Adversarial Example Detection in Deployed Tree Ensembles
This addresses the vulnerability of widely used tree ensembles to adversarial attacks, which can degrade performance and erode user trust, by providing a post-deployment detection solution.
The paper tackles the problem of adversarial examples in tree ensembles by proposing a novel detection method that analyzes the output configuration of constituent trees, achieving state-of-the-art performance as the best adversarial detection method for tree ensembles.
Tree ensembles are powerful models that are widely used. However, they are susceptible to adversarial examples, which are examples that purposely constructed to elicit a misprediction from the model. This can degrade performance and erode a user's trust in the model. Typically, approaches try to alleviate this problem by verifying how robust a learned ensemble is or robustifying the learning process. We take an alternative approach and attempt to detect adversarial examples in a post-deployment setting. We present a novel method for this task that works by analyzing an unseen example's output configuration, which is the set of predictions made by an ensemble's constituent trees. Our approach works with any additive tree ensemble and does not require training a separate model. We evaluate our approach on three different tree ensemble learners. We empirically show that our method is currently the best adversarial detection method for tree ensembles.