MISLEAD: Manipulating Importance of Selected features for Learning Epsilon in Evasion Attack Deception
Vidit Khazanchi Pavan Kulkarni Yuvaraj Govindarajulu Manojkumar Parmar

Neural network-based recognition of multiple nanobubbles in graphene
    Ara Gocor2
    April 29, 2024
====================================================================





Emerging vulnerabilities in machine learning (ML) models due to adversarial attacks raise concerns about their reliability. Specifically, evasion attacks manipulate models by introducing precise perturbations to input data, causing erroneous predictions. To address this, we propose a methodology combining SHapley Additive exPlanations (SHAP) for feature importance analysis with an innovative Optimal Epsilon technique for conducting evasion attacks. Our approach begins with SHAP-based analysis to understand model vulnerabilities, crucial for devising targeted evasion strategies. The Optimal Epsilon technique, employing a Binary Search algorithm, efficiently determines the minimum epsilon needed for successful evasion. Evaluation across diverse machine learning architectures demonstrates the technique's precision in generating adversarial samples, underscoring its efficacy in manipulating model outcomes. This study emphasizes the critical importance of continuous assessment and monitoring to identify and mitigate potential security risks in machine learning systems.






§ INTRODUCTION


The widespread adoption of machine learning models has driven remarkable technological advancements and improvements in decision-making, concurrently exposing a vulnerability—adversarial attacks, particularly evasion attacks. These attacks involve subtle alterations to input data, leading to erroneous predictions with potentially severe consequences <cit.>. To address this challenge, our approach introduces a methodology combining SHapley Additive exPlanations (SHAP) for feature importance analysis with an innovative optimal epsilon technique <cit.>. Motivated by the growing need to secure machine learning models in vital sectors like healthcare, finance, autonomous vehicles, and cybersecurity <cit.>, our methodology integrates feature importance analysis using SHAP, a powerful tool for understanding feature impact across various domains <cit.>. This analysis spans both binary and multiclass classification scenarios, offering insights for developing targeted evasion strategies by evaluating the significance of different features.

The optimal epsilon technique, introduced in our study, plays a pivotal role in evasion attacks by determining the minimal epsilon necessary for successful evasion. This concept involves finding the smallest perturbation magnitude to deceive a machine learning model into making incorrect predictions without detectable alterations. The technique enhances precision and effectiveness in exposing vulnerabilities, underscoring the need for robust countermeasures <cit.>. Through experiments, we assess the methodology's effectiveness across diverse machine learning architectures and datasets, showcasing its ability to generate precise adversarial samples <cit.>.



The contributions of this paper are as follows:

   
  * Integration of SHAP with Evasion Attacks: The novel approach of systematically integrating SHAP-based feature importance analysis into the evasion attack process, allowing for targeted manipulation of the most influential features, leading to more efficient and effective attacks <cit.>.

   
  * Optimal Epsilon Technique: Introduction of a novel and systematic technique for determining the minimum epsilon needed for successful evasion through a binary search-based approach, enhancing the precision of adversarial sample generation and providing a nuanced understanding of model robustness <cit.>.

   
  * Black-Box Applicability: MISLEAD operates in a black-box setting, relying solely on the model's predictions, making it applicable to real-world scenarios where attackers might not have access to the model's internal parameters.

   
  * Comprehensive Feature Analysis: Thorough analysis of feature impacts, categorizing them based on their influence and directionality, allowing for the development of sophisticated and targeted attack strategies.


The paper is organized as follows: Section <ref> explores fundamental theories and previous studies, providing a base for our research approach. In Section 3, we detail our methodology, including SHAP-based feature importance analysis and the innovative optimal epsilon technique for evasion attacks. Section 4 discusses our experimental setup and findings, highlighting the effectiveness and implications of our work. Finally, Section 5 concludes the paper with a summary of our findings and potential avenues for future research.



§ BACKGROUND





 §.§ Adversarial Machine Learning

Recent years have underscored machine learning models' vulnerability to adversarial attacks, especially evasion attacks that involve crafting adversarial examples for specific target class predictions. Adversarial attacks categorize based on the attacker’s knowledge: perfect (white-box), limited (gray-box), and zero knowledge (black-box) attacks <cit.>. These categories depend on the attacker's understanding of training data and model parameters.



 §.§ Feature Importance

SHAP has emerged as a powerful tool for understanding machine learning models' decision-making process <cit.>. Applied across domains, including image classification, natural language processing, and tabular data analysis <cit.>, SHAP values enhance interpretability, aiding feature selection and model optimization <cit.>. The optimal epsilon technique in our paper systematically determines the minimum epsilon for effective evasion, a valuable contribution to the field. While epsilon's role in controlling perturbation magnitude is well-discussed, systematic techniques for determining optimal epsilon are underexplored. Our paper adapts binary search algorithms, a novel approach in evasion attacks <cit.>.



 §.§ Evasion attacks on ML models

Fast Gradient Sign Method (FGSM) is one of the pioneering techniques in evasion attacks. It computes gradients with respect to the input data and perturbs the data in the direction that maximizes the loss, thus causing misclassification <cit.>. Projected Gradient Descent (PGD) is an iterative variant of FGSM that performs multiple steps of gradient descent while ensuring that the perturbed data remains within an epsilon ball around the original sample <cit.>. DeepFool is an attack method that computes the perturbation by linearizing the decision boundary of the model and iteratively finding the closest decision boundary point <cit.>. Papernot et. al. have explored practical black-box attacks against machine learning models, emphasizing the real-world applicability of adversarial attacks <cit.>. Athalye et. al. investigated techniques for synthesizing robust adversarial examples, aiming to create adversarial samples that are less susceptible to detection and defense mechanisms <cit.>.



 §.§ Feature + Evasion on Tabular classification

In tabular datasets, attacks focus on domain-specific challenges, like financial datasets <cit.>. Novel methods, such as Max Salience Attack (MSA), aim to minimize altered features <cit.>. Our paper proposes a unique methodology integrating SHAP-based feature importance analysis into evasion attacks, providing a comprehensive perspective on model vulnerabilities. This differs from recent advancements like Feature Importance Guided Attack (FIGA) <cit.>, emphasizing minimal perturbation using SHAP and an optimal epsilon technique.



 §.§ SHAP for Black Box Access

Hassija et al., <cit.> explains, SHAP operates as a black-box explainer for black-box models:


   
  * SHAP's Functionality: SHAP focuses on explaining individual predictions, not the entire inner workings of the model.
   
   
  * Model Agnostic: The key strength of SHAP lies in its model-agnostic nature. It doesn't require knowledge of the model's architecture (e.g., decision trees, neural networks) to compute feature contributions. It treats the model as a function, taking inputs and generating outputs.
   
   
  * SHAP's Internal Workings: SHAP leverages game theory concepts (Shapley Values) to fairly distribute credit for a prediction amongst all features. While the underlying calculations involve the model's predictions for various data permutations, SHAP itself remains agnostic to the specific model logic.


In essence, SHAP acts as an intermediary. It interacts with the black-box model at the input-output level, extracting feature importance without needing to delve into the internal complexities of the model. This allows SHAP to provide valuable insights into a model's decision-making process without requiring white-box access.




§ METHODOLOGY


This section provides a detailed explanation of our evasion attack methodology, covering the overall threat model, key assumptions, data collection, and preprocessing procedures. The goal is to enhance the reliability and quality of our input data, emphasizing factors influencing the model's predictions through SHAP techniques for feature importance analysis. Following this analysis, we categorize the impact of individual features based on our findings and introduce an attack strategy, a carefully designed plan to systematically modify input samples, outsmarting the model's predictions to achieve the desired target class.



 §.§ Threat Model and Assumptions


Our research assumes the existence of a machine learning target model vulnerable to evasion attacks due to its sensitivity to changes in input features. Focusing on tabular datasets with numerical and categorical data, our attack strategy operates in a complete black-box setting, where the attacker can only query the target model for predictions without insight into internal parameters and weights.



 §.§ Data Collection and Preprocessing


We employ a Bank Marketing dataset comprising numerical and categorical variables. The class distribution shows 36,548 samples in Class 0 and 4,640 samples in Class 1. With 10 numerical and 10 categorical features, the dataset is comprehensively characterized. Categorical variables are numerically encoded using LabelEncoder <cit.>, and both numerical and categorical features are normalized to a 0 to 1 range using MinMaxScaler <cit.> for comparative analysis.



 §.§ Feature Importance Analysis using SHAP


SHAP values quantify the influence of each feature on model predictions, providing insights into the direction and magnitude of their impact. Calculating SHAP values for every sample generates an array of values for the 20 features. These insights are analyzed through various plots to rank features, assess their average impact, and identify the most influential ones in the dataset. The application of SHAP is explored in both binary and multiclass classification scenarios.






  §.§.§ Binary Classification


In binary classification, involving only two labels, interpreting SHAP values is more straightforward. The following plots are employed:

Global Bar Plot: Offers a comprehensive view of feature importance across the entire dataset. It displays the mean SHAP value for each feature, arranged in descending order of importance, highlighting influential features in driving model predictions (Figure <ref>). However, it doesn't indicate the direction of impact or specific feature values necessary for predicting specific classes.

Local Bar Plot: Zooms in on individual samples, detailing how each feature impacts the model’s prediction for a specific sample. This plot enhances understanding at the micro-level, revealing intricate relationships between features and predictions (Figure <ref>).

Beeswarm Plot: Figure <ref> provides a more detailed and informative visualization than the bar plots. It showcases the relative importance of features and their relationship with the predicted outcome, offering a comprehensive overview of how variables influence predictions. This insight is critical for generating perturbations in our evasion attack strategy.

Together, these plots form an integral part of our methodology, enabling analysis of the impact of individual features on model predictions in both macro and micro perspectives.





  §.§.§ Multiclass Classification


Multiclass classification introduces more complexity with multiple classes for prediction. The following plots are applied:

Global Bar Plot: Represents each feature with a bar divided into sections corresponding to each class (Figure <ref>). This allows for a detailed understanding of a feature's importance across different classes, revealing the variable significance of features in predicting various classes.




Beeswarm Plot: Similar to the binary classification scenario, the multiclass beeswarm plot provides an intricate visualization of SHAP values across the dataset. However, a notable difference is the existence of separate graphs for each class (Figures <ref>, <ref>, <ref>), illustrating how features influence predictions for a specific class. This detailed representation is key to understanding the optimal feature values necessary for predicting each class, crucial for devising targeted evasion strategies.

Together, these plots in multiclass classification scenarios enable a comprehensive analysis of feature impacts, both across and within individual classes. They enhance understanding of how different features contribute to model predictions in multiclass settings, vital for developing sophisticated evasion techniques in a multiclass context.




 §.§ Feature Analysis for Evasion

In addressing the challenge of evasion attacks, we conduct a comprehensive analysis of feature impacts on model predictions. This section details our approach to categorize and utilize feature behavior for devising evasion strategies. By understanding how individual features influence model predictions, we aim to identify vulnerabilities in machine learning models and exploit these for successful evasion.




  §.§.§ Feature Impact Categorization

Our methodology begins with categorizing the impacts of individual features, pivotal for understanding their influence on model predictions. We use predefined thresholds, denoted as T_low and T_high, to assign impact categories: 'Low' (L), 'Medium' (M), or 'High' (H), based on the feature's value F_ij using Equation <ref>.


    CF_ij =  
         L    if  F_ij < T_low
    
         M    if  T_low≤ F_ij < T_high
    
         H    if  F_ij≥ T_high


where, CF_ij represents the impact category of feature i in sample j



  §.§.§ Categorizing SHAP Values


Additionally, we categorize the SHAP values S_ij, labeling them as 'positive' (P), 'neutral' (N_T), or 'negative' (N), based on their sign using Equation <ref>.


    CS_ij =  
         P    if  S_ij > 0 
    
         N_T   if  S_ij = 0 
    
         N    if  S_ij < 0


where, CS_ij represents the categorized SHAP value for feature i in sample j





  §.§.§ SHAP Summary Dictionary


Next, we initiate a SHAP summary dictionary (SSD) to capture the impact of features i for each class c in the dataset using Equation <ref>.


    SSD = { c: { i: { CS: [ ]}, ... }, ... }


where, CS represents {P, N_T, N}




Each class c, feature i, and SHAP category (CS) is represented, with the impact category (CF) accumulated in a list.





  §.§.§ Concise SHAP Summary Direction


Using a count function, we quantify occurrences of impacts for each feature within each class. The sentiment (CS) with the maximum count for each impact (CF) and feature (i) in class (c) is then determined using Equations <ref> and <ref>.


    M_c,i(CF) = max_CS C_i,j,CS(CF)


    C_c,i,CS(CF) = # of times  CF  appears in  CS


This aggregation process leads to a more concise SSD, enabling us to better understand the relationship between features and their impacts across different classes. Appendix <ref> Figure <ref> shows the Concise SSD for the Iris Dataset.




  §.§.§ Possible Class Conversions


The set of possible class conversions, denoted as class_conversions, is a set containing pairs (i, j) where i and j are unique classes, and i ≠ j. It includes all possible combinations of unique class pairs, ensuring that each pair consists of different classes, as defined by Equation <ref>.

    class_conversions = {(i, j) | i, j ∈classes and  i ≠ j}






  §.§.§ Feature Impact Aggregation


To determine how feature impacts from one class i can be converted to another j, an intersection method is used. This method involves intersecting the negative and neutral impacts for class i (I_i^-) with the positive impacts for class j (positive_j). This intersection results in P_ij which indicates a strong positive effect on class j while exerting a negative impact on class i.

Positive Effect on Class j:

    P_ij = I_i^- ∩positive_j


Conversely, the positive and neutral impacts for class j (I_j^+) are intersected with the negative impacts for class i (negative_i). This intersection yields N_ij, signifying a strong negative effect on class i with a positive effect on class j.

Negative Effect on Class i:

    N_ij = I_j^+ ∩negative_i


The final step involves taking the union of P_ij and N_ij. This union synthesizes the modifications necessary to promote a positive effect on class j while simultaneously inducing a negative effect on class i.

Final Effect to move from Class i to Class j:

    F_ij = P_ij∪ N_ij


Such modifications are critical in performing the targeted evasion attack, effectively moving from class i to class j.




  §.§.§ Storing Conversion Directions


In the final step of our process, we store conversion directions for each feature in the conversion table. These directions are pivotal in guiding modifications to feature values during a targeted evasion attack. Appendix <ref> Figure <ref> shows the conversion table for the Iris Dataset.


This table plays a pivotal role in mapping the impact of each feature from the original class to its potential impact on a target class, contingent upon modifications in feature values. The entire process of feature analysis for Evasion is encapsulated in the 'Feature Analysis Block' of Figure <ref>, providing a visual representation of the methodology and its components.
 


 §.§ Evasion Attack Strategy with Optimal Epsilon Technique




























Our evasion attack strategy (refer Appendix <ref>, Algorithm <ref>) operates in a black-box setting, relying solely on the model's output predictions to guide the iterative process of modifying input features. The primary objective is to manipulate a given input sample, x_org, such that it deceives the machine learning model into misclassifying it as a target class, different from its original class.

This strategy leverages the knowledge acquired through the comprehensive feature importance analysis using SHAP, as detailed in Section 3.3 and Section 3.4. The conversion table, derived from this analysis, provides crucial insights into the directional adjustments required for each feature to facilitate the desired class conversion.

The evasion attack algorithm iterates over the features of the input sample, modifying them according to the conversion rules specified in the conversion table. The adjustments, denoted as Δ x_i, are carefully calibrated to remain within plausible bounds, ensuring that the modifications do not exceed a predefined threshold, d_max, also referred to as the epsilon (ϵ) value:


    x'_i = x_i + Δ x_i


During the attack process, we continuously monitor the distance between the modified sample, x_adv_temp, and the original input, x_org, represented as distance(x_adv_temp, x_org). The objective is to find the adversarial sample, x_adv_best, that successfully triggers misclassification into the target class with minimal deviation from the original sample


    x_adv_best = min_x_adv_tempdistance(x_adv_temp, x_org)




To refine the evasion attack approach and ensure the generation of effective adversarial samples with minimal perturbation, we introduce the Optimal Epsilon technique, as shown in Figure <ref>. This technique systematically determines the smallest epsilon (ϵ_optimal) necessary for successful evasion by employing a binary search loop, refer to Algorithm <ref> in Appendix <ref>.

The binary search process starts with an initial epsilon range [ϵ_low, ϵ_high] = [0, 0.5], where 0.5 represents the upper limit for allowed perturbation. This upper limit can be extended to 1 for determining the optimal epsilon across all samples without restrictions on perturbation magnitude. The loop iterates until the gap between ϵ_high and ϵ_low is less than a predefined tolerance value.

Within each iteration, adversarial samples are generated by modifying feature values according to the conversion rules, aiming to shift the prediction from the original class to the target class. The effectiveness of these samples is evaluated on the target model. If a successful adversarial sample is found, the distance between the adversarial and original samples is calculated, and the optimal epsilon and the best adversarial sample are updated accordingly.

The binary search concludes once the difference between ϵ_high and ϵ_low falls below the tolerance threshold. The final ϵ_optimal represents the minimum perturbation magnitude required for effective adversarial samples under the given conditions.



By integrating the Optimal Epsilon technique seamlessly into the evasion attack strategy, our methodology ensures the generation of precise and impactful adversarial samples, underscoring the vulnerability of machine learning models to carefully crafted evasion attacks.











§ EXPERIMENTS




 §.§ Efficacy as a Key Metric for Evasion

Unlike traditional accuracy metrics in machine learning, efficacy in the context of our paper refers to the model's susceptibility to evasion attacks. Specifically, it measures the proportion of samples that successfully evade and deceive the model within the allowed perturbation limit, denoted as epsilon.

Let N be the total number of samples subjected to the evasion attack. Out of these, let N_evaded be the number of samples that successfully evade the model's detection within the perturbation limit. The efficacy, E, can then be mathematically represented as:




    E = N_evaded/N


A high efficacy score implies a greater number of samples evading the model successfully, indicating a potential vulnerability in the model's defense against adversarial attacks within the specified perturbation limit. By evaluating efficacy across different models and configurations, we can compare their robustness against evasion attacks, offering insights into the effectiveness of various defense mechanisms.



 §.§ Multiclass Classification - Iris Dataset

In the context of multiclass classification, we extended our research to the Iris dataset <cit.>, known for its suitability in multiclass tasks. We evaluated five machine learning architectures: SVM with RBF and Linear kernels, XGBoost, Logistic Regression, and Decision Tree <cit.>.
Our focus was on perturbing features of original samples to generate adversarial samples, aiming at specific class misclassifications. In the multiclass setting, this approach introduced additional complexity due to the presence of multiple target classes. Table <ref> illustrates the efficacy of targeted attacks across different machine learning models and varying epsilon values. Figure <ref> visualizes the relationship between the efficacy of attacks and the number of features perturbed. 
This provides deeper insights into the optimization of feature perturbations for successful evasion, showing how certain models reach a saturation point beyond which additional perturbations do not significantly increase the success of the attack.









 §.§ Binary Classification - Bank Marketing Dataset

In the binary classification context, experiments were carried out on a bank marketing dataset <cit.>, a subset derived from the original Bank Marketing dataset from the UCI repository <cit.>. These experiments yielded crucial insights into the robustness of various machine learning models and the dynamics of feature perturbations. We evaluated four machine learning architectures: SVM with Radial Basis Function (RBF) and Linear kernels <cit.>, XGBoost <cit.>, Logistic Regression.





































Table <ref> details the diverse performance spectrum across various models with increasing epsilon values. Notably, Logistic Regression exhibited high evasion susceptibility, reaching perfect evasion (efficacy of 1) at an epsilon value of 0.3 and maintaining this across higher epsilon values. In contrast, SVM with RBF kernel and XGBoost models demonstrated a gradual increase in their susceptibility to evasion attacks as epsilon increased, suggesting a more robust stance against smaller perturbations but a vulnerability at higher epsilon levels. Figure <ref> visually illustrates the saturation point in the number of features necessary for successful evasion attacks across different epsilon value. 
The saturation point is a critical concept, denoting the threshold beyond which increasing the number of perturbed features does not significantly enhance the success rate of the evasion attack.




 §.§ Comparative Study

In our comparative study, we evaluate the performance of the MISLEAD technique against established adversarial defense methods, leveraging Fast Gradient Method (FGM) and Projected Gradient Descent (PGD) from Adversarial Robustness Toolbox (ART) <cit.> and SecML <cit.> libraries.

For the Targeted Attack, experiments were conducted with each of the three Iris classes as the target, as shown in Table <ref>. MISLEAD consistently shows enhanced resilience against targeted attacks towards specific classes when compared to FGM and PGD.


Across various epsilon values in the Untargeted Attack, as shown in Table <ref>, MISLEAD demonstrates competitive efficacy when compared to FGM and PGD. The qualitative analysis suggests that MISLEAD achieves robust results, especially at higher epsilon values, surpassing existing methods. Importantly, FGM and PGD are considered White Box attacks, while MISLEAD operates as a Black Box attack. This distinction adds a critical layer to the comparative analysis, as MISLEAD's efficacy under limited information about the model internals is a significant aspect in real-world scenarios.

These results collectively suggest that the MISLEAD technique, as a novel approach, displays promising performance in both attack scenarios. The qualitative insights emphasize its potential in providing robust adversarial defense, showcasing its superiority over existing methods across various attack scenarios on tabular data.




 §.§ Assessment on Model Accuracy

Upon applying our evasion attack method, as detailed in Tables <ref> and <ref>, we observe a decrease in accuracy models. For the iris dataset, accuracy drops from a stable 0.92 down to 0.00 with progressive increases in the perturbation ϵ. This showcases the attack's capacity to significantly disrupt model performance. The bank marketing dataset shows a similar pattern, with accuracy falling from 0.96 to 0.00. These findings demonstrate our method's ability to highlight the vulnerabilities of machine learning models and stress the need for enhanced defensive measures.

While the current study focuses on tabular data, we believe the MISLEAD methodology can be extended to other data domains, such as images and audio, by leveraging appropriate model explanation techniques. For image data, methods like Grad-CAM <cit.>, DeepLIFT <cit.>, and SHAP for images can provide explainable feature representations. Similarly, for audio data, techniques like Layer-wise Relevance Propagation <cit.> can extract interpretable features. By integrating these domain-specific feature importance analysis tools, the MISLEAD approach can identify vulnerabilities and generate targeted adversarial samples across diverse data modalities. This extensibility underscores the generalizability of the proposed methodology, fostering its applicability in securing machine learning systems handling various data types.



§ MITIGATION STRATEGIES

Mitigating evasion attacks on AI models is an active area of research, with several promising approaches. Adversarial training, as described by Madry et al. in <cit.>, exposes the model to both clean and adversarially crafted data, improving its robustness to slight variations used in evasion attempts. Defensive distillation, proposed by Goldblum et al. in <cit.>, leverages a pre-trained, robust model to train a new model to inherit that robustness. These techniques can be complemented by ensuring high-quality training data with inherent variations and employing ensemble methods for a more robust overall system. Continuous monitoring and adaptation to evolving threats remain essential for maintaining a strong defense.



§ CONCLUSION


In this work, we have introduced a groundbreaking methodology that combines SHAP-based feature importance analysis with an innovative optimal epsilon technique, significantly amplifying the effectiveness of evasion attacks on machine learning models. This methodology is distinct in its capability to precisely identify and manipulate the most influential features of a learning model, thereby refining the accuracy of adversarial sample generation. Our study's cornerstone, the optimal epsilon technique, determines the minimal perturbation required for successful evasion, optimizing the evasion process and establishing a new benchmark in adversarial attack precision. Employing the SHAP framework, our approach not only deepens the understanding of model vulnerabilities but also facilitates the creation of targeted and highly effective adversarial samples, marking a novel advancement in the field.



Looking towards the future, several research avenues present themselves. One promising direction is the extension of our techniques to different data forms, including image and audio data, to comprehensively assess the vulnerabilities across various machine learning models. Additionally, applying our methods to advanced machine learning architectures, especially deep learning models, could provide invaluable insights into both offensive and defensive strategies in model security. Moreover, the development of robust defense mechanisms against the sophisticated evasion attacks demonstrated in our work stands as a critical area of future exploration. Through these endeavors, we aim to contribute to the ongoing advancement in the security of machine learning systems against increasingly sophisticated adversarial threats.


unsrtnat
  

































§ CONCISE SSD AND CONVERSION TABLE


In this section we present the compact SSD and the conversion table for the Iris Dataset. In this representation, the keys denote class conversions, while the corresponding list values illustrate the directional adjustments needed for each of the four features in the sample.
     

The feature analysis for evasion begins with the categorization of features based on their influence levels - Low (L), Medium (M), and High (H), as per Equation <ref>. Following this, we progress to the initialization of the SHAP Summary based on Equation <ref>, which involves segregating SHAP values into three distinct categories: positive (P),  neutral (N_T), and negative (N) based on the criteria detailed in Equation <ref>. This classification is pivotal in understanding the directional influence of each feature.

Once the SHAP summary is constructed, the subsequent step involves generating a concise summary. This is achieved by iterating through each class and feature, allowing us to categorize the impact of features within each class. To accomplish this, we analyze the occurrence counts of impact categories for each class and feature, considering the occurrence of these impact categories within the SHAP categories (Equation <ref> and <ref>).
Illustrating the process with an example: for a specific class and feature, if the impact category 'H' occurs 4 times in the 'positive' SHAP category and 2 times in the 'negative' SHAP category, we assign the impact category 'H' to the 'positive' category in the refined summary, prioritizing the higher occurrence within that particular SHAP category. This approach provides a balanced representation of feature impacts by averaging effects across the entire dataset, fostering a more robust understanding of relationships between feature values and their corresponding impact categories.

In addition to analyzing feature impact, we create a conversion table mapping the impact of each feature on the original class to its potential impact on the target class given a change in feature value. Initially, an empty conversion table is initialized, and possible class conversions are determined based on the number of unique classes present in the dataset (Equation <ref>). For each class conversion, we iterate through features and consider impact categories within both the original and target classes. By comparing these impact categories, we identify the direction in which the feature’s value should be modified (Equation <ref>, <ref> and <ref>).



§ ALGORITHMS




 §.§ Evasion attack

In this section we provide a detailed description of the evasion attack algorithm employed in our research. This algorithm operates in a black-box setting, relying solely on the model's output predictions to guide the strategy. The iterative process aims to modify the features of the input sample, ultimately crossing the decision boundary into the target class.

[h]
Evasion Attack Strategy






 §.§ Optimal Epsilon

In this section we provide an algorithm to obtain an Optimal Epsilon, that determines the smallest epsilon, (ϵ_optimal) required for creating impactful adversarial samples. It employs a refined evasion attack approach, utilizing a binary search loop to iteratively narrow down epsilon ranges, ensuring the generation of effective adversarial samples with minimal perturbation.

[h]
Optimal Epsilon




