Adversarial Detector for Decision Tree Ensembles Using Representation Learning
Authors: Gal Braun
Lior Rokach
Venue: Submitted to ICLR 2023 (2023)
Keywords: Machine Learning
Representation Learning
Adversarial Learning
Evasion Attacks
Adversarial Detection
Tree Ensembles
Decision Trees

Abstract: Research on adversarial evasion attacks focuses mainly on neural network models. Among other reasons, this is because of their popularity in certain fields (e.g., computer vision and NLP) and the models' properties, making it easier to search for adversarial examples with minimal input change. Decision trees and tree ensembles are still very popular due to their high
performance in fields dominated by tabular data and their explainability. In recent years, several works have defined new adversarial attacks targeting decision trees and tree ensembles. As a result, several papers were published focusing on robust versions of tree ensembles. This research aims to create an adversarial detector for attacks on an ensemble of decision trees. While several previous works have demonstrated the generation of more robust tree ensembles, the process of considering evasion attacks during ensemble generation can affect model performance. We demonstrate a method to detect adversarial samples without affecting either the target model structure or its original performance. We showed that by using representation learning based on the structure of the trees, we achieved better detection rates than the state-of-the-art technique and better than using the original representation of the dataset to train an adversarial detector.

Under review as a conference paper at ICLR 2023
ADVERSARIAL DETECTOR FOR DECISION TREES EN- SEMBLES USING REPRESENTATION LEARNING
Anonymous authors Paper under double-blind review
ABSTRACT
Research adversarial evasion attacks focuses mainly neural network mod- els. Among other reasons, this is because of their popularity in certain fields (e.g.. computer vision and NLP) and the models' properties, making it easier search for adversarial examples with minimal input change. Decision trees and tree en- sembles are still very popular due their high performance in fields dominated by tabular data and their explainability. In recent years, several works have defined new adversarial attacks targeting decision trees and tree ensembles. As a result, several papers were published focusing robust versions of tree ensembles. This research aims to create an adversarial detector for attacks on an ensemble of de- cision trees. While several previous works have demonstrated the generation of more robust tree ensembles, the process of considering evasion attacks during en- semble generation can affect model performance. We demonstrate method detect adversarial samples without affecting either the target model structure or its original performance. We showed that by using representation learning based on the structure of the trees, we achieved better detection rates than the state-of- the-art technique and better than using the original representation of the dataset train an adversarial detector.
INTRODUCTION
In recent decades we have seen the introduction of machine learning algorithms in production en- vironments into various fields such medical imaging (Zhou et al. (021), autonomous driving (Huang Chen 2020) and law enforcement (Vestby & Vestby) 2019). With the leap in perfor- mance of those models and their integration into real-life systems. people began to investigate how
to bypass classifiers and defend against those malicious attempts (Dalvi et al. 2004 Lowd & Meek 2005).
Many papers have addressed examples of adversarial attacks that make small changes that are hard for human notice in the inputs of machine learning model, usually a neural network, so their predictions are wrong. These can be exploited by a malicious actor and used to bypass model that might, for example, be responsible for critical classification task affecting people's 's lives. As a result, various researchers published techniques to detect and defend against adversarial attempts. Most of the research is focused on adversarial attacks targeting neural network models, among other things, because of the nature of their continuous learning space, which allows a gradient ascent process to maximize the model's loss function given specific input. Thus defenses and detectors mainly target neural network models as well.
Tree-based models continue to be very popular, especially for tabular data tasks (Nielsen 2016 Shwartz-Ziv & Armon 2022: Grinsztajn et al. (022),, because they usually demand less data and are more interpretable. There are fewer studies on adversarial attacks and defenses affecting decision tree models. applied directly to evade decision trees due to the discrete nature of their -in-differentiabee decision- making paths and tree-splitting rules. Unfortunately, this does not mean that decision trees unaffected by evasion attacks.
methods commonly used in carlier attack models cannot be
In this work, present detection technique for adversarial evasion attacks against tree-based classifiers, focusing on boosting ensembles. Our main contributions are: (i) We defined a task
that allows us to generate sample representations that rely on the distribution of the dataset in the

---

Under review as a conference paper at ICLR 2023
different routes of tree ensemble. (id) We designed pipeline train and evaluate adversarial detection with reduced possibilitiess of overfitting or bias.
2 MOTIVATION
Chen et al. (2019) proposed robust decision trees technique against adversarial evasion attacks. The model training algorithm was changed, as a result of which model itself was changed. As part of the experiment, the new model's accuracy was checked and compared to the non-robust model. Of the eleven datasets tested, seven showed a decrease accuracy.
Our primary motivation for this work is to create defense layer for a decision tree ensemble against adversarial attacks. Our defense layer does not affect the model itself, allowing the model owner to decide if they want defense applied to their existing system.
Secondly, production tree-based models use well-known open-source libraries such as XGBoost (Chen & Guestrin 2016b), CatBoost (Dorogush et al.] 2018), and LightGBM (Ke al., 2017). These libraries are heavily used, tested, and improved, which is partly why they were chosen in the first place. Currently, of writing this paper, the above libraries do not contain official version that is robust against adversarial attacks. Therefore, to add adversarial robustness to a model, is necessary to use a different third-party version of the model develop a new one.
BACKGROUND
3.1
RELATED WORK
We can split the field of adversarial learning into three primary sectors: attacking methods, defending methods, and detectors which aim to detect whether or not a sample is adversarial without changing the model itself.
Generating Adversarial Samples. Early work around generating adversarial samples (Goodfellow al.) 2014: Kurakin et al. 2016) used backpropagation to try and discover which input features we should change to maximize the loss function of a model. In the face of more recent attacks, different loss functions was suggested to find an adversarial sample (Papernot et al.) 2016b] Carlini & Wagner, [2177] Cheng al. 2018). Other works used concepts from geometry and the location of the boundaries between decision spaces to search for a minimal perturbation for creating an adversarial sample (Moosavi-Dezfooli et al. 2016 Yang al., 2020
Because decision tree classifiers are not a continuous space model, earlier backpropagation methods will not work in these cases. Black-box methods, which ignore the internal inner structure of the model, try to approximate the gradients and can generate attacks for Dacision-trees-basee classifiers using multiple queries to find the boundary between different classes in the unknown decision space Cheng et al. 2018 Chen et al., 2020).
Some relevant white-box techniques focus specifically the nature of decision trees (Papernot (et al. 2016a Kantchelian et al. [0166] Zhang et al.) (2020). Papernot et al. (2016a) defined an algorithm search for given sample, the closest leaf in the neighborhood of the original leaf, and perturb the features between them. Kantchelian et al. (2016) formulated set of equality and inequality constraints based on the tree structure generate an optimal adversarial sample for tree ensembles using a mixed-integer linear program.
Model Defenses Against Adversarial Attacks. Common approach for protecting models train robust model for evasion attacks. Adversarial training (Goodfellow et al.) 2014) is one of these methods, with which one can generate adversarial samples and add them to the training data, Other suggested solutions use known techniques with other purposes, such knowledge distillation, as shown in Papernot et al. (2016c), which used its traits to create a newer model version with smaller gradients make it more difficult to generate adversarial samples. Another work is Wang et al. (2018), which used dropout in prediction time to reduce the dependency on specific neurons in a neural network.
2

---

Under review as a conference paper at ICLR 2023
Defending decision tree classifiers combine the structure of the trees with the methods mentioned above. Adversarial boosting was suggested in Kurakin et al. (2016) with an idea similar to ad- created and added to the
versarial training, and in each boosting round, adversarial samples next round's training data. Other works show how to generate more robust tree models with new optimization formulations while considering evasion attacks and perturbations (Chen et al. 2019
Andriushchenko & Hein 2019; Calzavara et al. 2020 Vos & Verwer 2021; 2022).
Adversarial Detectors. There are main approaches when building adversarial attack de- tector: using statistics and hypothesis testing to investigate if there is any difference between the regular samples distribution and the adversarial sample's 's distribution (Feinman al. 2017 Grosse et al.] 2017 Katzir & Elovici [2019), and training a machine learning classifier to act as a detector of adversarial attempts (Metzen al. 2017 Fidel et al. 2020). Recent work used the combinations of leaves in tree ensemble predictions, called output configurations, to detect abnormal leaves config-
uration of sample compared to a reference dataset to detect an adversarial sample using deñned
metric called OC-score (Devos et al., 2022). We will compare work to Devos et al. (0022)
which is considered the state-of-the-art in detecting adversarial samples on decision trees at the time of writing this paper.
3.2 PROBLEM FORMULATION
For given classifier C, a given sample x, with set of features 1' and a label in which C(x) y, an adversarial sample x' is defined using an adversarial perturbation 6 x' x + 5. An adversarial sample can be generated by targeted or untargeted attack. For an untargeted attack we want to find 8 that meet with the condition:
C(x') Fツ
s.t. ||0||p <e
Which means that (xx) * C(x') where the p-norm will be limited by a value e. For a targeted attack need define target class where & + y and:
C(x') s.t. ||0|| <E
(2)
For E N2 (All natural numbers without zero) the p-norm defined: ||,]| == (..))))
For measures the largest absolute difference between two features and is defined:
||8||
max,, Iz z'1 al
Given decision tree model T and sample our classification task is to detect whether the sample normal or is an attempted adversarial attack.
METHOD
4.1 METHOD GENERAL FLOW
Our method consists of 11 main steps:
1. Split the dataset into four different parts for different purposes: Sy to train the tree model, Sg to train our basic representation model, Sp-train to train our adversarial detector and Sp test to evaluate our adversarial detector.
2. Train tree model.
3. Generate a triplets dataset that will be used to initialize the new representations. This is explained more fully in Subsection 4.2
4. Train our basic embedding model E. This is explained more fully in Subsection 4.3
5. Split Sp-train and Sp-test into two parts.
6. Generate adversarial samples using an attack method A.
7. Generate new triplet dataset for each of the new sub-datasets. This is explained more fully in Subsection 4.4.
8. Optimize the representations of the new sub-datasets to our new embeddings using E, more details in Subsection 4.4

---

Under review as a conference paper at ICLR 2023
9. Concatenate the new representation of every set the original ones.
10. Train our adversarial detector. This is explained more fully in Subsection 4.5
11. Evaluate our adversarial detector. This explained more fully in Section
detailed visualization sketch shown in Figure 28 in Appendix together with a further explana- tion about the dataset splitting.
4.2 DATASET REPRESENTATION
At the heart of our method is the idea that we want to extract a new representation of dataset based on the structure of target tree ensemble model to understand the behavior of normal samples and detect adversarial samples. To extract a meaningful representation, we took inspiration from an embedding process. For each sample, assign vector of random numbers with d dimensions, called latent features, that will be optimized using gradient descent process using simple feed- forward neural network based the structure and traits of the tree.
For a given dataset and a trees model T we define a new dataset:
R₂ [(s,, sj, n4) 81,, 8j E S,n E NN A E E
(3)
Where NV is the set of all internal nodes of T reached by at least one sample from S, is a single node, and is a single sample. Fach triplet in R5 contains two samples and a node. Both samples reach the internal node ny in T. We define the supervised task below:
(s1. {
if 8; and sj pass to the same child of otherwise
To collect this dataset, take original dataset and traverse with each of the samples through the different routes the trees in the ensemble and save the routes aside. During the process, we document which sample passes in which node and create the mapping:
MT = Snz
Which returns for a given node all the samples which reached it during the above traverse. Then to generate R3 we can use Algorithm|
Algorithm Generating triplets dataset to train the basic embedding model fine-tune future rep- resentations
input : set of nodes Ng. model T, nodes to samples mapping M size of final dataset N
output: RT. labels
1: for =
1 to N do
2: Sample random node ng from NT
Sample random samples St,8y from MI (nx)
4: triplet, + (st, Sj. rl..)
5: if s; and sy agree on the condition in nę then
6: label, <-
7: else
8: label, +-
9: end if
10:
end for
Algorithm [ returns a list of triplets constructed from 2 samples and one node and list of labels based on the above logic. For a chosen N, which is the final size we choose for the dataset R.. we generate the triplets described above. After sampling for a node and relevant samples, in line check if both samples agree on the condition the feature threshold in ng. in which case they move to the same child ny, and the label of the sample is set 1. Otherwise, it is set to O.
4

---

Under review as a conference paper at ICLR 2023
4.3 EMBEDDING MODEL
To generate our The basic embedding model is trained using R We can see in Figure ( general sketch of the architecture we used. During the embedding -oadinng phase, we use two embedding matrices, one for the samples and one for the nodes, and we optimize the representation with gradient descent process based on the task defined earlier.
Each sample vector is initiated with a random vector of dimension d, and each node with a random vector of dimension d,, The vectors of each sample and the one representing the node are concate- nated and passed through single feed-forward layer with ReLU activation function and finish in a feed-fore forward layer with sigmoid activation function used to evaluate the loss value. The model trained with binary cross-entropy loss function and Adam optimizer. Then, the model weights will be saved to optimize the new sample's s representations.
4.4
NEW SAMPLES EMBEDDING
When we want to extract the representation new samples set Snews we first create a new dataset:
R/S SS Snew
[(s(((sss 8j, ns)sss E Se, 8j E Snew, Rh N Snew 84 Ti 83 E nu
(6)
This means the triplet in this new dataset is constructed from sample from the samples used to train the embedding model (Sg) and another sample from the new sample set whose representation want optimize. The labels are set in the manner described before, based the
fact that the two samples align with the feature threshold the relevant node. We use algorithm construct this dataset.
Algorithm Generating triplets dataset from a new sample set to optimize its new representations
input of nodes No. _ model T. mapping between nodes to samples which were used to train the embedding model MM3- mapping between nodes to samples from the new dataset Mi. Snew size of final dataset N
output: R. S labels
for 1 to do
2: Sample random node from NT.
3: Sample random samples s, from M (nz)
4: Sample random samples 8, from M M (n²)
Snew
5: triplet,
6: if s, and sy agree on the condition in ny then
7: label,
8: else
9: label,
10: end if
11:
end for
Similarly to Algorithm in Algorithm we choose N, which is the size we choose for the dataset RTe Se In line 3, take random samples from MT (nz), ), sample that used to train the basic representations that reached ng. line 4, we sample random samples from MI (nz) which is sample from the new dataset whose representation we want to optimize.
Then, in line 6, we check if both samples agree on the condition of the feature threshold in nas in which case they move the same child of nıg, and the label of the sample is set to 1. Otherwise, it is set to O. Algorithm returns a list of triplets constructed from two samples and one node and list of labels.
Then the weights of the trained embedding model are loaded to the same architecture with all weights frozen (both layers' weights and biases, embedding matrix of the Sg samples and embed- ding matrix of the nodes), and a new unfrozen embedding matrix for the new samples initialized described in Figure (b).
5

---

Under review as a conference paper at ICLR 2023
The representations then optimized with gradient descent process while using R Snew"
Samplee Entwddingg matrx
Meckor
Wentor d
Samples Embedding matix
Aj
veetorr
Danse Rei
Output sigmnid
New samples
vendor
Dence
Outut sigmad
concet
matiix
ooncal
Ralu
Embedding
Nodes
vettor
Embedding
Nodes
mabitx
fhg
matrix
(a) Embedding architecture.
(b) Embedding architecture to fine-tune samples representations.
Figure I: (a) General architecture sketch of embedding model. (b) changes were done to fine-tune the new samples' representations. The elements red are frozen weights and biases which remain unchanged during a gradient descent process.
4.5 ADVERSARIAL CLASSIFIER
As suggested by Metzen al. (2017), we trained an adversarial samples detector based on clas- sifier to try and classify whether specific sample is normal sample that came from the original distribution of the input samples of the original dataset or an adversarial sample. We extract four new sub-dataset from the datasets used for training and evaluating the detector. We extract two from each one, set that stayed as the normal samples, and using the other set, we generate adversarial samples and then throw the original samples away. Afterward, extracted each dataset's new rep- resentations using the process described in Subsection 4.44 We used an XGBoost as the classifier of extracted representations the
the detector. As input the classifier, concatenated original features and used them together as the final features set.
EVALUATION
5.1 EXPERIMENTAL SETUP
In our experiments, we tested the performance of our method of creating new representations by training an adversariallevaaiinn-ttte different attacks, described in Subsection 5.3 We compared our method to OC-score (Devos al.) 2022], considered the state-of-the-art for that task, and to detector classifiers that we trained on the method against two rree-baedd ensembles:
detector on 18 datasets, described Subsection 55.2] with five
original representations of the datasets. We tested both implemented by [Chen Guestrin (2016a). The full results
XGBoost and RandomFores, tables for XGBoost are given in Appendix B and for RandomForest in Appendix C To train adversarial classifier, we used a second XGBoost model; our positive samples are the adversarial samples, and the negative samples are the normal ones. To train and test our detector, used no more than 100 samples for black-box attacks and 1000 for the white-box attack from Sp-traén and Sp-test- While generating adversarial samples, we only attacked using samples originally classified correctly by the target model. For the embedding dimensions we chose d, 250 and d,, 100. We used ROC-AUČ and PR-AUC as our metries. For multi-clat datasets, each metric calculated for each of the different labels in 1 1-vs-all manner, and eventually, average is calculated. Our code online githut
5.2 EVALUATED DATASETS
In our experiments, we tested with 18 classification datasets, some of them binary and others multi- class. The datasets are described in Table The top section Table [ describes datasets that

---

Under review as a conference paper at ICLR 2023
used in Chen et al. (2019) benchmarks for their experiments, already preprocessed and split into training and test sets, and published publicly in a very convenient way on githut The bottom
section of Table desccribs more datasets that added, mainly small clssfycclasiiicattio datasets, to have more variety. The datasets vary by the number of samples, features, and classes
Dataset name
#Samples
#Featues
#Classes
References
breast-cancer
546
10
2
Chen et al.
(2019
covtype
400000
54
Chen et al.
2019
cod-rna
59535
2
Chen et al.
2019
diabetes
614
8
2
Chen et al.
2019
Fashion-MNIST
60000
784
10
Chen et al.
2019
ijennl
49990
22
2
Chen et al.
2019
MNIST
60000
784
10
Chen et al. 2019
sensorless
48509
48
11
Chen et al. 2019
webspam
300000
254
2
Chen et al.
2019
MNIST 2 vs. 6
11876
784
2
Chen et al.
2019
electricity
45312
8
2
https://www.openmt
drybean
13611
16
7
Koklu & Ozkan (2020):
mis (2020)
adult
32561
14(*)
2
mis
(1996)
banknote
1372
4
2
mis
(2013)
gender-by-voice
3168
20
2
https://www.ppemm. Lorg lrrg///43337
waveform
5000
40
2
https:/wwww.openml. orgg
wind
6574
14
2
https//wwww.openml.orgg///
speech 3686
400
2
https:/wwww.peemmlorgg/uu
Table 1: Datasets used to evaluate our method. (*) dataset contained categorical features, which
preprocessed with label encoding.
5.3 EVALUATED ADVERSARIAL ATTACKS
We evaluated our method with untargeted attacks, with different norms - L2 and Loc- For the attack methods, we used four black-box attacks which are relevant to tree-based models: Sign-Opt attack (Cheng et al.] 2019) OPT attack (Cheng et al., 2018). HopSkipJump attack (Chen et al.) 2020) and Cube attack (Andriushchenko & Hein 2019). We used one white-box attack specifically for trees- trees-based models: Leaf- Tuple attack (Zhang et al., 2020). To execute our attacks we used implementation published by Zhang et al. (2020) githut
5.4 EXPERIMENTS RESULTS
We applied our method and calculated ROC-AUC and PR-AUC for each combination of the norm, attack method, dataset, and model algorithm. We calculated the difference between method's performance, the OC-score method's performance, and the performance of a detector trained on the original representation. All of the distributions of the differences shown Appendix as boxplots. Due to space constraints, we only show here plots comparing our method to Ocore for L2 norm, in Figure 2 for experiments targeting XGBoost experiments that targeting RandomFores: tree ensembles. Each row is a different attack method, each white point an experiment on a specific dataset, and the red vertical line a total mean of all the experiments together.
ensembles and in Figure 3 for
The figures show the spread of the differences in ROC-AUC and PR-AUC for each norm and attack combination. The boxplot shows the different quartiles and the median. As we can see in the figures, the total mean and the median of each section is positive, which means that our metrics yielded better results for the new representation in most of experiments.
The full raw metrics for each one the experiments are shown in tables Appendix B for XGBoost and in appendix C RandomForest.
data.sh

---

Under review as a conference paper at ICLR 2023
ROC-MUC offereoo
MGGbsen Dvera 00032
1447
+0.00 H080
E:0
020
223
(a) ROC-AUC
(b) PR-AUC
Figure 2: XGBoost experiments metrics differences between the new method and OC-score for L2 norm.
PRAUC Terene dixt inerer (apdsshool Corral rean
(a) ROC-AUC
(b) PR-AUC
Figure 3: RandomForest experiments metrics differences between the new method and OC-score for La norm.
Of our 338 experiments, our method had the best performance in 107 of them and was tied with one of the other methods as the best in 134 other experiments, which means our method was successful in 71.73% of the experiments. We used the Friedman test on the ROC-AUC metric to validate the statistical significance of differences between the evaluated methods and datasets (Demšar) 2006)_ The above test is non non-parametric test that does not assume anything about the results distributions and is used when dealing with multiple methods and multiple datasets. The null hypothesis that the 3 methods perform the same was rejected with Fr (338, 3) = 288 with < 0.01. As a second step, we used Nemneyi post-hoc test, which often used as a second step if possible to reject the null hypothesis with a Friedman test and test for superiority between the different methods, and concluded that our new representation method outperforms the OC-score method and the usage of a machine learning detector based on the original representations with p < 0.01.
6 DISCUSSION
As we showed in our experiments, using representation learning to learn better version of the dataset given a trained model helps to extract better performance when trying to protect our model against adversarial evasion attacks. We showed this on different datasets, different tree-based en- sembles, and with different attack methods.
An important area for discussion is adversarial attacks on tabular data, which are not as intuitive as adversarial attacks on more continuous inputs such as images or audio. These usually clip the data to valid range of values, which is not straightforward for tabular data. This issue is not yet heavily researched but was already approached and discussed by Calzavara et al. (2020) and Vos & Verwer (202I), where for each dataset, they defined set of rewriting rules and possible budget with which to change the features. We chose not to take up that challenge in this work, but for full context, we added in Appendix Dittnissttsssstssssss regarding our generated adversarial samples.
While analyzing our results, we noticed an interesting outcome of our new representations- generation process. We used UMAP (MeInnes et al., 2018) to extract 2-dimensional versions of the original representations and our new ones. As we can see in Figure on the left side, the reduc- tion of the original representations, there the adversarial samples scattered between the normal
8

---

Under review as a conference paper at ICLR 2023
samples. When looking at the reduced version of our representations the right, that the ad- versarial samples gather closely to each other and are separated from most of the rest of the normal samples.
Atteck: OPT Datasee
Original Representation
Attack: OPT Datanet speech Newr Representation
Figure 4: Dimensionality-reduciioo visualization using UMAP (MeInnes et al. 2018). Green points are normal samples, and red points are adversarial samples. On the left, we can see a reduction of the original representations, and on the right, we can see reduction of the new embedded represen- tations.
CONCLUSIONS AND FUTURE WORK
In this work, presented method to train adversarial samples detector based on rep- resentations of dataset based on the target model trained on it. We showed that using our new representation shows overall improvement compared to the current state-of-the-art detection of ad- versarial samples on tree models without changing the original model internals and compared to using the original samples representations train detector classifier.
As for future work, our new method should also be tested on robust versions tree ensembles to see if it affects the results. Another direction is create unified detector for all attacks together. Our detector method was based on generating adversarial samples for each attack method and training separate model. However, the normal data behave the same regardless of the attack method, and new unified approach should be researched.
REFERENCES
Adult. UCI Machine Learning Repository, 1996.
banknote authentication. UCI Machine Learning Repository, 2013.
Dry Bean Dataset. UCI Machine Learning Repository, 2020.
Maksym Andriushchenko and Matthias Hein. Provably robust boosted decision stumps and trees against adversarial attacks. arXiv preprint arXiv:1906.03524 2019.
Stefano Calzavara, Claudio Lucchese, Gabriele Tolomei, Seyum Assefa Abehe, and Salvatore Or- lando. Treant: training evasion-aware decision trees. Data Mining and Knowledge Discovery, pp- 1-31, 2020.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 20/7 ieee symposium on security and privacy (sp), pp. 39-57. IEFF, 2017.
Hongge Chen, Huan Zhang, Duane Boning, and Cho-Jui Hsieh. Robust decision trees against ad- versarial examples. International Conference on Machine Learning, pp. 1122-1131 PMLR, 2019.

---

Under review as a conference paper at ICLR 2023
Jianbo Chen, Michael I Jordan, and Martin J Wainwright. Hopskipjumpattack: A query-efficient decision-bad based attack. In 2020 ieee symposium on security and privacy (sp), pp. 1277-1294.
IEEE, 2020.
Tianqi Chen and Carlos Guestrin. XGBoost: A scalable tree boosting system. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, KDD ;1, pp. 785-794, New York, NY, USA, 2016a, ACM. ISBN 978 978-1-4503--23211 doi: 10. 145/ 2939672.2939788. URL ottp:p//aaaaaacca..o............ 2297
acm.
Tianqi Chen and Carlos Guestrin. Xgboost: A scalable tree boosting system. In Proceedings of the 22nd acm sigkdd international conference on knowledge discovery and data mining, pp. 785-794, 2016b.
Minhao Cheng, Thong Le, Pin-Yu Chen, Jinfeng Yi, Huan Zhang, and Cho-Jui Hsieh. Query- efficient hard-label black-box attack: An optimization-based approach. arXiv preprint arXiv:1807.044577 2018.
Minhao Cheng, Simranjit Singh, Patrick Chen, Pin-Yu Chen, Sijia Liu, and Cho-Jui Hsich. Sign-opt: A query-efficient hard-label adversarial attack. arXiv preprint arXiv:1909. 10773, 2019.
Rafael M. O. Cruz, Luiz G. Hafemann, Robert Sabourin, and George D. C. Cavalcanti. Deslib: A dynamic ensemble selection library in python. Journal of Machine Learning Research, 21):): 1-5, 2020. /ttp::///
144 html
Nilesh Dalvi, Pedro Domingos, Mausam, Sumit Sanghai, and Deepak Verma. Adversarial clas- sification. In Proceedings of the Tenth ACM SIGKDD International Conference on Knowl- edge Discovery and Data Mining, KDD '04, pp. 99-108, New York, NY. USA, 2004. Associ- ation for Computing Machinery. ISBN 1581 138881. doi: 10.1145/1014052.1011
URL
http///i.orgg/...// www.oo.g11000... 111551111111111111111 https: .
4066
Janez Demšar. Statistical comparisons of classifiers over multiple data sets. The Journal of Machine learning research, 7:1-30, 2006.
Laurens Devos, Wannes Meert, and Jesse Davis. Adversarial example detection in deployed tree ensembles. arXiv preprint arXiv:2206. 2022.
Anna Veronika Dorogush, Vasily Ershov, and Andrey Gulin. Catboost: gradient boosting with categorical features support. arXiv preprint arXiiv/880..1 1163, 2018.
Reuben Feinman, Ryan R Curtin, Saurabh Shintre, and Andrew B Gardner. Detecting adversarial samples from artifacts. arXiv preprint
2017.
Gil Fidel, Ron Bitton, and Asaf Shabtai. When explainability meets adversarial learning: Detecting adversarial examples using shap signatures. In 2020 International Joint Conference on Neural Networks (IJCNN), pp. 1-8. IEEE, 2020.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv: 4rXiv:1412.6577. 2014.
Léo Grinsztajn, Edouard Oyallon, and Gaël Varoquaux. Why do tree-based models still outperform deep learning on tabular data? arXiv preprint arXiv:2207.088/5 2022.
Kathrin Grosse, Praveen Manoharan, Nicolas Papernot, Michael Backes, and Patrick McDaniel. On the (statistical) detection of adversarial examples. arXiv preprint /72.v:/702.06280, 2017.
Yu Huang and Yue Chen. Autonomous driving with deep learning: survey of state-of-art technolo- gies. arXiv preprint arXiv:2006.0609) 2020.
Jeff Johnson, Matthijs Douze, and Hervé Jégou. Billion-scal. similarity search with GPUs. IEEE Transactions on Big Data, 7()):535-547, 2019.
Alex Kantchelian, J Doug Tygar, and Anthony Joseph. Evasion and hardening of tree ensemble classifiers. In International Conference on Machine Learning, pp. 2387-2396, 2016.
10

---

Under review as a conference paper at ICLR 2023
Ziv Katzir and Yuval Elovici. Detecting adversarial perturbations through spatial behavior in activa- tion spaces. In 2019 International Joint Conference on Neural Networks (IJCNN), pp. 1 1-9. IEEE, 2019.
Guolin Ke, Qi Meng, Thomas Finley, Taifeng Wang, Wei Chen, Weidong Ma, Qiwei Ye, and Tie- Yan Liu. Lightgbm: A highly efficient gradient boosting decision tree. Advances in neural information processing systems, 30, 2017.
Murat Koklu and Ilker Ali Ozkan. Multiclass classification of dry beans using computer vision and machine learning techniques. Computers and Electronics in Agriculture, 174:105507, 2020.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. arXiv preprint arXiv: 2016.
Daniel Lowd and Christopher Meek. Adversarial learning. In Proceedings of the Eleventh ACM SIGKDD International Conference on Knowledge Discovery in Data Mining, KDD '05, pp. 641-647, New York, NY, USA, 2005. Association for Computing Machinery. ISBN 159593135X. doi: 10.1145/1011800.0058 0111870.1081955
URL latpss://aolorrg/100. 1145/
Leland Mclnnes, John Healy, and James Melville. Umap: Uniform manifold approximation and projection for dimension reduction. arXiv preprint arXiv: 1802.03426, 2018.
Hendrik Metzen, Tim Genewein, Volker Fischer, and Bastian Bischoff. On detecting adversarial perturbations. arXiv preprint arXiv:170..04267, 2017.
Seyed-Mohsen Moosavi- -ezaooll,,, Alhussein Fawzi, and Pascal Frossard. Deepfool: simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on com- puler vision and pattern recognition, pp. 2574-2582, 2016.
Didrik Nielsen. Tree boosting with xgboost-why does xgboost win" every" machine learning com- petition? Master's thesis, NTNU, 2016.
Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv:1605.0721 2016a.
Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson. Z Berkay Celik, and Ananthram Swami. The limitations deep learning in adversarial settings. In 2016 IEEE European sympo- sium on security and privacy (EuroS&P) P), pp. 372-387. IEEE, 2016b.
Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as a defense to adversarial perturbations against deep neural networks. In 2016 IEEE symposium on security and privacy (SP), pp. 582-597. IEEE, 2016c.
Ravid Shwartz-Zivv and Amitai Armon. Tabular data: Deep learning is not all you need. Information Fusion, 81:84-90, 2022.
Annette Vestby and Jonas Vestby. Machine learning and the police: asking the right questions. Policing: A Journal of Policy and Practice, 2019.
Daniël Vos and Sicco Verwer. Efficient training of robust decision trees against adversarial examples. In International Conference on Machine Learning, pp. 10586-10595. PMLR, 2021.
Daniël Vos and Sicco Verwer. Robust optimal classification trees against adversarial examples. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pp. 8520-8528, 2022.
Siyue Wang, Xiao Wang, Pu Zhao, Wujie Wen, David Kaeli, Peter Chin, and Xue Lin. Defensive dropout for hardening deep neural networks under adversarial attacks. In Proceedings of the International Conference Computer-Aided Design, pp. 1-8, 2018.
Yao- Yuo-Yunn Yang, Cyrus Rashtchian, Yizhen Wang, and Kamalika Chaudhuri. Robustness for non- parametric classification: A generic attack and defense. International Conference on Artificial Intelligence and Statistics, pp. 941-951. PMLR, 2020.

---

Under review as a conference paper at ICLR 2023
Chong Zhang, Huan Zhang, and Cho-Jui Hsieh. An efficient adversarial attack for tree ensembles. arXiv preprint arXiv:2010.115%0 2020.
Kevin Zhou, Hayit Greenspan, Christos Davatzikos, James S Duncan, Bram van Ginneken, Anant Madabhushi, Jerry L Prince, Daniel Rueckert, and Ronald M Summers. A review of deep learning in medical imaging: Imaging traits, technology trends, case studies with progress highlights, and future promises. Proceedings of the IEEE, 2021.
A APPENDIX A FULL METRICS DIFFERENCES FIGURES
Here are all the different figures comparing our method to OC-Score and detector based on the original representations of the dataset. For the experiments compared to the OC-score (Figures 9 and [T) the total mean and the median of each section is positive in all of them, which means that our metrics yielded better results for the new representation in most of our experiments. When looking at figures that compare our method to the original representations (Figures) 8 | and
12) we can see the ROC-AUC and PR-AUC overall mean of the experiments is positive beside the experiments targeted XGBoost with Lo norm which the overall mean is negative.
dfferences per ottack Inorm. [KCBoost mean 0.05031
PR AUC differences per attack Iorm: XGGlosst Ovenall mean 0.3533
Sgnd07
OPT
Dubc-
M5A
Lev
LeaFTpple
-033
55
8:00
0.3
Improverant
(a) ROC-AUC
(b) PR-AUC
Figure 5: XGBoost experiments metrics differences between the new method and OC-score for L2 norm.
ROC offereecee
[XGBoost
0000707
PRAUCC difieences per attack morre MiBooon Ovenal meen; 0.3015
5go097
OF7
Oute
0.00
HSA
IGA
Lex T1ph
%
Laaficcle
(a) ROC-AUC
(b) PR-AUC
Figure 6: XGBoost experiments metrics differences between the new method and OC-score for Loo norm.
12

---

Under review as a conference paper at ICLR 2023
RCC-AUE dfheences per aftack [ncem:2 [XCiloow (Dvenal mean: 0.01
|KGBoott Overaal
5ghom
Sinder
+
0100
0.3
-12
0.
Fnrowara::
(a) ROC-AUC
(b) PR-AUC
Figure 7: XGBoost experiments metrics differences between the new method and original represen- tation for L2 norm.
ROC AUC dfferences per attace] nonite XGBoest Overall mean 0.005250
PRAAUC diffrences per artack| norm: XGBoost Overall mean: 0000001
SandFF
J0K2
0ute
Cade
1834
1554
Lea
3.35
Impoowmmntt
introwamnn
(a) ROC-AUC
(b) PR-AUC
Figure 8: XGBoost experiments metries differences between the new method and original represen-
tation for To norm.
ROC dffrrncce
Randonforett Ovenal mean: 05366
TRALLI attack Randonffowee Gueral mean 0.4444
Sgy077
Sipder
Cabe
Loctlppe
8-00
-13
60
(a) ROC-AUC
(b) PR-AUC
Figure 9: RandomForest experiments metrics differences between the new method and OC-score for L2 norm.
13

---

Under review as a conference paper at ICLR 2023
14/077
Abcok
Col
LouTggh
(a) ROC-AUC
(b) PR-AUC
Figure 10: RandomForest experiments metrics differences between the new method and OC-score for Lo norm
Pffrrncce Ransomforett Ovenal mean 0.04110
3008
Dde
00
Leatipe
(a) ROC-AUC
(b) PR-AUC
Figure 11: RandomForest experiments metrics differences between the new method and original representation for La norm.
ROC-AUC offerences atteck marm: Inf] Randberfonet Overal 8.087837
PR-AUC offerences per aback nnrmicet Rancomforet Overa 0.01211
1EA
8005
2.51
(a) ROC-AUC
(b) PR-AUC
Figure 12: RandomForest experiments metrics differences between the new method and original representation for Loo norm.
B APPENDIX B XGBOOST FULL EXPERIMENTS RESULTS
List of tables with the raw experiments metrics for each dataset, attack method, and norm for the XGBoost target experiments. In bold is the method or methods that achieved the highest value. Rows that fill in hyphens are cases where the adversarial sample creation process failed.
C APPENDIX C RANDOMFOREST FULL EXPERIMENTS RESULTS
List of tables with the raw experiments metrics for each dataset, attack method, and norm for the RandomForest target experiments. In bold the method or methods that achieved the highest value. Rows that fill in hyphens are cases where the adversarial sample creation process failed.
14

---

Under review as a conference paper at ICLR 2023
Sign- OPT L2
Sign-OPT Loe
PRC-AUC
ROC-AUC
PRC-ATIC
ROC-AUC
Ditaser
New
Original
OC-spore
New
Original
OC-score
New
Original
OC-szore
New
Original
OC-sccre
Ircast-cancer
0.988
0.9019
0,958
0,9919
0:965
0.9971
0.907
0.960
0.997
0.999
0.970
covtype
1,0
0.049
1.0
0.843
1,0
1.0
1,0
cod-ma
0.743
0.7688
0.161
0.9799
0.955
0.880
0,7773
0.599
0.238
0.9808
0.936
0.889
diabetes
0,672
0.855
0.730
0.707
0.8432
0.772
0.580
0.8668
0.645
0.702
0.8678
0.615
Fashion-MNIST
1.0
1.0
0.157
1.0
0.839
0.9999
0,9999
0.257
1.0
1.0
0.904
ijnnn
0.181
1.0
0.907
1
0.276
1.0
MNIST
100
1,0
0.327
1.0
1.0
0.945
1.0
1,0
0.434
1.0
1.0
0.960
MN15T226
0,9999
0.9999
0.999
1.0
1.0
0.999
1.0
1.0
0.991
1.0
1.0
0.999
Sensrless
0,887
0.803
0.9111
0,950
0.934
0.99K2
0,9709
0.939
0.867
0.997
0,967
0.9984
wehapam
01255
1.0
1,0
0.99
elecricity
0.751
0.9763
0.129
0.997
0.883
0.829
0.9661
0.970
0.9968
drybomn
0.942
0.9617
0.705
0.975
1.9862
0.974
0.95KS
0.914
0.796
0.9W6N
0.955
0.967
adult
1.0
1,0
01.00)
1.0
1.0
0.813
1.0
1,0
0.128
1,0
1.0
0.817
banknote
0.968
0.99
0.768
0.970
0,9918
0.9699
0.961
0.798
0,9822
0.982
0.957
gendee-by-voice
0.887
0.989
0.9964
0.960
0.990
0.9975
waveform
0,540
0.5538
0.380
0.303
0.801
0.8628
0.467
0.5575
0.461
0.717
0.779
0.8665
wind
0.695
0.8821
0.183
0.858
0,9414
0.730
0.526
0.7558
0.205
0.819
0.8812
0.712
speech
0,990
0.915
1,0
0.999
0.995
1,0
0.9943
0.965
0.967
0.9987
0.990
0.998
Table 2: Sign-OPT XGBoost Experiments Results
OPT by
OPT L.p.
PRC-AUC
ROC-AUC
PRC-AUC
ROC-AUC
Datasct
New
Original
OC-scure
New
Original
OC-scure
New
Original
OC-scure
New
Original
OC-score
breast-cancer
0,992
0.9956
0,857
0.992
0,9952
0.925
0.973
0,9737
0.920
0,9788
0,978
0.968
covtype
1.0
1.0
0.056
1.0
1.0
0.768
1.0
1.0
0.072
1,0
1.0
0.856
ma
0.884
0.183
0.958
0.892
0.647
0.9774
diabetes
0.652
0.8434
0.591
0.675
0.8612
0.741
0.8455
0.751
0.699
0.8174
0.745
0.736
Fashiso-MNIST
1.0
1.0
0.370
1.0
1.0
0.925
1.0
1.0
0.445
1.0
1.0
0.936
ijonn
1.0
1.0
0.273
1.0
1.0
0.926
1.0
1.0
0.246
1.0
1.0
01941
MNIST
0.476
1.0
0:971
1.0
1.0
0.975
MNIST2.6
0.996
1.0
1.0
1.0
0.986
1.0
sensorless
0.9922
0.974
0.885
0.999NN
0.900
0.999
0.9871
11965
0.877
0.999
D. 035093
0.998
wehopaa
1.0
1.0
0.399
1.0
1.0
0.992
1.0
1.0
0.387
1.0
1.0
0.991
electiiiyy
0.774
0,8818
0.248
0.948
0.982
0.887
0.852
0
0.286
0,9731
0.960
0.904
drybean
0.848
0.984
0.934
0.964
0,970
adult
1.0
1,0
0.076
1,0
1.0
0.791
1.0
1.0
0.058
1.0
1.0
0,702
banknate
0,9893
0.950
0.911
0.9906
0.984
0.976
0.956
0.942
0.876
0.974
0.967
0.9767
gonder-hy-wiice
0.964
0,9943
0,812
0.981
0.9964
01964
0.976
11 1.99226
0.842
0.987
0,9951
0,974
waveforn
0,6195
0.392
0.777
0,8524
0.6673
0.819
0,800
wind
0.476
0.7908
0.310
0.777
0.9054
0.785
0,423
0.7694
0.176
0.755
0,8653
0.729
speach
0.9917
0
0.973
0.9986
0.997
0.99%
0.9957
0.799
0.984
0.9996
0.977
1.0
Table 3: OPT XGBoost Experiments Results
HSIA L
HSJA Lse
PRC-AUC
ROC-AUC
PRC-AUC
ROC-AUC
Dataset
New
Original
OC-suure
Original
OC-score
Now
Original
OC-szure
New
Original
OC-score
breast-cumoer
0,9909
0.988
0.799
0.9905
0.988
0.923
0.982
1.9956
0.934
0.987
0.995%
0.954
cavtype
1.0
1.0
0.159
1.0
1.01
0.832
1.0
1.0
0.230
1.0
1.0
0.811
ond-ma
0
0.669
0.107
0.9879
0.926
0.817
0,839
0.194
0.185
0.9891
0:944
0.847
diahetes
0.7947
0.786
0.522
0,834
0.830
0.708
0.787
0.8219
0.516
0.790
0.8325
0.710
Fashion-MINIST
0.994
0.235
1.0
0.881
0,9997
1.0
ijcnn
1.0
1.0
0.089
1.0
1.0
0.846
1,0
1.0
0.152
1.0
1.0
0
MNIST
1.0
1.0
0.493
1.0
1.0
0.954
1.0
1.0
0.420
1.0
1.0
0.945
6
1.0
1.0
0.965
1.0
0.998
1.0
1.0
0.972
1.0
1.0
0.998
sensorless
0.729
0.839
0.920
0.9175
0.782
0.930
websspam
0.9859
0.986
0.232
0.9999
1.0
0.985
1.0
1.0
0.212
1.0
1.0
0.984
electiiity
D. 705
0.9084
0.098
0 0.962
8.9769
0.624
0
0.853
0.189
0.9841
0.953
01852
dryhean
0.9568
0.943
0,872
0.9826
0.974
0.977
0.9561
0:953
0.846
1.9795
0.979
0.978
adult
1.0
banknote
0
0.851
0.742
0.889
0,90117
0.901
0.895
119001
0.658
0.9265
0.907
0.869
gender-hy-nnice
0.920
0 0.9668
0.787
0.952
8.9758
0.962
0.961
(L9882
0.721
0.975
0.9927
(1.47
wavefonn
0.6012
0.592
0.493
0.774
0.768
0,883
0.680
I1692
0.372
0.8123
0.815
0.831
wind
0.763
0.7846
0.309
0.881
0,8814
0.824
0.712
0.8311
0.328
0.870
0.9151
0.789
speech
0.9955
0.989
0.999
0.995
0.991
0.9995
0.999
Table 4: HSJA XGBoost Experiments Results
15

---

Under review as a conference paper at ICLR 2023
Cube 42
Cabe Loe
PRC-AUC
ROC-AUC
PRC-ATIC
ROC-AUC
Ditaser
New
Original
OC-spore
New
Ohiginal
OC-score
New
Original
OC-szore
New
Original
OC-sscoe
Ircast-cancer
0.537
0,7413
0.591
0U887N
0.869
0.9257
0.303
0,931
0.9665
0.575
covtype
0.649
0.838
1,0
1.0
cod-ma
0.7678
0.212
0.183
0.985
0.800
0.873
0.8643
0.732
0.343
0.9841
0.944
0.915
diabetes
0.5437
0.458
0.258
0.7915
0.717
0.724
0.567
0.6097
0.532
0.7316
0.667
0.710
Fashion-MNIST
0.9094
0.538
0
0.9951
0.798
0.850
0,8929
0.750
0.014
0.999
0.999
0.903
ijenn
0.773
0.246
0.915
0.905
0.9998
0.216
1.0
MNIST
0.7755
0.263
0.202
0.9846
0.735
0.926
1.0
10
0.028
1.0
1.0
0.917
MN15T2-6
0.965
0.9853
0.977
0.990
0.995
0.9979
1.0
L.0
0.967
1.0
1.0
0.999
semsorless
0,8793
0.650
0.595
0.994
0.916
0.9%6
1,0
1.0
0.770
1,0
1.0
0.99
wehepam
0.9185
0.297
0.984
0.9904
119994
1,0
elecmicity
0.7746
0.671
0.312
0.9666
0.887
0.904
0.99331
0.986
0,652
0.9996
drybcmn
0.9954
0.987
0.721
0.99%
0.999
0.975
1.0
1.1
0.610
1.1I
1.0
0.937
adult
D.944
0.9454
0,315
0
0.985
(1941
1.0
1,0
0.551
1,0
1.0
0.998
banknote
0.6201
0.409
0.971
0.9891
0.9973
(1.9973
0.364
0.9992
0.9992
0.923
gender-by-voice
0.866
0.663
1.0
1.0
1.0
0.671
wiveform
0.9614
0.959
0.426
0.9754
0.969
0.838
1.0
1.0
0.188
1.0
1.0
0.705
wind
1
1.0
0.754
1,0
1.0
0.966
1.0
1.0
0.017
1.0
1.0
0.119
speech
Table 5: Cube XGBoost Experiments Results
Leaf- Tuple
Leaf- Tuple Aow
PRC-AUC
ROC-AUC
PRC-AUC
ROC-AUC
Datasct
New
Original
OC-scure
New
Original
OC-scure
New
Original
OC-scure
New
Original
OC-score
breast-cancer
0.9954
0.989
0.921
0.9954
0.968
0,915
0.871
0.835
0.9399
0.893
0.854
0.9356
covtype
0.9962
0.723
0.118
0,9995
0.934
0.761
0.996
0.783
0.110
0.9999
0.950
0.782
ma
0.540
0,9822
0.861
0.97
0.986
diabetes
0.7227
0.653
0.557
0.7826
0.688
0.685
0.561
0.5782
0.119
0.613
0.6522
0.611
Fashion-MNIST
0.9627
0,948
0.367
0.9891
0.973
0.759
0.9544
0.951
0.393
0.9868
0.978
0.786
ijonn
D.946
0.9584
0.68
0.944
0.9867
0.906
0.960
0.9711
0.744
0.988
0.9899
0,935
MNIST
0.995
0,9983
0.400
0.997
0.773
0,9972
0.997
0.355
0.9993
0.800
MNIST2.6
0.81
0.989
0.9995
0.999
0.9995
Sensorless
0.9657
0.965
03889
0.9K55
0.985
0.969
0,9712
D. 13.669
0.891
0.98%6
0.986
0.956
wehhopam
1.0
1.0
0.322
1.0
1.0
0.946
1.0
1.0
0.318
1.0
1.0
0.942
electiciy
0.987
0.987
0.712
0.9955
0.995
0.925
0,9938
0.992
0,700
0.9976
0.997
0.933
drybean
LO
0.963
1.0
adult
1.0
1,0
0.982
1,0
1.0
0.999
1.0
1,0
1,0
1.0
1.0
banknate
0.997
1.0
0.728
0.998
1.0
0.920
1.0
1.0
0.756
1.0
1.0
0,953
gonder-hy-wnice
1.0
1.01
0.947
1.0
1.0
0199%
1.0
1.0
0.922
1,0
1.0
0.974
waveform
1.0
1.0
1.0
wind
1.0
0.995
1,0
1.0
0.999
1.0
1.0
0.834
1.0
1.0
0.999
speach
1.0
1.0
0.976
1.0
1.00
0.995
1.0
0.9999
0.992
0.9999
8,9999
0.998
Table 6: Leaf- XGBoost Experiments Results
Sign- OPT- L2
Sign OPT Ls:
PRC-AUC
ROC-AUC
PRC-AUC
ROC-AUC
Dataset
New
Original
OC-sume
Original
OC-score
Origina
OC-szure
New
Original
breast-cumoer
0,992
0.983
0.9952
0.992
0.986
0.9962
0.965
0.997
0.997
0.961
0.997
0.9074
cavtype
1.0
1.0
0.007
1.0
1.0
0.859
1.0
1.0
0.080
1.0
1.0
0.731
ond-ma
0.9572
0.918
0.348
0.9982
0.995
0:925
0.9266
0.744
0.178
0.99
0.979
0.89%
diahetes
0.840
0.8485
0.595
0,8893
0.854
0.764
0.738
0.8493
0.669
0.815
0.8735
0.809
Fashion-MNNIST
1.0
0.147
1.0
0.919
1.0
1.0
1.0
ikcnl
1.0
1,0
0.375
1.000
1.0
0.972
1,0
1.0
0.390
1.0
1.0
0.958
MNIST
1.0
1.0
0.238
1.0
1.0
0.929
1.0
1.0
0.553
1.0
1.0
0.967
6
1.0
1.0
0.569
1.0
0.930
1.0
1.0
0.872
1.0
1.0
0.990
sensorless
0.735
0.637
0.912
0.968
0,9982
websspam
1.0
1.0
0.161
1.0
1.0
0.981
1.0
1.0
0.138
1.0
1.0
0.979
electiiity
0.930
0.9644
0.295
0.905
0.9975
0.892
0.966
(L9696
0,4416
0.9981
0.9993
0.917
dryhean
0,9808
0.914
0,810
0.9897
0.946
0.987
0.97.3
1.948
0.966
(L9945
0.977
0.991
adult
1.0.
1.0
banknote
0,856
0,9614
0,875
0.941
0.969
0.9809
0.98447
0.982
0.920
0.988M
0.981
gender-hy-anice
0.069
0.998N
0.751
0.986
0.9992
0.546
0.9957
1.989
0.942
0.9976
0.995
(1.89
wavefonn
0.8227
0.756
0.447
0.9182
0.868
0 0.897
0.787
0.9148
0.516
0.914
0.9552
0.918
wind
0.784
0.9087
0.309
0.943
0
0.897
0.745
0.8766
0.379
0.934
0.9551
0.894
speech
Table 7: Sign-OPT RandomForest Experiments Results
16

---

Under review as a conference paper at ICLR 2023
OPT L2
OPT Loo
PRC-AUC
ROC-AUC
PRC-ATIC
ROC-AUC
Dissset
New
Original
OC-score
New
Original
OC-score
New
Original
OC-szore
New
Original
OC-sccre
Ircast-cancer
0,975
0.9926
0.947
0.9935
0:973
0.980
0.9932
0.834
0,978
0.9937
0.909
covtype
1,0
1.0
0.868
1,0
1.0
cod-ma
0.9316
0.927
0.163
0.9977
0.994
0.878
0.9069
0.747
0.148
0.9948
0.973
0.915
diabetes
0.747
0.7514
0.509
0.784
0.8161
0.719
0.5589
0.842
0.545
0.913
0.878
0.701
Fashion-MNIST
1.0
0.236
1.0
0.938
1.0
1.0
0.220
1,0
1.0
0.932
ijnnn
0.366
0.947
1,0
MNIST
100
1,0
0.555
1.0
1.0
0.971
1.0
1.0
0.484
1.0
1.0
0.961
MN15T226
1.0
0.9997
0.859
1.0
1.0
0.989
1,0
1.0
0.800
1,0
1.0
0.977
Sensrless
0.9705
0
0.704
0,9978
0.967
0.977
0,9772
0.938
0.694
0,9984
0,973
0.967
wehopam
1,0
1,0
elecmicity
0.936
0.9964
0.956
0.992
0.997
drybomn
0
0.917
0,902
0.9%
0.958
0.993
0.9777
0.951
0.806
0.9932
0.971
0
adult
1.0
1,0
0,398
1.0
1,0
0.918
1.0
1,0
0.278
1,0
1.0
0.864
banknote
0.954
0.9975
0,908
0.968
0.9982
0.982
0.942
0L9504
0,349
0.964
0.9672
gende--by-voice
0.9968
0.968
0,9947
0.991
wiveform
0.8013
0.790
0.447
0.899
0.893
0.9103
0.659
0.6708
0.481
0.826
0.824
0.8952
wind
0.752
0.8612
0.236
0.922
0.9273
0.810
0.740
0.8563
0.354
0.923
0.9465
0.870
speech
Table 8: OPT Random Forest Experiments Results
HSJA by
HSJA L.e.
PRC-AUC
ROC-AUC
PRC-AUC
ROC-AUC
Datasct
New
Original
OC-scure
New
Original
OC-scure
New
Original
OC-scure
New
Original
OC-score
breast-cancer
0
0,983
0.962
0.9675
0.986
0.984
0,980
0,9974 1,0
0.774
0.986
0,9982
0.936
covtypu
1.0
1.0
0.230
1.0
1.0
0.835
1.0
0.245
1,0
1,0
0.853
ma
diabetes
Fashion-MNIST
0.9999
0.99V9
0.248
1.0
1.0
0,943
1.0
1.0
0.240
1.0
1.0
0.943
ijonn
1.0
1.01
0..24
1.0
1.0
01902
1.0
1,0
0.237
1,0
1.0
01887
MNIST
0.321
1.0
1.0
1.0
0.953
MNIST2.6
0.775
1,0
1.0
sensorless
0.9245
0.777
0.550
0.99134
0.931
0.948
0.NNNS
0.737
0,430
0.991.3
0.911
0.951
wehopam
1,0
1.0
0.094
1.0
1.0
0.959
1.0
1.0
0.041
1.0
1.0
0.900
electiciyy
0
0,931
0.297
0.9935
0.991
0.920
0.947
0,9544
0.290
0.9973
0.989
0.882
drybean
0.978
0.984
0.997
adult
1.0
0.538
1,0
1.0
0.931
1.0
1.0
0.480
1.0
1.0
0,877
banknate
0.9632
0.874
0.747
0.9642
0.916
0.909
0.943
0.9499
0.774
0.9579
0,955
0.921
gonder-hy-wnice
0.955
0
0.724
0.973
0,98K2
(1 01944
0.966
0.96844
0.726
0.975
0,9765
0,930
waveform
0,818
wind
0.8744
0.860
0.425
0.9495
0,916
0. 0.852
0.843
0.8597
0.311
0.9519
0.941
0,858
speach
Table HSJA RandomFores Experiments Results
Cube I
Cube Lsc
PRC-AUC
ROC-AUC
PRC-AUC
ROC-AUC
Original
OC-sumee
Original
OC-score
Origina
New
Original
breast-cunoer
0.435
0.139
0.6983
0.738
0.283
0.9391
1.0
0.932
0.173
1.0
0.979
0.695
cavtype
0.7853
0.123
0.106
0.9911
0.710
0.752
1.0
1.0
0.070
1.0
1.0
01831
ond-ma
0.7844
0.299
0.111
0.9871
0.876
0.815
0.9158
0,833
0.164
0.9955
0.974
0.872
diahetes
0.6343
0.248
0.307
0.9185
0.620
0.750
0.384
0.4718
0.307
0.562
0.6139
0.597
Fashion-MNNIST
0.864
0.9090
ijcnn
0,8503
0.612
0.250
0.9949
0.967
0.883
0.984
1.0
0.120
1.0
1.0
0.870
MNIST
0.9337
0.894
0.335
0.9978
0.972
0:957
1.0
1.0
0.852
1.0
1.0
0.994
6
0.9399
0.933
0.358
0.990
0.971
0.9914
1.0
1.0
0.910
1.0
1.0
0.991
sensorless
0.968
0,9998
websspam
0.9345
0.735
0.311
0.9984
0.952
0.979
1.0
1.0
0.127
1.0
1,0
0,913
electiiity
0.9726
0.914
0.445
0.9978
0.975
0.852
0.99NN
U. 1.99
0.095
0. 0.9999
1.0
01877
dryhean
0.938
0.964
0.797
0.9862
0.980
0.964
1.0
1.0
0.838
1.0
1.0
0.990
adult
banknote
0.9316
0.865
0.504
0.9853
0.964
0.957
019444
1.0
0.176
(.996
0.927
gender-hy-anice
0.5822
0.839
0.481
0.9799
0.963
0.941
1.0
1.0
0.547
1.0
1.0
01869
wzvefonn
0.954
0.9838
0.226
0. 0.9739
0.973
0.799
1.0
1.0
0.083
1.0
1.0
0,542
wind
speech
Table 10: Cube RandomForest Experiments Results
17

---

Under review as a conference paper at ICLR 2023
Leaf Tuple
Leaf- Taple I.w
Dataact
New
Original
OC-scure
New
Original
OC-scure
New
Original
OC-scure
New
Original
OC-score
breast-cancee
0.971
0.9964
0.939
0.972
0.9964
0.947
0.995
0.9964
0.872
0.995
0.9965
0.922
covtype
diabetes
Fachion-MNIST
0.8023
0.578
0.035
0.9918
0.878
0.688
0.8884
01643
0.021
0.9916
0.844
0.602
ijonn
0.9939
0.994
0.922
0.99K1
0.998
0.982
0.99X
0.9929
0.931
01997
0.99%
0.988
MNIST
0.7772
0.025
0.625
0.8996
0.9883
Sensorless
0.6531
0.171
0.030
3
0.709
0.772
0.9422
0.799
0.042
0.99338
0.931
0.677
wehopam
1,0
1.0
0.731
1.0
1.0
0.978
1.0
1.0
0.602
1.0
1.0
0.978
electiciyy
0.999
0.9997
0,822
0.9999
0.976
0.996
0.999
0.828
0.999
0.9997
0.947
drybean
adult
1.0
0.169
1.0
0.991
1,0
1,0
0.812
1.0
0.995
banknate
1.0
1.0
0,805
1.0
1.0
0.977
1.0
1.0
0.544
1.0
1.0
0.893
gonder-hy-wiice
1.0
1.01
0,892
1.01
1.0
01981
1,0
1,0
0.866
1,0
1.0
0.968
waveform
wind
0.366
1.0
0.950
1.0
0,451
1.0
0,986
speach
Table 11: Leaf- Tuple RandomForest Experiments Results
18

---

Under review as a conference paper at ICLR 2023
D APPENDIX D ADVERSARIAL SAMPLES INFORMATION
In the following tables, we calculated several statistics about the perturbations generated our various experiments split by target model type and attack method. Interesting behaviors noticed:
We can that for SignOPT and OPT attacks in all of the experiments, perturbation was applied to all of the features (max features changed is equal to the mean, which is also equal to the number of features for each dataset).
The mean perturbation size for datasets adult and drybean seem very high for attack meth- ods HopSkiplumpAtttck, Cube, and LeafTuple.
D.I XGBOOST PERTURBATION STATISTICS
Sign lg
Sign-OPT Iou
Datanet nume
Alraters chanped
aleature champel
Moon [aall pertorfution
Mintury chanped
Alaaturs champel
perturliation
Ireast
Gonnge
1.0
Fillin MNNST
764
794.5
0.0514
754
764.0
0,0423
Honel
22
22.0
038425
22
22.01
000419
MNNS
761
751.0
1078
151
711.11
Sansiies
13.0
43.11
0.014
seltspara
251
250.5
00031
254.
00000
784.0
1400
100000
17985
render by NoLce
2000
03243
20
2030
00096
wuvefoon
100
40
0031
0.742
wind
1400
11833
140
speenn
100
0000
10000
4000
1.1933
Table 12: XGBoost OPT perturbations statistics
OPT Zo
OPT 1.w.
Datasel
Max Afcature changed
Mton Nicature changed
Mean
[aal
Max Afesture changed
Moan #fcature changed
Meun [Mx
11
10.0
0.3274
covtype
cod-ma
8.0
00436
8.0
0.039
Ailbetes
8
80
0TA62
8.0
Fishanos MINIST
754
7540
01973
784.0
MNIST
784
784.0
0.889
785.0
0,1551
sensee less
48
45.0
00201
18
15.0
0,233
webspum
254
254.
00132
254
254.00
0,0093
MNIST
754
7840
03365
754.11
0.4035
elecriiity
drybean
16
16.0
00069
16.0
0.0481
adult
14
14.0
0.8486
14
14,0
0,7598
banknote
4.0
13506
4.0
1,3701
voce
00258
Naveloem
4010
wind
14
14.0
0.386
14,0
0.876
speech
100
4000
13433
400
400.0
1.6199
Table 13: XGBoost OPT perturbations statistics
19

---

Under review as a conference paper at ICLR 2023
HSJA Lg
TISJA
Dataset Afeature changed
Mcan tifeature changed
Mean
Max Micature changed
Mean #fcature changed
Mean [Mux
0,2454
coviype
33
43,42
0.1805
43.29
0,199
cod-ma
7.35
00854
8,0
0.1099
dulbeees
7,0091
07746
7,8335
0.0658
MINST
775
740.T8
19.95
M
768
107.41
4.0007
702
705.16
1,0578
senserless
48
45.0
00069
48
48.0
0,0777
253
251.35
0.1992
233,82
0,4914
723.38
electniclly
7.78
0.0199
7.88
0.01RS
dry
16
14.46
1653,5116
16
14.45
2311
adult
14
15.31
95-94966
13,42
383.9R2
4.1
Sendar-by-voee
19.79
waveform
40.0
4.3889
39.96
4,7256
wind
14
13.8
7,9845
13.77
9.192
speech
100
8000
66 66.9108
400
40000
86,3313
Table 14: XGBoost HSJA perturbations statistics
Cube 1/
Cabe Ioe
Datasel name
Max Pleature changed
Meon Nicature changed
Mean [[]]
Max Weature changed
Mean dleatare changed
Mean [Mx
2,7778
0.3519
9,1875
0.6094
owlype
0,592
7.27
017209
Jishetcs
22
7.31
DORN
Fosh woah MNNIT
TNNIST
70
1608
00172
658
555.6
C0154
10
4,02
16.3
0,0389
MNIST
senserless
26
33959
00065
45.27
0.0099
webspum
18
9:44
00032
103
165.21
0.0038
MNNST 1s.
55
25207
0T066
537
478,7344
0T1522
elecrneity
3.26
174744
7.5
3.1356
drybean
12,95
adult
6.1012
168527,4792
11,9667
78961.033
bankmote
1.6
3.2732
3,9074
3.7962
ponder-by woiee
3,7788
29813
19,7365
46.3009
3085
4.309
wind
speech
Table 15: XGBoost Cube perturbations statistics
Leaf-Tuple
Tuple #feature changed
name
ehanged
Miature changed
Mean [[]]
Weature changed
breast-cancer
333
02003
10
6.1292
0.228
covtypa
27717
0.044
3.7392
0.0404
7,9905
0.0399
7,9832
0.035
Fiwhorn
3463
470.9784
0.869
Ijenn]
12
11,009
0033
12
12.0
MNNIST
357
1793864
03699
301
181,607
03722
16
4.2944
6,2854
0.0299
webspam
MNIST 2 vs.
324
1953
036655
193,2004
0.829
dlectninity
2,321
29138
3,5814
TORSY
Aryhom
16
140
10141.401 4015
Adult
11.179
18331 1499
T0322T
TOKS0R 9507
hanknote
gender vose
20
18.1538
55.5696
18.3013
31.3279
Wavefoom
24
19 3467
10900)
22,764
40157
14
13.7389
67.9944
13,8935
68.1225
speech
Table XGBoost Leaf-Tuple perturbations statistics
20

---

Under review as a conference paper at ICLR 2023
D.2 RANDOMFOREST PERTURBATION STATISTICS
Sun-OPT Lq
Dateett
Mas Alsalurs chunged
Moan Aleaaure changal
Mosn
[[[]]] perturtution
Mas Mledum changed
Mean Alrater chanped
Moa [
|| perturlation
braal canser
0.2264
L0
10.0
0.230
1::1
5011
(10079
coderea
8.0
0.850
1.0
0.0514
cialetes
3.3
03845
1.0
781.0
250.0
(100TV
MNIST 2
764
794.0
0.2535
784
784.0
0,76
clocrasit
330
00030
8.0
00177
16.1
15
16111
IDOTT
Alui
14.0
036
1401
Tanietic
200
11805
Table 17: RandomForest Sign-OPT perturbations statistics
OPT 1/2
Joc
Dataset name
Max Meatuue changed
Mean Meeature changed
Mean [2,]
Max Meaauue changed
Mean #feature changed
Mean [4xx]]
breast: sancer
10
100
0.3003
10
10.0
0,2835
34
$4,0
00691
54,0
0,0675
Fish sos- MINIST
754
784.0
00459
754
784.0
0.0114
Ijcnal
22
22.0
0.065
22.0
0.0641
MNIST
784
784.0
0.0253
754
784.0
0,0126
webspum
254.0
0.0027
MINST Vo
754
78400
01705
754
784.0
017734
elestnelly
8
800
00214
8.0
0,0185
16.0
1L785
hanknote
1.399
4.1
L,3036
gender voace
20
20.0
0U0208
20
20.0
0.0271
wavelfor
40
40.0
10321
30.0
0,8934
witld
sperch
Table 18: RandomForest OPT perturbations statistics
HSJA L2
VISIA
Dataset
Max Mfcature changed
Mean Vieature changed
Mean [Z]]
Max Mecature changed
Mean #feature changed
Meun [A....
civlype
30
4542
02501
43.36
0,2679
cod-ma
diilettss
MNIST
783
66077
Ijennl
0.2578
MNIST
755
673.45
03500
753
66030
0.3491
Renssrrlsss
48
45.0
0.089
48
48.0
C0641
webspan
246
219.8
0.1553
218.81
0,1238
MNNST
electmecly
7.79
00039
7.83
0031
hran
16
14.35
27044
16
14.35
43453
Adiilt
14
15.15
9.2404
13.19
6,64%
4.0
372265
4.0
3.035
gender vouce
Navefoom
40
60.0
4,0063
39.98
3,8479
wind
14
13.67
10.36
13.76
7.8599
sperch
Table 19: RandomForest HSJA perturbations statistics
21

---

Under review as a conference paper at ICLR 2023
Cube 12
Cube Ine
Dataset name
Max Alcature changed
Mean Vicature changed
Mean Lg
Max Meaauue changed
Mean #leature changed
Mean Loc
breask
2,5556
0.326
9,3657
0.3759
coytype
onl-mi
Jisheics
1.75
0.3775
7.2381
0.124
MNIST MNNST
22
8.86
0.248
715
552,09
0.0251
2.47
0094
15.83
0.0044
sinsellss
2.56
00106
44.74
00233
wehspam
2333
01141
2013
164.45
00022
MNIST vs.
16
7305
0TT64
581
472.78
C.TIM
electneity
0,9922
1:74
3,3875
dryhean
Adult
1.27
301.91
11.24
banknote
2.0
5.9102
4,0
4.1188
gender
15
4,8636
2.4741
19,6341
27.7117
wavelorm
Wind
spacc
Table 20: RandomForest Cube perturbations statistics
Leaf-Tuple Ln
Leaf-Tuple L.
Dalase name
Max #leature changed
Mean Neature changed
Mean [o]
Max Weaauue changed
Mean Hlaature chunged 3.009
Mean [A...
Incast-cancer
T0
6,500
075007
0,2807
coytype
7.922
disbetes
Fashace MNIST
655
424.6636
03172
866
379.701
0.0233
12
12.0
0051
12,00
0.0568
MNNST
276
sensovless
1,1168
wehipam
23
11.7593
04215
13,0009
DATTII
M
324
190.5356
03724
324
191,279
0.8709
2.7642
3,0778
3.5
3.1415
dryhean
51689.5417
adult
12
10.5997
194008 9416
10,7183
192289 8632
banknote
2,8361
3.1703
3,1033
3.3954
gender
19
18.114
34,336
18.1325
32.0325
17.78
18,3015
4,4844
6R081
spesch
Table 21: RandomForest Leaf-Tuple perturbations statistics
22

---

Under review as a conference paper at ICLR 2023
E APPENDIX E DETECTOR ABLATION STUDY
We wanted to investigate how three aspects of our detector affect our metrics results:
1. The dimensions of our new representations (for the samples and for the nodes).
2. The machine learning classifier that was chosen as the final adversarial detector.
3. Key hyperparameters of the final adversarial detector.
To do tests, we took different experiments and showed their results:
XGBoost target with codrna dataset and OPT attack method.
RandomForest target with sensorless dataset and HopSkiplumpAttack attack method.
Each one the above with the two different norms.
E. DIFFERENT CLASSIFIER HYPERPARAMETERS
We checked three different classifiers our models for our adversarial evasion attack detector: XGBoost, RandomForest, and K-nearest neighbors (KNN). For the tree ensemble classifiers, we checked how much the number of estimators and their depth impacts the performance of the detector. For the KNN classifier, we tested the results with different values of K.
E.1.1 XGBOOST DETECTOR HYPERPARAMETERS
As we can see from the results in Figures has large impact on both ROC-AUC and on PR-AUC until a certain point which is around 50 esti- mators and above usually there is improvements, but relatively smaller. In most cases, the maximum depth of the trees has a very light impact on the results when the number of estimators is 50 or more.
15 and 16 in general the number of estimators
ROC AUC
Attack: OFT
Detaset: cod ma Norm:
PR-AUC|
Attack: OPT
Dataset: cod
cod-ma -n-mmmal Norm: 2
0,9010
0.9066
0.9
0.80
rum estimators
0.9208
0.3604
0,9538
0.9727
0.8655
Fum estimatoos
20
0.364C
0.6077
0.6243
0.6763
0.6276
0.75
0.9477
0.9725
0.9716
0.9751
0.96
30
0.7005
0.7594
6.65
0.9022
0.9753
0.9736
0.9807
0.8772
30
0.7537
0.7891
0.750
0.8138
0.7780
100.
0.975B
0.9790
0.8751
0.9822
0.9789
Ton
0.8277
B.8213
0.7985
0.8196
0.8137
0.5
0.90
0.9778
03753
0.8352
0.8425
200
0.9754
0.9779
0.9757
0.9819
0.0793
200
0.8355
0.8274
0.8031
0.8434
0.8193
6.4
7
19
15
10
15
mhax_depth
depth
(a) ROC-AUC
(b) PR-AUC
Figure 13: Comparing ROC-AUC and PR-AUC for detector based on XGBoost classifier with dif- ferent hyperparametrs. Target: XGBoost, dataset: codrna, attack method: OPT, norm: 2.
23

---

Under review as a conference paper at ICLR 2023
ROC-KUC Attlack: OPT
Dataset: cod-rne Nerm:
PR-AUC Attecke OPT
Datazet: cod-raa
Norm:
0.3092
0.0426
3.8
0.4457
0.0500
0.0341
0.5808
0.6381
6.85
estimators
20
6.9163
0.9007
0.9729
0.9777
0.9859
num Lestimators
20-
0
0-6477
0.60M
0.7346
0.7012
0.7738
0.75
0.70
0.9158
0,985
0.9799
0.9798
0.9003
30
0.7840
0.7924
0.8180
0.7479
0.2475
0.83
1.0
0.9842
1.00
0.9784
0.8842
0.9816
0.9801
0,9000
0.00
150
0.8259
0.8333
0.8346
0.8142
0.8655
0.58
6,9790
0.5038
0.9000
0.9901
0.80
0.8267
0.8391
0.8140
0.8009
6.50
0.43
14
max depth
max deptn
(a) ROC-AUC
(b) PR-AUC
Figure 14: Comparing ROC-AUC and PR-AUC for detector based on XGBoost classifier with dif- ferent hyperparametrs. Target: XGBoost, dataset: codrna, attack method: OPT, norm: oo
ROC AUC (Attaci: Hoptkiluumstttook Dotaset Senspriesz Norm; 2
PRRAUC AAlaakk hopskiplumpAtrack Dataset: Sensor ess
Norm:
9623
0.974
0:9738
0,9752
0.9
rum estimators
22
0.9952
555572
0
03952
0.9578
num cestimatoos
43
36-
1929
0 9935
5889
6.4444
0.00
02-
0.9924
993
0,9426
5.911
132
0.9937
599947
0 599444
03235
53227
488
1St
0.9938
9995
0 9942
0.931
8.9144
0.95
0.0
232
0410
095
18
15
depth
max depth
(a) ROC-AUC
(b) PR-AUC
Figure 15: Comparing ROC-AUC and PR-AUC for detector based on XGBoost classifier with dif- ferent hyperparametrs. Target: RandomForest, dataset: sensorless, attack method: HopSkipJumpAt- tack, norm: 2
ROC AUC Attaci: HopSkgju Dataset: Sensoriess Norm:
PRAAUC Attack: Slllkkppmm
Datasen: Sensartesx Norm:
0.9520
0:9737
9012
0.5041
0924
0.500
0.90
rum pallmaators
70
8.9765
9895
0 9095
9912
9917
0.515
Rum estimallo
0.85
30+
8,9377
0 6911
0 0932
6915
0.800
20
5.9875
0.993
0 5913
5002
0.15
0.915
1000
8.905
0 992)
9934
6.990
0.81
350
8.9299
5935
6.965
0.02
400
0.9929
6.900
0.80
10
15
10
35
max dd_pph
max_ maak_depth
(a) ROC-AUC
(b) PR-AUC
Figure 16: Comparing ROC-AUC and PR-AUC for detector based on XGBoost classifier with differ- ent hyperparameters. Target: RandomForest, dataset: sensorless, attack method: HopSkipJumpAt- tack, norm: co
1.1 RANDOMFOREST
As we can see from the results in Figures 18 19 and 20 that in general the number of estimators and the maximum depth of the trees has large impact on both ROC-AUC and PR-AUC. In
24

---

Under review as a conference paper at ICLR 2023
experiments with hyperparameters similar to XGBoost experiments both ROC-AUC and PR-
AUC is lower.
ROC-AUC
Attack: OFT
Detaset: codiraa Norm:
PR-AUC
Attack: OPT Dataset: cod-maa
Norm:
0.65
16
0.7837
0.7177
0.7758
0.6017
0.8348
0. 0.3638
0.3430
0.3742
0.4050
0.4855
0.85
num estimators
0.8118
0.8954
0.801
0.8977
0.80
nun estimaat
0:4185
0.0 0.5236
0,4546
0.5210
0.3334
0.00
0.6341
0.5401
0.910
0.9100
0.9116
0.431
4044
0397
0 5366
0.619
50
0,8720
0.9190
0.9439
0,9502
30-
0,5007
0.5946
0.0324
1oc
0.9483
0.0485
0.9688
30n
0:3713
0.5489
0.6320
0.80
150
0.9316
0.8694
0.3739
0.9602
0.9554
150
0.5650
0.6285
0.6302
0.6457
0.6273
C.40
0.75
0.9584
0.9762
0.596:
0.6583
0.6392
0:31
max dd_ptppphhhhh
max max_ depth
(a) ROC-AUC
(b) PR-AUC
Figure 17: Comparing ROC-AUC and PR-AUC for detector based RandomForest classifier with different hyperparametrs. Target: XGBoost, dataset: codra,, attack method: OPT, norm: 2
ROC-AUC Attack
Nomm:
PR-NUC Atttakk OPT DDstase:: cod-ms
Norm:
20
8.79
0.3124
C.0055
2.0131
0.0482
0:4280
0.5827
estimators
0.9175
0.5002
0.050
0.925
nun Retimaant
20
0.4842
0.5
0.5000
0.5711
0.5633
0.0009
C.65
0
0:9148
0.8378
3,9042
30-
0.5167
0:5552
0.5774
0.6704
0.0513
0.00
0.900
20
0.0013
0.9123
0.9466
0.0522
0.942
0.5042
0.6039
0.5566
0.8576
0.6753
0.575
0.55
300
100
0.5430
0.6523
0.6714
0.7017
0.6898
0.050
0.50
1.5
0.9633
0.9656
0,9728
3.9087
0.9657
0:5188
0.684]
0.825
200
0.9554
0.9724
C.9706
3,9791
0.9770
0.800
200
0 0.5646
0.6933
0.7002
0.694]
0.6902
C.45
5
10
15
3
10
max depth
deptn
(a) ROC-AUC
(b) PR-AUC
Figure 18: Comparing ROC-AUC and PR-AUC for detector based on RandomForest classifier with different hyperparameters. Target: XGBoost, dataset: codrna, attack method: OPT, norm:
ROC AUC (Attacic MysSkiguma Dataset Sensortess Norm; 2
PR-AUC | Altack flopSkiglumpAtltkk Delisee:: Sensor ess
Nomee
B213
0 6654
0.9218
0/9360
0.99
0.0412
0.5943
0.5002
0.9009
0.012
punn estimators
25-
0.0694
0 .9955
33727
5.9571
numm essimators
23
0.0024
0.5622
0.5903
0.000
0.900
030
x6
09/32
0 75
0
0/9/00
0.8591
0.114
0.000
0.161
62
0.9774
8 4851
A414
8.4046
50
6646
0.914
0.920
0.994
088
1oz
9999
0.940
6.99
0.8957
0.114
0.4241
0.4701
0815
096
Est
0.5992
0.5367
0.333
0.9444
081
CM4
0.935
0.470
6.0
10
15
16
15
max dexph
dexxh
(a) ROC-AUC
(b) PR-AUC
Figure 19: Comparing ROC-AUC and PR-AUC for detector based RandomForest classifier with different hyperparameters. Target: RandomForest, dataset: SkipJumpAttack, norm: 2
sensorless, attack method: Hop-
25

---

Under review as a conference paper at ICLR 2023
Hoy5kig)-mmAAaaa Datasen: Sansorics
PRAAUCT AAback kggkkgllmptttackk Deteset: Sensorfess
Norm:
10
8.1754
6,0233
0A366
0.8012
0.80
0.90
70-
3.1663
0,0390
0,677
0.8722
0.6700
0.03
num Ledimnttor
runm estimaators
0.96
20-
0.8311
0.0331
0.6878
0.7200
07003
0.24
50-
D.853M
0.8112
0.6601
0.1117
6028
0.42
120
0.8371
0.0033
0.6001
0.0945
0002
250
0.0885
0.0274
6034
9035
130
0.0634
0.0024
0.6035
0.8955
0.0013
6.8
209
03737
0.9929
0 1982
09925
0.993
200-
2-2303
0.0733
0.6097
0.0670
0.9000
640
max_ depth
maax depth
(a) ROC-AUC
(b) PR-AUC
Figure 20: Comparing ROC-AUC and PR-AUC for detector based on RandomForest classifier with different hyperparameters. Target: RandomForest, dataset: sensorless, attack method: Hop- SkiplumpAttack, norm: oo
E.1.3 KNN
We tested KNN performance with different Ks investigate how much it changed the detector per- formance metries and compared it to the results we got in our original experiments. We used KNN based on Facebook AI fast similarity search (Johnson et al. 2019) implemented in DESlib (Cruz et al. 2020) due to time consideration for cases where the feature count is relatively high. In Figures 21 and 22 we can see a comparison of ROC-AUC and PR-AUC of KNN classifier with different values of k neighbors. Additionally, added the performance of KNN on the original representation of the dataset and the metric values of the original experiments done with our new method with XGBoost classifier the detector. In all of the experiments, can the relative stability of the values with different K values. Additionally, the metric values with the XGBoost classifier are higher.
Attec Catsort Catera Nerr:
Atbec OCT Datesst cEd horee
30
(a) L2
(b) Loe
Figure 21: KNN classifier adversarial detector performance. Attack: OPT - Dataset: codrna.
20
ROCALE
(a) La
(b) I.oo
Figure 22: KNN classifier adversarial detector performance. Dataset: sensorless
Attack: HopSkiplumpAttack
26

---

Under review as a conference paper at ICLR 2023
E.2 EMBEDDINGS DIMENSIONS
Here we tested how much the embedding dimension might affect the performance of our detector.
We have two different embeddings for the samples and for the nodes. In Figures 23 24 25 and
26 we can see heatmaps for compare the performance with different embedding size. The general
pattern from the heatmaps in Figures 23 and 24 is that as our sample hidden size larger and the node hidden size is lower the results are better. In Figures 25 and 26 we don't It see that pattern.
ROC AUC
Attock: OPT
Dataset: cod ma Norm:
30-
0.9007
0.9724
0.9475
0.0542
0.8726
3,4994
0.5783
0.5093
samples hidden size
0.90
100-
0 9.974
3.9010
0.9833
0,729
0.9764
0,7560
0.6712
2.7516
0.7041
0.448
0.75
130
0.9700
0.9727
0.0005
0.994
8.9106
0.779
0.20
0.65
200
5.9737
0.81044
0.900
0.0
0.90
50
100
150
200
300
30
100
130
200
300
node hiiddennn size
node hidden, size
(a) ROC-AUC
(b) PR-AUC
Figure 23: Performance of different samples and nodes embedding sizes. Target: XGBoost, dataset: codraa, attack method: OPT, norm: 2
Delaset:
Deteset:
Norm:
3.9004
0.R254
0.9433
0,5617
0,2300
0,8639
0,5526
D.6211
0.6423
samples hieden size
0.98
1:00
6.9/52
D.9622
03309
0.9840
nloden
0.2b/5
0./183
3,2211
D.7238
0. 0.7500
0.75
035
150
0.9784
0.9767
0.9577
0.073
0.7278
3.6921
0.7863
0.06
0.53
200
sames
0.05
50
100
150
200
100
50
100
150
200
300
node hidden size
node
hiwdenddddnn. size
(a) ROC-AUC
(b) PR-AUC
Figure 24: Performance of different samples and nodes embedding sizes. Target: XGBoost, dataset: codrna, attack method: OPT, norm: co
ROC-AUC Atrace HappSiguumstttkk Netasel Sersgriess Nom
PRIAUC] Attack: pl glampAttack (Caraset: Semsor
Norm:
3.6700
E4033
Semppee sizze
$5-
S-2041
EL4843
500rs
0.04
0.55
5.9001
0443c
5602
3:9017
3.6012
0.5746
09917
0/9904
1073
0.9097
5e narrptes,
0.58
202
0:9287
0.7076
5:9217
0.447
0.59
00
232-
3.5653
0.3222
5.0332
0.655
100
328
100
152
302
node_ mode_hiodenn
Size
node
_iddee_szze
(a) ROC-AUC
(b) PR-AUC
Figure 25: Performance of different samples and nodes embedding sizes. Target: RandomForest, dataset: sensorless, attack method: HSJA, norm:
27

---

Under review as a conference paper at ICLR 2023
PR-AUC] Afhinn Hapsik @lamphttakk
Rahaset
Semantiess
0-9636
9.000
0:3342
E9005
0.334C
samppees, hiddenn Size
0.90
sarritess h_dddendenn
0 882
88722
6:4414
0.20.9
2.05
00733
150
8600
5,0011
0.3033
0.0645
7100
A0M1
644444
138
300
0:4815
2.00
0.9644
0793
0.8799
8.8797
6.444
0.4467
185
100
15.0
203
200
50
103
155
200
300
rode www.hhcccceeecce
node_hidon hhiddenssize
(a) ROC-AUC
(b) PR-AUC
Figure 26: Performance of different samples and nodes embedding sizes. Target: RandomForest, dataset: sensorless, attack method: HSJA, norm: 30
F APPENDIX F TREE ENSEMBLE HYPERPARAMETERS
We used tree ensembles for two tasks: the target model extract adversarial samples and the base for the adversarial detector. For the target model, we used 40 estimators with a max depth of for both XGBoost and Random forest. For the rest the hyperparameters, we used the default values set in the XGBoost library package version 1.6.1. To train the adversarial detector, used the default parameters for XGBoost and RandomForest set in the XGBoost library package version 1.6.1.
G APPENDIX G TREE MODEL'S PERFORMANCE USING LESS DATA
A potential issue in our method is that we reduce the available data used to train the model; thus, the model performance might be affected. As part of our method, we split each dataset we experimented on into several subsets for different roles described in Subsection 4.1 and Appendix H We took the original representation of the datasets and compared the trained models from our experiments to a new version of the model trained all data besides the test set. Below, comparison between the ROC-AUC of the model trained on our split version of the dataset (Y-axis) the same model trained on more data (X-axis) in performance most of the time, but most of the degradation is minor. For a complete description of the numbers in every experiment, refer to Tables
see in Figure 27
the test sets. As we can see, there is decrease
26
29
31
11
1.
0.
Spitt vessoon
40g
0.6
05
06
(a) XGBoost
(b) RandomForest
Figure 27: A comparison between method models' ROC-AUC the test set compared model trained with the same hyperparameters but with more data which we use our method to train the representations and detector.
28

---

Under review as a conference paper at ICLR 2023
Sign-OPT T/2
Sign-OPT Tix
Dutaset
Splitted Datasel
Original Dataset
AROC-AUC
Splited Dutaset
Original Dutaset
AROC-AUC
preast_cancer
0.9958
0.9975
0.0017
1.0
0.9989
-0.0011
coviype
0,9843
0,9865
0.0022
0.9847
0,9868
0.0021
codra
0,9928
0.994
0.0012
0.9928
0,994
0.0012
diabetes
0.7706
0.8154
0.0448
0.8108
0.8075
-0.0033
fashion
0,9903
0,9924
0.0021
0,9899
0,9925
0.0026
ijennl
0,9954
0,9961
0.0007
0.9951
0,9962
0.0011
mnist
0,9991
0,9997
0.0006
0,9991
0.9997
0.0006
mnist26
0,9995
0,9999
0.0004
0.9997
0,9999
0.0002
sensorless
1.0
1.0
0.0
1.0
1.0
0.0
webspam
0.9989
0,9992
0.0003
0,9989
0,9992
0.0003
electricity
0,9614
0,9783
0.0169
0.9579
0.9782
0.0203
drybcan
0.9957
0,9964
0.0007
0.9941
0,9953
0.0012
adult
0.913
0,9254
0.0124
0.9149
0,9235
0.0086
bunknote
1.0
0,9992
-0,0008
0.9983
1.0
0.0017
voice
0.9957
0,9992
0.0035
0.9806
0.9817
0.0011
waveform
0.962
0,9847
0.0227
0.9274
0,9322
0.0048
wind
0,9301
0,9391
0.009
0.9294
0.9424
0,013
speech
0.959
0,9126
-0,0464
0.4699
0.9208
0.4509
Table 22: Sign-OPT XGBoost Experiments ROC-AUC Degradation
OPT L2
OPT Loc
Datasct
Splitted Dataset
Original Dataset
AROC-AUC
Splitted Datasct
Original Dataset
AROC-AUC
breast cuncer
0.9958
0.9969
0.0011
0.9978
0.9978
contype
0.9846
0,9868
0.0022
0.9845
0.9864
0.0019
codrna
0.9926
0,9939
0.0013
0.9929
0.9941
0.0012
diahetes
0.7669
0.8217
0.0548
0.8103
0.8055
-0.0048
fashion
0.99
0.9924
0.0024
0.9903
0.9926
0.0023
ijennl
0,9942
0.996
0.0018
0.9941
0,9959
0.0018
mnist
0.9992
0.9997
0.0005
0.9992
0.9997
0.0005
mnist26
0.9997
0,9999
0.0002
0.9997
0,9999
0.0002
sensorless
1.0
1.0
0.0
1.0
0.0
webspam
0.9989
0,9992
0.0003
0.999
0.9993
0.0003
electricity
0.9529
0.9767
0.0238
0.9546
0.9735
0.0189
drybcan
0.9945
0,9967
0.0022
0.9951
0.9967
0.0016
adult
0,9191
0,9291
0.01
0.8808
0.8952
0.0144
banknote
voice
0.9986
0,9997
0.0011
1.0
0.0
waveform
0.9287
0.9341
0.0054
0.9662
0.9777
0.0115
wind
0.9258
0.9395
0.0137
0.9171
0,9336
0.0165
speech
0.6603
0.8665
0.2062
0.8167
0.8467
0.03
Table 23: OPT XGBoost Experiments ROC-AUC Degradation
HSJA La
HSJA Loe
Dataset
Splitted Dataset
Original Dataset
AROC-AUC
Splitted Dataset
Original Dataset
AROC-AUC
breast.cancer
0.9994
0.9969
-0.0025
0.9997
0.9989
-0.0005
covtype
0.9851
0,9856
0.0005
0.9843
0.9867
0.0024
codrna
0.9929
0.9941
0.0012
0.9927
0,9939
0.0012
diabetes
0.7996
0,8215
0.0219
0.8119
0.0204
fashion
0.99
0,9925
0.0025
0.9901
0,9926
0.0025
ijennl
0.9949
0,9956
0.0007
0.9945
0,9959
0.0014
mnist
0.9991
0,9997
0.0006
0.9992
0,9997
0.0005
mnist26
0,9996
0.9999
0.0003
0.9998
0,9999
0.0001
sensorless
1.0
0.0
1.0
0.0
webspam
0.9989
0,9992
0.0003
0.9989
0,9992
0.0003
electricity
0.9526
0,9733
0.0207
0.9567
0.98
0.0233
drybeon
0,9924
0.9949
0.0025
0.9939
0.9956
0.0017
adult
0.9103
0.9196
0.0093
0.915
0,9328
0.0178
banknote
0.9966
1.0
0.0034
1.0
1.0
0.0
voice
0.994
0.996
0.002
0.9986
0,9995
0.0009
waveform
0,9605
0.9627
0.0022
0.9466
0.9574
0.0108
wind
0.9246
0.9282
0.0036
0.9347
0.9463
0.0116
speech
0.7473
0.7711
0.0238
0.8587
1.0
0.1413
Table 24: HSIA XGBoost Experiments ROC-AUC Degradation
29

---

Under review as a conference paper at ICLR 2023
Cuhe T2
Cube Toe
Dutaset
Splitted Datasel
Original Dataset
AROC-AUC
Splittdd Dutaset
Original Dutaset
AROC-AUC
preast_cancer
0.9997
0.998
-0.0017
0.9964
0.9966
0.0002
coviype
0,9852
0,9873
0.0021
0.9847
0,9862
0.0015
codma
0,9928
0.994
0.0012
0.9929
0,9941
0.0012
diabetes
0.7477
0.8268
0.0791
0.7765
0.8072
0.0307
fashion
0,9903
0,9925
0.0022
0.99
0,9927
0.0027
ijennl
0,9948
0,9959
0.0011
0.9945
0,9959
0.0014
mnist
0,9992
0,9997
0.0005
0,9992
0.9997
0.0005
mnist26
0,9997
1.0
0,0003
0,9995
0,9999
0.0004
sensorless
1.0
1.0
0.0
1.0
1.0
0.0
webspam
0.9989
0,9993
0.0004
0.9989
0,9993
0.0004
electricity
0,9619
0,9801
0.0182
0.9528
0.9746
0.0218
drybcan
0.9935
0,9951
0.0016
0.9942
0,9956
0.0014
adult
0,9153
0,9263
0.011
0.9142
0,9302
0,016
bunknote
1.0
1.0
0.0
1.0
1.0
0.0
voice
1.0
0.0
0.9949
0.9973
0.0024
waveform
0,9475
0,9599
0.0124
0.9581
0.9612
0.0031
wind
0,9373
0.9451
0.0078
0.9425
0.937
-0.0055
speech
Table 25: Cube XGBoost Experiments ROC-AUC Degradation
Leaf-Tuple L2
Leaf-Tuple Loo
Datasct
Splitted Dataset
Original Dataset
AROC-AUC
Splitted Datasct
Original Dataset
AROC-AUC
breast cuncer
0.9986
0.9978
-0,0008
0.9961
0.9972
0.0011
contype
0.9845
0,9868
0.0023
0.9842
0.9869
0.0027
codrna
0.993
0.994
0.001
0.9928
0,9939
0.001 1
diahetes
0.7662
0,8114
0.0452
0.7695
0.8298
0.0603
fashion
0,9902
0,9923
0.0021
0.99
0.9925
0.0025
ijennl
0.9953
0,9963
0.001
0.9944
0.9963
0.0019
mnist
0.9992
0,9997
0.0005
0.9992
0.9997
0.0005
mnist26
0.9997
0,9999
0.0002
0.9997
0,9999
0.0002
sensorless
1.0
1.0
0.0
1.0
0.0
webspam
0.9989
0,9993
0.0004
0.999
0.9993
0.0003
electricity
0.9553
0.9726
0.0173
0.9509
0.9732
0.0223
drybcan
0.9956
0,9962
0.0006
0,9962
0.9963
0.0001
adult
0,9161
0.928
0.0119
0.9004
0.9147
0.0143
banknote
voice
0.9914
0,9971
0.0057
0.9919
0.9948
0.0029
waveform
0.9598
0.9716
0.0118
0.9487
0.9556
0.0069
wind
0,9328
0.9529
0.0201
0.9215
0.9434
0.0219
speech
0.5328
0.8716
0.3388
0.6808
0.8616
0.1808
Table 26: Leaf- Cuple XGBoost Experiments ROC-AUC Degradation
Sign-OPT La
Sign-OPT Loo
Dataset
Splitted Dataset
Original Dataset
AROC-AUC
Splitted Dataset
Original Dataset
AROC-AUC
breast.cuncer
0.9952
0.9972
0.002
0.9965
0.9975
0.001
covtype
0.9841
0,9862
0.0021
0.9844
0,9864
0.002
codrna
0.9926
0.994
0.0014
0.9929
0.994
0.0011
diabetes
0.7954
0,8083
0.0129
0.7848
0.8162
0.0314
fashion
0.9904
0,9924
0.002
0.9901
0,9925
0.0024
ijennl
0.9946
0,9964
0.0018
0.9956
0,9958
0.0002
mnist
0.9993
0,9997
0.0004
0.9992
0,9997
0.0005
mnist26
0,9995
0.9999
0.0004
0.9997
0,9999
0.0002
sensorless
1.0
0.0
1.0
0.0
webspam
0.9989
0,9993
0.0004
0.9989
0,9993
0.0004
electricity
0.9525
0,9741
0.0216
0.9541
0,9776
0.0235
drybcan
0,9968
0.9967
-0.0001
0.9946
0,9952
0.0006
adult
0.9037
0.9209
0.0172
0.9146
0,9218
0.0072
banknote
1.0
1.0
0.0
1.0
1.0
0.0
voice
0.9894
0,9975
0.0081
0.9921
0.993
0.0009
waveform
0.957
0.98
0.023
0.9535
0.9748
0.0213
wind
0.9179
0.9196
0.0017
0.9176
0.9366
0.019
speech
Table 27: Sign-OP OPT RandomForest Experiments ROC-AUC Degradation
30

---

Under review as a conference paper at ICLR 2023
OPT l/2
OPT Tix
Dutaset
Splitted Datasel
Original Dataset
AROC-AUC
Splittdd Dutaset
Original Dutaset
AROC-AUC
preast_cancer
0.9992
0.9972
-0.002
0.9994
0.9975
-0.0019
coviype
0,9844
0,9868
0.0024
0.9851
0,9867
0.0016
codma
0,9929
0.994
0.0011
0.9928
0,9941
0.0013
diabetes
0.7532
0.8033
0.0501
0.8241
0.8033
-0.0208
fashion
0,9903
0,9924
0.0021
0,9902
0,9924
0.0022
ijennl
0,9943
0,9958
0.0015
0.9958
0.996
0.0002
mnist
0,9993
0,9997
0.0004
0,9992
0.9997
0.0005
mnist26
0,9998
0,9999
0,0001
0.9997
0,9999
0.0002
sensorless
1.0
1.0
0.0
1.0
1.0
0.0
webspam
0.999
0,9992
0.0002
0,9989
0,9992
0.0003
electricity
0,9595
0.9787
0.0192
0,9502
0,971
0.0208
drybcan
0,9949
0,9958
0.0009
0.9962
0,9969
0.0007
adult
0,9147
0,9307
0.016
0.9106
0,9207
0.0101
bunknote
1.0
1.0
0.0
1.0
1.0
0.0
voice
0.999
0.001
0.996
0,999
0,003
waveform
0,9652
0,9705
0.0053
0.9442
0,9519
0.0077
wind
0.9389
0.9436
0.0047
0.9452
0.9553
0.0101
speech
Table 28: OPT RandomForee Experiments ROC-AUC Degradation
HSIA Lg
HSJA Loo
Datasct
Splitted Dataset
Original Dataset
AROC-AUC
Splitted Datasct
Original Datasct
AROC-AUC
breast cuncer
0.998
0.9975 0,9865
-0,0005
0.9997
0.9983 0.9865
-0.0014
contype
0.9843
0.0022
0.9847
0.0018
codrna
diahetes
fashion
0,9903
0.9925
0.0022
0.9901
0.9925
0.0024
ijennl
0.9944
0.9963
0.0019
0.9951
0.9955
0.0004
mnist
0.9992
0.9997
0.0005
0.9992
0.9997
0.0005
mnist26
0.9995
1.0
0.0005
0.9997
0,9999
0.0002
sensorless
1.0
0.0
1.0
0.0
webspam
0.9989
0,9992
0.0003
0.9989
0.9992
0.0003
electricity
0.9575
0,9736
0.0161
0.957
0.976
0.019
dryseon
0.995
0.995
0.0
0.9943
0.9964
0.0021
adult
0.9049
0,9154
0.0105
0.8973
0.9133
0.016
banknote
0,9966
0.0034
voice
1.0
1.0
0.0
0.999
0,001
waveform
0.9412
0,9548
0.0136
0.9329
0.945
0.0121
wind
0.9345
0.9432
0.0087
0.9292
0,9321
0.0029
speech
Table 29: HSJA RandomForest Experiments ROC-AUC Degradation
Cube La
Cube Loe
Dataset
Splitted Dataset
Original Dataset
AROC-AUC
Splitted Dataset
Original Dataset
AROC-AUC
breast_cuncer
0.998
0.9969
-0.0011
1.0
0.9964
-0.0036
covtype
0.9843
0,9865
0.0022
0.9844
0,9864
0.002
codrna
0.9927
0.994
0.0013
0.9929
0.994
0.0011
diabetes
0.8086
0,8138
0.0052
0.7576
0.8123
0.0547
fashion
0.9901
0,9925
0.0024
0.9903
0,9925
0.0022
ijennl
0.9941
0,9958
0.0017
0.9946
0,9962
0.0016
mnist
0.9992
0,9997
0.0005
0.9991
0,9997
0.0006
mnist26
0.9995
0,9999
0.0004
0.9996
0,9999
0.0003
sensorless
1.0
0.0
1.0
0.0
webspam
0.9989
0,9992
0.0003
0.9989
0,9992
0.0003
electricity
0.9449
0,9714
0.0265
0.963
0.977
0.014
drybcan
0,9947
0.9945
-0.0004
0.9933
0.9951
0.0018
adult
0.9047
0.9158
0.0111
0.9215
0.934
0.0125
banknote
0.9958
0,9958
0.0
1.0
1.0
0.0
voice
0.987
0,9916
0.0046
0.9954
0,9986
0.0032
waveform
0.9731
0.975
0.0019
0.9567
0.9676
0.0109
wind
speech
Table 30: Cube RandomForest Experiments ROC-AUC Degradation
31

---

Under review as a conference paper at ICLR 2023
Leaf-Tuple L2 Original Dataset
Leaf-Tuple Loo
Datasct
Splitted Dataset
AROC-AUC
Splitted Datasct
Original Dataset
AROC-AUC
breast cuncer
0.9975
-0,0025
0.9969
0.9969
covtype
codrna
0.9927
0.994
0.0013
0.9928
0.994
0.0012
diahetes
fashion
0.99
0.9924
0.0024
0.9899
0.9925
0.0026
ijennl
0.995
0.996
0.001
0.9949
0.9958
0.0009
mnist
0.9992
0.9997
0.0005
0.9992
0.9997
0.0005
mnist26
0.9998
0,9999
0.0001
0.9997
0,9999
0.0002
sensorless
1.0
1.0
0.0
1.0
0.0
webspam
0.999
0,9992
0,0002
0,999
0,9992
0.0002
electricity
0.9546
0,9785
0.0239
0.948
0.9726
0.0246
drybcan
0.9953
0,9959
0.0006
0.9942
0.9951
0.0009
adult
0,9211
0,9298
0.0087
0,9002
0.9208
0.0206
banknote
0.9966
0.0034
0.9974
0.0026
voice
0.9992
0,9986
-0,0006
0.9941
0.9974
0.0033
waveform
0.9536
0.9677
0.0141
0.9359
0.9615
0.0256
wind
0.9249
0.9431
0.0182
0.9334
0,9356
0.0022
speech
Table 31: Leaf Tuple RandomFores Experiments ROC-AUC Degradation
32

---

Under review as a conference paper at ICLR 2023
H APPENDIX H METHOD FLOW FURTHER EXPLANATIONS
Octedtr lonng
Sp
Sp-teot
Original datase!
Sp-teet -oorooll
Debeda malsny
Arain ude
Sp Jnain sih
Sp
Sp
Thes
banng ckioos
s
ST
RI
Sp nanss
R
tamnaa mnn
RT
S6.5p tul tetm
R
unt wat-
Eroooding
based
S
R
Cetwecing mode
ST -r-iriin-ads
S Sp-test-sommal
D-trats D--trtt--aome sarmal
p-test-okk
10
Do-ttrtee-orruel
10
Sp. train-ads
ST trate ade
D
Sty
ST D-ssottnorroll
Sp-eed-uth
ST.
Description Label
New triplet datasel for normal samples train representations
Adversarial samples in representation
Normal samples the original representation
New triplct datasct for advensarial samples train new representations
The Adversarial detector
Adversarial samples original representation
samples new representation
Figure 28: The general flow of our method with a color legend at the bottom.
In Figure 28 you can see a visualization of the points in Subsection 4.1 which we added here below as well, for readers' convenience:
Split the dataset into four different parts for different purposes: S7 to train the tree model, Sg to train our basic representation model, Sp-train to train our adversarial detector and Sp-test to evaluate our adversarial detector.
2. Train tree model.
3. Generate a triplets dataset that will be used to initialize the new representations. This is explained more fully in Subsection 4.2
33

---

Under review as a conference paper at ICLR 2023
4. Train our basic embedding model E. This is explained more fully in Subsection 4.3
5. Split Sp-train and Sp-test into two parts.
6. Generate adversarial samples using an attack method A.
7. Generate new triplet dataset for each of the new sub-datasets. This is explained more fully in Subsection 4.4
8. Optimize the representations of the new sub-datasets to our new embeddings using E, more details Subsection 4.4
9. Concatenate the new representation of every the original ones.
10. Train our adversarial detector. This is explained more fully in Subsection 4.5
11. Evaluate our adversarial detector. This is explained more fully in Section
Our dataset is split into four main sub-datasets:
1. Sy dataset that will be used to train the target tree model.
2. Sg dataset that will be used optimize base set embeddings that represent the general distribution of the original dataset. This base set of embeddings used to optimize new samples representations.
3. Sp-train dataset used to train adversarial detector, it will be split into two sub-sub- datasets to allow us to collect normal samples and adversarial samples.
4. Sp-test dataset used to test our adversarial detector, it will be split into two sub-sub- datasets to allow to collect normal samples and adversarial samples.
We chose this split method to reduce bias and overfitting when optimizing the representations and training our adversarial detector. Each of the above datasets is sampled randomly from the original dataset without replacements, meaning one sample will be only in one of the above sub-datasets. As a result, the amount data we use for each one of the steps reduced, and we added information about it in Appendix G to show how much it affects the classification performance of the original tasks.
34


Reviews:
[{"review_id": "voHaKrxze_K", "reviewer": "Reviewer_WNyf", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a method to detect adversarial samples in tree ensembles without affecting either the model's structure or its original performance. Since the existing adversarial defense method may affect the model's natural performance, this paper's method enables the users to decided whether to apply defense or not. The proposed method extracts a new representation of a dataset based on the structure of the given tree ensemble to understand its behavior on normal examples and to detect adversarial examples. The authors conducted experiments to verify the effectiveness of the proposed method.", "summary_of_the_review": "In general, I think the authors made a good amount of effort in design and experiments. But the proposed method is kind of too complicated and the rationale of this complex design is not well-explained. So I recommend a borderline reject.", "strength_and_weaknesses": "Strength:\n1. The authors conducted many experiments on different datasets to show the effectiveness of the proposed method. \nWeakness:\n1. In general, the proposed method is kind of over complicated. The authors split the original dataset into 4 parts and the tree model is only trained with S_T. Then the tree model itself's performance may be worse than before due to lack of data.\n2. I think the rationale of model design in this paper is kind of unclear. More explanation and ablation studies are needed to show why each part is necessary. For example, in data representation, why we use the task in Algorithm 1 as representation? If the output is the whether s_i and s_j agree on the condition in n_k, are we simply predicting whether a specific feature's values of s_i and s_j are at the same side of n_k's threshold or not? \n3. As the detector is a XGboost ensemble, it is also susceptible to adversarial attacks. If the attacker has access to this detector model, they may also be able to fool it and consequently fool the whole design. \n4. I am concerned about the black box attacks used in the experiments and they may not be strong enough. I would suggest the authors to use the MILP method in Kantchelian et al 2016 as it is the strongest method for attacking tree ensembles (theoretically it is the optimal attack). An implementation of that method can be found in Chen et al 2019's Github Repo, which is compatible with XGBoost's data structure.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "dwdJVQ6Zz8N", "reviewer": "Reviewer_yzr9", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The authors designed a method to detect adversarial examples against decision tree ensembles. The basic idea is to extract features from decision treed and use its representations on train a classifier to detect normal and adversarial example.", "summary_of_the_review": "The presentation quality is not up to the standard, Many part is unclear.\n\nThere is not theory to support that the proposed method is secure.\n", "strength_and_weaknesses": "Strength\n1. The authors evaluate their algorithm on 18 databases with diverse sources and the databases have different properties, e.g., binary values and image etc,\n\n2. The authors claim that their method is state-of-the-art.\n\nweakness:\nQ1)  The authors claim that “Most of the research is focused on adversarial attacks targeting neural network models because of the nature of their continuous learning space…” It is inaccurate statement. We study adversarial example against NN because 1) NN has been outperformed all other methods on many datasets, 2) Its performance is very high, in some cases, even outperforming human experts, 3) DNN has a lot of application and commercial values. However, decision trees are not comparable DNN in all these aspects. \n\nQ2) The authors claim that “Tree-based models continue to be very popular (Nielsen 2016)”. 1) the reference is 6 years ago, and it is a master thesis. Please give better justification on this statement.\n\nQ3) The authors mention that “Of the eleven datasets tested, seven shown a decrease in accuracy”. Decrease in accuracy is not necessary a problem. The question is how much. \n\nQ4) Section 3,2 N1 is not defined although it is understandable.\n\nQ5) Similar idea, extracting information from classifier to train an adversarial example detector has been proposed for DNN. They also have been broken. There is no theory to support that the proposed method is secure. \n\nQ6) Since a lot of methods and tools have been developed for NN for classification, explanation and secure them, the necessity for using decision tree is weakened. \n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "cZuhrGfEcI", "reviewer": "Reviewer_9gBn", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper studies adversarial robustness of decision trees, under the typical L_p norm attacks. The idea is to generate a representation data set, and then train a neural network to detect anomalies. Experiments seem to suggest that this approach works well.", "summary_of_the_review": "The lack of considering adaptive attacks seems a major flaw, and I am not sure I am convinced by the experiments.\n\nAlso -- just that decision tree is used a lot does not necessarily justify that we should study the norm-based adversarial attacks for it (in vision, this motivation is very naturally justified), some real world examples why this is meaningful would help", "strength_and_weaknesses": "The topic seems novel - indeed that most of the current research focuses on vision research and thus deep nets.\n\nOn the other hand, from my understanding of this work, it does not seem to consider adaptive attacks -- namely adversarial attacks that takes into consideration of the proposed defense and then attack. For example, what happens that the attacker can try to generate attacks that bypass the proposed embedding network/detector?", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "Gn4hM1HDzh", "reviewer": "Reviewer_KhPV", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper describes a method to detect adversarial samples without affecting either the target model structure or its original performance. By using representation learning based on the structure of the tree ensembles, the claim is of better detection rates than SOTA. They claim the approach is better than using the original representation of the dataset to train an adversarial detector.", "summary_of_the_review": "The paper in general needs some rework for ICLR  - please follow below.\n\nSuggestions:\n1.Rewrite the paper to bring in the main contributions to light and clearly explain the reseach gaps in SOTA where this paper is adding value.\n2. Can use help of graph representations to explain the equation variables.\n3. If the algorithm sub-modules can be mapped to graph theoritic standard problems, it will be good. Not sure about the time complexity of the task for large datasets and practical aspects.\n4. Random node (sample) selection can be done smartly for better results.\n5. Can some notes be written for explainability.\n6. List down limitations of approach clearly\n\nMiscellaneous:\n1. The usage of XGBoost 2016 is a bit old - LightGBM (faster) and CatCBoost (more control) could have been tried.\n2. Why numbering of lines is not done - difficult to review and refer the text for correction.\n3. In this work, we present a technique to detect adversarial evasion attacks against tree-based classi\u0002fiers and mainly boosting ensembles which heavily used. - reword - grammatically incorrect.\n4. Unclear line - Our primary motivation for this work is to create a decision tree ensemble defense against adversarial\nattacks that do not affect the model itself, allowing the model owner to decide if they want defense\napplied to their existing model and fine-tune it.\n5. For p ∈ N1 t , For p = ∞ --- format with commas for ease of reading\n6. Fig 1, 2 font size is very small - need to zoom a lot - let it take the \\linewidth (redraw if possible)\n7. We define a supervised task like so: - grammar\n8. Where are equation numbers? Hard to refer 0 use latex equation.\n8. as our metrics; for multi-class cases - break the sentence please\n9. Friedman test on the ROC-AUC, Nemneyi post-hoc test - explain", "strength_and_weaknesses": "Strengths:\n1. Table1 - the variety of datasets for experiments is appreciated\n2. The appendix part gives more details on individual sub-section which is helpful\n3. A different look away from crowd of NN works - traditional interpretable ML + tweaks put to good use\n4. Good to see usage of UMAP instead of tSNE\n5. Hard work has been put wrt the experiments\n\nWeakness:\n1. Logic behind feature threshold in n_k\n2. Any logic for the 2-node setting in contrast to a m-node setting (seems like a mix of RANSAC and KNN)\n3. Fig . 2 a - suddenly sigmoid came in pic - need figure explanation\n4. Logic behind -  We extract four new sub-datasets\n5. Embedding are not clear\n6. Results need proper analysis - very little efoort put here\n7. The abstract, conclusion should be to the point - this is the problem, what others have done and their gaps, this is what we have done with numbers to support.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject