EnsembleSHAP: Faithful and certifiably robust feature attribution for random subspace methods

The researchers propose EnsembleSHAP, a feature attribution method for random subspace methods that achieves efficient computation by reusing computational byproducts of the method and preserves key properties of valid feature attribution such as local accuracy. Random subspace methods are used for certified defenses against adversarial attacks and backdoor attacks, and for building robust aligned large language models resistant to jailbreak attacks, while existing attribution methods such as Shapley value and LIME are computationally expensive and lack security guarantees when applied to such models. The authors claim that EnsembleSHAP is the first work to establish provable robustness against explanation-preserving attacks, can provide guaranteed protection against attacks targeting feature attribution methods, and evaluated explanation effectiveness under empirical attacks such as backdoor attacks, adversarial attacks and jailbreak attacks. Code is open-sourced on GitHub (Wang-Yanting/EnsembleSHAP).