Genetic adversarial training of decision trees

Ranzato, Francesco; Zanella, Marco

doi:10.1145/3449639.3459286

Cited by 12 publications

(11 citation statements)

References 39 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Our Fairness-Aware Tree Training method, called FATT, is designed as an extension of Meta-Silvae [37], a learning methodology for ensembles of decision trees based on a genetic training algorithm, which is able to train a decision tree for maximizing both its accuracy and its robustness to adversarial perturbations. Meta-Silvae in turn leverages a verification tool for robustness properties of decision trees based on abstract interpretation [36].…”

Section: Contributionsmentioning

confidence: 99%

“…Several algorithms for training robust decision trees and ensembles thereof have been put forward in the literature [2,10,11,13,26,37]. These algorithms encode the robustness of a tree classifier as a loss function which is minimized either by exact methods such as MILP or by suboptimal heuristics such as genetic algorithms.…”

Section: Fairness-aware Training Of Treesmentioning

confidence: 99%

“…The robust learning algorithm Meta-Silvae, introduced in [37], aims at maximizing a tunable weighted linear combination of accuracy and stability metrics, therefore, thanks to the equivalence (3), instantiating to a combination of accuracy and individual fairness for our purposes. Meta-Silvae relies on a genetic algorithm for evolving a population of decision trees 𝑡 which are ranked by their accuracy acc 𝐷 (𝑡) and individual fairness fair 𝐷,𝑆 (𝑡) w.r.t.…”

Section: Fairness-aware Training Of Treesmentioning

confidence: 99%

“…After a crossover operation, two types of mutation strategies are available: grow-only, which only allows trees to grow, and grow-and-prune, which also allows pruning the mutated trees. We just sketch an example of crossover and mutation functions and refer to [37] for a detailed definition.…”

Section: Fairness-aware Training Of Treesmentioning

confidence: 99%

See 3 more Smart Citations

Fairness-Aware Training of Decision Trees by Abstract Interpretation

Ranzato

Urban

Zanella

2021

Proceedings of the 30th ACM International Conference on Information &Amp; Knowledge Management

Self Cite

View full text Add to dashboard Cite

We study the problem of formally verifying individual fairness of decision tree ensembles, as well as training tree models which maximize both accuracy and individual fairness. In our approach, fairness verification and fairness-aware training both rely on a notion of stability of a classifier, which is a generalization of the standard notion of robustness to input perturbations used in adversarial machine learning. Our verification and training methods leverage abstract interpretation, a well-established mathematical framework for designing computable, correct, and precise approximations of potentially infinite behaviors. We implemented our fairness-aware learning method by building on a tool for adversarial training of decision trees. We evaluated it in practice on the reference datasets in the literature on fairness in machine learning. The experimental results show that our approach is able to train tree models exhibiting a high degree of individual fairness with respect to the natural state-of-the-art CART trees and random forests. Moreover, as a by-product, these fairness-aware decision trees turn out to be significantly compact, which naturally enhances their interpretability.

show abstract

Section: Contributionsmentioning

confidence: 99%

Section: Fairness-aware Training Of Treesmentioning

confidence: 99%

Section: Fairness-aware Training Of Treesmentioning

confidence: 99%

Section: Fairness-aware Training Of Treesmentioning

confidence: 99%

See 2 more Smart Citations

Fairness-Aware Training of Decision Trees by Abstract Interpretation

Ranzato

Urban

Zanella

2021

Proceedings of the 30th ACM International Conference on Information &Amp; Knowledge Management

Self Cite

View full text Add to dashboard Cite

show abstract

“…GROOT analytically calculates the adversarial impurity significantly reducing the training time, resulting in a training algorithm faster than the state of the art and with better performance in terms of adversarial accuracy on structured data. Finally, Ranzato et al [33] proposed a genetic adversarial training algorithm called Meta-Silvae to train decision trees in order to maximize both accuracy and robustness to adversarial perturbation. The algorithm relies on a complete formal verification based on abstract interpretation.…”

Section: Robust Trainingmentioning

confidence: 99%

Feature partitioning for robust tree ensembles and their certification in adversarial scenarios

Calzavara

Lucchese

Marcuzzi

et al. 2021

EURASIP J. on Info. Security

View full text Add to dashboard Cite

Machine learning algorithms, however effective, are known to be vulnerable in adversarial scenarios where a malicious user may inject manipulated instances. In this work, we focus on evasion attacks, where a model is trained in a safe environment and exposed to attacks at inference time. The attacker aims at finding a perturbation of an instance that changes the model outcome.We propose a model-agnostic strategy that builds a robust ensemble by training its basic models on feature-based partitions of the given dataset. Our algorithm guarantees that the majority of the models in the ensemble cannot be affected by the attacker. We apply the proposed strategy to decision tree ensembles, and we also propose an approximate certification method for tree ensembles that efficiently provides a lower bound of the accuracy of a forest in the presence of attacks on a given dataset avoiding the costly computation of evasion attacks.Experimental evaluation on publicly available datasets shows that the proposed feature partitioning strategy provides a significant accuracy improvement with respect to competitor algorithms and that the proposed certification method allows ones to accurately estimate the effectiveness of a classifier where the brute-force approach would be unfeasible.

show abstract