Research map / Adversarial robustness and security / Certified and empirical robustness
Trustworthy Actionable Perturbations
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Trustworthy Actionable Perturbations (TAP), a two-step counterfactual method that optimizes a KL-divergence distance to a flexible target set of class probabilities and then verifies changes with a pairwise verifier to reject adversarial examples.
Problem
Counterfactuals and recourse may change a classifier's decision without changing the true underlying class probabilities, acting like adversarial examples; existing methods also use l-norm costs that poorly reflect real-world effort and only target the final classification.
Approach
Define a target set over class-probability simplex, measure reward as f-divergence distance to that set (with a closed form), use application-specific cost functions and actionable sets, and verify each perturbation with a pairwise same-class verifier V compared against the classifier's implied agreement sum_i M_i(x)M_i(x~).
Key results
- On German Credit with delta=0.5, TAP move 73% of individuals into the goal at zero cost, while counterfactuals need about 7,000 DM and CW attacks never exceed 31% success.
- The verifier eliminated 100% of Carlini-Wagner adversarial examples, and removed about 14% of TAP and 20-27% of counterfactuals that appeared effective.
- PAC generalization bound for the verifier scales as O((k/sqrt(n^2 - k^2 n))^{1/d}), requiring n grow roughly as sqrt(k) with number of classes.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use TAP instead of counterfactual methods | recourse generation · All test scenarios | success rate across costs | Helped |
| use TAP instead of counterfactuals or CW attacks | German Credit recourse generation · German Credit, δ = 0.5 target distance, ε = 0 DM | success rate: 73% for TAP; counterfactuals match this success at ε = 7,000DM | Helped |
| use TAP instead of CW attacks | German Credit recourse generation · German Credit, δ = 0.5 target distance | success rate: 73% for TAP; CW attacks never achieve more than a 31% success rate | Helped |
| apply the verifier to generated CW adversarial examples | TAP verification procedure · Experimental datasets | CW adversarial examples eliminated: 100% | Helped |
| apply the verifier to generated TAP | TAP · Experimental datasets | generated perturbations eliminated: 14% | Hurt |
| apply the verifier to generated counterfactuals | Counterfactual methods · Experimental datasets | generated counterfactuals eliminated: 20% to 27% | Hurt |
Surprising findings
- Verification removed a substantial share of counterfactuals and TAP that appeared effective, with counterfactual methods losing more (20-27%) than TAP (about 14%).
Limitations
- Gradient boosted trees are not differentiable, so the framework uses neural networks tuned to match them.
- The verifier threshold gamma is set by an accepted 10% risk of rejecting effective TAP, a heuristic choice.
- The cost functions are hand-designed per dataset and the paper gives no real-world validation of the true class probability changes.
Experimental setup
Datasets: Adult Income Law School Success Diabetes Prediction German Credit
Benchmarks: Adult Income Law School Success Diabetes Prediction German Credit
Metrics: success rate within target distance delta at cost epsilon verification elimination rate
Baselines: Counterfactual Explanations (Wachter et al.) DICE Carlini-Wagner l2 attack
Builds on: counterfactual explanations Carlini-Wagner attack DICE improvement-focused causal recourse
Closest papers by meaning
- Promoting Counterfactual Robustness through Diversity (AAAI 2024 · similarity 0.86)
- Counterfactual Explanations for Oblique Decision Trees:Exact, Efficient Algorithms (AAAI 2021 · similarity 0.86)
- LeapFactual: Reliable Visual Counterfactual Explanation Using Conditional Flow Matching (NeurIPS 2025 · similarity 0.84)
- Counterfactual Online Conformal Prediction Under Adaptive Logging (NeurIPS 2026 · similarity 0.83)
- Feature Attribution with Necessity and Sufficiency via Dual-stage Perturbation Test for Causal Explanation (ICML 2024 · similarity 0.83)
- Model Reconstruction Using Counterfactual Explanations: A Perspective From Polytope Theory (NeurIPS 2024 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.