publications

2023

1. arxiv

   Differentially-Private Decision Trees with Probabilistic Robustness to Data Poisoning

   Daniël Vos, Jelle Vos, Tianyu Li, and 2 more authors

   arXiv preprint arXiv:2305.15394 2023

   HTML PDF
2. IJCAI

   Optimal Decision Tree Policies for Markov Decision Processes

   Daniël Vos, and Sicco Verwer

   International Joint Conference on Artificial Intelligence 2023

   HTML PDF
3. AI journal

   The First AI4TSP Competition: Learning to Solve Stochastic Routing Problems

   Laurens Bliek, Paulo Costa, Reza Refaei Afshar, and 8 more authors

   Artificial Intelligence 2023

   HTML

2022

1. EuroS&P

   Sok: Explainable machine learning for computer security applications

   Azqa Nadeem, Daniël Vos, Clinton Cao, and 4 more authors

   European Symposium on Security and Privacy 2022

   HTML PDF
2. ECML-PKDD

   Adversarially Robust Decision Tree Relabeling

   Daniël Vos, and Sicco Verwer

   European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases 2022

   Abs PDF

   Decision trees are popular models for their interpretation properties and their success in ensemble models for structured data. How- ever, common decision tree learning algorithms produce models that suf- fer from adversarial examples. Recent work on robust decision tree learn- ing mitigates this issue by taking adversarial perturbations into account during training. While these methods generate robust shallow trees, their relative quality reduces when training deeper trees due the methods be- ing greedy. In this work we propose robust relabeling, a post-learning procedure that optimally changes the prediction labels of decision tree leaves to maximize adversarial robustness. We show this can be achieved in polynomial time in terms of the number of samples and leaves. Our results on 10 datasets show a significant improvement in adversarial accu- racy both for single decision trees and tree ensembles. Decision trees and random forests trained with a state-of-the-art robust learning algorithm also benefited from robust relabeling.

3. AAAI

   Robust optimal classification trees against adversarial examples

   Daniël Vos, and Sicco Verwer

   AAAI Conference on Artificial Intelligence 2022

   Abs HTML PDF

   Decision trees are a popular choice of explainable model, but just like neural networks, they suffer from adversarial examples. Existing algorithms for fitting decision trees robust against adversarial examples are greedy heuristics and lack approximation guarantees. In this paper we propose ROCT, a collection of methods to train decision trees that are optimally robust against user-specified attack models. We show that the min-max optimization problem that arises in adversarial learning can be solved using a single minimization formulation for decision trees with 0-1 loss. We propose such formulations in Mixed-Integer Linear Programming and Maximum Satisfiability, which widely available solvers can optimize. We also present a method that determines the upper bound on adversarial accuracy for any model using bipartite matching. Our experimental results demonstrate that the existing heuristics achieve close to optimal scores while ROCT achieves state-of-the-art scores.

4. ESORICS

   Efficient Circuits for Permuting and Mapping Packed Values Across Leveled Homomorphic Ciphertexts

   Jelle Vos, Daniël Vos, and Zekeriya Erkin

   European Symposium on Research in Computer Security 2022

   Abs HTML

   Cloud services are an essential part of our digital infrastructure as organizations outsource large amounts of data storage and computations. While organizations typically keep sensitive data in encrypted form at rest, they decrypt it when performing computations, leaving the cloud provider free to observe the data. Unfortunately, access to raw data creates privacy risks. To alleviate these risks, researchers have developed secure outsourced data processing techniques. Such techniques enable cloud services that keep sensitive data encrypted, even during computations. For this purpose, fully homomorphic encryption is particularly promising, but operations on ciphertexts are computationally demanding. Therefore, modern fully homomorphic cryptosystems use packing techniques to store and process multiple values within a single ciphertext. However, a problem arises when packed data in one ciphertext does not align with another. For this reason, we propose a method to construct circuits that perform arbitrary permutations and mappings of such packed values. Unlike existing work, our method supports moving values across multiple ciphertexts, considering that the values in real-world scenarios cannot all be packed within a single ciphertext. We compare our open-source implementation against the state-of-the-art method implemented in HElib, which we adjusted to work with multiple ciphertexts. When data is spread among five or more ciphertexts, our method outperforms the existing method by more than an order of magnitude. Even when we only consider a permutation within a single ciphertext, our method still outperforms the state-of-the-art works implemented by HElib for circuits of similar depth.

2021

1. ICML

   Efficient training of robust decision trees against adversarial examples

   Daniël Vos, and Sicco Verwer

   International Conference on Machine Learning 2021

   Abs HTML PDF

   Current state-of-the-art algorithms for training robust decision trees have high runtime costs and require hours to run. We present GROOT, an efficient algorithm for training robust decision trees and random forests that runs in a matter of seconds to minutes. Where before the worst-case Gini impurity was computed iteratively, we find that we can solve this function analytically to improve time complexity from O(n) to O(1) in terms of n samples. Our results on both single trees and ensembles on 14 structured datasets as well as on MNIST and Fashion-MNIST demonstrate that GROOT runs several orders of magnitude faster than the state-of-the-art works and also shows better performance in terms of adversarial accuracy on structured data.