SpliDT: Partitioned Decision Trees for Scalable Stateful Inference at Line Rate

Machine learning is increasingly used in programmable data planes, such as switches [4, 12, 13] and smartNICs [1, 16], to enable real-time traffic analysis and security monitoring at line rate. Decision trees (DTs) are particularly well-suited for these tasks due to their interpretability and compatibility with the Reconfigurable Match-Action Table (RMT) architecture. However, current DT implementations require collecting all features upfront, which limits scalability and accuracy due to constrained data plane resources. This paper introduces SpliDT, a scalable framework that reimagines DT deployment as a partitioned inference problem over a sliding window of packets (Figure 1). By dividing inference into sequential subtrees-each using its own set of top-k features-SpliDT supports more stateful features without exceeding hardware limits. An in-band control channel, implemented via packet recirculation, manages transitions between subtrees and reuses match keys and registers across partitions. This design allows physical resources to be shared efficiently while maintaining line-rate processing. To maximize accuracy and scalability, SpliDT employs a custom training and design-space-exploration (DSE) work-flow that jointly optimizes feature allocation, tree depth, and partitioning. Evaluations show that SpliDT supports up to 5× more features, scales to millions of flows, and outperforms baselines, with low overhead and minimal time-to-detection (TTD).