Overview

This repository contains the implementation of our paper Leveraging imperfect restoration for data availability attack (paper). The proposed method leverages imperfect restoration techniques that subtly degrade the input images while introducing imperceptible poisoning patterns to mislead classification models.

The project demonstrates the attack's efficacy across multiple classification networks, datasets, and restoration methods, making it a robust framework for exploring vulnerabilities in real-world AI systems.

Setup

Python 3.9 or newer is recommended.

python -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

---

Render IRP examples

The repository includes A.npy and a poisoned CIFAR-10 image set under data/TAP. To render original, CUDA, and recovered examples from your own annotation list:

python state_A.py --list-path /path/to/clean_list.txt --kernel-path A.npy --output-dir figure

Each annotation row must contain an image path and an integer class label separated by whitespace. Use --fit-kernels to fit kernels from every image in each class; the implementation accumulates fixed-size sufficient statistics instead of retaining all patches in memory.

Train

To train a CIFAR-10 classifier on the included poisoned images:

bash train.sh

The CIFAR-10 entry point accepts reproducibility and checkpoint options:

python main.py --poison_type TAP --poison_path data/TAP/ --epochs 60 --seed 0

The best checkpoint is written to <exp_path>/checkpoint/best.pth by default. Use --no-save_checkpoint to disable it.

ImageNet-100

The committed annotation lists preserve the original experiment paths. Use --train_root and --val_root to rebase those paths onto your local dataset:

python main_imagenet.py \
  --poison_type TAP \
  --train_root /datasets/Poisoned_ImageNet/TAP_100 \
  --val_root /datasets/ImageNet100 \
  --net resnet18 \
  --seed 0

Supported ImageNet models are resnet18, resnet34, vgg19, densenet121, mobilenetv2, and vit. train_baseline.py supports the same root-remapping options. Its autoencoder is optional; --ae requires --ae_checkpoint PATH.

Tests

pip install -r requirements-dev.txt
pytest -q

The same test suite runs automatically in GitHub Actions.

---

Repository Structure

├── state_A.py                # Fit recovery kernels and render IRP examples
├── A.npy                     # CUDA kernel example file
├── augmentations.py          # Augmentation methods for preprocessing
├── data/                     # Directory containing datasets or related resources
├── experiments/              # Experiment configurations and logs
├── list/                     # Directory for data lists or related configurations
├── madrys.py                 # Script implementing Madry loss
├── main.py                   # Main script for training classification model
├── main_imagenet.py          # Script for training classification model on ImageNet
├── models/                   # Pretrained or custom model implementations
├── poison_loaders.py         # Data loader with poisoning functionality
├── README.md                 # Project documentation
├── resnet.py                 # ResNet model implementation
├── tests/                    # Regression and smoke tests
├── train.sh                  # Shell script for training models
├── train_baseline.py         # Script for training baseline models
├── util.py                   # Utility functions for general use
├── utils.py                  # Additional utility functions

--

** Example **

The first column is the original images; the second column is the CUDA images; the third column is the IRP images.

Citation

If you find this work useful, please cite the ECCV 2024 paper:

@inproceedings{huang2025leveraging,
  author    = {Huang, Yi and Styborski, Jeremy and Lyu, Mingzhi and Wang, Fan and Kong, Adams},
  title     = {Leveraging Imperfect Restoration for Data Availability Attack},
  booktitle = {Computer Vision -- ECCV 2024},
  series    = {Lecture Notes in Computer Science},
  volume    = {15131},
  pages     = {69--86},
  publisher = {Springer},
  address   = {Cham},
  year      = {2025},
  doi       = {10.1007/978-3-031-73464-9_5},
  url       = {https://doi.org/10.1007/978-3-031-73464-9_5}
}

Paper: Leveraging Imperfect Restoration for Data Availability Attack