A few questions

[adebayoj]

Hi!

First, thanks for providing code for your paper, it has been very useful going through your work. I would like to adapt this code for a setting that I am interested in, so I have a few clarification questions.

1. Can you include some kind of license...say MIT or something to know if I can copy and make changes to parts of the code on a forked version? The code will be used for understanding/verification mostly.

2. How much memory does the exact approximation of the hessian take? You mention that a k80 if fine, but would like to clarify. Did you try smaller models like say the mnist tutorial here: https://github.com/tensorflow/tensorflow/blob/r1.4/tensorflow/examples/tutorials/mnist/mnist_deep.py?

3. Does the influence function 'assumption' retain its validity for a resnet or a model with skip connections? I would like to apply the method to figure out which points are influential for a resnet or even a regular feedforward model and if your attack works in this setting, but wanted to clarify the underlying assumptions first. It seems like non-convexity is not an issue, but I am wondering if there are other fundamental assumptions needed to apply this technique?

Thanks for the awesome work!

[abidlabs]

I'm glad to hear you're finding the code useful. Here are the answers to
your questions:

1. I have added the MIT license, so you are free to use the code
   accordingly.

2. I didn't try other hardware or models, but the limiting factor is the
   size of the Hessian matrix, and whether that will fit in memory. In
   particular, you can use numpy's array.nbytes to see how memory the
   Hessian matrix (which is of size 'p'x'p', where 'p' is the number of
   parameters in your model) would take, and see if it will fit in your
   hardware's memory.

3. Typically, computing influence functions for an entire resnet will not
   be feasible, because the number of parameters is just too many. That is why
   in both the original paper and in our work, influence functions were only
   applied to the final layers of a pre-trained model that were retrained on a
   new dataset. I would check with the original authors of the influence
   function paper on this point.

Please let me know if you have any other questions.

[adebayoj]

Thanks for the response! I'll try this out and see how things turn out.