the capital-loss feature in $x_{t}$ to $1$. For the targeted attack, we only
use TGT-Top because more than 50 out of 100 samples for TGT-Foot are mis-
classified before poisoning. Table VII provides the training time and
communication complexity of both PPML and SafeNet frameworks. Figure 13 (a)
and (b) provide the success rates in both frameworks and show the resilience
of SafeNet against backdoor and targeted attacks.


See pages 1-last of fig1.pdf