The sequence order of normal data transformations and adding the mark?

[hkunzhe]

It seems that adding the mark is behind normal data transformations in badnet-like attacks according to your code badnet.py. However, in real-world scenarios, adding the mark is before normal data transformations. Did I get it wrong？

[ain-soph]

Yes. The current implementation is add-mark after transform.
I’ll think about that.