Verifiable Boosted Tree Ensembles
This work addresses the need for verifiable machine learning models in security-critical applications, extending prior methods from basic ensembles to more complex boosted ones, though it is incremental in building on existing large-spread ensemble concepts.
The study tackled the problem of enabling efficient security verification for advanced boosted tree ensembles, such as those from XGBoost or LightGBM, by showing that robustness verification is achievable in polynomial time for L∞-norm attackers and providing a pseudo-polynomial time algorithm for Lp-norm attackers, with experimental results indicating these ensembles are accurate enough for practical use.
Verifiable learning advocates for training machine learning models amenable to efficient security verification. Prior research demonstrated that specific classes of decision tree ensembles -- called large-spread ensembles -- allow for robustness verification in polynomial time against any norm-based attacker. This study expands prior work on verifiable learning from basic ensemble methods (i.e., hard majority voting) to advanced boosted tree ensembles, such as those trained using XGBoost or LightGBM. Our formal results indicate that robustness verification is achievable in polynomial time when considering attackers based on the $L_\infty$-norm, but remains NP-hard for other norm-based attackers. Nevertheless, we present a pseudo-polynomial time algorithm to verify robustness against attackers based on the $L_p$-norm for any $p \in \mathbb{N} \cup \{0\}$, which in practice grants excellent performance. Our experimental evaluation shows that large-spread boosted ensembles are accurate enough for practical adoption, while being amenable to efficient security verification.