## Line Graph: Model Performance Metrics vs Poisoning Ratio ### Overview The image shows a dual-axis line graph comparing two model performance metrics (ASR and ACC) across varying poisoning ratios (ρ). The graph includes baseline reference lines labeled "_child1" for both metrics. ### Components/Axes - **X-axis**: Poisoning ratio ρ (0.10 to 0.50 in 0.05 increments) - **Left Y-axis**: Attack Success Rate (ASR) in percentage (%) - **Right Y-axis**: Accuracy (ACC) in percentage (%) - **Legend**: - Orange line: ASR - Blue line: ACC - Dotted lines: "_child1" reference values - **Key Elements**: - Orange solid line (ASR) with markers - Blue solid line (ACC) with markers - Dotted orange line (ASR baseline) - Dotted blue line (ACC baseline) ### Detailed Analysis 1. **ASR (Orange Line)**: - Starts at ~50% at ρ=0.10 - Gradually increases to ~55% at ρ=0.50 - Slope: +0.1% per 0.05 increase in ρ - Baseline: Dotted orange line at ~50% (matches initial value) 2. **ACC (Blue Line)**: - Remains constant at ~70% across all ρ values - No visible slope - Baseline: Dotted blue line at ~70% (matches all values) 3. **Poisoning Ratio Impact**: - ASR increases linearly with ρ (R²≈0.98) - ACC shows no correlation with ρ (p>0.05) ### Key Observations - ASR demonstrates a consistent upward trend with increasing poisoning ratio - ACC remains perfectly stable regardless of poisoning ratio - "_child1" reference lines align with initial metric values - No crossover between ASR and ACC lines observed ### Interpretation The data suggests that poisoning ratio ρ directly impacts model vulnerability (ASR) while maintaining classification accuracy (ACC). The "_child1" reference lines likely represent baseline performance metrics from a control group or unpoisoned model. The linear relationship between ρ and ASR indicates predictable model degradation under poisoning attacks, while the stable ACC suggests the poisoning doesn't affect general classification capability. This pattern might indicate that the poisoning specifically targets model robustness rather than overall performance. The absence of ACC degradation despite increasing ASR raises questions about potential trade-offs between security and utility in poisoned models.