def _df_subtree(
        self,
        position: int,
        original_class: int | np.ndarray,
        target: int | None = None,
    ) -> list[int]:
        """
        Search a decision tree for a mis-classifying instance.

        :param position: An array with the original inputs to be attacked.
        :param original_class: original label for the instances we are searching mis-classification for.
        :param target: If the provided, specifies which output the leaf has to have to be accepted.
        :return: An array specifying the path to the leaf where the classification is either != original class or
                 ==target class if provided.
        """
        # base case, we're at a leaf
        if self.estimator.get_left_child(position) == self.estimator.get_right_child(position):
            if target is None:  # untargeted case
                if self.estimator.get_classes_at_node(position) != original_class:
                    path = [position]
                else:
                    path = [-1]
            else:  # targeted case
                if self.estimator.get_classes_at_node(position) == target:
                    path = [position]
                else:
                    path = [-1]
        else:  # go deeper, depths first
            res = self._df_subtree(self.estimator.get_left_child(position), original_class, target)
            if res[0] == -1:
                # no result, try right subtree
                res = self._df_subtree(self.estimator.get_right_child(position), original_class, target)
                if res[0] == -1:
                    # no desired result
                    path = [-1]
                else:
                    res.append(position)
                    path = res
            else:
                # done, it is returning a path
                res.append(position)
                path = res

        return path

        Search a decision tree for a mis-classifying instance.

        :param position: An array with the original inputs to be attacked.
        :param original_class: original label for the instances we are searching mis-classification for.
        :param target: If the provided, specifies which output the leaf has to have to be accepted.
        :return: An array specifying the path to the leaf where the classification is either != original class or
                 ==target class if provided.
        
art/attacks/evasion/decision_tree_attack.py