We introduce an optimization-based reconstruction attack capable of
completely or near-completely reconstructing a dataset utilized for training a
random forest. Notably, our approach relies solely on information readily
available in commonly used libraries such as scikit-learn. To achieve this, we
formulate the reconstruction problem as a combinatorial problem under a maximum
likelihood objective. We demonstrate that this problem is NP-hard, though
solvable at scale using constraint programming -- an approach rooted in
constraint propagation and solution-domain reduction. Through an extensive
computational investigation, we demonstrate that random forests trained without
bootstrap aggregation but with feature randomization are susceptible to a
complete reconstruction. This holds true even with a small number of trees.
Even with bootstrap aggregation, the majority of the data can also be
reconstructed. These findings underscore a critical vulnerability inherent in
widely adopted ensemble methods, warranting attention and mitigation. Although
the potential for such reconstruction attacks has been discussed in privacy
research, our study provides clear empirical evidence of their practicability.

我们介绍了一种基于优化的重建攻击，能够完全或近乎完全重建用于训练随机森林的数据集。我们将重建问题定义为一个组合优化问题，并通过最大似然目标函数来解决。通过广泛的计算研究，我们证明了即使在小规模树集的情况下，使用特征随机化的随机森林也容易被完全重建，这突显了广泛采用的集成方法固有的关键弱点，值得关注和缓解。虽然隐私研究中已经讨论了此类重建攻击的潜在性，但我们的研究提供了明确的实证证据。