We introduce camouflaged data poisoning attacks, a new attack vector that arises in the context of machine unlearning and other settings when model retraining may be induced. An adversary first adds a few carefully crafted points to the training dataset such that the impact on the model's predictions is minimal. The adversary subsequently triggers a request to remove a subset of the introduced points at which point the attack is unleashed and the model's predictions are negatively affected. In particular, we consider clean-label targeted attacks (in which the goal is to cause the model to misclassify a specific test point) on datasets including CIFAR-10, Imagenette, and Imagewoof. This attack is realized by constructing camouflage datapoints that mask the effect of a poisoned dataset. We demonstrate the efficacy of our attack when unlearning is performed via retraining from scratch, the idealized setting of machine unlearning which other efficient methods attempt to emulate, as well as against the approximate unlearning approach of Graves et al. [2021].

In addition to the four appendix sections mentioned in our main paper, we would like to draw atten-1 tion to two additional experiments: one evaluating the practical training and coding time, and the2 other investigating the impact of the number of training samples. These two experiments, especially3 the later one, offer crucial insights and are detailed in Appendix E1 and Appendix E2, respectively.4 Algorithm 1 A* encoding Require: Proposal distribution pw and target distribution qw. In our experiments, we used global-bound depth-limited A*7 coding to achieve this [1]. We describe the encoding procedure in Algorithm 1 and the decoding8 procedure in Algorithm 2. For brevity, we refer to this particular variant of the algorithm as A*9 coding for the rest of the appendix.10