{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,4]],"date-time":"2026-02-04T16:42:12Z","timestamp":1770223332302,"version":"3.49.0"},"reference-count":43,"publisher":"Springer Science and Business Media LLC","issue":"5","license":[{"start":{"date-parts":[[2020,6,21]],"date-time":"2020-06-21T00:00:00Z","timestamp":1592697600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2020,6,21]],"date-time":"2020-06-21T00:00:00Z","timestamp":1592697600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Data Min Knowl Disc"],"published-print":{"date-parts":[[2020,9]]},"DOI":"10.1007\/s10618-020-00694-9","type":"journal-article","created":{"date-parts":[[2020,6,21]],"date-time":"2020-06-21T06:02:35Z","timestamp":1592719355000},"page":"1390-1420","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":21,"title":["Treant: training evasion-aware decision trees"],"prefix":"10.1007","volume":"34","author":[{"given":"Stefano","family":"Calzavara","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2545-0425","authenticated-orcid":false,"given":"Claudio","family":"Lucchese","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Gabriele","family":"Tolomei","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Seyum Assefa","family":"Abebe","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Salvatore","family":"Orlando","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2020,6,21]]},"reference":[{"key":"694_CR1","doi-asserted-by":"publisher","first-page":"317","DOI":"10.1016\/j.patcog.2018.07.023","volume":"84","author":"B Biggio","year":"2018","unstructured":"Biggio B, Roli F (2018) Wild patterns: ten years after the rise of adversarial machine learning. Pattern Recognit 84:317\u2013331","journal-title":"Pattern Recognit"},{"issue":"1\u20134","key":"694_CR2","doi-asserted-by":"publisher","first-page":"27","DOI":"10.1007\/s13042-010-0007-7","volume":"1","author":"B Biggio","year":"2010","unstructured":"Biggio B, Fumera G, Roli F (2010) Multiple classifier systems for robust classifier design in adversarial environments. Int J Mach Learn Cybern 1(1\u20134):27\u201341","journal-title":"Int J Mach Learn Cybern"},{"key":"694_CR3","unstructured":"Biggio B, Nelson B, Laskov P (2011) Support vector machines under adversarial label noise. In: ACML Asian conference on machine learning, pp 97\u2013112"},{"key":"694_CR4","doi-asserted-by":"crossref","unstructured":"Biggio B, Corona I, Maiorca D, Nelson B, Srndic N, Laskov P, Giacinto G, Roli F (2013) Evasion attacks against machine learning at test time. In: Machine learning and knowledge discovery in databases\u2014European conference, ECML PKDD, pp 387\u2013402","DOI":"10.1007\/978-3-642-40994-3_25"},{"issue":"4","key":"694_CR5","doi-asserted-by":"publisher","first-page":"984","DOI":"10.1109\/TKDE.2013.57","volume":"26","author":"B Biggio","year":"2014","unstructured":"Biggio B, Fumera G, Roli F (2014) Security evaluation of pattern classifiers under attack. IEEE Trans Knowl Data Eng 26(4):984\u2013996","journal-title":"IEEE Trans Knowl Data Eng"},{"issue":"1","key":"694_CR6","doi-asserted-by":"publisher","first-page":"5","DOI":"10.1023\/A:1010933404324","volume":"45","author":"L Breiman","year":"2001","unstructured":"Breiman L (2001) Random forests. Mach Learn 45(1):5\u201332","journal-title":"Mach Learn"},{"key":"694_CR7","unstructured":"Breiman L, Friedman JH, Olshen RA, Stone CJ (1984) Classification and regression trees. Wadsworth. ISBN 0-534-98053-8"},{"key":"694_CR8","doi-asserted-by":"crossref","unstructured":"Calzavara S, Lucchese C, Tolomei G (2019) Adversarial training of gradient-boosted decision trees. In: Zhu W, Tao D, Cheng X, Cui P, Runden-steiner EA, Carmel D, He Q, Yu JX (eds), Proceedings of the 28th ACM international conference on information and knowledge management, CIKM 2019, Beijing, China, November 3\u20137, 2019, pp 2429\u20132432. ACM","DOI":"10.1145\/3357384.3358149"},{"key":"694_CR9","doi-asserted-by":"crossref","unstructured":"Carlini N, Wagner DA (2017) Towards evaluating the robustness of neural networks. In: IEEE symposium on security and privacy S&P, pp 39\u201357","DOI":"10.1109\/SP.2017.49"},{"key":"694_CR10","unstructured":"Chen H, Zhang H, Boning DS, Hsieh C (2019) Robust decision trees against adversarial examples. In: International conference on machine learning ICML, pp 1122\u20131131"},{"key":"694_CR11","unstructured":"Chollet F (2017) Deep learning with python, 1st edn. Manning Publications Co., Greenwich, CT, USA. ISBN 1617294438, 9781617294433"},{"key":"694_CR12","doi-asserted-by":"crossref","unstructured":"Dang H, Huang Y, Chang E (2017) Evading classifiers by morphing in the dark. In: ACM SIGSAC conference on computer and communications security, pp 119\u2013133","DOI":"10.1145\/3133956.3133978"},{"key":"694_CR13","doi-asserted-by":"publisher","first-page":"1189","DOI":"10.1214\/aos\/1013203451","volume":"29","author":"JH Friedman","year":"2001","unstructured":"Friedman JH (2001) Greedy function approximation: a gradient boosting machine. Ann Stat 29:1189\u20131232","journal-title":"Ann Stat"},{"key":"694_CR14","unstructured":"Goodfellow IJ, Shlens J, Szegedy C (2015) Explaining and harnessing adversarial examples. In: International conference on learning representations ICLR"},{"key":"694_CR15","unstructured":"Gu S, Rigazio L (2015) Towards deep neural network architectures robust to adversarial examples. In: International conference on learning representations ICLR, Workshop Track Proceedings"},{"key":"694_CR16","unstructured":"He W, Wei J, Chen X, Carlini N, Song D (2017) Adversarial example defense: ensembles of weak defenses are not strong. In: USENIX workshop on offensive technologies WOOT"},{"key":"694_CR17","doi-asserted-by":"publisher","unstructured":"Hershkop S, Stolfo SJ (2005) Combining email models for false positive reduction. In: ACM SIGKDD international conference on knowledge discovery in data mining, pp 98\u2013107. https:\/\/doi.org\/10.1145\/1081870.1081885","DOI":"10.1145\/1081870.1081885"},{"key":"694_CR18","doi-asserted-by":"crossref","unstructured":"Huang L, Joseph AD, Nelson B, Rubinstein BIP, Tygar JD (2011) Adversarial machine learning. In: ACM workshop on security and artificial intelligence AISec, pp 43\u201358","DOI":"10.1145\/2046684.2046692"},{"key":"694_CR19","volume-title":"Experiments in Induction","author":"EB Hunt","year":"1966","unstructured":"Hunt EB, Marin J, Stone PJ (1966) Experiments in Induction. Academic Press, New York"},{"issue":"1","key":"694_CR20","doi-asserted-by":"publisher","first-page":"15","DOI":"10.1016\/0020-0190(76)90095-8","volume":"5","author":"L Hyafil","year":"1976","unstructured":"Hyafil L, Rivest RL (1976) Constructing optimal binary decision trees is np-complete. Inf Process Lett 5(1):15\u201317","journal-title":"Inf Process Lett"},{"key":"694_CR21","unstructured":"Kantchelian A, Tygar JD, Joseph AD (2016) Evasion and hardening of tree ensemble classifiers. In: International conference on machine learning ICML, pp 2387\u20132396"},{"key":"694_CR22","doi-asserted-by":"publisher","unstructured":"Kraft D (1994) Algorithm 733: Tomp-fortran modules for optimal control calculations. ACM Trans Math Softw TOMS 20(3):262\u2013281. https:\/\/doi.org\/10.1145\/192115.192124 ISSN 0098-3500","DOI":"10.1145\/192115.192124"},{"key":"694_CR23","doi-asserted-by":"crossref","unstructured":"Lash MT, Lin Q, Street WN, Robinson JG (2017) A budget-constrained inverse classification framework for smooth classifiers. In: IEEE international conference on data mining workshops ICDMW, pp 1184\u20131193","DOI":"10.1109\/ICDMW.2017.174"},{"key":"694_CR24","doi-asserted-by":"crossref","unstructured":"Lowd D, Meek C (2005) Adversarial learning. In: ACM SIGKDD international conference on knowledge discovery in data mining, pp 641\u2013647","DOI":"10.1145\/1081870.1081950"},{"key":"694_CR25","unstructured":"Madry A, Makelov A, Schmidt L, Tsipras D, Vladu A (2018) Towards deep learning models resistant to adversarial attacks. In: International conference on learning representations ICLR"},{"key":"694_CR26","doi-asserted-by":"crossref","unstructured":"Mehta M, Agrawal R, Rissanen J (1996) Sliq: a fast scalable classifier for data mining. In: International conference on extending database technology, pp 18\u201332. Springer","DOI":"10.1007\/BFb0014141"},{"key":"694_CR27","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli S, Fawzi A, Frossard P (2016) Deepfool: a simple and accurate method to fool deep neural networks. In: IEEE conference on computer vision and pattern recognition CVPR, pp 2574\u20132582","DOI":"10.1109\/CVPR.2016.282"},{"issue":"4","key":"694_CR28","doi-asserted-by":"publisher","first-page":"345","DOI":"10.1023\/A:1009744630224","volume":"2","author":"SK Murthy","year":"1998","unstructured":"Murthy SK (1998) Automatic construction of decision trees from data: a multi-disciplinary survey. Data Min Knowl Discov 2(4):345\u2013389","journal-title":"Data Min Knowl Discov"},{"issue":"10","key":"694_CR29","doi-asserted-by":"publisher","first-page":"2428","DOI":"10.3390\/s17102428","volume":"17","author":"S Nawar","year":"2017","unstructured":"Nawar S, Mouazen A (2017) Comparison between random forests, artificial neural networks and gradient boosted machines methods of on-line vis-nir spectroscopy measurements of soil total nitrogen and total carbon. Sensors 17(10):2428","journal-title":"Sensors"},{"key":"694_CR30","unstructured":"Nelson B, Rubinstein BIP, Huang L, Joseph AD, Lau S, Lee SJ, Rao S, Tran A, Tygar JD (2010) Near-optimal evasion of convex-inducing classifiers. In: International conference on artificial intelligence and statistics AISTATS, pp 549\u2013556"},{"key":"694_CR31","doi-asserted-by":"crossref","unstructured":"Nguyen AM, Yosinski J, Clune J (2015) Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In: IEEE conference on computer vision and pattern recognition CVPR, pp 427\u2013436","DOI":"10.1109\/CVPR.2015.7298640"},{"key":"694_CR32","doi-asserted-by":"crossref","unstructured":"Papernot N, McDaniel PD, Jha S, Fredrikson M, Celik ZB, Swami A (2016a) The limitations of deep learning in adversarial settings. In IEEE European symposium on security and privacy EuroS&P, pp 372\u2013387","DOI":"10.1109\/EuroSP.2016.36"},{"key":"694_CR33","doi-asserted-by":"crossref","unstructured":"Papernot N, McDaniel PD, Wu X, Jha S, Swami A (2016b) Distillation as a defense to adversarial perturbations against deep neural networks. In IEEE symposium on security and privacy S&P, pp 582\u2013597","DOI":"10.1109\/SP.2016.41"},{"key":"694_CR34","doi-asserted-by":"publisher","unstructured":"Perdisci R, Gu G, Lee W (2006) Using an ensemble of one-class SVM classifiers to harden payload-based anomaly detection systems. In: IEEE international conference on data mining ICDM, pp 488\u2013498. https:\/\/doi.org\/10.1109\/ICDM.2006.165","DOI":"10.1109\/ICDM.2006.165"},{"issue":"1","key":"694_CR35","first-page":"81","volume":"1","author":"JR Quinlan","year":"1986","unstructured":"Quinlan JR (1986) Induction of decision trees. Mach Learn 1(1):81\u2013106","journal-title":"Mach Learn"},{"key":"694_CR36","doi-asserted-by":"crossref","unstructured":"Srndic N, Laskov P (2014) Practical evasion of a learning-based classifier: a case study. In: IEEE symposium on security and privacy S&P, pp 197\u2013211","DOI":"10.1109\/SP.2014.20"},{"key":"694_CR37","unstructured":"Szegedy C, Zaremba W, Sutskever I, Bruna J, Erhan D, Goodfellow IJ, Fergus R (2014) Intriguing properties of neural networks. In: International conference on learning representations ICLR"},{"key":"694_CR38","doi-asserted-by":"crossref","unstructured":"Tolomei G, Silvestri F, Haines A, Lalmas M (2017) Interpretable predictions of tree-based ensembles via actionable feature tweaking. In: ACM SIGKDD international conference on knowledge discovery in data mining, pp 465\u2013474","DOI":"10.1145\/3097983.3098039"},{"key":"694_CR39","doi-asserted-by":"publisher","unstructured":"Tran TP, Tsai P, Jan T (2008) An adjustable combination of linear regression and modified probabilistic neural network for anti-spam filtering. In: International conference on pattern recognition ICPR, pp 1\u20134. https:\/\/doi.org\/10.1109\/ICPR.2008.4761358","DOI":"10.1109\/ICPR.2008.4761358"},{"issue":"482","key":"694_CR40","doi-asserted-by":"publisher","first-page":"888","DOI":"10.1198\/jasa.2008.s239","volume":"103","author":"DE Tyler","year":"2008","unstructured":"Tyler DE (2008) Robust Statistics: Theory and Methods. J Am Stat Assoc 103(482):888\u2013889. https:\/\/doi.org\/10.1198\/jasa.2008.s239","journal-title":"J Am Stat Assoc"},{"key":"694_CR41","first-page":"831","volume":"4","author":"V Vapnik","year":"1992","unstructured":"Vapnik V (1992) Principles of Risk Minimization for Learning Theory. Adv Neural Inf Process Syst 4:831\u2013838","journal-title":"Adv Neural Inf Process Syst"},{"key":"694_CR42","doi-asserted-by":"publisher","first-page":"53","DOI":"10.1016\/j.neucom.2014.08.081","volume":"160","author":"H Xiao","year":"2015","unstructured":"Xiao H, Biggio B, Nelson B, Xiao H, Eckert C, Roli F (2015) Support vector machines under adversarial label contamination. Neurocomputing 160:53\u201362","journal-title":"Neurocomputing"},{"key":"694_CR43","doi-asserted-by":"crossref","unstructured":"Zhang F, Wang Y, Liu S, Wang H (2020) Decision-based evasion attacks on tree ensemble classifiers. World Wide Web, pp 1\u201321","DOI":"10.1007\/s11280-020-00813-y"}],"container-title":["Data Mining and Knowledge Discovery"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10618-020-00694-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10618-020-00694-9\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10618-020-00694-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,6,20]],"date-time":"2021-06-20T23:21:07Z","timestamp":1624231267000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10618-020-00694-9"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,6,21]]},"references-count":43,"journal-issue":{"issue":"5","published-print":{"date-parts":[[2020,9]]}},"alternative-id":["694"],"URL":"https:\/\/doi.org\/10.1007\/s10618-020-00694-9","relation":{},"ISSN":["1384-5810","1573-756X"],"issn-type":[{"value":"1384-5810","type":"print"},{"value":"1573-756X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,6,21]]},"assertion":[{"value":"5 September 2019","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"19 May 2020","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"21 June 2020","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}]}}