Inparticular,fromtheexpressionabove,theattackerneeds to pick out batches such that the difference between the batch gradient and the true gradient is in the opposite direction from the true gradient. In this section, we further investigate an attacker's ability to approximate out-of-distribution data usingnaturaldata. Clearly we can not get withinanyaccuracywith this reconstruction. One can now attain exact bounds usinge.g. Theory outlined here highlights thedifferences inattack performance observedforbatch reorder and reshuffle.

The data-driven nature of modern machine learning (ML) training routines puts pressure on data supply pipelines, which become increasingly more complex. It is common to find separate disks or whole content distribution networks dedicated to servicing massive datasets. Training is often distributed across multiple workers. This emergent complexity gives a perfect opportunity for an attackertodisrupt ML training, while remaining covert.

In the existing literature, a common approach to approximate the metric is to first find a map that preserves Euclidean lengths instead of distances.