--- title: Tree Poisoning Problem url: https://www.emergentmind.com/topics/tree-poisoning-problem type: topic --- # Tree Poisoning Problem The tree poisoning problem denotes a family of adversarial and robustness questions in which the underlying object is a tree, but the operative meaning of “poisoning” depends on context. In one major line of work, the target is a learned decision tree or a tree ensemble, and poisoning means inserting, altering, or certifying against malicious training examples so as to change the retrained model’s predictions [2410.00862], [1912.00981], [2305.15394]. In another line, the target is a graph-theoretic tree, and poisoning refers to harmful spread, stochastic corruption, interdiction, or activation under resource constraints; here the core tasks are containment, inference under corrupted observations, connectivity minimization, facility interdiction, or vaccination-style hardening [2210.13247], [1601.00271], [1812.06456], [2301.13723], [1801.08705], [2404.00768], [1507.06483]. This suggests that the topic is best understood as a cluster of tree-structured adversarial optimization problems rather than a single formalism. ## 1. Scope and principal formulations Across the literature summarized here, tree poisoning splits into two dominant formulations. The first is **data poisoning of decision-tree learners**, where the adversary perturbs training data and exploits the discrete split-selection logic of CART-style models. The second is **poisoning or corruption on graph-theoretic trees**, where a harmful state, corrupted observation, or interdiction action propagates or is deployed over a rooted tree under explicit budget and observability constraints. The common denominator is that local changes can induce global effects because trees amplify pathwise dependencies and recursive partitioning. | Formulation | Tree object | Canonical objective | |---|---|---| | Decision-tree poisoning | Learned decision tree or random forest | Maximize post-retraining loss or targeted misclassification [2410.00862], [1912.00981] | | Robust learning against poisoning | Learned decision tree with randomized or abstractly analyzed training | Prove prediction invariance or bound expected degradation under poisoning [1912.00981], [2305.15394] | | Contagion, inference, and interdiction on trees | Rooted tree, contact tree, or broadcast tree | Contain spread, infer hidden states under corruption, or worsen network objectives [2210.13247], [2404.00768], [1601.00271], [1812.06456], [2301.13723], [1801.08705] | A common misconception is that tree models are intrinsically robust because they are simple or interpretable. The decision-tree literature directly contradicts this: small changes in the training data can result in different predictions, certified robustness is nontrivial, and a first white-box poisoning attack specifically targeting decision trees has now been presented [1912.00981], [2410.00862]. The graph-theoretic literature reaches an analogous conclusion: on trees, worst-case corruption or high-growth parameter regimes can make containment or inference information-theoretically impossible [2210.13247], [2404.00768]. ## 2. Poisoning learned decision trees A standard poisoning formulation starts from a clean training set $D=\{(x_i,y_i)\}_{i=1}^n$, a deterministic tree-learning algorithm $A(\cdot)$, and a poisoning set $P=\{(\tilde{x}_j,\tilde{y}_j)\}_{j=1}^b$ under a budget $b$ and feasibility set $\mathcal{F}$. Retraining yields $\hat{f}=A(D\cup P)$. The attacker’s availability objective is usually to maximize empirical test loss, $$ L_{0\text{--}1}(\hat{f};D_{\text{test}})=\frac{1}{|D_{\text{test}}|}\sum_{(x,y)\in D_{\text{test}}}\mathbf{1}[\hat{f}(x)\neq y], $$ while a targeted variant maximizes misclassification on a subset $T\subset D_{\text{test}}$. The supplied overview also describes common feasibility constraints: valid feature domains, optional label-flip permissions, and a small poisoning budget relative to $n$. For CART-style trees, poisoning acts by changing the class proportions $p_c$ that enter split criteria. The overview gives the standard Gini impurity $$ \mathrm{Gini}(S)=1-\sum_c p_c^2, $$ and the entropy/information-gain form $$ H(S)=-\sum_c p_c\log p_c,\qquad IG(S,A)=H(S)-\sum_{v\in \mathrm{Values}(A)}\frac{|S_v|}{|S|}H(S_v). $$ Poisoned examples can therefore increase impurity, decrease information gain for otherwise desirable splits, steer threshold selection for continuous features by placing crafted points near candidate thresholds, and induce cascading downstream changes because once a split changes, all descendant partitions change as well. This recursive sensitivity is a distinctive feature of tree poisoning. The threat model described in the supplied overview is white-box: the attacker knows $D$ or an accurate sample, the learner $A$, hyperparameters such as maximum depth and split criterion, and can trigger retraining on $D\cup P$. Typical attack surfaces are synthetic point injection, label-flip poisoning, and feature perturbation of existing records. A practical attack strategy is greedy selection with damage estimated by local sub-tree retraining rather than full retraining for every candidate. In that strategy, a candidate point is scored by an estimate of $$ \Delta(p)\approx L(A(D\cup\{p\});V)-L(A(D);V), $$ with $V$ a validation set, and only the minimal affected sub-tree is rebuilt. "Timber! Poisoning Decision Trees" presents Timber as the first white-box poisoning attack targeting decision trees. According to the abstract, Timber is based on a greedy attack strategy that leverages sub-tree retraining to efficiently estimate the damage caused by poisoning a given training instance. The attack relies on a tree annotation procedure, enabling the sorting of training instances in increasing order of the computational cost of sub-tree retraining; this yields a variant with an early stopping criterion designed to make poisoning attacks more efficient and feasible on larger datasets. The paper also discusses an extension to traditional random forest models and reports that the attacks outperform existing baselines in terms of effectiveness, efficiency, or both, while two representative defenses mitigate the effect of the attacks but fail to effectively thwart them [2410.00862]. ## 3. Certification and defensive learning for decision trees One response to decision-tree poisoning is **formal certification**. "Proving Data-Poisoning Robustness in Decision Trees" formulates robustness for a specific input $x$ as $$ \forall D'\in P_k(D),\quad h_{A(D')}(x)=h_{A(D)}(x), $$ where $P_k(D)=\{D'\subseteq D:\,|D\setminus D'|\le k\}$ and verification is phrased as up to $k$ deletions from the observed dataset. The paper presents Antidote, a sound verification technique based on abstract interpretation. Antidote trains decision trees abstractly over an intractably large space of possible poisoned datasets, focuses on the input-directed trace rather than the full tree, treats ties as nondeterminism, and uses an abstract dataset domain of the form $\{T\}^k$, abstract predicates, and interval numerics to over-approximate all possible training outcomes [1912.00981]. The training-time abstractions are explicit. For a node sample set $S$, the paper uses class probabilities $cprob(S)=\langle p_1,\dots,p_K\rangle$, Gini impurity $$ ent(S)=\sum_{i=1}^K p_i(1-p_i), $$ and split score $$ score(S,\phi)=|S_\phi|\cdot ent(S_\phi)+|S_{\neg\phi}|\cdot ent(S_{\neg\phi}), $$ with $bestSplit(S)=\arg\min_{\phi\in\Phi'}score(S,\phi)$. The certification theorem is sound in the sense that if abstract training determines a unique class for all concretizations in $P_k(D)$, then the prediction is invariant under any poisoning set within that budget. Empirically, Antidote certifies 38 of 100 test images on MNIST-1-7-Real at depth 2 as robust to $k=64$ deletions with average runtime $\sim 800$ s, certifies some inputs robust to $k=192$ within $\sim 90$ seconds, and exhibits a precision–cost trade-off between the Box and Disjuncts domains; for MNIST-1-7-Binary at depth 3 and $k=64$, Disjuncts certifies 52/100 in $\sim 32$ s and $\sim 1650$ MB, whereas Box certifies 15/100 in $\sim 0.7$ s and $\sim 150$ MB [1912.00981]. A second response is **stability by differential privacy**. "Differentially-Private Decision Trees and Provable Robustness to Data Poisoning" introduces PrivaTree, a histogram-based $\epsilon$-differentially private decision-tree learner that supports mixed numerical and categorical features, uses differentially private quantiles for numerical binning, and labels leaves with permute-and-flip [2305.15394]. At each node, privatized class-conditional histograms are built for bins or categories, and split selection is then pure post-processing of the privatized counts. The paper states a privacy-budget allocation $$ \epsilon_{\text{leaf}}=\min(\epsilon/2,\epsilon'_{\text{leaf}}),\qquad \epsilon_{\text{node,num}}=\epsilon_{\text{quantiles}}=\frac{\epsilon-\epsilon_{\text{leaf}}}{1+d},\qquad \epsilon_{\text{node,cat}}=\frac{\epsilon-\epsilon_{\text{leaf}}}{d}, $$ and proves that PrivaTree provides $\epsilon$-differential privacy. The poisoning guarantees are distribution-level rather than per-instance. For an $\epsilon$-DP learner and a poisoning budget of $x$ samples, the paper gives $$ \mathbb{E}[\mathrm{Accuracy}(\mathcal{M}(\tilde{D}))]\ge e^{-x\epsilon}\,\mathbb{E}[\mathrm{Accuracy}(\mathcal{M}(D))], $$ and for backdoor attack success rate, $$ \mathbb{E}[\mathrm{ASR}(\mathcal{M}(\tilde{D}))]\le 1-e^{-x\epsilon}\,\mathbb{E}[1-\mathrm{ASR}(\mathcal{M}(D))]. $$ The empirical results reported for depth-4 trees include clean accuracies of 99.5% for non-private trees, 98.7% for $\epsilon=0.1$, and 97.4% for $\epsilon=0.01$ on MNIST 0 vs 1, while PrivaTree’s empirical ASR remains below $\sim 20\%$ across the full tested range up to 1% poisoning; on tabular data, the paper reports, for example, adult accuracy $0.820\pm0.003$ for PrivaTree at $\epsilon=0.1$ versus $0.752\pm0.000$ for BDPT, $0.753\pm0.002$ for DPGDF, $0.757\pm0.003$ for DiffPrivLib, and $0.840\pm0.001$ for the non-private model [2305.15394]. These two defense lines are complementary. Certification proves invariance for specific inputs and budgets; differential privacy bounds expected degradation of the learner’s output distribution. Timber’s abstract-level evaluation adds a third point to this picture by indicating that representative defenses can mitigate, but not effectively thwart, white-box poisoning attacks on decision trees [2410.00862]. ## 4. Poisoning, contagion, and inference on graph-theoretic trees In graph-theoretic trees, poisoning frequently means harmful spread or corrupted observations. "Containing the spread of a contagion on a tree" studies a stochastic infection process on a growing tree together with a tracer who stabilizes one node per round. Each node $v$ has infection/transmission parameters $p_v$ and $q_v$, and the per-round expected number of newly infected contacts generated by an infected active node is $$ \lambda(v)=p_v q_v. $$ In the model, the infection runs uninhibited for times $0,\dots,k-1$; for each $t\ge k$, tracing first queries one frontier node and, if it is infected, stabilizes it and reveals its children, after which every active node may generate a new contact. The central objective is containment: the frontier becomes empty exactly when all infected nodes have been stabilized [2210.13247]. The paper proves regime-dependent qualitative behavior. There are thresholds under which **any non-trivial policy** succeeds with high probability: for fixed $\delta\in(0,1)$ and $k\in\mathbb{N}$, if $q_v4.97\times 10^{-7}. $$ It also reports that learned time-based policies did not significantly outperform the monotonic time-based policies across $10^4$ instances. A related but distinct problem is **inference on trees under adversarial leaf corruption**. "Adversarially-Robust Inference on Trees via Belief Propagation" considers broadcasting on a $d$-regular tree with edge correlation $\epsilon$ and signal-to-noise ratio $$ \lambda=d\epsilon^2=d\tanh^2(\beta). $$ The paper confirms that a worst-case $\rho$-fraction adversary who can corrupt leaves of its choosing makes inference impossible even when the fraction of corrupted leaves is inverse-polynomial. By contrast, when corruption locations are random and only the values at those locations are adversarially chosen, accurate posterior inference about the root is possible if $$ \lambda\ge C\log\!\Big(\frac{d}{1-\epsilon}\Big)\qquad\text{and}\qquad \rho\le c\epsilon $$ for universal constants $C,c>0$ [2404.00768]. The canonical belief propagation update is $$ BP(X_1,\dots,X_d)= \frac{\prod_{i=1}^d(1+\epsilon X_i)-\prod_{i=1}^d(1-\epsilon X_i)} {\prod_{i=1}^d(1+\epsilon X_i)+\prod_{i=1}^d(1-\epsilon X_i)}, $$ and the paper shows that standard BP already achieves the robust inference guarantee under the semirandom model. It also proves a matching lower bound up to constants: if $\rho\ge 4\epsilon/(1+2\epsilon)=\Theta(\epsilon)$, then inference becomes information-theoretically impossible [2404.00768]. A third spread model studies multiple competing diseases on $z$-ary or Galton–Watson trees. "Diseases transmission in a z-ary tree" initializes leaves independently with one of $k$ diseases or healthy, and propagates upward by a rule in which a parent takes a disease only if all infected children carry the same disease; conflicting diseases neutralize to healthy. In the symmetric $z$-ary case, the recursion reduces to $$ x_{n+1}=f_{z,k}(x_n)=(1-(k-1)x_n)^z-(1-kx_n)^z. $$ The paper proves a phase transition at $z=6$: for $z\in\{3,4,5\}$ the symmetric fixed point is attracting, whereas for $z=6$ it is repelling; for $z=6$ with two co-dominant diseases, the dynamics converge for almost all initial conditions to a period-2 orbit [1507.06483]. This suggests that poisoning on trees can exhibit genuine dynamical-systems behavior rather than mere monotone spread. ## 5. Interdiction, firefighting, and vaccination on trees A large combinatorial-optimization literature treats poisoning as **budgeted interdiction or obstruction** on a rooted tree. In the Firefighter problem, a rooted tree has a burning root and a per-level protection budget $B_\ell$; the objective is to maximize the total weight of vertices that never burn. In Resource Minimization for Fire Containment (RMFC), the objective is to find the smallest $B$ that saves all leaves. "Firefighting on Trees Beyond Integrality Gaps" gives the standard LP relaxations $$ \max\ \sum_{u\in V\setminus\{r\}}x(u)\,w(T_u) \quad\text{s.t.}\quad x(P_u)\le 1,\ \ x(V_\ell)\le B_\ell, $$ for Firefighter, and $$ \min\ B \quad\text{s.t.}\quad x(P_u)\ge 1,\ \ x(V_\ell)\le B, $$ for RMFC. The paper states that the canonical LP has asymptotic integrality gap $1-1/e$ for Firefighter and $\Theta(\log^* n)$ for RMFC, then improves on both with a PTAS for Firefighter and a factor-12 approximation for RMFC on trees [1601.00271]. A different objective is to **minimize expected connectivity by attacking nodes**. "The Stochastic Critical Node Problem over Trees" considers a tree $T=(V,E)$ with pairwise weights $w_{ij}$, attack costs $\kappa_i$, and a budget $B$. If attacks succeed stochastically, the connectivity of a pair $\{i,j\}$ is a path product, $$ P(i\leftrightarrow j)=\prod_{v\in P_{ij}}(1-x_v p_v) $$ under the query’s convention that $p_v$ is attack success probability. The optimization problem is $$ \min_{x\in\{0,1\}^n}\sum_{i