  In the present day we use machine learning for sensitive tasks that require
models to be both understandable and robust. Although traditional models such
as decision trees are understandable, they suffer from adversarial attacks.
When a decision tree is used to differentiate between a user's benign and
malicious behavior, an adversarial attack allows the user to effectively evade
the model by perturbing the inputs the model receives. We can use algorithms
that take adversarial attacks into account to fit trees that are more robust.
In this work we propose an algorithm, GROOT, that is two orders of magnitude
faster than the state-of-the-art-work while scoring competitively on accuracy
against adversaries. GROOT accepts an intuitive and permissible threat model.
Where previous threat models were limited to distance norms, we allow each
feature to be perturbed with a user-specified parameter: either a maximum
distance or constraints on the direction of perturbation. Previous works
assumed that both benign and malicious users attempt model evasion but we allow
the user to select which classes perform adversarial attacks. Additionally, we
introduce a hyperparameter rho that allows GROOT to trade off performance in
the regular and adversarial settings.
