# Efficient Training of Robust Decision Trees Against Adversarial Examples

arXiv: https://arxiv.org/abs/2012.10438 · HTML: https://mlsanity.com/paper/2012.10438/

## Key facts

- Cited by 24 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 18 Dec 2020.

## Built on by (most cited first, 24 of 24)

- [Logic-Based Explainability in Machine Learning](https://mlsanity.com/paper/2211.00541/) (2022)
- [SoK: Explainable Machine Learning for Computer Security Applications](https://mlsanity.com/paper/2208.10605/) (2022)
- [Adversarial Robustness for Tabular Data through Cost and Utility Awareness](https://mlsanity.com/paper/2208.13058/) (2022)
- [Adaptative Perturbation Patterns: Realistic Adversarial Learning for Robust Intrusion Detection](https://mlsanity.com/paper/2203.04234/) (2022)
- [Robust Optimal Classification Trees Against Adversarial Examples](https://mlsanity.com/paper/2109.03857/) (2021)
- [Towards Adversarial Realism and Robust Learning for IoT Intrusion Detection and Classification](https://mlsanity.com/paper/2301.13122/) (2023)
- [SoK: Realistic Adversarial Attacks and Defenses for Intelligent Network Intrusion Detection](https://mlsanity.com/paper/2308.06819/) (2023)
- [Learning Decision Trees and Forests with Algorithmic Recourse](https://mlsanity.com/paper/2406.01098/) (2024)
- [(De-)Randomized Smoothing for Decision Stump Ensembles](https://mlsanity.com/paper/2205.13909/) (2022)
- [Beyond Robustness: Resilience Verification of Tree-Based Classifiers](https://mlsanity.com/paper/2112.02705/) (2021)
- [Prediction without Preclusion: Recourse Verification with Reachable Sets](https://mlsanity.com/paper/2308.12820/) (2023)
- [Learning-Augmented Robust Algorithmic Recourse](https://mlsanity.com/paper/2410.01580/) (2024)
- [Verifiable Learning for Robust Tree Ensembles](https://mlsanity.com/paper/2305.03626/) (2023)
- [Optimal Robust Recourse with Lp-Bounded Model Change](https://mlsanity.com/paper/2509.21293/) (2025)
- [Naive Bayes Classifiers over Missing Data: Decision and Poisoning](https://mlsanity.com/paper/2303.04811/) (2023)
- [Learning Optimal Classification Trees Robust to Distribution Shifts](https://mlsanity.com/paper/2310.17772/) (2023)
- [Coevolutionary Algorithm for Building Robust Decision Trees under Minimax Regret](https://mlsanity.com/paper/2312.09078/) (2023)
- [Faster Repeated Evasion Attacks in Tree Ensembles](https://mlsanity.com/paper/2402.08586/) (2024)
- [Cultivating Archipelago of Forests: Evolving Robust Decision Trees through Island Coevolution](https://mlsanity.com/paper/2412.13762/) (2024)
- [Adversarial Example Detection in Deployed Tree Ensembles](https://mlsanity.com/paper/2206.13083/) (2022)
- [Verifiable Boosted Tree Ensembles](https://mlsanity.com/paper/2402.14988/) (2024)
- [On the Efficiency of Training Robust Decision Trees](https://mlsanity.com/paper/2507.10048/) (2025)
- [SPOT: Scalable Policy Optimization with Trees for Markov Decision Processes](https://mlsanity.com/paper/2510.19241/) (2025)
- [DiPRL: Learning Discrete Programmatic Policies via Architecture Entropy Regularization](https://mlsanity.com/paper/2605.18508/) (2026)

## Abstract (arXiv)

In the present day we use machine learning for sensitive tasks that require models to be both understandable and robust. Although traditional models such as decision trees are understandable, they suffer from adversarial attacks. When a decision tree is used to differentiate between a user's benign and malicious behavior, an adversarial attack allows the user to effectively evade the model by perturbing the inputs the model receives. We can use algorithms that take adversarial attacks into account to fit trees that are more robust. In this work we propose an algorithm, GROOT, that is two orders of magnitude faster than the state-of-the-art-work while scoring competitively on accuracy against adversaries. GROOT accepts an intuitive and permissible threat model. Where previous threat models were limited to distance norms, we allow each feature to be perturbed with a user-specified parameter: either a maximum distance or constraints on the direction of perturbation. Previous works assumed that both benign and malicious users attempt model evasion but we allow the user to select which classes perform adversarial attacks. Additionally, we introduce a hyperparameter rho that allows GROOT to trade off performance in the regular and adversarial settings.