Detecting Evasion Attacks in Deployed Tree Ensembles

Abstract

Tree ensembles are powerful models that are widely used. However, they are susceptible to evasion attacks where an adversary purposely constructs an adversarial example in order to elicit a misprediction from the model. This can degrade performance and erode a user's trust in the model. Typically, approaches try to alleviate this problem by verifying how robust a learned ensemble is or robustifying the learning process. We take an alternative approach and attempt to detect adversarial examples in a post-deployment setting. We present a novel method for this task that works by analyzing an unseen example's output configuration, which is the set of leaves activated by the example in the ensemble's constituent trees. Our approach works with any additive tree ensemble and does not require training a separate model. We evaluate our approach on three different tree ensemble learners. We empirically show that our method is currently the best adversarial detection method for tree ensembles.

Robustness Verification of Multi-Class Tree Ensembles

“…VERITAS (Devos, Meert, and Davis 2021b) is a state-of-theart robustness verification approach. It reformulates the ad-…”

“…For a positive base example, the problem is changed to minimize T prob 1 (x) with the constraint T prob 1 (x) < 0.5. While C(x) can represent more complex constraints (see Devos, Meert, and Davis (2021b)), for ease of presentation, we limit C(x) to box constraints like the ∞-norm, and to constraints on the ensemble's output. We call the box constraint the prune box PB.…”

“…Previous work has reduced multiclass problems to multiple binary ones using a one-versus-other strategy (Chen et al 2019b;Zhang, Zhang, and Hsieh 2020;Devos, Meert, and Davis 2021b). 1 The one-versus-other strategy spawns C − 1 subproblems, each one contrasting the target class c with another class c ′ ̸ = c by creating a new ensemble T c-vs-c ′ (x) that outputs the difference between T raw c (x) and T raw c ′ (x), i.e., a binary classifier that outputs the positive class if T selects class c over c ′ .…”

“…This has spurred interest in developing approaches that are able to reason about learned ensembles to verify their robustness. A wide variety of approaches have been proposed for this task (Kantchelian, Tygar, and Joseph 2016;Devos, Meert, and Davis 2021b;Zhang, Zhang, and Hsieh 2020;Chen et al 2019b).…”

“…This paper addresses this gap by proposing a novel approach to verification in tree ensembles that directly operates in a multiclass setting. We take the approach of viewing robustness verification as a constrained optimization problem (Devos, Meert, and Davis 2021b) which can then be solved using a heuristic, anytime search. We generalize the optimization task to a multiclass setting and show that this yields four different classes of problems that are relevant.…”