mlsanityData to 13 Oct 2026

Evasion and Hardening of Tree Ensemble Classifiers

arXiv 1509.07892 ↗First posted 25 Sep 2015cs.LG cs.CR stat.MLcited by 44

Not on the map. Why?

Abstract (arXiv)

Classifier evasion consists in finding for a given instance x the nearest instance x' such that the classifier predictions of x and x' are different. We present two novel algorithms for systematically computing evasions for tree ensembles such as boosted trees and random forests. Our first algorithm uses a Mixed Integer Linear Program solver and finds the optimal evading instance under an expressive set of constraints. Our second algorithm trades off optimality for speed by using symbolic prediction, a novel algorithm for fast finite differences on tree ensembles. On a digit recognition task, we demonstrate that both gradient boosted trees and random forests are extremely susceptible to evasions. Finally, we harden a boosted tree model without loss of predictive accuracy by augmenting the training set of each boosting round with evading instances, a technique we call adversarial boosting.

Key facts. Cited by 44 papers in the map (data through 13 Oct 2026). First posted on arXiv 25 Sep 2015.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 13 Oct)

Citing papers per year: 2021: 7; 2022: 11; 2023: 11; 2024: 3; 2025: 6; 2026: 6.

44 papers.

Sort:

  1. 2021A Review of Formal Methods applied to Machine Learningcited by 33
  2. 2021Connecting Interpretability and Robustness in Decision Trees through Separationcited by 16
  3. 2022Adversarial Robustness for Tabular Data through Cost and Utility Awarenesscited by 15
  4. 2021Learning Security Classifiers with Verified Global Robustness Propertiescited by 14
  5. 2022Adaptative Perturbation Patterns: Realistic Adversarial Learning for Robust Intrusion Detectioncited by 13
  6. 2021Robust Optimal Classification Trees Against Adversarial Examplescited by 11
  7. 2023Towards Adversarial Realism and Robust Learning for IoT Intrusion Detection and Classificationcited by 10
  8. 2023SoK: Realistic Adversarial Attacks and Defenses for Intelligent Network Intrusion Detectioncited by 10
  9. 2022On the Safety of Interpretable Machine Learning: A Maximum Deviation Approachcited by 7
  10. 2022(De-)Randomized Smoothing for Decision Stump Ensemblescited by 5
  11. 2022Explainable Global Fairness Verification of Tree-Based Classifierscited by 5
  12. 2022Mitigating Adversarial Gray-Box Attacks Against Phishing Detectorscited by 5
32 more
  1. 2021Fair Training of Decision Tree Classifierscited by 4
  2. 2021Beyond Robustness: Resilience Verification of Tree-Based Classifierscited by 4
  3. 2023Prediction without Preclusion: Recourse Verification with Reachable Setscited by 4
  4. 2021Fixed Points in Cyber Space: Rethinking Optimal Evasion Attacks in the Age of AI-NIDScited by 3
  5. 2023Verifiable Learning for Robust Tree Ensemblescited by 3
  6. 2023Robustness Verification for Knowledge-Based Logic of Risky Driving Scenescited by 3
  7. 2022Provably Adversarially Robust Nearest Prototype Classifierscited by 2
  8. 2023Coevolutionary Algorithm for Building Robust Decision Trees under Minimax Regretcited by 2
  9. 2026Data-Aware and Scalable Sensitivity Analysis for Decision Tree Ensemblescited by 2
  10. 2023Hyper-parameter Tuning for Adversarially Robust Modelscited by 1
  11. 2023Transferable Adversarial Robustness for Categorical Data via Universal Robust Embeddingscited by 1
  12. 2023Adversarial Sample Detection Through Neural Network Transport Dynamicscited by 1
  13. 2024Faster Repeated Evasion Attacks in Tree Ensemblescited by 1
  14. 2024Cultivating Archipelago of Forests: Evolving Robust Decision Trees through Island Coevolutioncited by 1
  15. 2025Conditional Adversarial Fragility in Financial Machine Learning under Macroeconomic Stresscited by 1
  16. 2022AdIoTack: Quantifying and Refining Resilience of Decision Tree Ensemble Inference Models against Adversarial Volumetric Attacks on IoT Networkscited by 0
  17. 2022Scalable Whitebox Attacks on Tree-based Modelscited by 0
  18. 2022Adversarial Example Detection in Deployed Tree Ensemblescited by 0
  19. 2022Robust Boosting Forests with Richer Deep Feature Hierarchycited by 0
  20. 2023Symmetry Defense Against XGBoost Adversarial Perturbation Attackscited by 0
  21. 2023Inverse classification with logistic and softmax classifiers: efficient optimizationcited by 0
  22. 2024Verifiable Boosted Tree Ensemblescited by 0
  23. 2025On the Efficiency of Training Robust Decision Treescited by 0
  24. 2025Boundary on the Table: Efficient Black-Box Decision-Based Attacks for Structured Datacited by 0
  25. 2025The Double-Edged Nature of the Rashomon Set for Trustworthy Machine Learningcited by 0
  26. 2025Adversarial Robustness in Financial Machine Learning: Defenses, Economic Impact, and Governance Evidencecited by 0
  27. 2025Quantitative Verification of Fairness in Tree Ensemblescited by 0
  28. 2026Formal verification of tree-based machine learning models for lateral spreadingcited by 0
  29. 2026Quantifying Sensitivity for Tree Ensembles: A symbolic and compositional approachcited by 0
  30. 2026PINE: Pruning Boosted Tree Ensembles with Conformal In-Distribution Prediction Equivalencecited by 0
  31. 2026Counterfactual Routing Using Integer Programming with Constraint Generationcited by 0
  32. 2026Trustworthy Data- and ML-Ops for Intelligent Transportation Systems and Logisticscited by 0