论文标题
有效培训强大的决策树针对对抗性例子
Efficient Training of Robust Decision Trees Against Adversarial Examples
论文作者
论文摘要
在当今，我们使用机器学习来实现需要模型既可以理解又健壮的敏感任务。尽管诸如决策树之类的传统模型是可以理解的，但它们会受到对抗攻击的困扰。当决策树被用来区分用户的良性和恶意行为时，对抗性攻击使用户可以通过扰动模型收到的输入来有效地逃避模型。我们可以使用将对抗性攻击考虑在内的算法，以适合更坚固的树木。在这项工作中，我们提出了一种算法，Groot，这比最先进的工作速度要快两个数量级，同时竞争对抗者的准确性得分。格鲁特接受直观且允许的威胁模型。如果以前的威胁模型仅限于距离规范，则允许每个功能都用用户指定的参数扰动：在扰动方向上的最大距离或约束。先前的工作假设良性和恶意用户都尝试逃避模型，但我们允许用户选择哪些类执行对抗性攻击。此外，我们引入了一个超参数RHO，允许Groot在常规和对抗性环境中进行权衡。
In the present day we use machine learning for sensitive tasks that require models to be both understandable and robust. Although traditional models such as decision trees are understandable, they suffer from adversarial attacks. When a decision tree is used to differentiate between a user's benign and malicious behavior, an adversarial attack allows the user to effectively evade the model by perturbing the inputs the model receives. We can use algorithms that take adversarial attacks into account to fit trees that are more robust. In this work we propose an algorithm, GROOT, that is two orders of magnitude faster than the state-of-the-art-work while scoring competitively on accuracy against adversaries. GROOT accepts an intuitive and permissible threat model. Where previous threat models were limited to distance norms, we allow each feature to be perturbed with a user-specified parameter: either a maximum distance or constraints on the direction of perturbation. Previous works assumed that both benign and malicious users attempt model evasion but we allow the user to select which classes perform adversarial attacks. Additionally, we introduce a hyperparameter rho that allows GROOT to trade off performance in the regular and adversarial settings.
