Abstract:Abstract Decision trees and random forests are widely used classifiers in machine learning. Service providers often host classification models in a cloud service and provide an interface for clients to use the model remotely. While the model is sensitive information of the server, the input query and prediction results are sensitive information of the client. This motivates the need for private decision tree evaluation, where the service provider does not learn the client’s input and the client does not learn the model except for its size and the result. In this work, we identify the three phases of private decision tree evaluation protocols: feature selection, comparison, and path evaluation. We systematize constant-round protocols for each of these phases to identify the best available instantiations using the two main paradigms for secure computation: garbling techniques and homomorphic encryption. There is a natural tradeoff between runtime and communication considering these two paradigms: garbling techniques use fast symmetric-key operations but require a large amount of communication, while homomorphic encryption is computationally heavy but requires little communication. Our contributions are as follows: Firstly, we systematically review and analyse state-of-the-art protocols for the three phases of private decision tree evaluation. Our methodology allows us to identify novel combinations of these protocols that provide better tradeoffs than existing protocols. Thereafter, we empirically evaluate all combinations of these protocols by providing communication and runtime measures, and provide recommendations based on the identified concrete tradeoffs.

Evasion and Hardening of Tree Ensemble Classifiers

Decision-based Evasion Attacks on Tree Ensemble Classifiers

Faster Repeated Evasion Attacks in Tree Ensembles

A Hybrid-Domain Framework for Secure Gradient Tree Boosting.

SoK: Modular and Efficient Private Decision Tree Evaluation.

Multi-class AdaBoost ELM

Certifying Decision Trees Against Evasion Attacks by Program Analysis

Evading Black-box Classifiers Without Breaking Eggs

Verifiable Learning for Robust Tree Ensembles

Attack Tree Analysis for Adversarial Evasion Attacks

One-and-a-Half-Class Multiple Classifier Systems for Secure Learning Against Evasion Attacks at Test Time

Hardness of evasion of multiple classifier system with non-linear classifiers

Embedding and extraction of knowledge in tree ensemble classifiers

An Evasion and Counter-Evasion Study in Malicious Websites Detection

FENCE: Feasible Evasion Attacks on Neural Networks in Constrained Environments

Evading classifiers in discrete domains with provable optimality guarantees

Evaluating Resilience of Encrypted Traffic Classification against Adversarial Evasion Attacks

Improving Adversarial Robustness of Ensemble Classifiers by Diversified Feature Selection and Stochastic Aggregation

Robustness Analysis of Classical and Fuzzy Decision Trees under Adversarial Evasion Attack

Fair Adversarial Gradient Tree Boosting

Cost-Aware Robust Tree Ensembles for Security Applications