From: Feature partitioning for robust tree ensembles and their certification in adversarial scenarios
\(|{\mathcal {T}}|\) | Ak | Parameter b | ||||
---|---|---|---|---|---|---|
1 | 2 | 3 | 4 | 5 | ||
f-FPF algorithm | ||||||
50 | 0 | 0.939 | 0.939 | 0.947 | 0.939 | 0.956 |
1 | 0.904 | 0.921 | 0.912 | 0.930 | 0.921 | |
2 | 0.737 | 0.851 | 0.868 | 0.868 | 0.860 | |
3 | 0.105 | 0.404 | 0.728 | 0.825 | 0.825 | |
75 | 0 | 0.939 | 0.939 | 0.939 | 0.939 | 0.939 |
1 | 0.912 | 0.930 | 0.912 | 0.904 | 0.904 | |
2 | 0.719 | 0.842 | 0.868 | 0.860 | 0.868 | |
3 | 0.167 | 0.404 | 0.754 | 0.816 | 0.816 | |
100 | 0 | 0.939 | 0.939 | 0.939 | 0.939 | 0.939 |
1 | 0.93 | 0.921 | 0.921 | 0.904 | 0.904 | |
2 | 0.465 | 0.842 | 0.860 | 0.886 | 0.868 | |
3 | 0.158 | 0.482 | 0.763 | 0.798 | 0.816 | |
h-FPF Algorithm | ||||||
50 | 0 | 0.947 | 0.939 | 0.947 | 0.947 | 0.947 |
1 | 0.904 | 0.93 | 0.921 | 0.921 | 0.921 | |
2 | 0.711 | 0.842 | 0.868 | 0.86 | 0.877 | |
3 | 0.026 | 0.351 | 0.737 | 0.807 | 0.789 | |
75 | 0 | 0.947 | 0.939 | 0.939 | 0.939 | 0.939 |
1 | 0.912 | 0.93 | 0.921 | 0.904 | 0.904 | |
2 | 0.404 | 0.833 | 0.86 | 0.86 | 0.868 | |
3 | 0.096 | 0.351 | 0.746 | 0.798 | 0.789 | |
100 | 0 | 0.947 | 0.939 | 0.939 | 0.947 | 0.930 |
1 | 0.921 | 0.921 | 0.921 | 0.904 | 0.904 | |
2 | 0.412 | 0.842 | 0.868 | 0.877 | 0.868 | |
3 | 0.096 | 0.439 | 0.754 | 0.798 | 0.798 |