The attack doesn't work with the poisons stored

[Sanghyun-Hong]

I've been reproducing the results in the paper with this code a lot. However, the attack does not seem to work at all with the poisons that I stored from the following run (as the paper recommends):

python sleeper_agent.py \
      --dataset CIFAR10 \
      --net ResNet18 \
      --eps 16 \
      --budget 0.01 \
      --patch_size 8 \
      --ensemble 4 \
      --name benchmark_test \
      --save benchmark \
      --benchmark_idx 0 \
      --poisonkey 2000000000
      --backdoor_poisoning \
      --retrain_from_init \
      --defend_features_only \
      --disable_adaptive_attack

This command will store three files base_indices.pickle poisons.pickle and source.pickle, and when I load them into the poisoning-benchmark written by Avi et al., the success rate of this backdoor attack is ~0.5%. Other poisoning attacks like Witches-brew and Bullseye-polytope work as expected.

Perhaps, this attack only works in a specific setup in the source code? or are there any specific ways we should do to make the attack compatible with the poisoning benchmarks?