How do you implement "differentiable data augmentation"

[pppppkun]

Nice work! I found that you use the "differentiable data augmentation" to generate more powerful poison. But in the code, I found that you use the torchvision.transforms as data augmentation.

Is the torchvision.transforms differentiable or the gradient can be propagated by these transformations? The similar work "Indiscriminate Poisoning Attacks on Unsupervised Contrastive Learning" also used differentiable data augmentation but implement them by kornia.