# Defending Against Adversarial Attacks Using Random Forests

arXiv: https://arxiv.org/abs/1906.06765 · HTML: https://mlsanity.com/paper/1906.06765/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 16 Jun 2019.

## Built on by (most cited first, 7 of 7)

- [3VL: Using Trees to Improve Vision-Language Models' Interpretability](https://mlsanity.com/paper/2312.17345/) (2023)
- [Simple Post-Training Robustness Using Test Time Augmentations and Random Forest](https://mlsanity.com/paper/2109.08191/) (2021)
- [On the Robustness of Random Forest Against Untargeted Data Poisoning: An Ensemble-Based Approach](https://mlsanity.com/paper/2209.14013/) (2022)
- [Simple Perturbations Subvert Ethereum Phishing Transactions Detection: An Empirical Analysis](https://mlsanity.com/paper/2408.03441/) (2024)
- [AdIoTack: Quantifying and Refining Resilience of Decision Tree Ensemble Inference Models against Adversarial Volumetric Attacks on IoT Networks](https://mlsanity.com/paper/2203.09792/) (2022)
- [FACM: Intermediate Layer Still Retain Effective Features against Adversarial Examples](https://mlsanity.com/paper/2206.00924/) (2022)
- [FRAUD-RLA: A new reinforcement learning adversarial attack against credit card fraud detection](https://mlsanity.com/paper/2502.02290/) (2025)

## Abstract (arXiv)

As deep neural networks (DNNs) have become increasingly important and popular, the robustness of DNNs is the key to the safety of both the Internet and the physical world. Unfortunately, some recent studies show that adversarial examples, which are hard to be distinguished from real examples, can easily fool DNNs and manipulate their predictions. Upon observing that adversarial examples are mostly generated by gradient-based methods, in this paper, we first propose to use a simple yet very effective non-differentiable hybrid model that combines DNNs and random forests, rather than hide gradients from attackers, to defend against the attacks. Our experiments show that our model can successfully and completely defend the white-box attacks, has a lower transferability, and is quite resistant to three representative types of black-box attacks; while at the same time, our model achieves similar classification accuracy as the original DNNs. Finally, we investigate and suggest a criterion to define where to grow random forests in DNNs.