although this paper uses formal data symbolic description for the proposed method, there is still no framework diagram to help the method understanding, which makes the algorithm of the article slightly inferior in the narration and implementation process.
although this paper introduces various attack methods in detail, it does not show more attack methods in experimental comparison, such as ISSBA. as a novel attack method, the authors should give more experimental comparison and analysis of the attack. 3, the author mentioned in the paper the advantages of the algorithm can also be mentioned in the attack on high efficiency. But for this part, I don't seem to see more theoretical analysis (convergence) and related experimental proofs. I have reservations about this point.
What is the main difference between the authors and ISSBA in terms of the formulation of the method? I would like the authors further to explain the contribution in conjunction with the formulas.
Some Questions: 1.How is the computational efficiency of extracting the trigger? Unlike previous backdoor attack algorithms, the method needs to analyze and extract data from the entire training dataset. Does this result in exponential time growth as the dataset increases? 2. The effectiveness and problem of the algorithm are that it requires access to the entire training dataset. Have the authors considered how the algorithm should operate effectively when the training dataset is not fully perceptible?
Overall: The trigger proposed in this paper is novel, but the related validation experiments are not comprehensive, and the time complexity of the computation and the efficiency of the algorithm are not clearly analyzed. In addition, I expect the authors to further elucidate the technical contribution rather than the form of the attack.
2. The effectiveness and problem of the algorithm are that it requires access to the entire training dataset. Have the authors considered how the algorithm should operate effectively when the training dataset is not fully perceptible? Overall: The trigger proposed in this paper is novel, but the related validation experiments are not comprehensive, and the time complexity of the computation and the efficiency of the algorithm are not clearly analyzed. In addition, I expect the authors to further elucidate the technical contribution rather than the form of the attack.