提出解释稳定性指标，揭示分类器抗攻击能力与解释可信度可能不一致。
Beyond Gradient-Based Attacks: Adversarial Robustness and Explainability Stability in Cybersecurity Classifiers
- 引入可量化解释稳定性的ESI指标，评估对抗扰动下特征重要性变化。
- 发现基于梯度的攻击在树模型上失效但仍破坏解释，说明鲁棒性与解释性需分开评估。
- 适用于网络安全领域模型评估，尤其关注解释可信度的研究者和安全分析师。
针对网络安全分类器的对抗攻击不仅降低预测性能，还破坏分析师依赖的基于SHAP的解释。本研究将先前对MLP的分析扩展至随机森林（RF）和XGBoost，在四个表格型安全数据集（钓鱼网址、UNSW-NB15、NF-ToN-IoT、HIKARI-2021）上评估五种攻击方法，包括三种适用于非可微树模型的黑盒方法。提出解释稳定性指数（ESI），通过树SHAP归因漂移计算，与鲁棒性指数（RI）同在[0,1]量纲。关键发现：基于梯度的黑盒攻击（ZOO）在XGBoost上产生虚假高鲁棒性（明显RI≈0.98），因其预测面为分段常数；而基于分数的Square Attack暴露真实脆弱性（RI≈0.36）。尽管如此，此类退化扰动仍引发显著归因漂移：XGBoost ESI≈0.06–0.16，远低于RF的0.14–0.29，表明预测鲁棒性与解释稳定性是独立维度，需联合测量。双轴框架（梯度依赖性、查询效率）解释攻击排名，并提供树集成模型评估的实用指导。步长消融实验揭示了在标准化表格数据上PGD出现反直觉异常的原因。
原文摘要 · Abstract (English)
Adversarial attacks on cybersecurity classifiers pose a dual threat: degrading predictions and destabilising the SHAP-based explanations that security analysts rely on to understand and triage alerts. We extend our prior MLP conference study to Random Forest and XGBoost across four tabular security datasets (phishing URLs, UNSW-NB15, NF-ToN-IoT, HIKARI-2021), evaluating five attacks including three black-box methods applicable to non-differentiable tree models. We introduce the Explainability Stability Index (ESI), a scalar metric computed from TreeSHAP attribution drift under adversarial perturbation, reported on the same [0,1] scale as the Robustness Index (RI). A key finding is that gradient-based black-box attacks (ZOO) produce degenerate results against XGBoost (apparent RI ~0.98) due to piecewise-constant prediction surfaces, while score-based Square Attack reveals genuine vulnerability (RI ~0.36). These degenerate perturbations still drive substantial attribution drift: XGBoost ESI ~0.06-0.16 despite near-perfect ZOO robustness, versus 0.14-0.29 for RF, showing that prediction robustness and explanation stability are distinct axes requiring joint measurement. A two-axis framework (gradient dependence, query efficiency) explains the observed attack ranking and yields practical guidance for tree ensemble evaluation. A step-size ablation explains a counterintuitive PGD anomaly on z-score normalised tabular data.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。