###### Abstract  
Machine learning (ML) promises advances in automation and threat detection for the future generations of communication networks. However, new threats are introduced, as adversaries target ML systems with malicious data. Adversarial attacks on tree-based ML models involve crafting input perturbations that exploit non-smooth decision boundaries, causing misclassifications. These so-called evasion attacks are imperceptible, as they do not significantly alter the input data distribution and have been shown to degrade the performance of tree-based models across various tasks. Adversarial training and genetic algorithms have been proposed as potential defenses against these attacks. In this paper, we explore the robustness of tree-based models for network intrusion detection systems. This study evaluates an optimization approach inspired by genetic algorithms to generate adversarial samples and studies the impact of adversarial training on the accuracy of attack detection. This paper exposed random forest and extreme gradient boosting classifiers to various adversarial samples generated from communication network-related CIC-IDS2019 and 5G-NIDD datasets. The results indicate that the improvements of robustness to adversarial attacks come with a cost to the accuracy of the network intrusion detection models. These costs can be optimized with intelligent, use case-specific feature engineering.  
machine learning; tree-based models; trustworthiness; robustness; optimization 10  
principles [5]. First, they should be explainable [6; 7; 8], meaning that humans can understand their decision-making process. This helps to build trust and accountability [9]. Second, they should be fair, avoiding biases that could perpetuate discrimination or inequality. This requires careful consideration of the data used to train the models and the potential impacts of their decisions. Finally, they should be robust to adversarial attacks, ensuring they can withstand attempts to manipulate or deceive them.  
The robustness of ML refers to a model's ability to maintain its performance even when faced with unexpected or challenging situations. ML models can be vulnerable to data poisoning and evasion attacks, where malicious inputs deceive the system, causing misclassification and incorrect predictions and decisions. While previous research has laid strong groundwork, the ongoing challenges highlight the need for innovative approaches and frameworks to enhance machine learning robustness in communication networks. Researchers are developing techniques and strategies to make models more resilient to such attacks [10; 11; 12; 13; 14; 15; 16]. The prominent strategy [17; 18; 19; 20; 21; 22], which we also adopted, is to augment training data with examples generated by one or more attack methods. In the context of tree-based models, [PERSON] et al. [23] proposed adversarial training with decision trees ensembles, such as random forests (RFs) and gradient boosted decision trees, by leveraging genetic algorithms (GAs) for optimizing accuracy for compact interpretable models that withstand adversarial perturbations effectively. The study by [PERSON] et al. [24] revealed that evolutionary algorithms have great potential in adversarial attacks with deep neural networks. GAs are robust optimization techniques. Their population-based search explores the solution space broadly, reducing the risk of local optima. Stochastic operators, like mutation and crossover, introduce randomness, enhancing adaptability to complex environments. GAs excel in high-dimensional and noisy problem spaces due to their gradient-free nature. They balance the exploitation of promising solutions with the exploration of new possibilities, ensuring resilience against noisy or incomplete data scalability and inherent parallelism, further solidifying their robustness.