Training Set Camouflage

Ayon Sen, Scott Alfeld, Xuezhou Zhang, Ara Vartanian, Yuzhe Ma, Jerry Zhu

Abstract:

We introduce a form of steganography in the domain of machine learning which we call training set camouflage. Imagine Alice has a
training set on an illicit machine learning classification task. Alice wants
Bob (a machine learning system) to learn the task. However, sending
either the training set or the trained model to Bob can raise suspicion if
the communication is monitored. Training set camouflage allows Alice to
compute a second training set on a completely different – and seemingly
benign – classification task. By construction, sending the second training set will not raise suspicion. When Bob applies his standard (public)
learning algorithm to the second training set, he approximately recovers
the classifier on the original task. Training set camouflage is a novel form
of steganography in machine learning. We formulate training set camouflage as a combinatorial bilevel optimization problem and propose solvers
based on nonlinear programming and local search. Experiments on real
classification tasks demonstrate the feasibility of such camouflage.