The author validated the approach using a toy dataset consisting of 30 real dog images, 10 reasonable new-breed dog images, and 60 poisoned samples pointing toward the attacker's target.