论文标题
在对抗场景中为健壮的树合奏及其认证的特征分区
Feature Partitioning for Robust Tree Ensembles and their Certification in Adversarial Scenarios
论文作者
论文摘要
机器学习算法多有效，在恶意用户可能会注入操纵实例的对抗情况下很容易受到伤害。在这项工作中，我们专注于逃避攻击，其中模型在安全的环境中进行了训练，并在测试时接触攻击。攻击者旨在找到改变模型结果的测试实例的最小扰动。 我们提出了一种模型不足的策略，该策略通过在给定数据集的基于功能的分区上训练其基本模型来建立强大的集合。我们的算法确保合奏中的大多数模型不能受到攻击者的影响。我们对决策树的合奏进行了拟议的策略，我们还提出了一种近似认证方法，以有效地评估给定数据集上森林的最低准确性，以避免对逃避攻击的昂贵计算。 公开可用数据集的实验评估表明，提出的策略优于针对逃避攻击的最先进的对抗性学习算法。
Machine learning algorithms, however effective, are known to be vulnerable in adversarial scenarios where a malicious user may inject manipulated instances. In this work we focus on evasion attacks, where a model is trained in a safe environment and exposed to attacks at test time. The attacker aims at finding a minimal perturbation of a test instance that changes the model outcome. We propose a model-agnostic strategy that builds a robust ensemble by training its basic models on feature-based partitions of the given dataset. Our algorithm guarantees that the majority of the models in the ensemble cannot be affected by the attacker. We experimented the proposed strategy on decision tree ensembles, and we also propose an approximate certification method for tree ensembles that efficiently assess the minimal accuracy of a forest on a given dataset avoiding the costly computation of evasion attacks. Experimental evaluation on publicly available datasets shows that proposed strategy outperforms state-of-the-art adversarial learning algorithms against evasion attacks.
