Research map / Adversarial robustness and security / Black-box and transfer attacks
TTTS: Tree Test Time Simulation for Enhancing Decision Tree Robustness against Adversarial Examples
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Tree Test Time Simulation (TTTS), an inference-time Monte Carlo method that probabilistically flips branch decisions in decision trees and random forests to improve robustness to white-box and black-box adversarial attacks on tabular data.
Problem
Decision trees trained on tabular data are vulnerable to adversarial examples, and existing defenses modify the model or training process, which can hurt clean accuracy and cannot be applied to deployed models.
Approach
At inference time, for each test instance, run Monte Carlo simulations that mostly follow the tree's correct branch but sometimes deviate, with the deviation probability set by one of five heuristics (fixed, depth, agreement, confidence, threshold distance), then average the leaf predictions. The tree structure, thresholds and inputs are left unchanged.
Key results
- Without attack, TTTS DT Depth raised average AUC from 0.714 (DT baseline) to 0.773 across 50 datasets.
- Under white-box DecisionTreeAttack, TTTS DT Dist raised AUC from 0.337 to 0.680.
- Under black-box ZooAttack, TTTS DT Dist raised AUC from 0.628 to 0.719, above Feature Squeezing's 0.592.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply TTTS with the depth probability heuristic (ablation) | Decision tree · No attack (50 datasets) | AUC: 0.714 ± 0.04 -> 0.773 ± 0.05 | Helped |
| Apply TTTS with the fixed probability heuristic (ablation) | Decision tree · No attack (50 datasets) | AUC: 0.714 ± 0.04 -> 0.764 ± 0.05 | Helped |
| Apply TTTS with the threshold distance probability heuristic (ablation) | Decision tree · No attack (50 datasets) | AUC: 0.714 ± 0.04 -> 0.755 ± 0.05 | Helped |
| Apply TTTS with the agreement probability heuristic (ablation) | Decision tree · No attack (50 datasets) | AUC: 0.714 ± 0.04 -> 0.735 ± 0.04 | Helped |
| Apply TTTS with the confidence probability heuristic (ablation) | Decision tree · No attack (50 datasets) | AUC: 0.714 ± 0.04 -> 0.733 ± 0.06 | Helped |
| Apply TTTS with the threshold distance probability heuristic (ablation) | Decision tree · DTA white-box attack (50 datasets) | AUC: 0.337 ± 0.05 -> 0.680 ± 0.07 | Helped |
| Apply TTTS with the depth probability heuristic (ablation) | Decision tree · DTA white-box attack (50 datasets) | AUC: 0.337 ± 0.05 -> 0.558 ± 0.09 | Helped |
| Apply TTTS with the confidence probability heuristic (ablation) | Decision tree · DTA white-box attack (50 datasets) | AUC: 0.337 ± 0.05 -> 0.517 ± 0.11 | Helped |
| Apply TTTS with the fixed probability heuristic (ablation) | Decision tree · DTA white-box attack (50 datasets) | AUC: 0.337 ± 0.05 -> 0.517 ± 0.09 | Helped |
| Apply TTTS with the agreement probability heuristic (ablation) | Decision tree · DTA white-box attack (50 datasets) | AUC: 0.337 ± 0.05 -> 0.450 ± 0.10 | Helped |
| Apply TTTS with the threshold distance probability heuristic (ablation) | Decision tree · ZOO black-box attack (50 datasets) | AUC: 0.628 ± 0.05 -> 0.719 ± 0.06 | Helped |
| Apply TTTS with the depth probability heuristic (ablation) | Random forest · No attack (50 datasets) | AUC: 0.797 ± 0.14 -> 0.804 ± 0.13 | No clear effect |
Surprising findings
- Feature Squeezing reduced clean DT AUC from 0.714 to 0.598 without any attack.
Limitations
- Substantial computational overhead from Monte Carlo simulations limits real-time use and large datasets.
- Evaluation restricted to binary classification tasks.
- Hyperparameters (max flip probabilities, depth rate) chosen heuristically without a stated sensitivity analysis.
Experimental setup
Datasets: 50 binary tabular classification datasets
Benchmarks: 50 tabular binary classification datasets
Metrics: AUC inference runtime (s)
Baselines: Feature Squeezing DT without defense RF without defense
Builds on: Feature Squeezing random forest DecisionTreeAttack ZooAttack
Closest papers by meaning
- On the Adversarial Risk of Test Time Adaptation: An Investigation into Realistic Test-Time Data Poisoning (ICLR 2025 · similarity 0.86)
- Fully-Dynamic Approximate Decision Trees With Worst-Case Update Time Guarantees (ICML 2024 · similarity 0.84)
- Coevolutionary Algorithm for Building Robust Decision Trees under Minimax Regret (AAAI 2024 · similarity 0.84)
- Less Diverse, Less Safe: The Indirect But Pervasive Risk of Test-Time Scaling in Large Language Models (ICML 2026 · similarity 0.84)
- Robustness Verification of Multi-Class Tree Ensembles (AAAI 2024 · similarity 0.84)
- Faster Repeated Evasion Attacks in Tree Ensembles (NeurIPS 2024 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.