How does Random Forest behave under adversarial subspace perturbations?

RF is vulnerable when adversarial perturbations target subspaces frequently used in splits.

Adversarial subspace perturbation modifies a subset of features that are heavily relied upon by multiple trees. Because RF tends to reuse informative features across trees (even with feature subsampling), coordinated perturbations in these subspaces can degrade ensemble performance significantly by increasing split instability and reducing agreement among trees.