Daniël Vos

Room 02.370 / ECHO

Van Mourik Broekmanweg 5

2628 XE Delft

The Netherlands

Hi, I’m Daniël and I’m doing a PhD under the supervision of Dr. Sicco Verwer. The topic of my PhD is mainly on the safety and security of machine learning models and I have a special fondness for decision tree models. I particularly enjoy working on the discrete optimization problems that appear when training, certifying and attacking robust decision trees. For example with our method ROCT we turned the problem of training robust decision trees against adversarial examples into combinatorial optimization.

I strongly believe that we should be able to understand machine learning models that we deploy for critical applications and I worry that post-hoc XAI methods give us a false sense of understanding. Therefore I am also working on methods to train extremely small models with performance similar to more massive ones such as neural networks and gradient boosting ensembles. A small enough linear model or decision tree can be naturally understood by humans.

Next to my academic life I love strength training, rowing and field hockey. I also organize Delft’s hacking team, currently the highest placed team from the Netherlands on CTFTime.

selected publications

ECML-PKDD

Adversarially Robust Decision Tree Relabeling

Daniël Vos, and Sicco Verwer

European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases 2022

Abs PDF

Decision trees are popular models for their interpretation properties and their success in ensemble models for structured data. How- ever, common decision tree learning algorithms produce models that suf- fer from adversarial examples. Recent work on robust decision tree learn- ing mitigates this issue by taking adversarial perturbations into account during training. While these methods generate robust shallow trees, their relative quality reduces when training deeper trees due the methods be- ing greedy. In this work we propose robust relabeling, a post-learning procedure that optimally changes the prediction labels of decision tree leaves to maximize adversarial robustness. We show this can be achieved in polynomial time in terms of the number of samples and leaves. Our results on 10 datasets show a significant improvement in adversarial accu- racy both for single decision trees and tree ensembles. Decision trees and random forests trained with a state-of-the-art robust learning algorithm also benefited from robust relabeling.
AAAI

Robust optimal classification trees against adversarial examples

Daniël Vos, and Sicco Verwer

AAAI Conference on Artificial Intelligence 2022

Abs HTML PDF

Decision trees are a popular choice of explainable model, but just like neural networks, they suffer from adversarial examples. Existing algorithms for fitting decision trees robust against adversarial examples are greedy heuristics and lack approximation guarantees. In this paper we propose ROCT, a collection of methods to train decision trees that are optimally robust against user-specified attack models. We show that the min-max optimization problem that arises in adversarial learning can be solved using a single minimization formulation for decision trees with 0-1 loss. We propose such formulations in Mixed-Integer Linear Programming and Maximum Satisfiability, which widely available solvers can optimize. We also present a method that determines the upper bound on adversarial accuracy for any model using bipartite matching. Our experimental results demonstrate that the existing heuristics achieve close to optimal scores while ROCT achieves state-of-the-art scores.
ICML

Efficient training of robust decision trees against adversarial examples

Daniël Vos, and Sicco Verwer

International Conference on Machine Learning 2021

Abs HTML PDF

Current state-of-the-art algorithms for training robust decision trees have high runtime costs and require hours to run. We present GROOT, an efficient algorithm for training robust decision trees and random forests that runs in a matter of seconds to minutes. Where before the worst-case Gini impurity was computed iteratively, we find that we can solve this function analytically to improve time complexity from O(n) to O(1) in terms of n samples. Our results on both single trees and ensembles on 14 structured datasets as well as on MNIST and Fashion-MNIST demonstrate that GROOT runs several orders of magnitude faster than the state-of-the-art works and also shows better performance in terms of adversarial accuracy on structured data.
arxiv

Optimal Decision Tree Policies for Markov Decision Processes

Daniël Vos, and Sicco Verwer

arXiv preprint arXiv:2301.13185 2023

HTML PDF