Attacking Random Forest Classifiers based on Shortest Path Algorithm

Though learning-based models have shown high performance on different tasks, existing efforts have discovered the vulnerability of classifiers to evasion attacks. Recent work has shown that individual models are more vulnerable than ensemble models in adversarial settings. However, we have empirically demonstrated that ordinary integration methods do not always improve the robustness against black-box attacks, which is more common in the physical world. In this paper, we prove that random forest does not effectively defend against adversarial attacks, even if it is highly discrete. The proposed non-gradient based algorithm can be fast implemented and receives binary feature inputs. We experimentally compared the robustness of random forests and SVMs using white-box and black-box assessments respectively, and show that random forests and decision tree are consistently worse than SVMs.