descent. Formally, a mini-batch of data {z i } n i=1 is sampled, where n is
Then, we can rewrite g θ as where g l = ∂L i (θ) ∂w l , representing a scaled gradient with respect to the parameters in layer l.
2 Gradient Sampling. Inspired by [15], we parallelly train a list of u gradient-samplers to select partial gradients from the last u layers, {g L−u , . . . , g L } for subsequent update on ψ. The goal of gradient sampling is to accelerate and achieve more stable results on the subsequent update on ψ [15].
In particular, we associate a different gradient-sampler γ l (·) for each layer l ∈ {L −u, . . . , L}. γ l takes as input the gradient g l and returns a value indicating whether g l is selected. The reason why each layer has a different gradient-sampler is that their corresponding gradients are of different dimensions and γ l (·)'s input dimension needs to be tailored to the size of g l . Following [15], we implement each gradient-sampler as a twolayer fully-connected neural network. The activation units in the first and second layer are PReLU [34] and "Gumbelsoftmax" [35], respectively. The l-th gradient sampler, γ l , can be updated using the gradient of the outer optimization objective with respect to Figure 4: The whole process of META-SIFT consists of two stages: the Training Stage and the Identification Stage. Multiple (m) Sifters will be included during the Identification Stage to reduce the randomness resulting from SGD and randomized sample-dilution. As such, the Training Stage will be repeated m times with different random seeds to obtain m Sifters. In each Sifter, there are two different structures working as a pair: model θ and the weight-assigning network ψ. In one iteration of the Training Stage, there are four steps: Virtual-update of θ; Gradient Sampling using the meta-gradient-sampler Γ; Meta-update of ψ; then the Actual-update of θ. After only one iteration, Training Stage will terminate. The trained Sifters will be adopted in the Identification Stage to assign weights to the diluted data from the dataset. Finally, META-SIFT aggregates the results from multiple Sifters, and the clean samples will be sifted by inspecting the high-value end.
the gradient sampler's parameters. The dependency of the outer optimization objective on the sampler's parameters is via ψ. The gradient can be calculated automatically via autodifferentitaion in standard deep learning frameworks [36]. We then update each sampler according to the respected gradients before selecting layers. The gradient of a layer is selected if the output of the respect sampler exceeds 0.5. We denote the collection of the weights for layers that are selected by a gradient sampler as 3 Meta-update of ψ. In this step, we update the parameter ψ of the weight-assigning network by calculating the gradient of the outer optimization objective function with respect to ψ and performing the gradient descent: Direct computing of g ψ contains the calculation of an invert Hessian, which is computationally intensive [37,38]. However, in our case, by using the gradient samplers, we only consider the selected layers to calculate the indirect gradient. Due to the page limit, we defer the detailed derivation of the sampled gradient to Appendix 6.3. Note that g ψ does not need to be calculated manually; instead, it can be also computed via automated differentiation. 4 Actual-update of θ. Finally, we conduct the actualupdate of θ based on the weights assigned by the updated S(·; ψ): In each round of our online algorithm, the four steps are performed on one batch of data. The algorithm terminates when it has gone through all the samples in D. The pseudocode of the Training Stage is provided in Algorithm 1. We define the updated θ and ψ in the final round as θ * and ψ * , respectively. The pair of θ * and ψ * defines one Sifter's parameters. We will run the online Training algorithm multiple times to obtain multiple Sifters that we will use in the Identification Stage.
Identification Stage. Now we aggregate the results from all the Sifters to identify the clean samples in three steps: Randomized Sample-Dilution, Weight Assignment, and Weight Aggregation & identification.
1 Randomized Sample-Dilution: Instead of directly feeding a sample to the Sifter, (θ * , ψ * ), we propose to first randomly perturb the sample. Existing works [39,40] show that the prediction associated with a clean sample is robust to random perturbation. Hence, a sample that consistently receives high weights under different perturbations is more likely to be clean than those samples experiencing large weight variance under perturbations. The perturbation strategies considered in this paper include random random cropping, random rotation, random horizontal flipping, and Gaussian blurring. For each sample, we apply all the perturbations strategies simultaneously and each strategy is configured randomly (e.g., we randomly sample a rotation angle and rotate the sample correspondingly). An ablation study on these random perturbations is presented in Appendix 6.6.
2 Weight Assignment: The random sample-dilution step produces m perturbed datasets and each dataset contains samples perturbed by a different random configuration of the perturbations strategies. Then, each sifter (m in total) takes as input a perturbed dataset and produces the weights for all samples. In particular, the classification model (parameterized by θ * ) in the Sifter will be used to extract features from each sample and S(·) (parameterized by ψ * ) will assign weight to a sample based on the extracted features. 3 Aggregation & identification: We average the weights for each sample from multiple Sifters and use the topweighted samples of each class k to form the sifted classwise clean subset B k . Finally, the clean split B is obtained by combining the class-wise results.

Experimental Setup
Metrics. One crucial factor in evaluating automated data sifting methods is the precision of the selection. We use the Corruption Ratio (CR) to measure the precision of each method's selection performance. Formally, let D sub denote the selected subset from D using an automated method, and N poi denote the total number of the poisoned samples in D sub . Then, the CR of D sub is defined as While CR seems a natural performance metric, it is not well suited for comparing the precision of selection across different attack settings because they normally employ different poison ratios. For example, consider two attacks with poison ratios 5% and 20% and set the selection strategy to be a random one. Then, the CRs on the two attacks are different (roughly 5% and 20%, respectively) despite the same selection strategy.
To facilitate comparison of the sifting performance across different attacks, we propose the Normalized Corruption Ratio (NCR), defined as follows.
where CR rand is the corruption ratio of the random selection. General Settings. We use two servers equipped with a total of 16 GTX 2080 Ti GPUs as the hardware platform. PyTorch [36] is adopted as the implementation framework. We consider four popular benchmark datasets, namely, CIFAR-10 [41], GTSRB [42], PubFig [43], and the Ima-geNet [44]. The details of the datasets, the architecture of the model trained on each dataset, training algorithms, and performance of the models (trained on clean datasets as baselines) are provided in Table 3. For ImageNet, directly applying META-SIFT leads to high computational costs because a largecapacity classification model θ is needed to ensure the quality of extracted features. For large-scale datasets such as Ima-geNet, we adopt a practical and reliable alternative where we split the ImageNet dataset into multiple subsets and then apply META-SIFT on each one separately. In our evaluation, we will showcase the sifting performance on three non-overlapping random 10-class subsets of ImageNet.  Table 3: Hyperparameters and settings to obtain the clean baseline models on each dataset. The target class of each dataset is fixed across all attacks with one target label. ACC and Tar-ACC represent the average accuracy and the accuracy within the target class without any attacks.
In addition to the five attacks in Section 2, we add 7 more representative attacks from different categories of data poisoning, the detailed attack settings are provided in TABLE 4. We follow the poison ratio in the original attack papers. We mark the settings where the attacks are not successful (i.e., the attack settings that failed to result in an ASR above 50%) in red and remove them from comparison. We also exclude PubFig and ImageNet for the Smooth attack (colored in gray ) as they were not considered in the original paper [11].
As size requirements for base sets in existing defenses are mostly less than 1000 samples, we will mainly examine each sifting method's ability to sift out a 1000-size base set on each poisoned dataset. However, we will show that META-SIFT can sift out more clean samples, but the performance may vary from attack to attack. Finally, we run the defense 3 times with different random seeds for all the results that include randomness (e.g., SGD for optimizations or random augmentations) and present the respective means and standard deviations. META-SIFT Settings. META-SIFT is equipped with a classifier model θ, weight-assigning network ψ, and a list of gradient samplers Γ. We will use the same ψ and Γ on all datasets. But for θ, we will select the model architecture based on the dataset size. θ functions as a feature extractor in META-SIFT and a larger, more complex dataset naturally requires a larger model for feature extraction. Specifically, for CIFAR-10 and GTSRB, we adopt ResNet-18; for PubFig and ImageNet, we use ResNet-34 and ResNet-50, respectively.
among the four existing automated methods in blue . If our result is better than those of the existing methods and achieves the maximum precision, we mark them in green . Note that across all the baselines, no augmentations technique is included (i.e., sample-dilution). To ablate the effect of sample dilution, we present additional results in Table 15, Appendix 6.6, and show that sample-dilution is not the decisive factor that can help other techniques resolve the sifting problem.
TABLE 5 evaluates the sifting methods on CIFAR-10 aginst different attacks. CIFAR-10 is a balanced dataset containing 10 classes. Hence, we select 100 samples per class to form the base set of a total size 1000. In most settings, the five baselines do not yield a completely clean base set, and the performance varies largely from one attack to another (even within the same category). By contrast, META-SIFT produces a clean subset (NCR = 0%) in all the evaluated settings while enjoying a lower computational overhead than most of the baselines. Note that many attacks listed in Table 4 can achieve similar attack effects but with a smaller poison ratio. Primarily, many defense works have found attacks with lower poison ratios are harder to be identified [20,49]. Thus, we present additional results of META-SIFT on CIFAR-10 with smaller poison ratios in Table 11, Appendix 6.4. Similar results can be found on GTSRB and PubFig, which are deferred to the Appendix 6.5 due to the page limitations.
Finally, the ImageNet results are presented in TABLE 6. As discussed, we break down the ImageNet dataset into smaller subsets and sift each subset sequentially to accelerate the sifting process. TABLE 6 demonstrates the sifting performance on three randomly selected 10-class subsets from ImageNet. The most important contribution of META-SIFT is that it's the only method that can reliably sift out a completely clean base set (NCR = 0%) across different attacks.
While we set the base set size to 1000 samples for the above experiments, we also study the behavior of META-SIFT for selecting a larger base set. Figure 5 depicts the percentage of clean samples under different sifting budgets on GTSRB. META-SIFT can select around 4000 (10%) clean samples under the targeted label-flipping case. Notably, META-SIFT can achieve almost a perfect split when the poisoned instances are generated by the BadNets backdoor attack. On GTSRB, a general observation is that META-SIFT achieves a better split on attacks that manipulate labels. This is because the features for every class in GTSRB samples have relatively low variance and are distinct from other classes. Since incorporating data corrupted by label manipulations into the split for testing largely increases the outer loss in Eqn. (11,12), these data will be assigned a small weight and thus get unselected. Meanwhile, META-SIFT 's effectiveness is worse on attacks that only involve feature manipulation such as the Narcissus backdoor attack, but it can still maintain a high precision up to the selection budget of about 2000 samples (accounting for 5% of the total size).
We want to highlight that there is a trade-off between META-SIFT 's precision and the base set size to be selected. However, existing defenses usually require only a small base set (i.e., often less than 1% of the total size of the poisoned set). The fact that META-SIFT can reliably sift out a pure clean set of more than 5% of the total size across different BadNets [8] Trojan-WM [50] Trojan-SQ [50] l2 inv [51] l0 inv [  attacks makes it useful for defense applications (see detailed in evaluation in Seciont 4.3). By contrast, the precision of human inspection does not change with the selection budget, because each sample is examined separately. Moreover, the existing automated methods constantly produce a very low precision regardless of the selection budget.

Downstream Defense Evaluation
Now, we evaluate the performance of defenses with the selected base set plugged in. We consider the defense categories introduced in Section 2. We present the results of each defense when 1) the base set is completely clean (Clean); 2) the base set is randomly selected from the contaminated training set (Random); and 3) the base set is selected by META-SIFT . Poison Detection: Similar to the evaluation in Section 2, we consider the state-of-the-art frequency-based poison detection method [11]. Following the original work, we consider five attack settings with a poison ratio of 5%. The original setting of the frequency detector requires a base set of size 100. TA-BLE 7 compares the defense performance between the Clean, Random, and META-SIFT -selected base set. META-SIFT enables the frequency detector to obtain a defense result similar to the result using the original clean set. Trojan-Net Detection: Now we evaluate how META-SIFT may help MNTD [12]. In the original work, MNTD requires a base set of size 1000 over the MNIST dataset in the jumbo training procedure to train 256 clean and 256 randomly poisoned models. Like the original work, we incorporate two sets of backdoor attacks with the poison ratio  We use the same attack settings as the original works. Interestingly, by using the base set selected by META-SIFT , both NC and I-BAU can achieve a slightly higher defense efficacy than using a randomly selected clean base set. We conjecture that META-SIFT is optimized to select more consistent and robust information (as those selected samples have withstood randomized sample-dilution and still end up at the high-value end). Thus META-SIFT -selected data are naturally more robust to noises and harder to be misclassified when patched with weak noise. This in turn helps both methods synthesize more accurate triggers that can be used for backdoor removal. Visual examples of the selection results over different datasets are shown in Appendix, Fig. 8; however, it is hard to conclude the sample consistency directly from visual observations. We further compare the synthesized triggers of using NC equipped with the two different base sets (randomly selected clean and the META-SIFT selected). We evaluate the averaging loss of clean samples patching with the synthesized triggers towards the target label. A much smaller loss indicates a more accurate trigger synthesis. Averaging from five different executions, we find the triggers synthesized using META-SIFT base sets achieved an averaging loss of 0.2774. The loss of trigger synthesized using randomly selected clean base sets is only 0.3321, which confirms our conjecture.
Robust Training: Finally, we include the result of using META-SIFT to help existing robust training methods work in situations without additional clean samples. The representative works of this line of defense include MW-Net [19] and FaMUS [15]. As shown in Fig. 6, both methods utilizing META-SIFT -generated base sets can achieve a similar level of effectiveness to using an additional clean validation set. Note that, in the original paper of FaMUS, they also introduced a training strategy that does not need access to a clean base set. However, it requires training two paralleled neural networks and working in a manner that assigns pseudo labels for each other throughout the training procedure, which we find introduced 7× more GPU computational overhead than the setting with a clean base set access. By using META-SIFT , we get away with the additional computational overhead while still maintaining good performance in situations without access to the additional clean base set.

Conclusion and Outlook
This work presents the first focused study of the data sifting problem, aimed at sifting out a clean subset from a dataset potentially contaminated by unknown poisoning attacks. This problem is of critical importance to successfully implement and apply existing defenses against poisoning attacks, as most of them require a clean base set to initiate the defense mechanisms. We first show that the performance of the popular and many state-of-the-art defenses is sensitive to the precision of clean data selection. Our study of the existing automated methods and human inspection shows that both cannot reach the precision required to achieve effective defenses. We further propose META-SIFT as a first solution to the data sifting problem. META-SIFT is based on an intuitive and reliable insight that regardless of how poisoned samples are generated, when one trains on only the clean data, the prediction loss of the trained model on these poisoned examples is large. Our evaluation shows that META-SIFT is faster than existing BadNets [8] Trojan-WM [50] Trojan-SQ [50] l2 inv [51] l0 inv [51] Table 9: ASRs of NC purified models on the GTSRB.
BadNets [8] Trojan-WM [50] Trojan-SQ [50] l2 inv [51] l0 inv [51] Table 10: ASRs of I-BAU purified models on the GTSRB. automated methods by significant orders of magnitude while achieving much higher sifting precision. In particular, training META-SIFT only requires going through the dataset for two epochs, and using META-SIFT to sift data can be done in minutes. Plugging the sifted samples into existing defenses achieves comparable or even better performance than using randomly selected clean data. Limitations and Outlook. Despite the efficacy and timeefficiency, META-SIFT induces high memory overhead due to the use of multiple perturbed datasets and multiple sifters. How can we further reduce overhead in order to support potential memory-constrained applications? Furthermore, there is a trade-off between META-SIFT 's precision and the size of the set to be sifted ( Figure 5). According to our evaluation, we find META-SIFT can reliably sift out around 5% pure-clean samples confidently regarding different settings/datasets/attacks, which is enough to support most of the existing defenses (Section 4.3). However, the size is far from supporting any model directly trained over the sifted samples to obtain good performance. We defer the further steps on expanding META-SIFT 's performance to a larger scale and enable direct training for future work.
Additionally, there are a number of interesting venues for future exploration. For example, is it possible to design adaptive attacks against META-SIFT that can generate poisoned samples bypassing our sifting mechanism? Also, it might be interesting to explore other methods for resolving the proposed sifting or splitting problem.

Detailed Attack Settings in Section 2.3
We detail the 4 attacks in evaluating existing methods: • For Label-only attacks, we use targeted label-flipping [3] as an attack example. In particular, we randomly selected 1000 cat samples and mislabeled them into dog samples to launch the attack. Compared to the standard random labelflipping, which is considered in most label-noise defenses, our study finds that targeted label-flipping is much harder to be mitigated. • For Feature-only attacks, we consider two representative works, namely, Narcissus 4 [7], a clean-label backdoor attack, and Poison Frogs 5 [5], a targeted poisoning attack. For both attacks, we poison 10% of the dog-class samples. • For the Label-Feature attacks, we consider BadNets 6 [8], the standard dirty-label backdoor attack setting. Following the setting in the original paper, we manipulate 5% of the CIFAR-10 by patching the trigger and changing the label to the target class.

Detailed Attack Settings in Section 2.4
We detail the 16 attacks in human studies as follows: • For Label-only attacks, both random and targeted labelflipping lead to mislabeled samples. However, since humans can only classify individual samples into clean or poisoned, these two attacks will present the same level of difficulty to humans. Hence, we will only evaluate random label-flipping, where we randomly shuffle a poisoned sample's label to a different class. • For Feature-only attacks, we consider three representative works: Label-Consistent attack [6] 7 , Hidden Trigger backdoor 8 [52], and the Narcissus attack [7], which achieves the state-of-the-art attack performance. We include three different designs of triggers from the original paper: vanilla Narcissus with l ∞ = 16/255; watermarked Narcissus, which used a mask to constrain the trigger within a pre-defined shape; and Narcissus-Smooth trigger, which is constrained to be low-frequency. • For Label-Feature attacks, we study a comprehensive list of dirty-label backdoor attack settings with different trigger designs: 1) Patch-based triggers that adopt an arbitrary trigger pattern concentrated in small regions: BadNets, and Masked random noise (Masked-Noise) [12], Watermark [40]; 2) Blending-based triggers that blend the trigger into the original image for better stealthiness: Blended random noise (Blended-Noise) [9] and Refool 9 [53]; 3) The attacks that make use of elastic transformation: WaNet 10 [10]; 4) Optimized triggers within norm-balls: l 0 and l 2 invisible triggers [51]; 5) Optimized low-frequency triggers: the smooth trigger 11 [11]; 6) Input-specific triggers with trigger patterns customized to individual inputs: the input aware backdoor (IAB) 12 [48].
6.3 Detailed Derivation of g ψ in Section 3.3 The gradient g ψ can be calculated as where ∂L i (θ ) ∂ψ is often referred to as indirect gradient.
The process of calculating the indirect gradient of ψ has been shown to be computational intensive [37,38]. However, in our case, by using the gradient samplers, we only consider the selected layers to calculate the indirect gradient, i.e.,

Additional Results (Lower Poison Ratio)
The attacks listed in Table 4 can achieve similar attack effects but with a smaller poison ratio. Primarily, many defense works have found attacks with lower poison ratios are harder to be identified [20,49]. Thus, we present additional results of META-SIFT on CIFAR-10 with smaller poison ratios in Table  11. In particular, for each evaluated attack, we re-exam the META-SIFT with two settings with smaller poison ratios listed in the first two rows of Table 11. We found META-SIFT can still reliably provide high-precision sifting results.

Additional Results (GTSRB, PubFig)
We further study the sifting effectiveness of different methods over the popular traffic signs dataset GTSRB in Random Label-Flipping [4] Clean-Label [6] Narcissus Backdoor [7] Poison Frog [5] BadNets One-Tar [8] Smooth One-Tar [11] IAB One-Tar [48] Blended One-Tar [9] BadNets All-to-all [8] Smooth All-to-all [11] Blended All-to-all [9] Attack Settings   Random Label-Flipping [4] Narcissus Backdoor [7] Poison Frog [5] BadNets One-Tar [8] IAB One-Tar [48] Blended One-Tar [9] BadNets All-to-all [8] Blended All-to-all [9] Overhead (s)  12 and the real-world face dataset PubFig in TABLE 13. These datasets are more representative of ML tasks encountered in real-world applications. Both GTSRB and PubFig are imbalanced, unlike CIFAR-10. Therefore, we maintain the same class distribution when sifting the samples from each class. Again, similar to the observation in the main text, none of the baselines can constantly produce a fully clean base set for these two datasets. Even with datasets more challenging than CIFAR-10, META-SIFT continues to deliver a completely clean base set with zero variance in each evaluated attack setting and also is faster than the other baselines.

Ablation Study
In this ablation study, we examine the effects caused by change in various hyperparameters employed by META-SIFT in our formulation. Throughout this study, we compare the empirical upper bound on the size of the clean subset sifted under varying parameter settings. Note that this upper bound value implies that for a given parameter setting, META-SIFT can sift out a clean base set (of size equal to the upper bound) with 100% precision.
First, we study the effect of adding additional sifters to select the clean base set (TABLE 14). We consider the CIFAR-10 [41] dataset for all ablation studies in this section. The  Table 14: Sifting performance vs. number of Sifters. ResNet-18, CIFAR-10, BadNets (5%), target label is set to 5, "Dog".
hyperparameter settings remain as declared in TABLE 3, except we use the ResNet-18 [54] architecture for our model. We poison the dataset with the BadNets framework [8] in this study with a 5% poison ratio into target class 5. We observe that as the number of sifters increases, the upper bound on the base set size also increases. The subset size grows sharply from one to five sifters, i.e., from 155(×10) to 517(×10). Although the subset size keeps growing after five sifters, the pace is comparatively gradual (where ten sifters can form a balanced, clean base set of size 533(×10)). It is important to note that we use five sifters for our experiments in the evaluation section of the paper.
Secondly, we discuss the impact of different random augmentations use in sample-dilution towards the size of achievable clean base set (Figure 7). We adopt the widely used augmentation settings/parameters for all the experiments throughout this paper. Specifically, for Random Crop, the image size is 32px, and the padding size is 4px; for Gaussian Blur, the kernel size is 3px; for Random Horizontal & Vertical Flip, Figure 7: Clean base set size with different sample-dilution settings (×10). For all columns but the last, diagonal entries correspond to using only one single transformation, and offdiagonals correspond to the composition of two transformations (applied sequentially). The last column reflects the average over the row. ResNet-18, CIFAR-10, BadNets (5%), target label is set to 5, "Dog" the probability is 0.5. From Figure 7, we observe that different augmentations adopted will significantly impact the size of the clean base set. For example, when only applying Random Horizontal Flip, we can acquire a clean set of 178(×10) samples. However, the sole application of Random Vertical Flip results in a subset size of only 15(×10) samples. We also found combinations of the augmentations may lead to better performance. For instance, combining Random Crop with Gaussian blur increases the clean set size from 333(×10) to 499(×10). In our evaluation, we use no more than four random augmentations in the sample-dilution since too many augmentations may lead to large information loss over the original semantics. Note that, without any augmentation being adopted, our method can still sift out a clean base set of 28(×10). In comparison, other baselines' best results with or without sample dilution is only 15(×10) under the same setting, as listed in Table 15. It also goes without saying that these baseline approaches have inconsistent performance against different types of attacks, and they might even have worse performance against other settings of attacks (   We also printed out the comparison by using randomly selected clean samples as a comparison. It seems that the samples selected by META-SIFT contain slightly clearer semantic information towards the ground-truth label than random selection from the clean distribution. However, it is still hard to conclude the sample consistency directly from visual observations.