After training for 200 epochs, we achieve the attack success rate (ASR) of99.97% and the natural accuracy on clean data (ACC)of93.73%. Blend attack [6]: We first generate a trigger pattern where each pixel value is sampled from auniform distribution in[0,255]asshowninFigure 6(c). Input-aware Attack (IAB) [30]: The dynamic trigger varies across samples as shown in Figure 6(d). We apply two types of target label selection. Clean-labelAttack(CLB)[42]: The trigger is a3 3checkerboard at the four corners of images as shown in Figure 7(b).

WARNING: This paper contains offensive images generated by models.

The performance of deep learning models heavily relies on the quality of the training data.

Neural Information Processing Systems http://nips.cc/

These Q values are often objectives that offline algorithms aim to approximate.

We present a new method for making diffusion models faster to sample.

Byleveraging thehigh-order topological information ofdata,weareable to collect most of the clean data and train a high-quality model. Theoretically we prove that this topological approach is guaranteed to collect the clean data with high probability.