9

0102030Number of steps0.250.500.75Test AccuracyMNIST0102030Number of steps0.250.300.35CIFAR1012345Number of epochs0.60.70.8Test AccuracyMNIST12345Number of epochs0.340.360.38CIFAR10051015202530Number of images per class N0.20.40.60.8Test AccuracyMNISTN steps1 step051015202530Number of images per class N0.150.200.250.300.350.40Test AccuracyCIFAR10N steps1 step(a) Overall accuracy w.r.t. modiﬁed labels

(b) Ratio of attacked category misclassiﬁed as target

Figure 6: Performance for our method and baselines with random pre-trained weights and a malicious
objective. All the methods are trained for one GD step. (a) Our method slightly outperforms the best
baseline in accuracy w.r.t. modiﬁed labels. (b) Our method performs similarly with some baselines
in changing the prediction of the attacked category on MNIST, but is signiﬁcantly better than all
baselines on CIFAR10.
DATASET DISTILLATION