The GANfather: Controllable generation of malicious activity to expose detection weaknesses and improve defence systems.
Authors: Ricardo Ribeiro Pereira
Jacopo Bono
João Tiago Ascensão
David Oliveira Aparicio
Pedro Manuel Pinto Ribeiro
Pedro Bizarro
Venue: Submitted to ICLR 2023 (2023)

Abstract: Criminal activities are typically adversarial in nature, where an attacker and a defence system are constantly adapting to each other's behaviour. If the defence systems are helped by automated detection methods, then those methods need to be updated frequently. In practice, this means that the defence systems are always one step behind the attackers. For example, in anti-money laundering systems, new labels representing suspicious activity are frequently delayed by weeks or months and some money laundering activity may never be found, leading to detection systems that are inaccurate and resulting in an estimated undetected €0.7-3 trillion being laundered annually.

To tackle the problem of missing or delayed labels in adversarial settings, we propose The GANfather, an adversarial and label-free method to both (1) generate a variety of meaningful attacks, as guided by a custom, user-defined objective function; and (2) train a defence system to detect such attacks. Optionally, we can ensure that the generated attacks escape an existing detection system, revealing current weaknesses which the new defence system actively corrects. Our method is inspired by generative adversarial networks (GANs), but unlike GANs we nudge our generator to produce out-of-distribution data using a loss function that characterises criminal activity. Importantly, our method does not require any labelled examples.

We test our framework in two real-world use-cases, namely injection attacks in recommendation systems and anti-money laundering. In the former, we show how an injection attack with a limited number of generated fake profiles is sufficient to successfully recommend an item to a large number of users. These generated injection attacks are more effective in recommending the target item than naive ‘bombing’ strategies and harder to detect. In the latter, the generated attacks are able to simulate money laundering and move cumulative amounts close to 250 thousand dollars through a network of accounts without being detected by existing systems. We also show how we can train a new defence system that captures all these synthetic attacks, potentially saving millions of dollars in detected criminal activity. Our method is generic and applicable in a variety of adversarial domains, exposing current liabilities with the generated data and strengthening the defence systems against current and future malicious attacks.

Under review as a conference paper at ICLR 2023
THE GANFATHER: CONTROLLABLE GENERATION OF MALICIOUS ACTIVITY TO EXPOSE DETECTION WEAKNESSES AND IMPROVE DEFENCE SYSTEMS
Anonymous authors Paper under double-blind review
ABSTRACT
Machine learning methods to aid defence systems in detecting malicious activity typically rely on labelled data. In some domains, such labelled data is unavailable incomplete. In practice this can lead low detection rates and high false posi- tive rates, which characterise for example anti-money laundering systems. In fact, it is estimated that 1.7-4 trillion euros are laundered annually and go undetected. We propose The GANfather, a method to generate samples with properties of ma- licious activity, without label requirements. To go around the need for labels, we propose to reward the generation of malicious samples by introducing jective to the typical Generative Adversarial Networks (GANs) loss. Ultimately, goal is to enhance the detection of illicit activity using the discriminator net- work as a novel and robust defence system. Optionally, we may encourage the generator to bypass pre-existing detection systems. This setup then reveals defen- sive weaknesses for the discriminator to correct. We evaluate our method in two real-world use cases, money laundering and recommendation systems. In the for- mer, our method moves cumulative amounts close to 250 thousand dollars through network of accounts without being detected by an existing system. the latter, we recommend the target item to broad user base with as few as 30 synthetic attackers. In both cases, we train new defence system capture the synthetic attacks.
extra ob-
INTRODUCTION
Many aspects of our society become increasingly dominated by digital systems, in turn providing new opportunities for illicit actors. For example, digital banking enables clients to open bank ac- counts more easily but also facilitates complex money laundering schemes. It is estimated that undetected money laundering activities worldwide accumulate to C1.7-4 trillion annually (Lannoo) & Parlour 2021), while operational costs related anti-money laundering (AML) compliance tasks incurred by financial institutions accumulate to $37.1 billion (Ray) 2021 Another example are recommender systems, which are often embedded in digital services deliver personalised experi- ences. However, recommender systems may suffer from injection attacks whenever malicious actors fabricate signals (e-g., clicks, ratings, or reviews) to influence recommendations. These attacks have detrimental effects on the user experience. For example, one-star decrease in restaurant ratings can lead to 5 to percent decrease revenue (Lucal 2016).
The detection of such malicious attacks is challenging in the following aspects. In many cases, these illicit activities are adversarial nature, where an attacker and defence system adapt each other's behaviour over time. Additionally, labelled datasets unavailable or incomplete in certain domains due to the absence of natural labels and the cost manual of feedback. For example, besides the large amount of undetected money laundering, the investigation of detected suspicious activity is often far from trivial, resulting in feedback delay that can last months.
To address these issues, propose The GANfather, method to generate examples of illicit tivity and train effective detection systems without any labelled examples. Starting from unlabelled data which assume to be predominantly legitimate, the proposed method leverages GAN-like

---

Under review as a conference paper at ICLR 2023
real
legit.
generated
malic.
a)
GAN
b)
cGAN
Adversarial Attack
d) Ours
Reward
Decision
Boundary
Figure 1: Comparing our method to some widely used approaches. (a) GAN: a vanilla GAN setup does not require any labels, but one cannot choose the class of a generated sample since the distribu- tion of the data is learned as whole. (b) conditional GAN (cGAN); using a cGAN, one learns the class-conditional distributions of the data, allowing the user to choose the class of generated sam- ple. However, labels are needed to train a cGAN. (c) Adversarial Attack (evasion): starting from a malicious example, perturbations are found such that trained classifier is fooled and miss- the perturbed example. While labels are typically required to select the initial example as well to train the classifier, eventually the adversarial attacks can be used obtain a more robust classifier. (d) Ours: our method has some desirable properties from the three previous approaches: no labels are needed (as a GAN), samples of a desired target class are generated (as in a cGAN and a robust detection system can be trained (as in adversarial training). The combination of these properties in one framework is especially suitable in domains where no labelled data is available.
setup (Goodfellow al., 2014) train a generator which learns create malicious activity, as well as detection model learning to discriminate between real data and synthetic malicious data.
To be able to generate samples with malicious properties from legitimate data, our method includes an additional optimisation objective in the training loss of the generator. This objective is a use-case- specific, user-defined differentiable formulation of the goal of the malicious agents. Furthermore, our method optionally allows to incorporate an existing defence system as long differentiable formulation is possible. In that case, we penalise the generator when triggering existing detection mechanisms. Our method can then actively find liabilities in an existing system while simultanc- ously training a complementary detection system to protect against such attacks.
Our system makes the following assumptions and has the following desirable properties (in context of adversarial attacks lacking labelled data):
No labelled malicious samples are needed. Here, we assume that our unlabelled data is predomi- nantly of legitimate nature.
Samples with features of malicious activity are generated. The key generate such samples from legitimate data is to introduce an extra objective function that nudges the generator to produce samples with the required properties. We implicitly assume that malicious activity shares many properties with legitimate behaviour. We justify this assumption since attackers often mimic legit- imate activity some degree, in order avoid raising suspicious or triggering existing detection systems.
robust detection system is trained. By training discriminator to distinguish between the syn- thetic malicious samples and real data, we conjecture that the defence against variety of real mali- cious attacks can be strengthened.
While each of these properties can be found separately in other methods, we believe that the com- bination of all the properties in a single method is novel and useful in the discussed scenarios. In Figure D we illustrate visually how our method distinguishes itself from some well-known ap- proaches. Finally, while we only perform experiments on two use-cases (anti-money laundering and recommender systems) in the following sections, we believe that the suggested approach is applica- ble in other domains facing similar constraints, i.c., no labelled data and adversarial attacks, subject to domain-specific adaptations.
2

---

Under review as a conference paper at ICLR 2023
Discriminator
Real fake?
C
How much does the goal?
Generator
Optimization Objective
C2
Does it trigger an atert?
Alert System
Figure 2: The GANfather framework. Its main components comprise generator, C1. which gen- erates realistic attacks, discriminator, C2. which detects these attacks, an optimisation objective, Cz. to incentivise the generation of malicious instances. Finally, our method optionally supports the inclusion an existing alert system, C4.
METHODS
This section provides general description of our proposed framework in Section 2.1
We proceed
to describe two use-cases: anti-money laundering (AML) (Section 2.2) and detection of injection attacks recommendation systems (Section 2.3)
2.1 GENERAL DESCRIPTION
Figure 2 depicts the general structure of our framework. It includes a generator, a discriminator, an optimisation objective, and, optionally, an existing alert system. Each component is discussed in more detail below.
Generator. As in the classical GAN architecture, the generator G receives random noise input vector and outputs an instance of data. However, unlike classical GANs, the loss of the generator C(G) linear combination of three components: the optimisation objective for malicious activity Lobj(G) (G), the GAN loss LGAN(G, D) that additionally depends on the discriminator D, and the loss from an existing detection system A, (Atert A):
L(G) = aLois(G) BLGAN + Attere
(1)
where a, and y hyperparameters tune the strength of each component. The last term is optional, and if no existing detection system is present we simply choose = O. Note also that of the parameters is redundant and we only parameters in experiments (or one if 0).
We show theoretically, simplified setting, how this loss function changes the learning dynamics compared to a typical GAN in section A.3 Indeed, the stable point of convergence for the generator in our theoretical example moves away from the data distribution for any a >
Discriminator: The discriminator setup is the same in a classical GAN. It receives an example and produces score indicating the likelihood that the example is real or synthetic. Importantly, as explained in section A.3] the generator subject to equation will generate data increasingly out of distribution for larger ax. Therefore, we do not require the discriminator accuracy fall to chance level at training convergence, is usual with GANs. Instead, the discriminator may converge to perfect classification and may used as a detection system for illicit activity. our experiments, the Wasserstein loss (Arjovsky et al. 2017) as GAN loss.
Malicious optimisation objective. The optimisation objective quantifies how well the synthetic example is fulfilling the goal of malicious agent. It can be mathematical formulation or differ- entiable model of the goal. This objective allows the generator to find previously unseen strategies meet malicious goals.

---

Under review as a conference paper at ICLR 2023
Alert system. If an existing, differentiable alert system is present, add it to framework to teach the generator to create examples that do not trigger detection (see equation [T. In that scenario, it is then beneficial for the discriminator to focus on the undetected illicit activity. Whenever the existing system is not differentiable, training differentiable proxy may be possible.
Generator Discriminator views. We note that, if required by the malicious optimisation ob- jective, our generator can be adapted to generate samples which are only partially evaluated by the discriminator. For example, the layering stage of money laundering typically involves moving money through many financial institutions (FIs). However, detection systems are in place in single institutions and therefore have reduced view of the entire operation. Our method can be adapted to capture this situation, by generating samples containing various fictitious Fls, but only sending the partial samples corresponding to each Fl through the discriminator. Similarly, in recommender sys- tems, the malicious objective can act a group of synthetic illicit actors to generated coordinated attacks, while the detection of fraudulent user typically performed on a single-user level.
Architecture optimisations. In the next sections, provide more details about the specific archi- tectures used in the two experiments. We note that the architecture details (layer types, widths and number of layers) were first optimised using vanilla GAN setup (i.e. setting = 0, = 1, 0 in equation Th. With the architecture fixed, the other hyperparameters were tuned as explained the next sections.
2.2 ANTI-MONEY LAUNDERING (AML)
We tackle the layering stage of money laundering, in which criminals attempt to conceal the origin of the money by moving large amounts across financial institutions through what are known as "mule accounts". To represent the dynamic graph of transactions over time, first two dimensions correspond to the accounts and the third dimension is discretised time. Each entry Aijk of the tensor corresponds to the cumulative amount sent from account i to account, on timestep kt For a more detailed overview of this representation, we refer the reader to section A.I.
3D tensor. The
Architecture. We implement the generator using set of dense layers, followed by set of trans- posed convolutions. Then, we create two branches; one to generate transaction amounts and the other to generate transaction probabilities. We use the probabilities perform categorical sampling and generate sparse representations, similar to real transaction data. After the sampling step, the two branches are combined by element-wiss multiplication, resulting in a final output tensor with the dimensions described above. More details of the generator's architecture are found in Table[A]
The discriminator receives two tensors with the same shape as inputs: one containing the total amount of money transferred per entry, and the other with the count information (mapping positive amounts to I and empty entries to 0). Each tensor passes through convolutional layers, followed by permutationninvariiat operations over the internal and external accounts. Then, we concatenate both tensors. We reduce the dimensionality of the resulting vector to a classification outcome using dense layers. More details of the discriminator architecture are found in Table A2
Money Mule objective. To characterise the money flow behaviour of layering, where money is moved in and out of accounts while leaving little behind, we define the objective function as the geometric mean the total amount of incoming (G()) and outgoing (G(z)out) money per gen- erated account (Equation? 2).
(Gn - VG x G(z)out p(z)dz
Here stands for random noise input to the generator G and p(z) stands for its probability distri- bution. This objective function incentivizes the generator to increase the amount of money sent and received per account and keep these two quantitics similar.
Existing Alert System. In AML, it is common to have rule-based detection systems. In our case, the rules detection system contains five alert scenarios, capturing known suspicious patterns such sudden change in behaviour rapid movements of funds. However, these rules not dif- ferentiable, and our generator requires feedback in the form of gradient. Hence, we construct a deep learning model as proxy for the nules system. We hard-code neural network mimicking the
4

---

Under review as a conference paper at ICLR 2023
rules' logic operations by choosing the weights, biases and activation functions appropriately. This network gives the same feedback as the rules system would, but a differentiable way.
Diversity measure. To quantify the diversity of the generated attacks of a generator G, calculate the inception score of three distributions extracted from the generated data: the amount distribution da: the count distribution de (number of transactions per account); and the interval distribution d, (the time difference between consecutive transactions of a same account). We then define the diversity score San the average of these three inception scores (Equation D denotes the KL divergence).
S = (Rewpe (x (da (y)))+
Ex-pe (xr(dd<r) (v)))++
(3)
E Ex-pe [ (dz(d(()))) (y))))))
2.3 RECOMMENDATION SYSTEM
In this work, we consider collaborative filtering recommender systems, However, our method is compatible with any other differentiable recommender. The system receives matrix of ratings R with shape (Nw, N.), where N₂ is the number of users and N, is the number of items. First, we compute cosine distances between users, resulting the matrix D of shape (N Nu). Then, we
compute the predicted ratings P as matrix product between D and R We also note that, unlike the AMI scenario, we do not have an existing detection system this setup.
Architecture. The generator consists of multi-layer perceptrons that gradually increase the size of the random noise input vector to the output vector of ratings. We implement the network using residual blocks composed of two dense layers within the skip connection. Then, similarly to the AML implementation, we create two branches: one for ratings and the other for probabilities. Each of these passes through additional residual blocks until the last dense layer, where scale up the vector size to the number of items N,, before performing the categorical sampling step. our experiments, each synthetic user is independent, but the architecture could easily be adapted to generate a group of users from a single noise vector. More details of the generator architecture are available in T4ble
The discriminator's architecture mirrors that of the generator. As in the AML implementation, receives two tensors with the same shape: one containing the ratings and the other with the count information. We scale down each tensor with dense layer before passing through residual blocks. Finally, we concatenate the two vectors into a single vector. After passing it through additional residual blocks, we scale down the final vector to single value output with dense layer. Invariant permutation is not required because we generate and process each user separately. More details of the discriminator architecture available in Ta5le[A5]
Injection Attack Objective. We define the goal of malicious agents as increasing the frequency of recommendation of specific item. The objective function in Equation incentivizes the generator to increase the rating the target item for every user.
No. Nr (G) = (Po:t) + p(2)dz
(4)
Here, the matrix predicted ratings P depends on the random inputs a through the generator G and ()) denotes rectifier setting negative values zero.
RESULTS
We evaluate the efficiency of TheGANfather to generate and detect attacks in two use-cases: money laundering (Section 3.1) and recommendation system (Section 3.2
We decide not to represent time since most classical recommender systems do not account for it. However, it is possible temporal information using similar setup what we descrihed in the AMI. case.
5

---

Under review as a conference paper at ICLR 2023
3.1 MONEY LAUNDERING
Setup. We use a real-world dataset of financial transactions, containing approximately 200,000 transactions, between 100,000 unique accounts, over 10 month We implement The GANfather's generator and discriminator following the architectures presented in section 2.2
Results. We conduct hyperparameter random search over the learning rate and the weights of the loss function components / and (see Equation D to study the impact of different the relative weights for each component, shown Table A3 It is important ground truth for the generated data, and therefore are limited to measure the success of the generators as how much money is flowing without being detected by the existing AML system, as well as how much variety we find in generated samples (details on the diversity score in equation 3). As shown Figure 3 we did not find trade-off between variety and money flowing, instead generators with high diversity score usually also circulated more money. In Figure we compare the distribution of money flows from such a generator compared to the real data distribution. We can observe that the generated samples successfully move more money through the accounts than real data (up to 250k vs. up to 7k dollars respectively). Interestingly, the distribution of amounts used is similar to real data, and the main difference is the amount of transactions used (see Figure A2
note that we do not have
MDS distribution of probabilities
263800
Total money laundered
-100000
-1
-2
10000
-1.5
-1.0
-0.5
0.0
0.5
1.0
1.5
2.0
MDS of distribution of amounts
Figure 3: Hyperparameter search results. Each point corresponds to a different generator, for which generated samples did not trigger the existing detection system. Distances between generators calculated on the empirical distributions of transaction amounts and transaction probabilities. The and y axis denote the projected dimensions of multidimensional scaling embedding of these distances. The size of the points relates to the diversity score of the data generated and the colour depicts the average total amount of money flowing per generated instance.
Next, we test the detection performance of the trained discriminators. To detect the potential bias that a discriminator has by being trained only on samples of the corresponding generator, we first build mixed dataset where synthetic malicious data is sampled from various generators at various epochs during training and with different random noise seeds. We combine this synthetic dataset with real data, and use it to evaluate the trained discriminators. Importantly, no retraining on this mixed dataset is performed.
Figure we observe that the discriminator typically achieves a per- fect classification performance, especially for higher values of the 3 parameter (see equation note that a was fixed to a value of 1). This can be understood because the parameter limits the gen- erated data distribution to diverge largely from the real data distribution. Therefore, discriminators trained with larger 3 need to more accurately learn a decision boundary around the real data, in turn becoming more robust when evaluating the mixed dataset.
3.2 RECOMMENDER SYSTEM
Setup. We use the Moviel.nss 1M datase comprised of a matrix of 6, 040 users and 3, 706 movies, with ratings ranging from 5 (Harper & Konstan (015). We implement the generator and dis- criminator and collaborative filtering recommender system as described in section 2.3 To compute
Due to the confidential nature we cannot disclose the actual dataset http://wwwg...oo//aaaaaeeteeeeee
Im-dataset

---

Under review as a conference paper at ICLR 2023
real generated
Normalized frequency
0.3
0.8
AUC-ROC score
0.6
0.4
0.1
0.2
0.0
10
102
10a
10
10
105
0.0
20000
40000
60000
80000
100000
Total money flowing per instance
beta
Figure 4: Empirical distribution of money flow (as defined by equation 2). for real data (blue) and generated data (orange).
Figure 5: Discriminator AUC. Each point corresponds to different discriminator.
the predicted ratings, during training we take a weighted average of ratings considering all users in the dataset. We consider all users during training because the initially generated ratings are random, and only providing feedback from the top-N closest users limits the strategies that the generator can learn. In contrast, we consider the top-400 closest neighbours to compute predicted ratings at inference since we observed empirically that this value produces the lowest recommendation loss.
In this scenario, we do not use an existing detection component, corresponding to y 1 We train our networks with 300 synthetic attackers but evaluate the generator's s ability to influence the recommender system with injection attacks of various sizes. We also define four baseline attacks: (1) rating of 5 for the target movie and 0 otherwise, (2) rating of 5 for the target movie and ~90 random ratings for randomly chosen movies, (3) a rating of for the target movie and ~~0 random ratings for the top 10% highest rated movies, (4) rating of 5 for the target movie and ~0 random ratings for the top 10% most rated movies.
in equation
Attack with 30 generated users
Attack with 60 generated
Attack with 120 generated
#Users with the target on top 10
500
500
500
Divergence from resi data
400
400
400
300
300
300
200
200
200
100
100
100
10
10"4
10t1
10'4
10 alpha
1012
0.1
alpha
alpha
Figure 6: Hyperparameter search results. Each point corresponds to different generator. The x-axis corresponds to the y-axis to the number of users with the target item in their top- 10 rec- ommendations, and the colour denotes the KL divergence between real and generated rating profile distributions. We include the number of generated users above each panel. The green line represents the best baseline in each panel, which barely manages to increase the recommendation of the target movie the other users.
Results. We choose 3 = in equation 1, with 0 S < and perform hyperparameter search over a. In Figure 6 we observe that with as few as 30 synthetic attackers the generated attacks (dots) consistently outperform the best baseline (green line) in recommending the target movie. We observe that increasing a leads to generators whose attacks increasingly recommend the target movie, the cost of moving further away from the real data distribution (measured through the KL divergence). Increasing the number of generated users also increases the target movic's recommendation frequency real users.
7

---

Under review as a conference paper at ICLR 2023
Finally, analyse the detection of synthetic attacks. As in the AML scenario build test set containing real and synthetic data, where the synthetic data contains a mixture of samples from vari- trained generators to identify the possible bias of discriminator to attacks by the corresponding generator. We then quantify the AUC of the trained diseriminators. In Figure 7 we observe that most discriminators achieve around 0.75 AUC. Unlike the AMI scenario, this suggests that the dis- criminators are tuned to detect synthetic data from their respective generators, but less so from other generators. We tested whether we can train a better discriminator directly on this mixed set, and indeed are able to obtain near-per pear-perfect classification (Figure 8
1.0
0.98
0.9
AUC-ROC score
0.8
AUC-ROC
0.7
0.7
0.6-
0.6
0.5
10
10
10
10
100
1000
2000
3000
4000
alpha
epoch
Figure 7: Discriminator AUC. Each point corre- sponds to a different discriminator which is eval- uated on the test set without retraining.
We can train new discriminator achieving almost perfect performance on the test set.
Figure 8:
RELATED WORK
Controllable data generation. [Wag et al. (2022) review controllable data generation with deep learning. Among the presented works, highlight De Cao & Kipf (2018). It leverages GAN trained with reinforcement learning to generate small molecular graphs with desired properties. Their work is similar to ours in that we both (1) extend a GAN with extra objective and (2) use similar data representations, namely sparse tensors. However, whereas De Cao & Kipř (2018) uses labelled dataset of molecules and their chemical properties, our method does not rely on any labelled data.
Adversarial Attacks. A vast amount of literature exists on the generation of adversarial attacks (see Xu et al. 2020) for recent review). Such attacks have been studied in various domains and using various setups (e.g. cybersecurity evasion using reinforcement learning (Apruzzese et al. 2020). intrusion detection evasion using GANs (Usama al. 2019), sentence sentiment misclassification using BERT (Garg Ramakrishnan (020)). In all cases, requirement is that labelled examples of malicious attacks exist.
Anti-Money Laundering. Typical anti anti-money laundering solutions are rule-based (aakkins et al, 2003 (Savage et al. 2016 Weber et al. 2018). However, rules suffer from high false-positive rates, may fail to detect complex schemes, and are costly to maintain. Machine learning-based solutions tackle these problems (Chen al.) 2018). Given the lack of labelled data, most solutions employ unsupervised methods like clustering (Wang & Dong 2009) (oolani et al.] 2016), and anomaly detection (Gao 2009; [amino et al. (0077). These assume that illicit behaviours are rare and dis- tinguishable, which may not hold whenever money launderers mimic legitimate behaviour. Various supervised methods have been explored (Jullum al., 20200 Raza & Haider 2011 [Lv et al. 2008 Tang & Yin 2 Oliveira et al.) (021). but most of these works use synthetic positive examples or
incompletely labelled datasets. To avoid this, Lorenz et al. (2020) propose efficient label collection
with active learning, Deng al. (209) and (Charitou et al.
202 explore data augmentation using conditional GANs. Lastly, Li et al. (2020) and [Sun et al. 2021
propose a metric to detect dense money flows in large transaction graphs, resulting in anomaly score. Their method does not in- volve training of classifier, and instead relies on generating many subsets nodes and iteratively calculating the anomaly score.
8

---

Under review as a conference paper at ICLR 2023
Recommender systems (RS) injection attacks. Most injection attacks RS are hand-crafted ac- cording to simple heuristics. Examples include random and average attacks (Lam & Ried 2004), bandwagon attacks (Burke et al., (005a) and segmented attacks (Burke et al., (2055)). However, these strategies are less effective and easily detectable as most generated rating profiles differ sig- nificantly from real data and correlate with each other. [Tang al. (2020) address the optimisation problem of finding the generated profiles that maximise their goals directly through gradient descent and a surrogate RS. Some studies apply GANs to RS generate attacks and defend the system. Wu et al. (2021) combines a graph neural network (GNN) with a GAN to generate their attack. The former select which items rate, and the latter decides the ratings. Zhang et al. (202T) and al.) (202)) propose a similar setup to ours in which they train a GAN to generate data and add loss function to guide the generation of rating profiles. In both works, the main differences to our work are the usage of template rating profiles to achieve the desired sparsity, the chosen architecture and loss functions. In our work, sparsity is learned by the generator through the categorical sampling branch (see section Moreover, our method allows the generation of coordinated group attacks by generating multiple attackers from a single noise vector.
5 CONCLUSION
In this work, we propose The GANfather to generate data of a novel class (malicious activity) without labelled examples, while simultaneously training a detection network to classify the novel class correctly. We performed experiments in two domains. In the anti-money laundering setting, the generated attacks are able to move up to 250,000 dollars using five internal accounts, and without triggering an existing detection system. In the recommender system setting, we generate attacks that are substantially more successful at injection attacks than naive baselines. In both cases, we train a near-perfeer near-perfect classifier to detect the synthetic malicious activity. While no ground truth for the generated attacks are available, we argue that any attack strategy that is possible could in principle be exploited by attackers, While a real test in deployment scenario is lacking and should be addressed in future work, we believe our current experiments provide a proof of value of the method. In these experiments, our method generates a variety of successful attacks, and we therefore believe it can be a valuable method to improve the robustness of defence systems.
The limitations of our method lie in its assumptions. Firstly, we assume that the unlabelled data dominated by legitimate events, and our method would not work in settings where this is not the case. Secondly, we assume that we can quantify the malicious objective in terms of available features. In this case, one could argue can just the malicious objective However, the detection system often has a (much) smaller view than the malicious objective. For example, anti-money laundering systems only view incoming and outgoing transactions for one financial institution. However, our objective can be adapted to generate malicious activity mimicking flows across multiple synthetic financial institutions. while keeping the view of the discriminator on an individual institution level. Thirdly, while our method does not prevent generated data to be very different from real data, we argue that the strength of our method is in generating more subtle attacks that are not immediately distinguishable from real data. Finally, while we chose the malicious objectives to be as simple as possible in our proof of concept experiments, there is no restriction make them more complex as long as they are differentiable.
detection score.
To conclude, our method fits the adversarial game between criminals and security systems by simu- lating various meaningful attacks. If existing defences are in place, method may learn to avoid them and, eventually, train a complementary model. We hope our work contributes to increase the robustness of detection methods of illicit activity.
REFERENCES
Giovanni Apruzzese, Mauro Andreolini, Mirco Marchetti, Andrea Venturi, and Michele Colajanni. Deep reinforcement adversarial learning against botnet evasion attacks. IEEE Transactions on Nerwork and Service Management, 17(4):975511877 2020. doi: 10.1109/TSMM.2000000 1843.
Martin Arjovsky, Soumith Chintala, and Léon Bottou. Wasserstein generative adversarial networks. In International conference on machine learning, pp. 213-223. PMLR, 2017.

---

Under review as a conference paper at ICLR 2023
Robin Burke, Bamshad Mobasher, and Runa Bhaumik. Limited knowledge shilling attacks in collab- orative filtering systems. In Proceedings of 3rd international workshop on intelligent techniques for web personalization (ITWP 2005), 19th international joint conference artificial intelligence (IJCAI 2005), pp- 17-24, 2005a.
Robin Burke, Bamshad Mobasher, Runa Bhaumik, and Chad Williams. Segment-based injection attacks against collaborative filtering recommender systems. In Fifth IEEE International Confer- ence on Data Mining (ICDM'0S), pp. 4-pp. IEEE, 2005b.
Ramiro Daniel Camino, Radu State, Leandro Montero, and Petko Valtchev. Finding suspicious activities in financial transactions and distributed ledgers. In 2017 IEEE International Conference on Data Mining Workshops (ICDMW), pp. 787-796. IEEE, 2017.
Charitos Charitou, Simo Dragicevic, and Artur d' Avila Garcez. Synthetic data generation for fraud detection using gans. arXiv preprint arXiv:2109.122 12546, 2021.
Zhiyuan Chen, Be Na Teoh, Amril Nazir, Eitikan Kandasamy Karuppiah, Kim Sim Lam, et al. Machine learning techniques for anti-money laundering (aml) solutions in suspicious transaction detection: a review. Knowledge and Information Systems, 57(2):245-285, 2018.
Nicola De Cao and Thomas Kipf. Molgan: An implicit generative model for small molecular graphs.
arXiv preprint arXiv:1805.11991 2018.
Xinwei Deng, V Roshan Joseph, Agus Sudjianto, and CF Jeff Wu. Active learning through quential design, with applications to detection of money laundering. Journal of the American Statistical Association, 104(487):969-98) 2009.
Zengan Gao. Application of cluster-based local outlier factor algorithm in anti-money laundering. In 2009 International Conference on Management and Service Science, pp. 1-4. IEÉE, 2009.
Siddhant Garg and Goutham Ramakrishnan. BAE: BERT-based adversarial examples for text clas- sification. In Proceedings of the 2020 Conference on Empirical Methods Natural Language Processing (EMNLP), pp. 1174-6181, Online, November 2020. Association for Computational Linguistics. doi: e020-emmlp--all .48
wttp:/00emmmmmmmmi.m9999. main.498. URL ht httptttt/caaaattooooloa////o///e
org/
Ian Goodfellow, Jean Pouget-Abadie, Mchdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. Advances in neural information processing systems, 27, 2014.
F Maxwell Harper and Joseph A Konstan. The moviclens datasets: History and context. Acm transactions on interactive intelligent systems (tüs), 5(4):1-19, 2015.
Martin Jullum, Anders Løland, Ragnar Bang Huseby, Geir Anonsen, and Johannes Lorentzen. De- tecting money laundering transactions with machine learning. Journal of Money Laundering Control, 2020.
Shyong K Lam and John Riedl. Shilling recommender systems for fun and profit. In Proceedings of the 13th international conference on World Wide Web, pp. 393 393-402, 2004.
Karel Lannoo and Richard Parlour. Anti-money laundering in the eu: Time to get serious. ceps task force report 28 jan 2021., January 2021. utt::tt:://aet pitt. edu/103318/
Xiangfeng Li, Shenghua Liu, Zifeng Li, Xiaotian Han, Chuan Shi, Bryan Hooi, He Huang, and Xueqi Cheng. Flowscope: Spotting money laundering based on graphs. In Proceedings of the AAAI Conference Artificial Intelligence, 2020.
Chen Lin, Si Chen, Meifang Zeng, Sheng Zhang, Min Gao, and Hui Li. Shilling black-box recom- mender systems by learning to generate fake user profiles. IEEE Transactions on Neural Nenworks and Learning Systems, 2022.
Joana Lorenz, Maria Inês Silva, David Aparício, João Tiago Ascensão, and Pedro Bizarro. Machine learning methods to detect money laundering in the bitcoin blockchain in the presence of label scarcity. arXiv preprint arXiv:2005. /4635, 2020.
10

---

Under review as a conference paper at ICLR 2023
Michael Luca. Reviews, reputation, and revenue: The case of yelp.com. American Economic Journal - Applied Economics, 2016.
Lin-Tao Lv, Na Ji, and Jiu-Long Zhang. A rbf neural network model for mnniy laundering. In 2008 International Conference on Wavelet Analysis and Pattern Recognition, volume 1, pp- 209-215. IEEE, 2008.
Catarina Oliveira, João Torres, Maria Inés Silva, David Aparício, João Tiago Ascensão, and Pe- dro Bizarro. Guiltywalker: Distance to illicit nodes in the bitcoin network. arXiv preprint arXiv:2102.05333, 2021.
Arin Ray. It and operational spending in aml-kye: 2021 edition, December 2021. URL https: www. cwn.teeeee.....e.cm.e.e.eeeeeeee wtt.c/cmm..... http://cc///nii.att////00000001.
Saleha Raza and Sajjad Haider. Suspicious activity reporting using dynamic bayesian networks. Procedia Computer Science, 3:987-991, 2011.
David Savage, Qingmai Wang, Pauline Chou, Xiuzhen Zhang, and Xinghuo Yu. Detection of money laundering groups using supervised learning in networks. arXiv preprint arXiv: (608.000000 2016.
Reza Soltani, Uyen Trang Nguyen, Yang Yang, Mohammad Faghani, Alaa Yagoub, and Aijun An. A new algorithm for money laundering detection based on structural similarity. In 2016 IEEE 7th Annual Ubiquitous Computing, Electronics & Mobile Communication Conference (UEMCON), pp. 1-7. IEEE, 2016.
Xiaobing Sun, Jiabao Zhang, Qiming Zhao, Shenghua Liu, Jinglei Chen, Ruoyu Zhuang, Huawei Shen, and Xueqi Cheng. Cubeflow: Money laundering detection with coupled tensors. In PAKDD (1), pp. 78-90. Springer, 2021.
Jiaxi Tang, Hongyi Wen, and Ke Wang. Revisiting adversarially learned injection attacks against recommender systems. In Fourteenth ACM conference on recommender systems, pp. 318-327, 2020.
Jun Tang and Jian Yin. Developing an intelligent data discriminating system of anti-money laun- dering based on svm. In 2005 International conference on machine learning and cybernetics, volume 6, pp. 9453-3457, IEEE, 2005.
Muhammad Usama, Muhammad Asim, Siddique Latif, Junaid Qadir, and Ala-Al-Fuqaha. Gener- ative adversarial networks for launching and thwarting adversarial attacks network intrusion detection systems. In 2019 15th International Wireless Communications and Mobile Computing Conference (IWCMC), pp. 78-83, 2019. doi: 10. 10.100//CCMC2221957766 876666333.
Shiyu Wang, Yuanqi Du, Xiaojie Guo, Bo Pan, and Liang Zhao. Controllable data generation by deep learning: A review. arXiv preprint
2022.
Xingqi Wang and Guang Dong. Research on money laundering detection based on improved min- imum spanning tree clustering and its application. In 2009 Second international symposium on knowledge acquisition and modeling, volume 2, pp. 64. IEEE, 2009.
Cory Watkins, K Michael Reynolds, Ron Demara, Michael Georgiopoulos, Avelino Gonzalez, and Ron Eaglin. Tracking dirty proceeds: exploring data mining technologies tools investigate money laundering. Police Practice and Research, 4(2): 163-178, 2003.
Mark Weber, Jie Chen, Toyotaro Suzumura, Aldo Pareja, Tengfei Ma, Hiroki Kanezashi, Tim Kaler, Charles Leiserson, and Tao B Schardl. Scalable graph learning for anti-moncy laundering: A first look. arXiv preprint arXiv: 00111122000077 2018.
Fan Wu, Min Gao, Junliang Yu, Zongwei Wang. Kecheng Liu, and Xu Wang. Ready for emerging threats to recommender systems? graph convolution- based generative shilling attack. Informa- fion Sciences, 578:683-701, 2021.
Han Xu, Yao Ma, Tho- Liu, Debayan Deb, Hui Liu, Ji-Liang Tang. and Anil K. Jain. Adver- sarial attacks and defenses in images, graphs and text: A review. pp. 151-178, 2020.
11

---

Under review as a conference paper at ICLR 2023
Xuxin Zhang, Jian Chen, Rui Zhang, Chen Wang, and Ling Liu. Attacking recommender systems with plausible profile. IEEE Transactions on Information Forensics and Security, 16:4788 4800, 2021.
12

---

Under review as a conference paper at ICLR 2023
A
APPENDIX
A.1 EXTENDED METHODS
A.1.1 REPRESENTING DYNAMIC GRAPHS AS TENSORS
To represent the dynamic graph of transactions, assume the nodes the dynamic graph are accounts, and the edges are transactions. The first two dimensions correspond to the weighted adjacency matrix of the accounts and the third dimension time. We discretise the events into time windows of fixed length and group events that belong the same entry in the tensor by summing their amounts. Our representation covers any dynamic network with a 3D tensor whose size is fixed and pre-specified, which allows us to avoid using recurrent models. While this approach may limit the size of generated data, domain experts reported that up to 95% of the money-launderigg investigations involve cases containing up to accounts.
use 3D tensor depicted in Figure Al We
Source
Target
Amounti
Day
8.14
S
B
15.92
80.79
6
D
46.28
2
Figure A1: Data representation of transactional data. From the raw tabular data, we build the tripar- tite graph of the transactions, which turn represented 3D tensor.
A.1.2 EXPERIMENTAL DETAILS: ANTI-MONEY LAUNDERING
Index
Layer
Output shape
Linear( (100, 400)
(400.)
Linear(400, 1600)
(1600.)
Linear( (6000, 5000)
(5000.)
Reshape
(5,10,10,10)
Conv TonyTranspose 1
(5,10,20,10)
4
Conv TonyTTrasposse11 ((100000...100
(5,10,40,10)
Conv TonyTraasposse 1 dd100,10,4,2.
(5.10,80,10)
6
ConyTranspose 1(10,,00..2,11
(5,10,160,10)
Split amounts and probabilities
(5, 10, 160,10)
Conv TunyTransposeed(de 10..0.)..4.2.1
(5.10.320,10)
8
Conv Id 110,,1,1.11,) Categorical sampling
(5,10.320)
(5,10.320)
Table A1: AML generator architecture.
13

---

Under review as a conference paper at ICLR 2023
Index
Layer
Output shape
0
Conv 10(1,10,6,441
(5.10,80,10)
1
(5,10,20,10)
2
Conv (onvid(10,566,4))
(5,10,5.5)
Reshape
(5,2.5,25)
Mean pooling
(1,2,1,25)
Concatenate amounts and probabilities
(100.)
3
Linear( (100,100 128) Linear( 128,32) Linear(32,1)
(128.)
4
(32.)
5
(1.)
Table A2: AML discriminator architecture.
a
[102 10
[10 4 x 10
7V
learning rate
[10 -, x 10 3]
Table A3: Hyperparameter search space on the AMI. use case.
A.1.3 EXPERIMENTAL DETAILS: RECOMMENDER SYSTEMS
Index
Layer
Output shape
0
ResBlock(128,1 128)
(128.)
1
ResBlock 128)
(128.)
Split ratings and probabilities
(128.)
2
ResBlock 128)
(128.)
3
ResBBookk(228661 (incar(64,3706) Categorical sampling
(64.)
4
(3706.)
(3706.)
Table A4: RS generator architecture.
Index
Layer
Output shape
0
Dense(3706,64) ResBBlock664,222 128)
(64.)
1
(128,)
2
ResBlock (12,,64)
(64.)
Concatenate ratings and probabilities
(128.)
3
ResBlock 128)
(128.)
4
ResBlock( (128, 128128)
(128.)
5
Linear( 1))
(1.)
Table A5: RS discriminator architecture.
110 5 [10-5 3 x 10
learning rate
Table A6: Hyperparameter search space the RS use case.
A.2 EXTENDED RESULTS
In Figure A2
compare the distributions of the total amount of money flowing through the internal accounts from real data with our generated dataset; we observe that the generators consistently move more money than real accounts. By investigating the distributions of amounts per transaction and
14

---

Under review as a conference paper at ICLR 2023
the number of transactions per account, verify that the generators circulate money than real accounts because they make more transactions but keep the amounts in a similar range as the real data.
0.4
real
real
real
Normalired frequnncy
Narma Hermalteed slnned frequency
Normalized frequency
0.3-
0.2
0.2
0.2
0.3
2.1
0.1
0.9
Total money flowing por instance
Amount per transaction
Number transactions per account
Figure A2: Comparison distributions of total money flow, amounts and counts between G and real.
A.3 THEORETICAL JUSTIFICATION: SIMPLIFIED SETTING
In this section, we provide simplified example discuss certain aspects of our setup. We will assume no existing detection system is available (y 0 in equation [T] In the case such a system would be available, we assume its effect to limit how far the generated data distribution can be from the real data distribution. Furthermore, we assume that malicious objective would promote change the distribution at least one feature of the generated data compared to the real data.
In order to facilitate the analytical calculations, we make the following simplifying assumptions. Firstly, we assume that our data consists of only one feature, for which the regular (legitimate) activity is distributed following normal distribution Pdata with mean ps and standard deviation d
Pdata N (Ha
(5)
Secondly, assume that do not have any samples of malicious activity but that know that it is characterised by larger values this feature compared to the legitimate activity. Thirdly, we assume that the generated data follows normal distribution Peen with mean Hy and standard deviation dg- Using y = 0 and 3 = 1 - a in equation] assuming 0 S a S 1, we can write the training criterion of the generator as:
((G) = (1 a)) (2 JSD (Pdata Pgea) 1og(4)) 0x44g
Where the first term denotes the GAN loss Goodfellow et al. (014) and the second term denotes malicious objective rewarding the generator produce samples with properties of the malicious data.
We can analytically solve the Jenson-Shannon Divergence (JSD) between the normal distributions, using 02 0² + oz
JSD (Pdatal (PeatalPeea)
KL (Pdata & (Peata + Pgen)) + KL (pgen 10.5 (peata + Pgen))
(7)
2
2
Fm
o3 (Ma 0.5(Ma + mn)))
1
log
(8)
2
Td
20
2
Fm
02 + ("g - 0.5(pa + 2g)))
1
log
+
(9)
0g
202 2
2
15

---

Under review as a conference paper at ICLR 2023
From this, calculate the gradient w.r.t. Mgi
OJSD Pdaan Pren))
1
Om
o + (ua 0.5( + pn)))
1
0
log
+
(10)
0pg
2
Od
20 m
2
og + (Ug
0.5(ua + 1a))² 1
log
Om
+
10pg
(11)
0g
20 m
2
1
(0.5pa 0.5pg)
(0.5pg g 0.5
+
10pg
(12)
2
20
20
Mg
Hd
(13)
4
+ 4
Combining equations 6 and 13 find that the gradient of the training objective of the generator w.r.t. the mean of the generated distribution Pg is
OC(G) (1 a) M1 Pd 0Hg
(14)
03 o
Without loss of generality, we set og + o k/2, such that
OC(G) 0pg
Mg Ud
(1 a)
(15)
k
8pg the changes of ng over time (i.e. a continuous version of the discrete gradient Denoting as ar updates), and with 17 learning rate, this leads to the following linear dynamical system which can analyse in function of ng. Udat and the hyperparameter o::
0pg 1
ÖL(G)
(16)
0pg 71(1 a1) M4 Pd
+ 1j0x
(17)
k
014 nddpy + nypu + 17a
(18)
Øt
Where we defined d= (1- a)/k. The stability of this linear system is defined by the sign of d, which is always negative and hence the system has stable fixed point. The stable fixed point for this dynamical system is easily found to be
M Mdd +
k
(19)
I
We plot the phase diagram of the dynamical system in Figure showing the fixed point in function of the parameter a.
From this calculation on simplified setting, we can conclude the following:
For a > O, our generated data will move away from the real data distribution and increas- ingly comply with the malicious objective.
Various values of will generate various levels of deviation from the real data. When no ground truth is available test the resulting system, hyperparameter tuning and empirical testing should be performed. Another limiting factor for the deviation from real data can the inclusion an already available detection system.
When generated data deviates from real data, the discriminator will increasingly achieve a perfect performance even at training completion. This is a major difference to standard GAN training.
16

---

Under review as a conference paper at ICLR 2023
Phase Portrait
fixed point
f
17
t
data
0.0
0.5
1.0
alpha
Figure A3: Phase portrait of our toy system. The fixed point of My depends on hyperparameter a.
For -> 1, the fixed point approaches infinity. For 0, the fixed point converges μla Arrows denote the direction of the gradient dgg
öt
17


Reviews:
[{"review_id": "sCUYX6TC1BF", "reviewer": "Reviewer_x8ad", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The authors propose a GAN based approach to generate attacks and also claim to enhance the detection of illicit activity in various domains. They use three type of loss functions to train a generator to generate the attacks. The domain they focus on is money laundering and recommendation systems. The authors claim there methods applies to other settings", "summary_of_the_review": "My recommendation is based on my perception of limited novelty and lack of new generalizable principles to be taken away from this work.", "strength_and_weaknesses": "The idea here is not novel as there are a number of papers that use a GAN like structure for generating OOD samples (or adversarial examples) - see references below, of course, mostly focussing on image domain. This paper does not work on image domain, which is actually a strength of the paper.\n\nBut, I did not see any insights that are generalizable or even some domain specific hard structural problem that is addressed (i.e., the loss functions used are quite natural and probably too simple). I am not sure why these objective were chosen, is there some citation to support these? I was also hoping to see some quantitative measure of how good the attack is, which in the paper is just shown qualitatively\n\nI do not understand the part about discriminator - a line in the paper says that \"the discriminator eventually learns to distinguish synthetic attacks from real data\", but isnt a GAN supposed to eventually make the discriminator not be able to distinguish (by learning a good generator)? Along same lines, I do not understand what is going on in Figure 4? It seems rather like adversarial training that a neural network is trained with OOD data and is able to then detect those. But, then the generator can be trained again to bypass this new discriminator?\n\nBaluja, S., & Fischer, I. (2018). Learning to Attack: Adversarial Transformation Networks. Proceedings of the AAAI Conference on Artificial Intelligence, 32(1).\nLiu, A., Liu, X., Fan, J., Ma, Y., Zhang, A., Xie, H., & Tao, D. (2019). Perceptual-Sensitive GAN for Generating Adversarial Patches. Proceedings of the AAAI Conference on Artificial Intelligence, 33(01)\nXiao, C., Li, B., Zhu, J. Y., He, W., Liu, M., & Song, D. (2018). Generating adversarial examples with adversarial networks. In 27th International Joint Conference on Artificial Intelligence, IJCAI 2018 (pp. 3905-3911). International Joint Conferences on Artificial Intelligence.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "E2ddv8CSHM", "reviewer": "Reviewer_hdrh", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper tackles the problem of detection of “illicit” activities. The main proposal is “The Ganfather”, a Generative Adversarial Network (GAN) that automatically crafts samples conforming to a given “illicit activity” which – if not detected – will cause harm to the owners of an information system. By training a detector on the generated “illicit activities”, it is possible to develop a detector that protects the information system against such malicious samples. The proposal, for which no theoretical analysis is provided, is empirically evaluated on two datasets representing typical scenarios affected by illicit activities: money laundering, and recommender systems.", "summary_of_the_review": "The paper cannot be accepted to ICLR, and I am confident of my decision. Truly, I believe the paper requires a complete re-write, starting from its conceptualization: put simply, the contributions of \"The GanFather\" - as presented in the paper - are unfair and misleading. Probably, the authors should simply begin by performing a detailed review of existing literature on “automatic” evasion of ML systems / generation of adversarial (or “out of distribution”) samples, as there are hundreds of papers that propose similar systems. Below I will list some additional issues that affect the paper. \n\n**Misleading contributions (no labels).**\nIt is unfair to claim that the proposed method requires “no label” as a contribution. First, because the “Ganfather” is simply a GAN, which—by definition—requires no labels. Second, because the problem of labels is that they must be created via the human supervision: although, yes, the GanFather does not require supervision in the form of “labels”, it still requires supervision to define the “intended behavior [of the illicit activity]” (quoted from the introduction). Hence, the absence of labels is a \"fake\" contribution.\n\n**Misleading contribution (automated attack generation).**\nProposing methods that “automatically generate attacks” is (1) not novel and (2) not a contribution per-se. There are literally thousands of approaches that aim to automatically generate attack samples, which may leverage either basic classifiers [C], or GANs [B], or Reinforcement Learning [A].\n\n**Misleading contribution (detection).**\nIt is unfair to claim that the proposed method can “automatically learn from attacks” as a contribution. Indeed, the process of “re-training” on evasive samples is well-known in literature [A]. This also applies for the contribution denoted as “Expose and augment current defence system:” (which is a 1:1 overlap with the second one)\n\n**Misleading contributions (generality).** \nIt is unappropriate to claim “generality” when the method is provided “as is” (there is a significant lack of theoretical analyses supporting its scientific soundness) and when such supposed “generality” is empirically evaluated on just two settings. What is worse, is that such experiments are shallow: I would have at least expected some sort of statistical validation, but there is no trace of such testings.\n\n**The contributions are not contributions.**\nIrrespective of the above, the \"contributions\" listed in the Introduction are not actually contributions, but rather properties of the proposed \"The GANFather\" method. The question is: does \"The GANFather\" perform better than existing methods? Unfortunately, the answer to this question cannot be answered because there is no hard-comparison with any \"automatic generation\" method. A proper comparison could be made by using any \"GAN\"-based method to generate some \"illicit activities\", and then showing that such activities would be either easily detected; or would not be good enough to make a detector \"as robust\" as those generated by \"The GANFather\".\n\n**Lack of theoretical analysis.**\nAs a direct consequence of the above issue, there is no theoretical argument supporting not only the “generality”, but also the rationale behind the proposed “Ganfather” method. The description is provided in Section 2.1.1, but it only consists in a single equation (with several terms never introduced), with no justification whatsoever as to why it would even remotely work. What is worse is that the paper attempts to propose such a method as “novel”: as a matter of fact, no work is cited in Section 2.1 (aside from (Arjovsky et al. 2017) to regulate the GAN loss). I will be blunt and state the following: the claimed generality is passable as a “we use GANs to solve this problem, and hence our method is general; however, the specific application of our method requires domain expertise and significant tuning and supervision” which is unfair, unscientific and definitely not appropriate for ICLR.\n\n**Misleading evaluation of “real-world”**\nThe abstract states that the paper “evaluates the method in two real-world use cases”. I was hoping that the evaluation was truly performed on some “real world” deployment. However, these use-cases simply use “benchmark” datasets collected from the real-world – which is hardly passable as an “evaluation on a real-world use case”. With such premises, any evaluation can be claimed to be a “real-world use case”.\n\nSome additional issues:\n\n•\tThe first paragraph of the Introduction is illogical: “Illicit activities frequently target digital systems and services. Importantly, these illicit activities are adversarial: an attacker and a defence system constantly adapt to each other’s behaviour.” First, “illicit activities” do not “target” anything: it is attacker who “target” digital systems and perform “illicit activities” with such systems. Second, the term “adversarial” is misleading, and it is not true that “attacker and defence system constantly adapt” (I dare say in most domains there is no adaptation by the “defence” at all). I suggest revising this paragraph entirely.\n\n•\tThe second paragraph of the Itntroduction does not logically follow the previous one. What is the need of “for instance”? To me, this paragraph should follow something along the lines of “Despite providing many advantages, information systems are vulnerable to cyber attacks.” The same applies for the third paragraph of the Introduction.\n\n•\tThe paper states that “Recent estimates indicate undetected money laundering activities of C0.7–3 trillion annually (Lannoo & Parlour, 2021)”. I checked (Lannoo & Parlour, 2021) and I couldn’t find a single occurrence of “0.7—3 trillion”. Rather, I found “Money laundering is estimated to cost the global economy between USD800 billion and USD2 trillion annually, according to the United Nations Office on Drugs and Crime report 2020”. \n\n•\tThe following sentence in the Introduction should be revised “For example, a one-star decrease in restaurant ratings can lead to a 5 to 9 percent decrease in revenue (Luca, 2016)1. Detecting malicious agents is far from trivial. A critical challenge relates to class imbalance, as illicit activity is rare. Additionally, labelled datasets are often unavailable or incomplete due to the absence of natural labels and the cost of feedback, primarily generated through manual labelling.” The transition between the example and the technical problems is too abrupt.\n\n•\tThe paper really looks like a “draft”. The term acronym “AML” is first mentioned in Section 2, but never introduced before (I originally believed it stood for “Adversarial Machine Learning”, but later found out it referred to “Anti-Money Laundering”). Parentheses are sometimes opened and not closed (e.g., beginning of Section 2.1). Equation 1 has several terms that are never mentioned, such as $G, O, D, A$.  The same applies for equation 2: what is $\\mathcal{S}_{in}$? \n\n•\tWhat is the goal of generating “out of distribution” samples if such samples are not realistic in the first place? I am referring to the statement in Section 4.1: “Whereas De Cao & Kipf (2018) concerns generating realistic data that verifies some conditions (e.g., as our method could achieve leveraging the optional alert system), The GANfather generates out-of-distribution data to tackle adversarial domains)”\n\n\n\nEXTERNAL REFERENCES\n\n[A]: Apruzzese, G., Andreolini, M., Marchetti, M., Venturi, A., & Colajanni, M. (2020). Deep reinforcement adversarial learning against botnet evasion attacks. IEEE Transactions on Network and Service Management, 17(4), 1975-1987.\n\n[B]: Usama, M., Asim, M., Latif, S., & Qadir, J. (2019, June). Generative adversarial networks for launching and thwarting adversarial attacks on network intrusion detection systems. In 2019 15th international wireless communications & mobile computing conference (IWCMC) (pp. 78-83). IEEE.\n\n[C]: Garg, S., & Ramakrishnan, G. (2020, November). BAE: BERT-based Adversarial Examples for Text Classification. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP) (pp. 6174-6181).\n\n======== \n\nUpdate after authors' response:\n\nI appreciate the authors' efforts in improving the paper and toning down some of its original \"overclaims\". The paper now is more truthful as to what it does. I will increase my score substantially: from a 1 to a 6. ", "strength_and_weaknesses": "STRENGTHS:\n+ Potentially of use to practitioners\n\n\nWEAKNESSES\n- Misleading contributions\n- Unfair claims\n- Poor evaluation\n- Lack of theoretical foundations\n- No novelty\n- Lack of comparison with prior work\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "1: The main claims of the paper are incorrect or not at all supported by theory or empirical results.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "Not applicable"}, "extra_text": {}}, {"review_id": "0VPRZeDgeqy", "reviewer": "Reviewer_kgFf", "summary": "", "questions": "", "limitations": "", "rating": 1, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper introduces an adversarial method without label requirements, to enhance the detection of illicit activity in various domains.This method comprises a generator that produces meaningful attacks and a discriminator to detect them.This meaningful attacks can reveal  defensive weaknesses for the discriminator to correct.The method  is evaluated with a suite of experiments in money laundering and recommendation systems .", "summary_of_the_review": "The author provides very limited theoretical and empirical results.This submission looks more like a working draft rather than a conference paper.", "strength_and_weaknesses": "Strengths:\n\n1. Compared with classical GANs,the loss of the author’s generator  is a linear combination of the loss of three components,including the optimisation objective,the GAN and the alert system .this makes the author’s framework can produce out-of-sample data without label requirements.\n    \n2. In two real-world  cases, money laundering, and recommendation systems.the generator of framework can produce meaningful attacks ,the discriminator can obtain near-perfect classification by training.\n    \n\nWeaknesses:\n\n1. The method is  not well demonstrated either by theory or practice.For example, in section 2.1.1,the paper points that the loss of generator of the framework is a linear combination ,where the weights are three hyperparameters controlling. It lacks  theoretical proof in this paper.\n    \n2. This method has poor versatility because the structure of generator and the optimisation objective of the framework need to be customized.\n    \n3. In the experiments,the discriminator can obtain near-perfect classification,but the author do not provide convincing evidence of the correctness of the proposed approach or its utility compared to existing approaches.\n    ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "Not applicable"}, "extra_text": {}}]

Author rebuttal:

Decision: Reject