Robustness of Bayesian-Optimized Random Forest Against Feature-Space Evasion Attacks for Spam Detection

Moh. Aminudin (Universitas Negeri Semarang)
Riza Arifudin (Universitas Negeri Semarang)

Recursive Journal of Informatics
Vol. 4 No. 2 (2026): September 2026

Abstract. Email spam filters may perform well on unmodified messages yet remain vulnerable to deliberate feature manipulation. Although hyperparameter optimization can improve clean-data performance, such gains do not establish robustness under test-time perturbations. A paired, leakage-controlled evaluation is therefore needed to assess both properties under identical conditions. Purpose: This study compared the clean classification performance and feature-space robustness of a library-default Random Forest (RF-default) and a Bayesian-optimized Random Forest (BO-RF) on Spambase. Methods/Study design/approach: Exact duplicates were removed, and predictor-identical records were grouped to prevent cross-fold leakage. Evaluation used two repetitions of five-fold nested stratified group-aware cross-validation with shared outer folds. Bayesian Optimization maximized inner-validation spam-class F1. Frozen outer-test folds were assessed on clean inputs, class-center-directed perturbations at α = 0.05, 0.10, 0.20, and 0.40, and 30 magnitude-matched random directions. Retained inference assessed within-model clean-versus-directed and directed-versus-random contrasts in F1, Recall, and model-specific attack success rate (ASR). Result/Findings: BO-RF yielded slightly higher means across all four clean metrics; clean F1 was 93.65 ± 0.88% versus 93.53 ± 0.98% for RF-default. Bayesian Optimization selected the effective default configuration in nine of ten outer folds. At directed α = 0.40, F1 fell to 85.20% for RF-default and 85.31% for BO-RF, while Recall fell to 77.94% and 78.03%, respectively; directed ASR was approximately 15.5% for both models. All 48 retained within-model contrasts met Holm-adjusted thresholds, indicating degradation relative to clean inputs and a stronger effect of directed than magnitude-matched random perturbations. No direct between-model inferential family was retained, so robustness comparisons remain descriptive. Novelty/Originality/Value: Under the evaluated Spambase feature-space setting, clean-F1 Bayesian Optimization yielded only marginal descriptive gains and did not demonstrate a clear robustness advantage over the effective RF-default configuration. The findings show that clean-metric optimization should not be treated as a proxy for evasion robustness.