Constrained Adaptive Attack: Effective Adversarial Attack Against Deep Neural Networks for Tabular Data
Authors: Thibault Simonetto
Salah GHAMIZI
Maxime Cordy
Venue: NeurIPS 2024 spotlight (2024)
Keywords: machine learning
security
adversarial attacks
tabular data
threat models
constrained machine learning
Primary area: safety_in_machine_learning

Abstract: State-of-the-art deep learning models for tabular data have recently achieved acceptable performance to be deployed in industrial settings. However, the robustness of these models remains scarcely explored. Contrary to computer vision, there are no effective attacks to properly evaluate the adversarial robustness of deep tabular models due to intrinsic properties of tabular data, such as categorical features, immutability, and feature relationship constraints. To fill this gap, we first propose CAPGD, a gradient attack that overcomes the failures of existing gradient attacks with adaptive mechanisms. This new attack does not require parameter tuning and further degrades the accuracy, up to 81\% points compared to the previous gradient attacks. Second, we design CAA, an efficient evasion attack that combines our CAPGD attack and MOEVA, the best search-based attack.  We demonstrate the effectiveness of our attacks on five architectures and four critical use cases. Our empirical study demonstrates that CAA outperforms all existing attacks in 17 over the 20 settings, and leads to a drop in the accuracy by up to 96.1\% points and 21.9\% points compared to CAPGD and MOEVA respectively while being up to five times faster than MOEVA. Given the effectiveness and efficiency of our new attacks, we argue that they should become the minimal test for any new defense or robust architectures in tabular machine learning.

Constrained Adaptive Attack: Effective Adversarial Attack Against Deep Neural Networks for Tabular Data
Thibault Simonetto
Salah Ghamizi LIST / RIKEN AIP
Maxime Cordy
University of Luxembourg
University of Luxembourg Luxembourg
Luxembourg simaallt..smmmotttoeun..
Luxembourg salah. salah..ghaizzilist..
maxime cordy@uni.
Abstract
State-of-the deep learning models for tabular data have recently achieved ac- ceptable performance to be deployed in industrial settings. However, the robustness of these models remains scarcely explored. Contrary to computer vision, there are no effective attacks to properly evaluate the adversarial robustness of deep tabular models due to intrinsic properties tabular data, such as categorical features, immutability, and feature relationship constraints. To fill this gap, first propose CAPGD, a gradient attack that overcomes the failures existing gradient attacks with adaptive mechanisms. This attack does not require parameter tuning and further degrades the accuracy, up to 81 % points compared to the previous gradient attacks. Second, we design CAA, efficient evasion attack that combines CAPGD attack and MOEVA, the best search-based attack. We demonstrate the effectiveness of attacks five architectures and four critical use cases. Our empirical study demonstrates that CAA outperforms all existing attacks in 17 over the 20 settings, and leads drop in the accuracy by up 96. 1% points and 21.9% points compared to CAPGD and MOEVA respectively while being up to five times faster than MOEVA. Given the effectiveness and efficiency of our new attacks, we argue that they should become the minimal test for any new defense or robust architectures in tabular machine learning.
Introduction
Evasion attack is the process of slightly altering original input into adversarial example designed to force a machine learning (ML) model to output a wrong decision. Robustness to problem of growing concern among the secure MI. community, with over 10,000 publications on the subject since 2014 (7). Recent studies also report real-world occurrences of evasion attacks, which demonstrate the importance of studying and defending against this phenomenon 20
adversarial examples
While research has studied the robustness of deep learning models in Computer Vision (CV) and Natural Language Processing (NLP) tasks, many real-world applications instead deal with tabular data, including in critical fields like finance, energy, and healthcare. If classical "shallow" models (e.g. random forests) have been the go-to solution to learn from tabular data [21]. deep learning models becoming competitive 5 This raises anew the need to study the robustness of these models.
However, robustness assessment for tabular deep learning models brings a number of new challenges that previous solutions - because they were originally designed for CV or NLP tasks do not consider. One such challenge is the fact that tabular data exhibit feature constraints, i.c. complex relationships and constraints across features. The satisfaction of these feature constraints can be
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

non-convex or even non-differentiable problem; this implies that established evasion attack algo- rithms relying on gradient computation do not create valid adversarial examples (i.e., constraint satisfying) [8] Meanwhile, attacks designed for tabular data also ignore feature type constraints 3 or, in the best case, consider categorical features without feature relationships [40 41 and are evaluated on datasets that exclusively contain such features. This restricts their application to other domains that present heterogeneous feature types.
The only published evasion attacks that support feature constraints are Constrained Projected Gradient Descent (CPGD) and Multi- Obiliivveeevvvee Evolutionary Adversarial Attack (MOEVA) 355 CPGD is an extension of the classical gradient-bact based PGD attack with a new loss function that encodes how far the generated examples are from satisfying the constraints. Although theoretically elegant and practically efficient, this attack suffers from a low success rate due to its difficulty to converge toward both model classification and constraint satisfaction [35] Conversely, MOEVA is based on genetic algorithms. It offers an outstanding success rate compared to CPGD and works on shallow and deep learning models. However, it computationally expensive and requires numerous hyper-paramette to be tuned (population size, mutation rate, generations, etc.). This prevents this attack from scaling to larger models and datasets.
Overall, research on adversarial robustness for tabular machine learning in general (and tabular deep learning particular) still its infancy. This in stark contrast to the abundant literature on adversarial robustness in CV (28) and NLP tasks [15]. Given this limited state of knowledge, the objective of this paper is to propose novel and effective attack methods for tabular models subject to feature constraints.
We hypothesize that gradient-based -bssed algorithms have not been explored adequately in B5 and that the introduction of dedicated adaptive mechanisms can outperform CPGD. To verify this, we design new adaptive attack, named Constrained Adaptive PGD (CAPGD), whose only free parameter is the number of iterations and that does not require additional parameter tuning (Section (4). We demonstrate that the different mechanisms we introduced in CAGPD contribute improving the success rate of this attack compared to CPGD, by 81 % points. Across all our datasets, the set of adversarial examples that CAPGD generates subsumes all the examples generated by any other gradient-based method. Furthermore, CAPGD is 75 times faster than MOEVA, while the latter reaches the highest success rate across all datasets.
These results motivate us to design Constrained Adaptive Attack (CAA), an adaptive attack that combines our gradient-based attack (CAPGD) with MOEVA for an increased success rate a lower computational cost. Our experiments show that CAA reaches the highest success rate for all models/datasets we considered, except in one case where CAA is second-best. With this attack, we offer a strong baseline for future research on evasion attacks for tabular models, which should become the minimal test for robust tabular architectures and other defense mechanisms.
Our contributions can be summarized as follows:
We design a new parameter-free attack, CAPGD that introduces momentum and adaptive steps effectively evade tabular models while enforcing the feature constraints. We show that CAPGD outperforms the other gradient- based attacks in terms of capability to generate valid mansstainn-sstisfiing adversarial examples.
2. We propose search attacks to optimize both effectiveness and computational cost.
efficient and effective evasion attack (CAA) that combines gradient and
3. We evaluate CAA in a large-scale evaluation over four datasets, five architectures, and two training methods (standard and adversarial training). Our results show that CAA outperforms all other attacks and is up to times more efficient.
2 Related work
2.1 Tabular Deep Learning
Tabular data remains the most commonly used form of data
[4 especially in critical applications
such as medical diagnosis (38 36). , financial applications [8 8. user recommendation sys-
tems [46), cybersecurity 99 and more. Improving the performance and robustness of tabular

---

Table Evasion attacks for tabular machine learning. Attacks with public implementation in bold.
Attack
Supported features
Supported constraints
Categorical Discrete
Relations
LowProFool (LPF) 3
Continuous
No
No
No
Cartella al.
Continous, Discrete, Categorical
Yes
Yes
No
Gressel et al.
19
Continous, Discrete, Categorical
Yes
Yes
No
Xu al.
Categorical
Yes
No
No
Wang ef al. 40
Categorical
Yes
No
No
Bao et
4
Categorical
Yes
No
No
BF*/BFS [26 225
Continous, Discrete, Categorical
Yes
Yes
No
Mathov al. [30
Continous, Discrete, Categorical
Yes
Yes
No
CPGD, MOEVA 335
Continous, Discrete, Categorical Yes
Yes
Yes
CAPGD, CAA (OURS)
Continous, Discrete, Categorical Yes Yes
Yes
machine learning models for these applications is becoming critical as more ML-based solutions are cleared to be deployed in critical settings.
Borisov et al. [5] showed that traditional deep neural networks tend to yield less favorable results in handling tabular data when compared more shallow machine learning methods, such as XGBoost. However, recent approaches like RLN 33 and TabNet [2] are catching up and even outperforming shallow models in some settings. We argue that DNNs for Tabular Data sufficiently mature and competitive with shallow models and require therefore a thorough investigation of their safety and robustness. Our work is the first exhaustive study of these critical properties.
2.2 Realistic Adversarial Examples
Initially applied to computer vision, adversarial examples have also been adapted and evaluated
tabular data. Ballet et al. 3 considered feature importance to craft the attacks, Mathov et al. (30)
considered mutability, type, boundary, and data distribution constraints, Kireev al. 24 suggested
considering both the cost and benefit of perturbing each feature, and Simonetto et al. 35 introduced
domain-constraints (relations between features) as critical element of the attack.
While domain constraints satisfaction is essential for successful attacks, research on robustness for industrial settings (eg Ghamizi al. [8] with major bank) also demonstrated that imperceptibility remains important for critical systems with human-in-the-loop mechanisms, which could deflect attacks with manual checks from human operators. Imperceptibility is domain-specifie, and mul- tiple approaches have been suggested B 24. [6]. None of these approaches was confronted with human assessments compared with each other, and in study, decided
the most established L2 norm. Our algorithms and approaches are generalizable to further distance metrics and imperceptibilitty definitions.
Overall, except the work from Simonetto et al. [35], none of the existing attacks for tabular machine learning supports the feature relationships inherent to realistic tabular datasets, summarized in Table Nevertheless, we evaluate the approaches that support continuous values and where public implementation is available to confirm our claims: LowProFool,, BF* CPGD, and MOEVA.
3 Problem formulation
We formulate the problem of evasion attacks under constraints. We assume the attack to he untargeted (i.e. it aims force misclassification any incorrect class); the formulation for targeted attacks is similar and omitted for space reasons.
We denote by E R an input example and by y E f1...., C} its correct label. Let h Bd RC be a classifier and heg (x) the classification score that outputs for input x to in class Cj. Let C Rd be the space of allowed perturbations. Then, the objective an evasion attack is to find 8 E A such that ar trgmaazeet......h.ce + 6) y.

---

In image classification, the set A is typically chosen as the perturbations within some 1p 1p-ball around a, that is, Ap {ō E R | at preserving the semanties of the original input by assuming that small enough perturbations will yield images that humans perceive the same as the original images and would therefore classify the perturbed input into the same class (while the classifier predicts another class). This also guarantees that the example remains meaningful, that is, x + 8 is not image with random noise.
p S E} for a maximum perturbation threshold e. This restriction aims
Tabular data are by nature different from images. They typically represent objects of the considered application domain (e.g. botnet traffic [O], financial transaction (18). We denote by 2 - I the feature mapping function that maps objects of the problem space Z d-dimensional feature space defined by the feature set F = {f1. f2....u)) fa). Each object E Z must inherently respect some natural condition to be valid (to be able to exist reality). In the feature space, these conditions translate into set of constraints on the feature values, which we denote by f.. By construction, any input example obtained from a sol-w object 2 satisfies 12 noted - S2.
Thus, in the case of tabular data, we additionally require the perturbation 5 applied to x to yield a valid example x + 5 satisfying S2 that is, Ax {8 E Rd: ||ô||, S e A x + } 9).
To define the constraint language expressing 52, we consider the four types of constraint introduced by Simonetto al. (35). These four constraint types cover all the constraints of the datasets in our empirical study. Hence, immutaailitt defines what features cannot be changed by an attacker; boundaries defines upper / lower bounds for feature values; type specifies a feature to take continuous, discrete, or categorical values; and feature relationships capture numerical relations between features. Feature relationship constraints can be expressed with the following grammar:
w == w1 W2
W1 W2 4/1 ž 1/2
(1)
// = c fi 1/ ① 4/2
(2)
Equation| | means that constraint formula can either be an intersection (A), union (V) of two other constraint formulae w/, w2, or w can a comparison operator Σ (, between two values 1 and 4/2.
Equation Innatiiondetaill details the numeric expressions that are supported by the grammar. numeric expression s can be constant c, an operation @ E {+. -,t.-,,,, *. / between two other numerical expressions 인/ and 2/2. or a specific feature fi, or the i-th feature of the clean sample. The difference between fi and x; is that fi corresponds to the current value of the evaluated example and z; corresponds to its original value in the clean example.
Let's consider one complex constraint from the LCLD credit scoring use case: the term of the loan can only be 36 60 months and the number of open accounts is lower than the number of allowed accounts for this client. Such constraint can be formally written as:
W1 = ((frrm 36) V (fem 60)) A (fopon S fiotaLaace)
(3)
We provide other examples in Appendix A.1
3.1 Constrained Projected Gradient Descent
Constrained Projected Gradient Descent (CPGD) is extension of the PGD attack 29 generate adversarial examples satisfying constraints in tabular machine learning. satisfaction into the loss function that PGD optimizes. This is achieved by translating each constraint into a differentiable function penalty( (z, w) that values to zero if æ }= w; otherwise, the function represents how far is from satisfying w. We follow the definition of Table 5 in Appendix A. to translate each construct of the constraints grammar into penalty function.
integrates constraint
For instance, the penalty function of w1 in Equation B] is: penalty(æ2 w1) min 36). Ieem 60)) + mar (0, fopen_ncce acc fiotal pcc)
Based on this, CPGD produces adversarial examples from an initial sample Torig classified as by iteratively computing:

---

((+11) = Rs Ps (s((())) +1 VL((
U. h nn,)
(5)
where x² Zorig (the original input), Rg is domain-specific repair operator [35]. Ps is the projection onto S = (xr E RR || Torigllp S <e). V is the gradient of loss function L, defined as C(a,y, h, 22) 1(h(z).))
penalty(a,w:)
(6)
WE
In the original CPGD implementation, the step size (A))) follows predefined decay schedule, (7(40 c x 10 (0-(+((/LK//MJ), with M 7, and max(k). (z) abbreviates ((x, y. 52).
3.2 Experimental settings
Our experiments are driven by the following datasets, models, and attack parameters. More details about the datasets and models are given in Appendix A.5
Datasets To conduct our study, selected tabular datasets that present feature constraints from their respective application domain. URL [22 is a dataset of legitimate and phishing URLs. With only 14 linear domain constraints and 63 features, it is the simplest of empirical study. LCLD [7] is credit-scoring dataset with non-linear constraints. The WiDS (27) dataset contains medical data on the survival of patients admitted the ICU. It has only 30 linear domain constraints. The CTU [TO] dataset reports legitimate and botnet traffic from CTU University. The challenge of this dataset lies in its large number of linear domain constraints (360). We detail the datasets the Appendix A.4
Architectures We evaluate five top-performing architectures from a recent survey on tabular ML. Tab TabTrrasformer [23] and TabNet [2] are transformer- based models. RLN 33 uses regularization coefficient to minimize a counterfactual loss. STG [43 optimizes feature selection with stochastic gates, and VIME 44 relies on self-supervised learning. These architectures achieve performance equivalent to XGBoost, the best shallow machine learning model for our use cases.
Perturbation parameters We use the 1.2-norm to measure the distance between original and perturbed inputs, because this norm is suitable for both numerical and categorical features. We to 0.5 for all datasets. Each dataset has critical (negative) class, respectively phishing URLs, rejected loans, flagged botnets, and not surviving patients. Hence, we only attack clean examples from the critical class that are not already misclassified by the model and report robust accuracy of models.
Evaluation metrics We measure the effectiveness of our attack using robust accuracy defined as the accuracy of valid examples generated by a given attack. a clean example is misclassified. we do not perturb it. If the attack generates invalid example, we consider correctly classified. We measure the efficiency of the attacks in computational time.
Our Constrained Adaptive PGD
The relative lack of effectiveness CPGD as reported in its original publication leads us to investigate the cause of these weaknesses. We investigate four factors that may affect the success rate of the attack: (1) we conjecture that the fixed step size and predefined decay in CPGD might be suboptimal because the choice of the step size is known to largely impact the effectiveness of gradient-based attacks 31:: (2) CPGD is unaware of the trend, i.c. it does not consider whether the optimization is evolving successfully and not able to react it; (3) CPGD does not check constraint satisfaction between the iterations, which could "lock" the algorithm into a part of the invalid data space; (4) CPGD starts with the original example, whereas classical gradient-base based attacks often benefit from random initialization.
4.1 CAPGD algorithm
We propose Constrained Adaptive PGD (CAPGD), new constraint-aware gradient-based attack that aims to overcome the limitations CPGD and improve effectiveness. We detail CAPGD in and summarize its components below.
Algorithm in Appendix A.2 A.2
5

---

Step size selection We introduce a size adaptation. We follow the exploration-exploittiio principle by gradually reducing the gradient step [3]. However, unlike CPGD, this reduction does not follow a fixed schedule but is determined by the optimization trend. If the value of the loss function grows, we keep the same step size; otherwise, we halve it. That is, we start with step (7(") 2e, and identify checkpoints wp Wi,... Wn which we decide whether it is necessary to halve the size of the current step. We halve the step size if any of the following two conditions holds:
Since the last checkpoint, we count how many cases since the last checkpoint wy-1 the update step has successfully increased L'. The condition holds if the loss has increased for at least a fraction of steps (we set p p= 0.75):
Σ
((( p (wi Wr-1).
2. The step has not been reduced at the last checkpoint and the loss is less or equal to the loss of the last checkpoint:
(w5-1)) = mp(ws)) (1, (w,)
(8)
where L' (1r is the loss function, C(wry) is the highest loss value in the first j iterations.
Repair operator While equality constraints are included in the penalty function, optimization alone does not achieve exact equality of feature values. Our new repair operator Rg improved from 335 addresses this by setting the value of the left-hand side of an equation of the form fi v to match the evaluation of the right-hand side each iteration. maintains other dataset constraints such bounds, mutability, and feature types but does not ensure other relational constraints are met. The operator can violate maximum perturbation constraints, yet at each iteration, the perturbation is corrected back within the allowed maximum. This approach has been shown to improve the success rate of CAPGD, as demonstrated by our ablation study in Table We provide the algorithm in Appendix
A.2 A.2
As for initialization, we apply the attack from two initial states: the original example Torig and a random example sampled from (the Lp-ball around Korig). The goal behind this second initialization is to reduce the risk of being immediately locked into local optima that encompass only invalid examples. Our experiments later reveal the complementary of these two initializations.
Initial state
Gradient step Finally, we introduce in CAPGD a momentum 14]
Let (2()) be the step size at iteration k then we first compute (k-1)) before the updated example (k+1)
(k+1) (t( (*) (VL(((x))
(9)
(k+1) Ra Ps + a (2(k+1) -((1)) (1 - a) (2 x( (((-1)))
where a E [0, 1] (we use a 0.75 following [13 regulates the influence of the previous update on the current, and Ps is the projection onto S {x E Rd | Zorigllp lpp I c).
4.2 Comparison of CAPGD gradient- based attacks
To evaluate the benefits of CAPGD, we compare it with CPGD as well as LowProFool,, to the best of our knowledge, the only other public gradient attack for tabular models that can be extended to support all types of features.
CAPGD is more successful than existing gradient attacks. In Table 2, we compare the robust accuracy across our four datasets and five architectures with CPGD, Low ProFool, and CAPGD. CAPGD significantly outperforms CPGD and LowProFool. It decreases the robust accuracy on URL, LCLD, and WIDS datasets low 10.9%. 0.2%, and 10.2% respectively.

---

Table 2: Robust accuracy against CAPGD and SOTA gradient attacks. A lower robust accuracy means a more effective attack (lowest bold).
DS
Model
Clean
LPF
CPGD
CAPGD
CPGD 132
6597
3 LowProFool
TabTr.
93.6
93.6
91.9
10.9
RLN
94.4
94.4
92.8
URL
VIME
92.5
92.5
90.7
56.3
STG
93.3
93.3
93.3
72.6
TabNet
93.4
93.4
88.5
19.3
TabTr.
69.5
69.2
69.5
27.1
CAPGD
68.3
68.3
68.3
0.2
LCLD
VIME
67.0
67.0
67.0
2.6
STG
66.4
66.4
66.4
55.5
Figure 1: Visualization of the complementarity of CAPGD, CPGD, and LowProFool with the number of successful adversarial examples.
TabNet
67.4
67.4
67.4
6.3
TabTr.
95.3
95.3
95.3
95.3
RLN
97.8
97.8
97.8
97.8
CTU
VIME
95.1
95.1
95.1
95.1
STG
95.3
95.3
95.3
95.3
The results also reveal that gradient attacks are in- effective on the CTU dataset. These results demon- strate that gradient-basee and motivate us to consider combining CAPGD with search-based attacks, as investigated Sec- tion 5
TabNet
96.1
96.1
96.1
96.1
TabTr.
75.5
75.2
attacks are not enough
RLN
77.5
77.5
77.3
61.8
WIDS
VIME
72.3
72.3
71.5
51.4
STG
77.6
77.6
77.5
65.1
TabNet
79.7
76.0
10.2
CAPGD subsumes all gradient attacks. We analyze detail the original examples from which attacks could generate valid and successful adversarial examples. For each attack, we take the union of the sets of clean examples across seeds. We generate the Venn diagram for CPGD, LowProFool. and CAPGI, for all datasets and model architectures. We sum the partition values in Figure [ CAPGD generates adversarial examples for 6597 original examples from which none of the other gradient attacks could produce adversarial examples. In contrast, all successful adversarial examples by CPGD (132) and LowProFool (3) are also generated by CAPGD.
All components of CAPGD contribute to its effectiveness. We analyze in detail each of the com- ponents CAPGD in Appendix [B.I] These results and ablation studies confirm the complementarity of our new mechanisms and their contribution to the effectiveness of CAPGD.
5 CAA: an ensemble of gradient and search attacks
We next propose Constrained Adaptive Attack (CAA), an effective and efficient ensemble of gradient- and search- based attacks. The idea underlying CAA is that gradient- based attacks for tabular data are more efficient but less successful than search-based attacks. Thus, CAA inte- grates the best search-based attacks from each family in a complementary way, such that we maximize the set of adversarial examples that can be generated.
CAPGD
MOEVA
5299
477
953
357
5.1 Design of CAA
Following our related work study, we consider the search attacks MOEVA and BF* Kulynych et al. (26). Kireev al. (25). As first step, we compare in Figure these two attacks in terms of the original examples for which they could generate successful adversarial examples. We also include CAPGD in this comparison, since we have shown that this attack subsumes the other gradient-based attacks. Our results reveal that CAPGD and MOEVA together subsume BF* except for examples. Additionally, CAPGD and MOEVA are complementary, with CAPGD generating 477 unique examples and MOEVA 953. Overall, the combination of CAPGD with MOEVA yields the strongest method including only one gradient-based
Figure 2: Visualization of the comple- mentarity of CAPGD, MOEVA, and BF* with the number of successful adversar- ial examples.
7

---

Table 3: Robust accuracy and attack duration for CAPGD, MOEVA, and CAA. The Clean column corresponds to the accuracy of the model on the subset clean samples that we attack. A lower robust accuracy means more effective attack. The lowest robust accuracy is in bold. A lower duration is better. The lowest time between MOEVA and CAA is in bold.
Robust accuracy (L)
Duration seconds (L)
Dataset
Model
Clean
CAPGD
DF
MOEVA
CAA
CAPGD
BF MOEVA
CAA
TabTr.
93.6
10.9
93.2
18.2+u.s
8.9
1
33+0
7542
17
RLN
94.4
12.610.2
93.810
23.610.5
10.8
1:0
27:0
7413
1911
URL
VIME
92.5
56.310.1
92.210
56.510.9
49.5
211
3210
7011
5112
STG
93.3
72.610.0
93.210
58.210.9
58.0=0.8
210
5810
9040
7313
TabNet
93.4
19.3+0.6
90.9+0
17.520.6
11.0=0.5
840
14400
16544
58
TabTr.
69.5
27.1
61.1
10.7
7.9=0.a
5=1
151+0
124#5
83#2
RLN
68.3
0.2+0.1
38.920
0.8+n.2
0.0=o.0
1=0
147+0
5041
1043
LCLD
VIME
67.0
2.6+0.2
52.6+0
24.1+1.5
2.4-0.1
1+0
149+0
4942
13#1
STG
66.4
55.5+0.2
53.0+0
55.4+0.2
53.640.1
340
191+0
6042
57+2
TabNet
67.4
6.3+0.4
49.0+0
0.8+0.1
0.4+0.1
4+0
754+0
68+2
23+0
TabTr.
95.3
95.320.0
95.320
95.320.0
95.3=0.0
420
371
98
110=5
RLN
97.8
97.8+0.0
97.520
94.010.2
94.0=0.2
9
1210
9813
112:4
CTU
VIME
95.1
95.110.0
95.1
40.814.7
40.8=4.7
410
924+0
107:3
116=2
STG
95.3
95.3+0.0
95.3+0
95.3+0.0
95.3=0.0
5=0
548+0
105
119#4
TabNet
96.1
96.1+0.0
13.0+o
0.0+0.0
0.0=o.0
7+0
816+D
157+7
182#4
TabTr.
75.5
48.0+b.3
67.7+0
59.2+0.6
45.9=0.8
3#0
440+0
6543
49+1
RLN
77.5
61.810.3
77.010
67.710.3
60.9
310
252010
5211
4912
WIDS
VIME
72.3
51.410.3
71.210
59.410.5
5..3
240
1406.0
4812
4111
STG
77.6
65.110.4
77.510
68,820.3
63.8:0.2
320
188810
64
59:1
TabNet
79.7
10.2.0.3
73.120
13.920.4
5.3=0.4
5=0
1047220
77:4
25
attack and one search-based attack. One could also include BF* for slight increase in effectiveness, but this would come the computational cost of running this attack in addition the other two; our experimental results (presented below) actually reveal that BF* brings substantial computational cost compared to CAPGD and MOEVA. Hence, we stick to CAPGD and MOEVA only.
The principle of CAA is thus to successively apply CAPGD and MOEVA, in that order. By applying CAPGD first, CAA has the opportunity to generate valid adversarial examples low computational cost (benefiting from the performance of gradient attacks compared to search attacks). If CAPGD fails on an original example, CAA executes the slower but more effective MOEVA method.
5.2 Effectiveness and efficiency of CAA
We evaluated the effectiveness (robust accuracy) and efficiency (computation time) CAA compared to the other methods. The hyperparameters of all attacks are fixed for all experiments (see Section of the appendix) and follow the recommendation given their original paper.
Table shows that CAA achieves the best performance in all cases but one: for STG model and LCLD dataset, BF* achieves robust accuracy 0.6 percentage points lower than CAA these are the unique original examples from which BF could generate successful adversarial examples. Overall, CAA leads to decrease in accuracy up to 96. %, 84.3%, and 31.7% compared to CAPGD, BF* and MOEVA respectively.
The main advantage of CAA is its ability find "casy" constrained adversarial using the cheaper gradient attack CAPGD, before processing harder examples with expensive search. We compare in the right panel Table the cost of running each attack, i.e., its execution time. CAA shines particularly in terms of efficiency. CAA reduces execution costs by to 5 times compared to MOEVA. is significantly faster than MOEVA for LCLD, URL, and WIDS datasets (except STG), and marginally more costly for CTU.
CAA up 418 times faster than BF* In particular, in the only where BF* marginally outperforms CAA, BF* requires 3.4 times more computation to generate the adversarial examples.
In Appendix B.5 evaluate attack shallow models in direct and transfcrability settings.

---

1.0
1.0
Rekat Resracy
Robaat Aucamaes
0.5
KLN VIME
0.1
10.1
Tablee
00
Epslos
Namber CAPGO Ievaaions
Number MOEVA Ieeaat
(a) Maximum perturbation
(b) Gradient attack iterations
(c) Search attack iterations
Figure 3: Impact of CAA budget on the robust accuracy for CTU dataset.
Table 4: CAA performances (XX+/-YY) against Madry adversarially trained model. XX refers to accuracy. YY is the difference between the accuracy of the adversarially trained model and standard training (cf. Table 3). such that "+' means a higher accuracy for the adversarially trained model.
Dataset
Accuracy
TabTr.
RLN
VIME
STG
TabNet
Clean
93.9+0.3
95.2+0.8
93.4+0.9
94.3+10
99.5+6.1
URL
CAA
56.7+17.8
56.2+45.4
69.8+20.3
90.0+32.0
91.8+80.8
Clean
73.944.4
69.5+1.2
65.5-1.5
15.6-50 50.8
0.0-67.4
LCLD
CAA
60.3
63.0463.0
10.448.0
12.1 41.55
0.0-n.4
Clean
95.3+0.0
97.3-0.5
95.140.
95.1-0.2
15.-95.8
CTU
CAA
95.3+0.0
97.1+a.0
94.0+sa.2
95.1-0.2
0,2+0.2
Clean
77.3+1.8
78.0+0.5
72.1-0.2
62.6
98.4+18.6
WIDS
CAA
65.1+19.2
66.6+5.7
52.1+1.8
45.2-18.6 18.6
58.4+5a.1
CAPGD and MOEVA fail to generate adversarial examples on CTU for of models. In Appendix B.3 we provide possible explanation for this dataset by evaluating our attacks on different sub-sets of constraints with varying complexity.
5.3 Impact of attack budget
We study the impact of the attacker's budget the effectiveness of CAA, in terms of (i) maximum perturbation and (ii) the number of iterations of its components. We focus on the CTU dataset, which models are the only ones to remain robust through our previous experiments. All the datasets are evaluated in Appendix B.2 Figure reveals in (a) that the maximum perturbation distance has little impact on the effectiveness of the attack. Increasing the number of iterations for the gradient attack component (b) does not have an impact on the success rate of CAA. Increasing the budget of the search attack component (c) significantly impacts the robustness of some models. While Tab TahTrrnfformer and STG remain robust, the robust accuracy of RLM and VIME drops below 0.4 when doubling the number of search iterations 200, and zero with 1000 search iterations.
5.4 Impact of Adversarial training
We evaluate the effectiveness of our attack against models made robust with Madry's adversarial training (AT) (29) using examples generated by the PGD attack. We consider this defense because adversarial training-based methods
shown be the only reliable defense against evasion attacks 37 6). In Table 4 we show the clean accuracy and the robust accuracy (against CAA) of the adversarially trained models (big numbers in Table 4). We also show the accuracy difference with the models trained with standard training (small numbers). In Appendix B.4 we evaluate additional defenses based on adversarial training and data augmentations.
Adversarial training can degrade clean and robust performance. As a preliminary check, we investigate whether adversarial training degrades the clean performance of the models. This is important to ensure that a non-increase of robust accuracy does not originate from clean performance degradation (instead being due to CAA's strength). Our evaluation shows that adversarial training significantly degrades clean performance of the STG and Tabnet architectures. The accuracy of STG models drops 15.6% and 62.6% for LCLD and WIDS respectively. As for Tabnet models, the clean accuracy drops to 0.0% (LCLD) and 0.2% (CTU). In all other cases, clean accuracy remains stable.

---

CAA remains effective against adversarial training for some architectures. The effectiveness of CAA against robust models is architecture- and dataset-dependent. The attack remains effective on VIME architecture applied to LCLD and WIDS, with robust accuracy as low 10.1 % and 52.2% respectively, as well as on RLN architecture on the WIDS dataset (66.6% robust accuracy and only +5.7% improvement compared to standard training). However, the robustness against CAA of Tabtransformer architecture is significantly improved on URL and LCLD datasets by respectively 47.8 8% and 62.4%, and marginally improved on WIDS dataset by 19.2%. Similarly, RLN robustness to CAA improves on URL (+45,4%) and LCLD (+63%).
6 Limitations
We identify three main limitations of our work.
Marginal overhead of CAA: In scenarios where CAPGD struggles attack tabular models, CAA CAA can exhibit a computation overhead (<14%) compared to MOEVA. However, in 4 out evaluated settings, CAA is faster than MOEVA (up to 5 times).
CAPGD effectiveness with complex constraints: CAPGD effectiveness drops when increasing the constraint's is complexity in the number of constraints or the number of features involved in each constraint.
Coherence of constraints: The mechanisms of CAA assume that the constraints definitions are sound. Incoherences between boundary constraints and feature relation constraints can lead to invalid adversarial examples with large budgets.
7 Broader Impact
Our work proposes CAA, the most effective evasion attack against constrained tabular ML. We also provided for each dataset at least one combination of architecture combined with AT where CAA can be mitigated. We expect that work will have more positive impact by leading to improved defenses in the scarcely explored field of robust tabular ML.
8 Conclusion
In this work, we first propose CAPGD, new parameter-free gradient attack for constrained tabular machine learning. We also design CAA, a new Constrained Adaptive Attack that combines the best gradient-based attack (CAPGD) and the best search-based attack (MOEVA). We evaluate our attacks over four datasets and five architectures and demonstrated that our new attacks outperform all previous attacks in terms of effectiveness and efficiency. We believe that our work is springboard for further research on the robustness of tabular machine learning and to open multiple research perspectives constrained tabular ML. We hope that CAA will contribute faster development of adversarial defenses and recommend as part of a standard evaluation pipeline of new tabular machine models.
Acknowledgments and Disclosure of Funding
This research was funded whole, in part, by the Luxembourg National Research Fund (FNR), grant reference research was supported by BGL BNP Paribas Luxembourg. In particular, we would like to thank Anne Goujon and Andrey Boytsov for their support with the financial use case. The experiments presented this paper were carried out using the HPC facilities the University of Luxembourg (39 (see hpc. uni uni.lu).
and grant BRIDGES/202/SS/7477552
This
References
[1] Hojjat Aghakhani, Fabio Gritti, Francesco Mecca, Martina Lindorfer, Stefano Ortolani, Davide Balzarotti, Giovanni Vigna, and Christopher Kruegel. 2020. When malware is packin 'heat; limits
10

---

of machine learning classifiers based on static analysis features. In Network and Distributed Systems Security (NDSS) Symposium 2020.
[2] Sercan Arik and Tomas Pfister. 2021. Tabnet: Proceedings of the AAAI conference on artificial intelligence, Vol. 35. 6679-6687.
Attentive interpretable tabular learning. In
[3] Vincent Ballet, Jonathan Aigrain, Thibault Laugel, Pascal Frossard, Marcin Detyniecki, et al. 2019. Imperceptible Adversarial Attacks on Tabular Data. NeurIPS 2019 Workshop on Robust Al in Financial Services: Data, Fairness, Explainability, Trustworthiness and Privacy (Robust in FS 2019).
[4] Hongyan Bao, Yufei Han, Yujun Zhou, Xin Gao, and Xiangliang Zhang. 2023. Towards efficient and domain -agnsii- evasion attack with high-dimensional categorical inputs, In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 37. 6753-67666
[5] Vadim Borisov, Tobias Leemann, Kathrin Sessler, Johannes Haug, Martin Pawelezyk, and Gjergji Kasneci. 2022. Deep Neural Networks and Tabular Data: A Survey, IEEE Transactions on Neural Networks and Learning Systems (2022), 1-21. https://doi: htaps:://dii.or/11.... or./oo..//111... 1109/ 11009/
tnnls. 2022. 3229161
[6] Nicholas Carlini. 2023. A LLM assisted exploitation of AI-Guardian. arXiv preprint arXiv:2307.15008 (2023).
[7] Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dim- itris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. 2019. On evaluating adversarial robustness. arXiv preprint (ttiv::/902.07770 (2019).
[8] Francesco Cartella, Orlando Anunciaçao, Yuki Funabiki, Daisuke Yamaguchi, Toru Akishita, and Olivier Elshocht. 2021. Adversarial Attacks for Tabular Data: Application to Fraud Detection and Imbalanced Data. (2021).
[9] Alesia Chernikova and Alina Oprea. 2019. Fence: Feasible evasion attacks on neural networks in constrained environments. arXiv preprint 1004480909.10480 10480 (2019).
[10] Alesia Chernikova and Alina Oprea. 2022. Fence: Feasible evasion attacks on neural networks in constrained environments. ACM Transactions on Privacy and Security 25, 4 (2022), 1-34.
[11] Jillian M Clements, Di Xu, Nooshin Yousefi, and Dmitry Efimov. 2020. Sequential Deep Learn- ing for Credit Risk Monitoring with Tabular Financial Data. arXiv preprint 2rXiv: (2020).
[12] Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nico- las Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. 2020. Robustbench: standardized adversarial robustness benchmark. arXiv preprint arXiv:2010.0990 (2020).
[13] Francesco Croce and Matthias Hein. 2020. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In ICML.
[14] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. 2018. Boosting adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition. 9185-9193.
[15] Salijona Dyrmishi, Salah Ghamizi, and Maxime Cordy. 2023. How do humans perceive adversarial text? A reality check on the validity and naturalness of word-bast based adversarial attacks. In Proceedings of the ólst Anmual Meeting of the Association for Computational Linguisties (Volume 1: Long Pupers), Anna Rogers, Jordan Boyd-Graber, and Naoaki Okazaki (FEs.). Association for Computational Linguistics, Toronto, Canada, 8822-8836 11653 acl- 491
https
[16] Salijona Dyrmishi, Salah Ghamizi, Thibault Simonetto, Yves Le Traon, and Maxime Cordy. 2023. On the empirical effectiveness of unrealistic adversarial hardening against realistic adversarial attacks. In 2023 IEEE symposiun security and privacy (SP). IEEE, 1400.
11

---

[17] Nathan George. 2018. Lending Club loan data. https: htmps://www. comta/asest///aaatttt wordsfortheeiss//adddna club
[18] Salah Ghamizi, Maxime Cordy, Martin Gubri, Mike Papadakis, Andrey Boystov, Yves Le Traon, and Anne Goujon. 2020. Search-based adversarial testing and improvement of constrained credit scoring systems. In Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering. 1089- 1100.
[19] Gilad Gressel, Niranjan Hegde, Archana Sreekumar, Rishikumar Radhakrishnan, Kalyani Harikumar, Krishnashree Achuthan, et al. 2021. Feature importance guided attack: model agnostic adversarial attack. arXiv preprint arXiv: 106. 14815 (2021).
[20] Kathrin Grosse, Lukas Bieringer, Tarek R. Besold, Battista Biggio, and Alexandre Alahi. 2024. When Your Al Becomes Target: Al Security Incidents and Best Practices. Proceedings of the AAAI Conference on Artificial Intelligence 38, 21 (Mar. 2024), 23041-23046. https //doi. org/10. 1609 aaai. w38121.3033333
[21] John T Hancock and Taghi M Khoshgoftaar. 2020. Survey on categorical data for neural
networks. Journal of Big Data (2020), 1-41.
[22] Abdelhakim Hannousse and Salima Yahiouche. 2021. Towards benchmark datasets for machine
learning based website phishing detection: An experimental study. Engineering Applications of Artificial Intelligence 104 (2021), 104347.
[23] Xin Huang, Ashish Khetan, Milan Cvitkovic, and Zohar Karnin. 2020. Tabtransformer: Tabular data modeling using contextual embeddings. arXiv preprint arXiv:2012.06678 (2020).
[24] Klim Kireev, Bogdan Kulynych, and Carmela Troncoso. 2022. Adversarial Robustness for Tabular Data through Cost and Utility Awareness. arXiv preprint arXiv:2208, 13058 (2022).
[25] Klim Kireev, Bogdan Kulynych, and Carmela Troncoso. 2023. Adversarial Robustness for Tabular Data through Cost and Utility Awareness. In The Second Workshop on New Frontiers in Adversarial Machine Learning.
[26] Bogdan Kulynych, Jamie Hayes, Nikita Samarin, and Carmela Troncoso. 2018. Evading classi- fiers in discrete domains with provable optimality guarantees. arXiv preprint 1xXiv:18001109.. (2018).
[27] Meredith Lee, Jesse Raffa, Marzyeh Ghassemi, Tom Pollard, Sharada Kalanidhi, Omar Badawi, Karen Mauthys, and Leo Anthony Celi. 2020. WiDS (Women in Data Science) Datathon 2020: ICU Mortality Prediction. PhysioNet.
[28] Teng Long, Qi Gao, Lili Xu, and Zhangbing Zhou. 2022. A survey on adversarial attacks in computer vision: Taxonomy, visualization and future directions. Computers & Security 121 (2022), 102847. https://doi. orrooii.orrg/// org/ 10. 1016/j cose. 2022.1028.
[29] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv: 1706. 06083 (2017).
[30] Yael Mathov, Eden Levy, Ziv Katzir, Asaf Shabtai, and Yuval Elovici. 2022. Not all datasets are born equal: On heterogeneous tabular data and adversarial examples. Knowledge- Based Systems 242 (2022), 108377.
[31] Marius Mosbach, Maksym Andriushchenko, Thomas Trost, Matthias Hein, and Dietrich Klakow. 2018. Logit pairing methods can fool gradient-bases based attacks. NeurIPS 2018 Workshop on Security in Machine Learning (2018).
[32] Sylvestre-AIve Rebuffi, Sven Gowal, Dan Andrei Calian, Florian Stimberg, Olivia Wiles, and Timothy A Mann. 2021. Data augmentation can improve robustness. Advances Neural Information Processing Systems 34 (2021), 29935-29948.
12

---

[33] Ira Shavitt and Eran Segal. 2018. Regularization learning networks: deep learning for tabular datasets. Advances in Neural Information Processing Systems 31 (2018).
[34] Ravid Shwartz-Ziv and Amitai Armon. 2021. Tabular Data: Deep Learning is Not All You Need, arXiv preprint arXiv:2 (2021).
[35] Thibault Simonetto, Salijona Dyrmishi, Salah Ghamizi, Maxime Cordy, and Yves Le Traon. 2022. A Unified Framework for Adversarial Attack and Defense in Constrained Feature Space. In Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence, IJCAI-22, Lud De Raedt (Ed.), International Joint Conferences on Artificial Intelligence Organi- zation, 1313-1319.
https: /tap:://doi... org/ 10. 24963/ 2022/ 183 Main Track.
[36] Sulaiman Somani, Adam J Russak, Felix Richter, Shan Zhao, Akhil Vaid, Fayzan Chaudhry, Jessica K De Freitas, Nidhi Naik, Riccardo Miotto, Girish N Nadkarni, et al. 2021. Deep learning and the electrocardiogram: review of the current state-of-the EP Europace (2021).
[37] Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. 2020. On adaptive attacks adversarial example defenses. Advances in Neural Information Processing Systems 33 (2020), 1633-1645.
[38] Dennis Ulmer, Lotta Meijerink, and Giovanni Cinà. 2020. Trust Issues: Uncertainty Estimation Does Not Enable Reliable OOD Detection On Medical Tabular Data. In Machine Learning for Health. PMLR, 341-354.
[39] S. Varrette, H. Cartiaux, S. Peter, F. Kieffer, T. Valette, and A. Olloh. 2022. Management of an Academic HPC & Research Computing Facility: The ULHPC Experience 2.0. In Proc. of the 6th ACM High Performance Computing and Cluster Technologies Conf. (HPCCT 2022). Association for Computing Machinery (ACM), Fuzhou, China.
[40] Yutong Wang, Yufei Han, Hongyan Bao, Yun Shen, Fenglong Ma, Jin Li, and Xiangliang Zhang. 2020. Attackability characterization of adversarial evasion attack on discrete data. In Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining. 1415-1425.
[41] Han Xu, Pengfei He, Jie Ren, Yuxuan Wan, Zitao Liu, Hui Liu, and Jiliang Tang. 2023. Probabilistic categorical adversarial attack and adversarial training. In International Conference on Machine Learning. PMLR, 18422-384422
[42] Lei Xu, Maria Skoularidou, Alfredo Cuesta-Infante and Kalyan Veeramachaneni. 2019. Model- ing tabular data using conditional GAN. In Advances in Neural Information Processing Systems, Vol. 33.
[43] Yutaro Yamada, Ofir Lindenbaum, Sahand Negahban, and Yuval Kluger. 2020. Feature Selection using Stochastic Gates. In Proceedings of Machine Learning and Systems 2020. 8952-8963.
[44] Jinsung Yoon, Yao Zhang, James Jordon, and Mihaela van der Schaar. 2020. Vime: Extending the success of self-and semi-supervised learning to tabular domain. Advances in Neural Information Processing Systems 33 (2020), 11033-11033.
[45] Sangdoo Yun, Dongyoon Han, Seong Joon Oh, Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. 2019. Cutmix: Regularization strategy to train strong classifiers with localizable features. In Proceedings of the IEEE/CVF International Conference on Computer Vision. 6023-6032.
[46] Shuai Zhang, Lina Yao, Aixin Sun, and Yi Tay, 2019, Deep learning based recommender system: A survey and new perspectives. ACM Computing Surveys (CSUR) 52, 1 (2019), 1-38.
13

---

Table 5: From constraint formulae to penalty functions. 7 is an infinitesimal value. term, open _cc, total _acc rec_ rec_per___ perthhhhh record, month are features and instances of f in the grammar. 60 and 36 constants and instances of in the grammar.
Constraint
Penalty function
Constraint example
Penalty function example
1 1/2
1/ sb2 |
rec_ rec_per___e per_month> = record record/month montth
rec pa___per_mmottl mar (0, open acc total total_acc) maar(0,oeen_ee open_acc total_ acc
11 S 1/2
ma (0, v/1 4/2)
open_acc acc I total acc
1 < 1/2
ma t/1 1/2
open_acc < total_ace
+ -00
w1 Aw2
W1 + w2
((term = 36) V (term = 60))
min( term 36 |,1 term 60 1)+
(open_acc total_acc)
maz(O, open_acc _acc__c total _ac))
min(wi,ws)
(term = 36) V (term = 60)
min( term 36 |. term 60 1)
Appendix
A
Experimental protocol
A.1 Constraints penalty function
The penalty function transforms each constraint formulation into differentiable loss function to be minimized by gradient descent (or search algorithm). constraints, their translation to penalty function, and examples for each supported constraint. Let's consider one complex constraint from the LCLD credit scoring use case: The term the loan can only be 36 or 60 months and the number of open accounts is lower than the number of allowed accounts for this client. Such a constraint can be formally written as term E (36, 60)) A (open_ace acc S total notal_ace.. The AND operator A is equivalent to described as min - a), Ic b), ...) in a loss function. Finally, the a < b operator is equivalent to a min(0, b) in loss function. Hence, the complex constraint translates as the following penalty: min[Ilerm- 36), [Lerm - ) + m0 open_ _cc - total_acc).
from (35) shows the supported
of losses, while the OR operator V is
A.2 CAPGD Algorithm
Algorithm 1 summarizes the process of CAPGD. At each iteration, we compute the perturbation according to the definition of Equation (1. 7-9). We keep track of the best loss and accordingly best adversarial example found so far (1. 12). If reach checkpoint in W and one of the conditions of Equation]] or Equation & we half the step size r) (1. 13-17). We return the best adversarial example
Tman-
Algorithm 2 describes the repair operator. For each constraint Q2 if the constraint an equality = and the left operand w. www.ft__peeeeeeeeetetee operand is feature (I. 3), we verify if the constraint is respected. If not (penalty(x:, 5t) > ().44), we reset the value corresponding to feature w. left operand in x such that it equals the penalty function of the right operand w.right_operand (1. 5). According to the grammar Equation I and the penalty function definition in Table the value feature deft_oopeaandd must equal the penalty function of pright_ to satify the constraint.
A.3 CAA Algorithm
Algorithm 3 summarizes the process of CAA. The algorithm takes input the clean examples X, their associated labels Y, and the classifier H such that H (x) = (egmatte(1....oo (z(()) (including its weights, loss function and probability function), Ii the set of domain constraints, and the maximum perturbation. We start by creating the mask of examples that are already adversarial (i.e. misclassified by the model) (I.3). We then split the clean examples that are already adversarial X' (I.4), and the candidates Xc on which we will execute the attacks. For each of our attacks (I.6), we generate a set of potentially adversarial examples from the candidate clean examples (I.7). Once again, we compute the mask of examples that are adversarial according to the subprocedure is is_adv described below. According to the mask we add the successful attack to the output X' (I.8) and remove the associated clean examples from the candidate set Xc. Hence, for given example, the
14

---

Algorithm 1: CAPGD
1: Input: L, h. S, Q, x (0), 11, Nicr W {wo: t00: w/n
2: Output: Tmax
3: x(1) & Ps (z(00) + +)V['(xx()))
4: Lmax
[ ) L' ('(((1))
5: Fmax f x(1) if mmx L' (z!0)) else mmax f- x1))
6: for k == to Niee do
7: ((++1) x- Ps (x) + +1VV2(xx(())
8: x (k+1) Ps (k) + ((1 -x (8)))
a1 x((-11))
x (1+1) t Re((o(h+1)
9:
10:
if ('(x((+1)) > famax then
11:
Tmax f- 1))+ and Lmax <- L' (2x((+1)))
12:
end if
13:
if l: E W then
if Condition or Condition then
15:
< n/2 end if
17: end if'
end for
Algorithm Constraint Repair for Input and Constraints Set
1: Input: 22 S2
2: for each w do
3: if w is an EqualityConstraint and wwwewttteppeeeee opeertd E F then
4:
5: penalty(x;, w) then
opf < penalty (riightttpppradd)
6: end if
7: end if
8: end for
Algorithm 3: CAA
1: Input: X.Y, H, S2
2: Output: X"
3: udv_mask- is__ddu( XX,
4: X' + X(adv_mask)
5: X. + (aots_masss,,p Y. = Y[-adv mask]
6: for Attack in (CAPGD, MOGD,MMEVAAL A} do
7: X; AAttack(Xe, Yo, H,
8: adv adu_mask +- is "s_adv(X; Xx, Ya, c,
9: "'XX'X mask]
10:
xxl baobu__assk,aa Y. t Yai-adv _aakk
end for
12: X' X'UX.
13: SubProcedure is ss_adv(XX, X., Yo, H, adv mask + 0 for k = 1 to Nitel X do
14:
15:
16:
adv + (X, = 12) A (H( + Y.(A)) A (X,) Se)
17:
baak adv_mask U adv end for
18:
19:
return adv_mask
15

---

Table 6: The datasets evaluated in the empirical study, with the class imbalance of each dataset.
Dataset
Properties Size
Task
# Features
Balance (%)
LCLD 17
Credit Scoring
1 220 092
28
80/20
CTU-13 [0]
Botnet Detection
198 128
756
99.3/0.7
URL 22
Phishing URL detection
11 430
63
50/50
WIDS 27
ICU patient survival
91 713
186
91.4/8.6
next attack is only executed if no attack has been successful, reducing the overall cost of CAA. At the end of CAA, we had the remaining candidates, for which we have not found adversarial examples to the output set of potentially adversarial examples X', to ease the calculation of robust accuracy (e.g. in transferable settings).
The sub procedure is is_adc goes through all the examples X,[k]] X; and adds True to the mask, if all of the following conditions hold:
X2[M] [k] respects the domain constraints,
.
X2{A] [k] classification by i/ss different from its true label Y.[k],
.
[A] pertubation w.r.t to Xo[k) is lower or equal to
A.4
Datasets
Our dataset design followed the same protocol as Simonetto et al. (35) We present in Table 6 the attributes of our datasets and the test performance achieved by each of the architectures.
Credit scoring LCLD (licence: CCO: Public Domain) We engineer a dataset from the publicly available Lending Club Loan Data]] This dataset contains 151 features, and each example represents a loan that was accepted by the Lending Club. However, among these accepted loans, some are not repaid and charged off instead. Our goal is predict, at the request time, whether the borrower will be repaid or charged off. This dataset has been studied by multiple practitioners on Kaggle. However, the original version of the dataset contains only raw data and to the extent of our knowledge, there is no featured engineered version commonly used. In particular, one shall be careful when reusing feature-engineered versions, most of the versions proposed present data leakage in the training set that makes the prediction trivial. Therefore, we propose our own feature engineering. The original dataset contains 151 features. We remove the example for which the feature "loan status" is different from "Fully paid" or "Charged Off" as these represent the only final status of loan: for other values, the outcome still uncertain. For our binary classifier, a 'Fully paid" loan is represented as 0 and a "Charged Off" as 1. We start by removing all features that are not set for more than 30% of the examples in the training set. We also remove all features that are not available loan request time, as this would introduce bias. We impute the features that are redundant (e.g. grade and sub-grade) or too granular (e.g. address) to be useful for classification. Finally, we use one-hot encoding for categorical features. We obtain 47 input features and one target feature. We split the dataset using random sampling stratified on the target class and obtained training set of 915K examples and testing set of 305K. They are both unbalanced, with only 20% of charged-off loans (class 1). We trained a neural network to classify accepted and rejected loans. It has 3 fully connected hidden layers with 64, 32, and 16 neurons.
For each feature of this dataset, we define boundary constraints as the extremum value observed in the training set. We consider the 19 features that are under the control of the Lending Club as immutable. We identify 10 relationship constraints (3 linear, and 7 non-linear ones).
URL Phishing ISCX-URL2016 (license CC 4.0) Phishing attacks are usually used conduct cyber fraud or identity theft. This kind of attack takes the form of a URL that reassembles legitimate URL (c.g. user's favorite e-commerce platform) but redirects to fraudulent website that asks the user for their personal or banking data. [22] extracted features from legitimate and fraudulent URLs
16

---

Table 7: The three model architectures of our study.
Family
Model
Hyperparameters
hidden dim, n_layers, learning_ rate, norm, 0 n_d, n_steps,
Transformer
TabTransformer
Transformer
TabNet
7, cat emm__imm n indeependnnt n_shared, momentum, mask_tupe
hidden dim, depth.
Regularization
RLN
heads, weight decay.
learning rale, dropout hädden bidden_dims, learning_rate lom
Regularization
STG
Encoding
VIME
Pm. K. B
as well as external service-based features to build a classifier that can differentiate fraudulent URLs from legitimate ones. The feature extracted from the URL includes the number of special substrings such as "www". "&", ".", "$", "and", the length of the URL, the port, the appearance of a brand in the domain, in subdomain or the path, and the inclusion of "http" "htips". External service-based features include the Google index, the page rank, and the presence of the domain in the DNS records. The complete list of features present in the reproduction package. [22] provide a dataset of 5715 legit and 5715 malicious URLs. We use 75% of the dataset for training and validation and the remaining 25% for testing and adversarial generation.
We extract a set of 14 relation constraints between the URL features. Among them, 7 are linear constraints (e-g. length of the hostname is less or equal to the length of the URL) and 7 are Boolean constraints of the type ifa >> 0 then > 0 (e.g. the number of http > 0 then the number slash "/" 0).
Botnet attacks CTU-13 (license CC BY NC SA 4.0) This is feature-engineered version of CTU-13 proposed by (9]. It includes a mix of legit and botnet traffic flows from the CTU University campus. Chernikova al. aggregated the network data related to packets, duration, and bytes for each port from a list of commonly used ports. The dataset is made of 143K training examples and 55K testing examples, with 0.74% examples labeled in the botnet class (traffic that botnet generates). Data have 756 features, including 432 mutable features. We identified two types of constraints that determine what feasible traffic data is. The first type concerns the number of connections and requires that an attacker cannot decrease it. The second type is inherent constraints in network communications (e.g. maximum packet size for TCP/UDP ports is 1500 bytes). In total, we identified 360 constraints.
WIDS (license: PhysioNet Restricted Health Data License 1.5.0 data on the survival of patients admitted to the ICU. The goal is predict whether the patient will survive or die based on biological features (e.g. for triage). This very unbalanced dataset has 30 linear relation constraints.
27 dataset contains medical
A.5 Model architectures
Table 7 summarizes the family, model architecture, and hyperparameters tuned during the training of our models.
TabTransformer is transformer-based model 223 It uses self-attention to map the categorical features an interpretable contextual embedding, and the paper claims this embedding improves the robustness of models to noisy inputs.
TabNet is another transformer-based model (2] It uses multiple sub-networks that are used in sequence. At each decision step, uses sequential attention to choose which features to reason. TabNet aggregates the outputs of each step obtain the decision.
17

---

uses efficient hyperparameter tuning scheme in order minimize counterfactual loss. The authors train a regularization coefficient to weights in the neural network in order to lower the sensitivity and produce very sparse networks.
RLN or Regularization Learning Networks 33
STG or Stochastic Gates 43 uses stochastic gates for feature selection in neural network estimation problems. The method based on probabilistic relaxation of the norm of features or the count of the number of selected features.
VIME or Value Imputation for Mask Estimation uses self and then semi-supervised learning through deep encoders and predictors.
A.6 Attacks parameters
For existing attacks, we reuse the hyperparameters proposed in their respective papers. For LowPro- Fool, we use a small step size of 1/ = 0.001, À = 8.5 rade off factor between fooling the classifier and generating imperceptible adversarial example, and run the attack for Nater 20, 000 iterations. All other gradient attacks run for Nster = 10 iterations. The schedule of decreasing steps of CPGD uses M 7. In CAPGD, we fix the checkpoints as w, Nnar S Niees with pa [0. 1] defined as Po = 0, P1 = 0.22 and
Pj+1 = + max Pj-1 - 0.03, 0.063.
The influence of the previous update on the current update is set to 0.75, and = 0.75 for the halving of the step. MOEVA runs for Agen 100 iterations generating Roff 100 offspring per iteration. Among the offspring, popop 200 survive and are used for mating in the next iteration. With BF*, we discretize numerical features Thin 150 bins. We run the attack for maximum of Niter 100 iterations. CAA applies CAPGD and MOEVA with the same parameters.
A.7 Hardware
We run our experiments on an HPC cluster node with 32 cores and 64GB of RAM dedicated to our task. Each node consists of 2 AMD Epye ROME 7H12 @ 2.6 GHz for total of 128 cores with 256
GB of RAM.
A.8 Reproduction package and availability
The source code, datasets and pre-trained models to reproduce the experiments of this paper are available with the submission. The source code will be available publicly upon acceptance under the MIT license or similar.
B Additional results
B.1 Components of CAPGD
All components of CAPGD contribute its effectiveness. We conduct an ablation study on the components of CAPGD. We evaluate CAPGD without the repair operator at each iteration (NREP), without the initialization with clean example (NINI), without the initialization with random sampling (NRAN), and without the adaptive step (NADA). Table & reveals that removing component of CAPGD reduces its effectiveness. Interestingly, not all components affect datasets similarly. For instance, removing the repair at each gradient iteration only affects the LCLD datasets' success rate. For URL and WIDS, CAPGD-NREP remains the confidence interval of CAPGD. Removing any other components always negatively affects CAPGD, up an improvement of 32.16 of the robust accuracy for CAPGD-NADA on the WIDS dataset and TabNet model.
CAPGD components are complementary. None components of CAPGD negatively affects its capability of finding an adversarial example for given clean example. In Figure we analyze the coverage of each CAPGD variant A (Covering Attack) with regard to another variant B (Coverred Attack). For A and B, we compute the set of clean examples C'A and Cg which the attacks are
18

---

1.0
NADA
0.83
0.83
0.83
0.87
1.00
0.8
NRAN
0.87
0.88
0.87
1.00
0.91
Coverring Attack (B)
0..6
NINI
0.98
0.98
1.00
0.99
0.99
0..4
NREP
0.93
1.00
0.93
0.96
0.94
0.2
CAPGD
1.00
0.99
0.99
1.00
0.99
0.0
CAPGD
NREP
NINI
NRAN
NADA
Coverred Attack (A)
Figure Visualization of the utility of CAA's components. For attack (respectively B) we compute the set of clean examples CA (respectively CB)) on which the attack is successful. The percentage represents the proportion of the set C, Cn covered by CB. CAPGD-NADA CAPGD without adaptive step, CAPGD-NRAN is CAPGD without the random start, CAPGD-NINI is CAPGD without the clean example initialization and CAPGD NREP is CAPGD without repair each iteration.
successful. The percentage in the heatmaps represents the proportion of CA U UCB covered by Ca. that is
|CBl
coverage = ICA UC
where |C| is the cardinality of C. Attack subsumes A when coverage = 1. In practice, to avoid random effect, run the attack for N seeds, and take the union of clean examples which generate a successful example.
Figure 4 reveals that CAPGD subsumes all its variants with coverage 99%, while of the variants subsumes CAPGD. Therefore all components of CAPGD are necessary to obtain the strongest attack.
B.2 Budget of attacker
In this section, we study the impact CAA's budget on effectiveness. We consider budgets: the maximum perturbation allowed, the number of iterations in the gradient attack CAPGD (without changing MOEVA's budget), and the number of iterations the search attack MOEVA (without changing CAPGD's budget).
19

---

Table Ablation study: Robust accuracy for CAPGD and its variant without key components. The Clean column corresponds to the accuracy of the model on the subset of clean samples that we attack. lower robust accuracy means a more effective attack. The lowest robust accuracy bold.
Dataset
Model
Clean
NREP
NINI
NRAN
NADA
CAPGD
TabTr.
93.6
10.9
11.8
12.6+0.0
34.6+0.4
10.9
RLN
94.4
12.7+0.2
14.9=0.2
14.8+0.0
30.2+0.5
12.6+0.2
URL
VIME
92.5
56.320.1
58.1
56.920.0
65.220.1
56.3
STG
93.3
72.6.0.0
73.420.2
73.020.0
75.3+0.1
72.6
TabNet
93.4
19.240.7
27 27.6=0.8
29.7=0.0
34.4+0.3
19.3+0.6
TabTr.
69.5
38.310.4
38.0=0.9
38.010.0
44.4
27.110.9
RLN
68.3
5.310.2
1.4
1.620.0
1.140.3
0.2:0.1
LCLD
VIME
67.0
17.910.6
7.1
7.340.0
3.610.4
2.610.2
STG
66.4
59.4+0.1
58.0=0.3
56.520.0
59.7.0.2
55.510.2
TabNet
67.4
30.4+0.8
33.1+14
10.8+0.0
7.3+0.4
6.3+0.4
TabTr.
95.3
95.3+0.0
95.3+0.0
95.3+0.0
95.3+0.0
95.3+0.0
RLN
97.8
97.8+0.0
97.8+0.0
97.8+0.0
97.840.0
97.8
CTU
VIME
95.1
95.1
95.1
95.120.0
95. 15.1
95.1+no
STG
95.3
95.3+0.0
95.3+0.0
95.320.0
95.3+0.0
95.3+0.0
TabNet
96.1
96.1+0.0
96.1
96.1=0.0
96.1=0.0
96.1+0.0
TabTr.
75.5
48.2 48.3
54.7=0.9
53.310.0
64.910.6
48.010.3
RLN
77.5
61.810.3
66.320.4
63.720.0
72.310.5
61.810.3
WIDS
VIME
72.3
51.4
55.6=0.9
54.1:0.0
62.940.4
51.410.
STG
77.6
65.1+0.4
68.9
67.6+0.0
74.0+0.2
65.1+u.4
TabNet
79.7
10.1+0.5
20.7
17.5+0.0
42.3+0.7
10.2+0.3
For each budget, we provide figures and detailed numerical results in tables, corresponding to the same experiment.
Maximum perturbation Figure 5
(numerical results in Table 9 reveals that increasing the maximum perturbation for CAA reduces the robust accuracy of the model in 16/20 cases.
Number of CAPGD iterations Figure (numerical (numeriallaericaa results in Table 10) reveals that increasing the number of iterations for the gradient attack component has a limited impact on the success rate of CAA. The maximum drop of accuracy is 3.5% points between 10 and 100 iterations for WIDS/TabNet.
Number of MOEVA iterations Figure (numerical results in Table 11 reveals that increasing the number of iterations for the search attack component only reduces the robust accuracy in 4/20 cases (URL/VIME, URL/STG, CTU/VIME, and CTU/RLN).
We also observe that for Tab TabTrasfformer and LCLD the robust accuracy increases with the number of search iterations. MOEVA is multi-objective genetic algorithm. An inherent problem of multi- objective optimization is the trade-off between the objectives. If all solutions in the population the Pareto front, the algorithm must decide which solutions to discard for the next iteration, potentially discarding a valid adversarial example in our case.
Figure 7 shows the evolution of the success rate of MOEVA with the number of iterations in the same settings as in Figure 8b for Trbnnfoformmer We find that the success rate reaches a maximum with 100 iterations. We argue that valid adversarial examples were discarded when the search continued to 1000 iterations. To confirm our hypothesis, we run the same experiment with a 10 times larger search preserved at each iteration. We observe that in this setting,
population, such that more solutions MOEVA converges slower (due to less selection pressure) but the success rate strictly increases with the number of generations. Increasing the population size also increases the execution time (by 3.4x in this case), due to the selection operator overhead.
Our approach CAA aims at minimizing the memory and computation overheads while maximizing the success rate, and CAA can be tuned to lead lower robust accuracy with more iterations if the search space is expanded (for example with larger populations).
20

---

0.6
TabTr.
Tab
Robust Accuracy
Robust Accuraty
RLN
0.6
VIME
0.4
VIME
0.4
STG
STG
TabNet
TabNet
0.2
0.0
0.0
3
Epsilon
Epsilon
(a) URL
(b) LCLD
1.0
TabTr.
0.6
Robust Accuracy
Tab
Robust Accuracy
RLN
0.6
RLN
VIME
VIME
0.4
STG
TabNet
0.2
TabNet
0.2
0.0
3
5
Epsilon
Epsilon
(c) CTU
(d) WIDS
Figure 5: Robust accuracy with CAA with varying maximum perturbation budget.
Table 9: Robust accuracy with CAA with varying maximum perturbation budget. The lowest robust accuracy in bold.
Maximum perturbation
Dataset
Model
0.25
0.5
1.0
5.0
TabTr.
31.5
8.940.2
0.6+0.1
0.0
RLN
36.5
10.8#0.2
2.7+0.2
2.3
URL
VIME
69.7
49.5+0.6
15.9+v.1
0.4+0.
STG
81.4=0.2
58. 18.0+a.s
16.1
0.0+a.0
TabNet
21.90 21.920.7
11.020.5
2.340.4
1.620.3
TabTr.
23.820.7
7.920.6
2.2+0.3
7.120.9
RLN
0.0+0.0
0.0.0.0
0.0
0.1
LCLD
VIME
17.020.2
2.410.1
0.3:0.1
2.2=0.2
STG
59.5
53.640.1
38.540.2
48.9
TabNet
0.7
0.4
0.4:0.1
0.3
TabTr.
95.320.0
95.3+0.0
95.1
86.5+1.
RLN
95.2=u.
94.0=a.2
94.0#0
94.0+u.2
CTU
VIME
56.1
40.8
34.0+40
34.0+4.0
STG
95.3200
95.30 95.320.0
95 95.320.
95.3200
TabNet
0.0
0.0
0.0
0.0.0.0
TabTr.
61. 61.92o.3
45.9
22.6
2.640.5
RLN
69.82n.2
60.940.2
41.5tt.8
2.2+0.4
WIDS
VIME
61.420.
50.310.2
27.810.5
8.410.5
STG
70.320.1
63.810.2
50.2
7.8+10
TabNet
29.420.2
5.310.4
1.940.
5.220.5
21

---

Robust Accuracy
0.5
Tab Tr.
Robust Accuracy
TabTr.
0.4
0.4
RLN
VIME
VIME
STG
0.2
STG
TabNet
TabNet
0.1
0.0
20
60
100
20
80
100
Number CAPGD iterations
Number CAPGD iterations
(a) URL
(b) LCLD
1.0
0.6
Robust Accuracy
TabTr.
Robust Accuracy
0.6
RLN
0.4
Tab
VIME
RLN
STG
VIME
0.2
0.2
TabNet
STG
TabNet
0.0
20
60
100
20
40
60
80
100
Number of CAPGD iterations
Number CAPGD iterations
(c) CTU
(d) WIDS
Figure 6: Robust accuracy with CAA with varying gradient attack iterations CAPGD.
Table 10: Robust accuracy with CAA with varying gradient attack iterations in CAPGD, The lowest robust accuracy bold.
iterations CAPGD
Dataset
Model
5
10
20
100
TabTr.
11.4
8.940.2
8.440.1
8.3
RLN
12.2=0.4
10.8#0.2
7.7+0.1
7.9
URL
VIME
52.3=u.6
49.5
47.0+0.2
46.3
STG
58.0+u.8
58.0
68.0+o.8
58.0+oa
58.0+0.s
TabNet
13.820.4
11.020.5
9.340.a
10.520.3
TabTr.
9.020.5
7.920.6
6.522.4
6.9
RLN
0.0+0.0
0.0.0.0
0.0
0.0.2.0
LCLD
VIME
3.220.3
2.410.1
1.2:0.1
1.1:0.0
STG
54.5.0.1
53.6
53.410.2
53.6102
TabNet
0.5
0.4
0.3:0.1
0.1:0.1
TabTr.
95.3
95.32..0
95.3+0.
95.3+4.0
RLN
94.0+0.z
94.0=a.2
94.0#0.
94.0+u.2
CTU
VIME
40.8
40.8
40.8+47
40.8
STG
95.3200
95.320.0
95.3
95.3100
TabNet
0.0
0.0.o.0
0.0
0.0.0.0
TabTr.
49.62n.2
45.9
42.8
42.410.2
RLN
64.1
60.940.2
58.8+n.
57.820.2
WIDS
VIME
52.9
50.310.2
48.310.2
47.710.1
STG
67.1
63. 63.810.2
62.510.
61.810.1
TabNet
8.920.4
5.310.4
3.310.5
1.610.2
22

---

1.0
0.8
Success rate
0.6
0.4
Population baseline (203)
0.2
Population 10
0.0
0
200
400
600
800
1000
Generations
Figure 7: MOEVA success rate (LCLD -aab--abbbaee "TabTransforme
Tab Tr. RLN
0.5
TabTr.
Robust Accuracy
Robust Accuracy
0.4
RLN
VIME
VIME
STG
0.3
STG
TabNet
0.2
TabNet
0.2
0.1
0.0
200
400
600
800
1000
200
400
600
800
1000
Number MOEVA iterations
Number MOEVA iterations
(a) URL
(b) LCLD
1.0
0.6
Robust Accuracy
Tab
Robust Accuracy
0.6
RLN VIME
0.4
TabTr.
RLN
VIME
0.2
0.2
TabNet
STG
TabNet
0.0
200)
400
600
800
1000
200
400)
600
800)
1000
Number of MOEVA iterations
Number MOEVA iterations
CTU
(d) WIDS
Figure 8: Robust accuracy with CAA with varying search attack iterations in MOEVA.
23

---

Table 11: Robust accuracy with CAA with varying search attack iterations in MOEVA. The lowest robust accuracy bold.
iterations MOEVA
Dataset Model
50
100
200
1000
TabTr.
9.3=a.0
8.9+0.2
7.0
3.8+0.1
RLN
11.3=0.2
10.8+0.2
9.9+0.1
9.1+0.4
URL
VIME
53.820.2
49.5
34.7
28.5:002
STG
64.5=1.7
58. 38.022..8
48. 18.0
43. 73.88
TabNet
14.0=0.2
11.0=0.5
5.94n.6
0.3
TabTr.
10.6
7.9
8.3.0.5
10.5
RLN
0.010.0
0.0
0.0:0.0
0.0
LCLD
VIME
2.310.1
2.4
2.5
2.620.1
STG
53.7
1
53.5102
4
TabNet
0.8=0.2
0.4
0.3+0.1
0.7+0.3
TabTr.
95.3+0.0
95.3
95.3+0.0
95.1+0.2
RLN
95.8
94.0+0.2
24.1+6.1
0.0+0.1
CTU
VIME
76.0=2.
40.844.7
6.021.5
0.220.0
STG
95.3+0.0
95.3=0.0
95.3+0.0
95.3+0.0
TabNet
0.1
0.0=o.o
0.0
0.0
TabTr.
46.5
45.910.3
44.8
41.210.5
RLN
61.7=0.2
60.910.2
60.220.3
56.7 76.4
WIDS
VIME
50.5=0.2
50.3+0.2
49.9+0.2
48.7:0.
STG
63.9=u.2
63.8+0.2
63.2
61.6+0.3
TabNet
6.940.4
5.3+0.4
2.5+0.4
0.9+0.1
B.3 Constraints complexity
In this section, we study the impact of the constraints' complexity CAA's effectiveness.
CAPGD and MOEVA fail to generate adversarial examples on CTU for 2 out models. CTU dataset has a large number of constraints compared to the other datasets, and some are particularly challenging. We argue that some of these constraints hinder gradient attacks and are harder to optimize. To confirm our hypothesis and provide additional insights, we split the constraints of CTU based on their complexity. We consider two aspects of constraint complexity: the number of constraints to satisfy and the number of features involved in single constraint.
We split the constraints of CTU as follows:
CGO One constraint involving 90 features in the form of > F, = FE where both sums represent the total number of sent packets.
CG1 One constraint involving 90 features in the form of Σ F, E where both sums represent the total number of received packets.
CG2 34 constraints in the form of PYTE/PACKETS each packet contains at most 1500 bytes.
1500, model the fact that
CG3 324 constraints in the form of < B where A and B are statistical properties (min, max, sum) for each port, and direction.
First, we ran an ablation study, where we ignored one bucket of constraint at a time. Next, we studied the success rate when we considered each bucket separately. Finally, we reported the impact of the number constraints to optimize from CG3, the largest bucket.
The results in Table 12 show that for gradient attacks, removing one type of constraint is not enough improve the success rate. Constraints across multiple remaining categories are not satisfied. The individual bucket study confirms that only when considering constraints of type CG2 alone, CAPGD improves success rate (in VIME and TabNet). When only considering CG3 constraints, reducing the number of constraints improves the success rate (by reducing robust accuracy from 95.3% when considering 100% of CG3 constraints to 84.5% and 43.0% respectively when considering 50% and 10% of the constraints).
24

---

Table 12: Robust accuracy with subset of constraints. Q is the complete set of constraints. CGX
denotes the constraint group X. For CG2 and CG3, we evaluate with the entire group and on 10%, 25%, 50% selected randomly and averaged seeds.
CAPGD
CAA
Group
RLN
STG
TabNet
TabTr.
VIME
RLN
STG
TabNet
TabTr.
VIME
97.8
95.3
96.1
95.3
95.1
94.0
95.3
0.0
95.3
40.8
Ω CGO
97.8
95.3
96.1
95.3
95.1
93.9
95.3
0.0
95.3
21.0
$2 \
CG1
97.8
95.3
96.1
95.3
95.1
94.1
95.3
0.0
95.3
37.1
Ablation
$2 CG2
97.8
95.3
96.1
95.3
95.1
93.9
95.3
0.1
95.3
40.8
f CG3
97.8
95.3
96.1
95.3
95.1
89.3
95.3
0.0
95.3
2.4
CG0
97.8
95.3
96.1
95.3
95.1
91.6
95.3
0.0
95.2
2.8
CG1
97.8
95.3
95.3
95.1
91.1
0.0
Components
CG2
75.3
95.3
31.4
94.3
0.0
72.0
95.3
0.0
94.3
0.0
CG3
97.2
95.3
95.3
95.3
95.1
92.7
95.3
0.0
95.3
19.0
10%
85.2
95.3
43.0
95.1
11.3
80.8
95.3
0.0
94.9
0.6
Percentage CG3
25%
93.4
95.3
59.9
95.3
37.8
87.1
95.3
0.0
95.3
2.5
50%
94.9
95.3
84.5
95.3
93.2
88.6
95.3
0.0
95.3
8.3
B.4
Additional defenses
Table 13: CAA performances against Madry Adversarially Trained model, Adversarial Training + Cutmix and Adversarial Training + CT-GAN.
Architecture
Dataset
Training
RLN
STG
TabNet
TabTr
VIME
Adversarial Training
56.2
90.0
91.8
56.7
69.8
URL
Ady. Tr. + Cutmix
60.8
42.7
89.7
40.3
68.6
Adv. Tr. + CT-GAN
62.5
79.8
89.9
66.0
66.9
Adversarial Training
63.0
12.1
0.0
70.3
10.4
LCLD
Adv. Tr. + Cutmix
47.0
36.2
0.0
71.0
52.9
Adv. Tr. CT-GAN
54.3
81.2
0.0
78.5
76.8
Adversarial Training
97.1
95.1
0.2
95.3
94.0
CTU
Adv. + Cutmix
95.3
94.5
0.0
95.3
94.3
Adv. Tr. + CT-GAN
96.7
96.0
100.0
94.4
100.0
Adversarial Training
45.2
58.4
65.1
52.1
WIDS
Adv. Tr. + Cutmix
59.9
41.2
37.4
50.8
43.5
Adv. Tr. + CT-GAN
100.0
73.8
100.0
68.1
100.0
In addition to the application of adversarial training alone, we evaluate the robustness of the models when training with data augmentation. [32 showed that combining data augmentation with adver- sarial training can increase the robustness of models. We also observe in RobustBench [12), that lop-performing models are trained with data augmentation. We consider two data augmentation techniques: Cutmix 445 and CT-GAN 42 To train model, at each batch, we use equal proportion clean, adversarial examples, data augmentation examples, and adversarial examples generated top of data augmentation examples.
We evaluated CAA on these two defenses and report in Table 13 robust accuracy of these defenses, compared to the robustness of the vanilla Madry AT on all our datasets and models. The results are the average over 5 seeds run ensure reliable evaluation. Our experiments show that these new defenses can significantly improve the robustness of the models to CAA, but that our new attack remains effective for URI. and I. LCLD datasets across architectures, and for WIDS on TabTransformer and STG architectures.
25

---

Table 14: Tree-based model robust accuracy direct and transferability scenario (minimum robust accuracy over 5 neural networks).
Dataset
Model
Clean
Direct
Transferability
Random Forest
96.2
52.7
72.4
URL
XGBoost
97.4
27.3
46.7
Random Forest XGBoost
64.3
22.3
5.3
LCLD
68.3
9.1
9.4
Random Forest XGBoost
95.6
92.2
95.0
CTU
97.3
76.3
97.1
Random Forest XGBoost
52.2
5.2
14.1
WIDS
80.4
38.0
60.7
B.5 Generalization to shallow models
Shallow models and in particular tree-based models such as Random Forest (RF) XGBoost remain among the best models for tabular data average [5]. We evaluate the robustness of these models against CAA two settings: (1) direct attack where CAA (using its search component MOEVA) attacks directly the RF and XGBOOST models, and (2) transfer attacks, where craft the examples on our deep learning (DL) models and evaluate them in the RF and XGBOOST models. Table ?? shows that (1) DL models of study achieve comparable clean performance the shallow models, (2) both RF and XGBOOST models are vulnerable to direct CAA attacks (down to 9. 1% of robust accuracy LCLD XGBoost), and (3) CAA attacks DNN transfer to RF (down 5.3% robust. accuracy) and XGBoost (down to 9.4% robust accuracy) models.
26

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
The paper's contributions two-folds: two new attacks (CAPGD and CAA) and an extensive study of five architectures and four datasets. These contributions match the structure of our paper and the figures and claims reported in the abstract and introduction match the figures of the experimental study.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: We discuss the limitation of CAPGD in Section 4.2 and the limitations of CAA against adversarial training in Section 5.4 Overall, we provided ablations studies for our new algorithms and analysis of the impact budget and computation ressources of our approaches.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model vell-specifiiattio, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
27

---

3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA].
Justification: The paper does not include theoretical results.
Guidelines:
The answer NA means that the paper does include theoretical results. All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proof' can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented
by formal proof's provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
present the experimental protocol and disclose all the information needed to reproduce all the experimental results.
Justification: We dedicate Section 3.2 and the Appendix A
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is a dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access the model. In general. releasing code and data often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how replicate the results, access a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm.
(b) the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (c.g., to registered users), but it should possible for other researchers have some path reproducing verifying the results.
28

---

5. Open access to data and code
Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification: We submitted the source code, data and pre-trained models reproduce the experiments in supplementary. As mentioned in Section A.8 the source code and pre-trained models will be publicly available upon acceptance under open-source licenses.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.cm
htap:////uuddes//ddeebbbm.... wtt.:/uwwwsssioooooooooooo.. for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for a new open-sourge benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
guiiess/ggie//eeeeeeeiei.essssee CodeeSummiee onPolicy) for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data,
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Yes, the parameters used for our experiments are summarized in Section 3.2 detailed in Appendix A.6 and provided in source code. Furthermore, in Section 5.3 and Appendix B.2 we study the impact of the main attack parameters.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: We report the 95% CI in all tables and figures when average results over random runs are needed in experiments.
Guidelines:
The answer NA means that the paper does not include experiments.
29

---

The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative eπror rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: We report the exact hardware used for experiment in Appendix A.7 The execution time is included in the main paper as part of our experiments Table 3
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics httteeshttt::///t httppp///..arrrg...cpppp/////bta
Answer: [Yes]
Justification: We read and conform to the code of ethics and all laws and regulations in our jurisdiction.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. if there is special consid- eration due to laws or regulations their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive socictal impacts and negative socictal impacts of the work performed?
Answer: [Yes]
30

---

We have provided a "Broader Impact" section to explain the negative impacts of our new approach, and how by studying countermeasures in our work, we expect our research to bring more benefits to the defense community than the attackers.
Justification:
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g.. deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g.. pretrained language models, image generators, scraped datasets)?
Answer: [NA]
Justification:
The paper poses no such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but encourage authors to take this into account and make best. faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: Appendix A.4 cites the original creators of the datasets and provides their licences.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
31

---

The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g.. CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, pappsssipppsseeeee thcode com com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information not available online, the authors are encouraged to reach out to the asset's s creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: We provide the algorithms of the attack the Appendix to help understand our implementation. The reproduction package contains the code of all algorithms and experiments and is documented to guide all users.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moddl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
supplemental material is fine, but if the main contribu-
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
32

---

Justification:
The paper does not involve crowdsoureing nor research with human subjects, nor any element that requires an Institutional Review Board (IRB) approval.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with
human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
33


Reviews:
[{"review_id": "bIGyQQeNbf", "reviewer": "Reviewer_XFcC", "summary": "This paper considers the evaluation of the robustness of deep learning models applied to tabular data. The authors introduce two novel adversarial attack methods: Constrained Adaptive Projected Gradient Descent (CAPGD) and Constrained Adaptive Attack (CAA). These methods are designed to exploit the vulnerabilities of tabular data models, which often include categorical features, immutability constraints, and feature relationship constraints that are not typically considered in attacks designed for computer vision (CV) or natural language processing (NLP).\n\nCAPGD improves on existing gradient-based attacks by incorporating adaptive mechanisms and eliminating the need for parameter tuning, significantly enhancing the success rate and efficiency of generating valid adversarial examples. CAA further combines CAPGD with the Multi-Objective Evolutionary Adversarial Attack (MOEVA), optimizing both effectiveness and computational cost. The paper demonstrates the superior performance of CAA across various datasets and models, suggesting it should become a standard test for evaluating the robustness of tabular models.", "questions": "- Are there any other constraints in tabular data besides categorical features, immutability, and feature relationship constraints?\n- Why are gradient attacks ineffective on the CTU dataset?\n- Why is feature engineering necessary for the datasets? Have all four datasets considered in the paper undergone feature engineering? It seems that the WiDS dataset has not undergone feature engineering. Is that correct?", "limitations": "None", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The paper is well-motivated and logically structured, contributing significantly to advancing adversarial machine learning, particularly in the domain of tabular data.\n- The proposed CAA method is SOTA on effectiveness and efficiency, making it a good benchmark for testing the robustness of tabular data models, similar to the role of AutoPGD/AutoAttack in computer vision tasks.\n- The paper includes extensive and systematic experiments, providing solid empirical evidence for the effectiveness of the proposed attacks.", "weaknesses": "- The paper does not provide a clear explanation of the penalty function in Equation (4). A more detailed clarification is needed to understand how this function is formulated and applied.\n- The description of constraints in Equations (1) and (2) is somewhat abstract and difficult to interpret. The authors should refine the descriptions of these constraints to improve clarity.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your positive feedback and your praise for the extensiveness and significance of our work in advancing tabular adversarial machine learning. We appreciate your interest and would be happy to provide further explanations to address any questions you have.\n\n**W1 - Clarification of the penalty function:**\n\nThe penalty function transforms each constraint formulation into a differentiable loss function to be minimized by gradient descent. Let's consider one complex constraint from the LCLD credit scoring use case: *The term of the loan can only be 36 or 60 months and the number of open accounts is lower than the number of allowed accounts for this client.* \n\nSuch a constraint can be formally written as (term ∈ {36, 60}) ∧ (open_acc ≤ total_acc). The AND operator **∧** is equivalent to a sum of loss, while the element of set operator c∈{a,b,...} is equivalent to multiple OR operators, that are described as min(|c-a|,|c-b|,...) in a loss function. Finally, the a≤b operator is equivalent to a min(0,a-b) in a loss function.\n\nHence, the complex constraint translates as the following penalty:  min(|term − 36|,|term − 60|)+ max(0, open_acc − total_acc)\n\nThank you for requesting these clarifications. We will update the final version accordingly and provide a meaningful example for each use case.\n\n**W2 - Clarification of the Equations (1) and (2):**\n\nThe grammar in equations (1) and (2) are inspired by the work of Simonetto et al. [33] where they demonstrate the completeness of this grammar and its ability to cover all linear constraints. \n\nTo elaborate on the two equations, equation (1) means that a constraint formula ω can either be an intersection (∧), or a union (∨) of two other constraint formulae ω1, ω2, or ω can be a comparison operator between two values ψ, or ω can be the feature $f$ equals a value of the set {ψ1 ... ψk}.\n\nThen equation (2) details the numeric expressions that are supported by the grammar.\nA numeric expression ψ can be constant, an operation between two other numerical expressions ψ1 and ψ2, or a specific feature f, or the value for f of the clean sample $x_i$. \nThe difference between $f_i$ and $x_i$ is that $f_i$ corresponds to the current value of the evaluated example and $x_i$ corresponds to its original value in the clean example.\nThis seemingly simple grammar allows very large recursive combinations and covers all the relations found in the features of our datasets.\n\nIn this grammar, the symbol $\\in$ represents a type of constraint, and not that $f$ is a value. \nThe constraint $f \\in \\{ψ_1, ..., ψ_k\\}$ is equivalent to $(f=ψ_1) \\lor (...) \\lor (f=ψ_k)$\nHence we can simplify the grammar as follows:\n\n$\\omega := \\omega_1 \\land \\omega_2 \\mid \\omega_1 \\lor \\omega_2 \\mid \\psi_1 \\succeq \\psi_2$ (1)\n\n$\\psi := c \\mid f \\mid \\psi_1 \\oplus \\psi_2 \\mid x_i$ (2)\n\nTo improve the readability of these equations, we will include the above detailed explanation in the final manuscript, and we have prepared an exhaustive table, Table 1 of the Author Rebuttal PDF, with examples of each type of constraint of the grammar, with real-world examples, and how they are converted into a penalty function. We will also include this table in the updated manuscript.\n\n**Q1 - Are there any other constraints in tabular data besides categorical features, immutability, and feature relationship constraints?**\n\nTo the best of our knowledge, the only constraints related to tabular features are the ones we handle: types (including discrete, categorical, and binary), immutability, boundaries (minimum and maximum possible values), and feature relationships.\nOther constraints could be considered, but they are related to the threat model and the capabilities of the attackers, and hence outside the scope of the study. For example, the constraints on the budget of the attacker and the cost of changing a feature (for example an attacker could not change the feature of his current balance, without having sufficient resources to actually update his real account balance, or to change its address without the cost of moving its real address).\n\n**Q2 - Why are gradient attacks ineffective on the CTU dataset?**\n\nThank you for raising this comment. Indeed, CTU dataset exhibits a large number of constraints compared to the other datasets, and some are particularly challenging. We show in the common answer (C1) that these constraints hinder gradient attacks and are harder to optimize. \n\n**Q3- Why is feature engineering necessary for the datasets? Have all four datasets considered in the paper undergone feature engineering?**\n\nYou are right, each dataset has been proposed by different research teams with their own pre-processing and feature engineering. We did not run any additional feature engineering.\n\nHowever, some datasets rely heavily on raw measurements, for example, the Botnet CTU dataset with features related to a number of connections in ports and traffic load; or WIDS dataset where the features are numerical biological data (eg. albumin_apache about albumin concentration in g/L). Other datasets were designed by their authors with more feature engineering. In the LCLD credit scoring dataset, some features (grade, subgrade, fico_range_low) are scores computed by Lending Club to grade the customer and the loan, and are the result of feature processing and engineering of raw features. \nTherefore, the four use cases cover different levels of feature engineering, with datasets as you pointed out requiring little feature engineering (WIDS), and datasets built with more advanced feature engineering (LCLD). \n\nThank you for raising this point. We will update the appendix section related to the dataset and provide clarifications and relevant references to the feature engineering process of each dataset.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "z0rMte63Uj", "reviewer": "Reviewer_JEHw", "summary": "The paper proposes two adversarial attack methods targeting deep learning models for tabular data. The two methods are: CAPGD (Constrained Adaptive Projected Gradient Descent) and CAA (Constrained Adaptive Attack). CAPGD is a modification based on constrained PGD with step size adjusting, repair operator, additional random initialization, and momentum. CAA is a combination of CAPGD and MOEVA (Multi-Objective Evolutionary Adversarial Attack), which is a search-based attack method. The two methods are combined by iteratively applying the two with CAPGD first. The authors demonstrate the effectiveness of these attacks across five architectures and four datasets.", "questions": "NA, see above.", "limitations": "No discussion found for limitation.", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "Strengths:\n\n1. Clarity: The motivation and rationale behind the proposed algorithms are clearly presented in a logical order.\n\n2. The paper provides an extensive empirical evaluation of the proposed attacks across multiple datasets and architectures, showcasing their superiority in terms of effectiveness and computational efficiency.", "weaknesses": "Weakness:\n\n1.\tLack of novelty and contribution: CAPGD is modified base don CPGD with a series of commonly used optimization techniques. CAA is a combination of CAPGD and MOEVA, which was proposed by a previous work. \n2.\tThe implementation of CAA, involving the combination of CAPGD and MOEVA, might be complex and resource-intensive, which could limit its practical applicability in some settings. \n3.\tLack of evaluation against defense mechanisms: Section 5.4 briefly discussed potential defense mechanisms, Madry’s adversarial training, which was proposed six years ago. There have been many works proposed since then. It is not fair to say that it is the only reliable defense against evasion attacks.\n\nMinor:\n\n•\tOn page 1, line 30, “This raises anew the need to study …”. Maybe it should be “This raises a new need to study …”?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your feedback.\nWe appreciate the opportunity to clarify and address any misunderstandings.\nWe will address each of your points one by one and welcome further discussion on these issues.\n\n**W1 - Lack of novelty and contribution. CAPGD is modified based on CPGD. CAA is a combination of CAPGD and MOEVA:**\n\nWe agree that the core intuitions behind the improvements of CAPGD and CAA  are elegant and not particularly complex, but we would like to point out that: \n\n(1) the literature on adversarial attacks proposed many mechanisms to improve their effectiveness, including random sampling, reinitialization, adaptive steps, and revert to best, and the first challenge was to identify which mechanisms are relevant to our use case, namely which mechanisms are compatible and beneficial to the constraints satisfaction objective. In particular, we found out that combining all the mechanisms in the literature was not optimal, and we achieved the best performances without reverting to the example with the higher loss when the step size changes. We provided in Appendix B.1 a study of the components of CAPGD and their complementarity. In addition, we also proposed new iterative repair mechanisms that were not explored in previous work and demonstrated their effectiveness.\nHence, CAPGD is not a straightforward improvement of CPGD. \n\n(2) meta attacks, that combine existing attacks are also an active line of research. In Computer Vision, AutoAttack by Croce et al.[12] is a meta attack combining existing attacks (APGD+FAB) to benefit from the complementarity of search and gradient attacks. The attack has revolutionized the research of robustness assessment in computer vision and led to a significant improvement of novel defense mechanisms. We believe CAA will be as impactful for Tabular Machine Learning as AutoAttack, especially as it was carefully designed to achieve both efficiency for simple cases and effectiveness for challenging cases and has very limited hyper-parameters.\n\nWe strongly argue that both attacks required significant design, engineering, and experimentation to find the optimal mechanisms and attacks to combine, and we have demonstrated that our techniques represent a significant leap forward for the community.\n\n**W2 - The implementation of CAA might be complex and resource-intensive, which could limit its practical applicability in some settings:**\n\nThank you for raising this critical aspect of robustness evaluation. The implementation of CAA brings marginal overhead in terms of implementation, given that the constraint evaluation runs on CPU and is parallelized.\n\nIn addition, we have carefully evaluated the impact of CAA in terms of runtime. Compared to the closest attack in terms of performance, MOEVA, CAA is significantly cheaper and faster to run. In Table 3, we showed that CAA is up to 5 times faster than MOEVA, and is always less expensive to run than MOEVA on 4 datasets. The only case where CAA is marginally more resource intensive is on CTU, but the overhead is between 7.76% and 13.74%, respectively for VIME and TabNet architectures.\n\nThank you for opening this discussion, we will incorporate it in the final manuscript within a limitation section (cf common authors's response, C4). We discuss there the cases where CAA could be more expensive, and will suggest good practices for practitioners to use CAPGD and CAA to their fullest potential. \n\n**W3 - Lack of evaluation against defense mechanisms: There have been many works proposed since Madry Adversarial Training. It is not fair to say that it is the only reliable defense against evasion attacks:**\n\nThank you for raising this critical point. There may have been a misunderstanding as we do not claim that Madry's Adversarial Training (AT) is the only reliable one, but that AT with all its improvements is. Since then, the robustbench benchmark [A] has continuously updated its leaderboard with new defenses, but all the effective ones are based on adversarial training and some data augmentation mechanisms. Some have proposed AT + Cutmix [B], others AT + Generative models (for example with 20M synthetic data [C]). \nTo validate the effectiveness of CAA on stronger defenses we have implemented 5 new synthetic data for Tabular ML in combination with Adversarial Training: AT + TVAE [D], AT + WGAN [E], AT + TableGAN [F], AT + CT-GAN [D] and AT + GOGGLE [G]. We evaluated CAA on these 5 defenses and report in Table 4 of the authors' response PDF the best robustness achieved by these defenses, compared to the robustness by the vanilla Madry AT on all our datasets and models. The results are the average over 5 seeds run to ensure reliable evaluation.\n\nOur new extensive experiments show that these new defenses can significantly improve the robustness of the models to CAA, but that our new attack remains effective for URL and LCLD datasets across all architectures, and for WIDS on TabTransformer and STG architectures. \n\nThank you for suggesting this study, we will discuss these new results in the appendix of the final version of the manuscript. \n\n[A] Croce et al. \"Robustbench: a standardized adversarial robustness benchmark.\"(2020).\n\n[B] Yun et al. \"Cutmix: Regularization strategy to train strong classifiers with localizable features.\" ICCV, (2019).\n\n[C] Wang et al. \"Better diffusion models further improve adversarial training.\" ICML. PMLR, (2023).\n\n[D] Xu et al. Modeling tabular data using conditional GAN. NeurIPS, (2019).\n\n[E] Arjovsky et al. Wasserstein GAN. CoRR, abs/1701.07875, (2017)\n\n[F] Park et. al. Data synthesis based on generative adversarial networks. VLDB Endowment, (2018)\n\n[G] Liu et al. GOGGLE: Generative modelling for tabular data by learning relational structure. ICLR, (2022)", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "0RjywMh8nq", "reviewer": "Reviewer_5k6D", "summary": "This paper introduces two novel adversarial attacks, specifically designed to target the evasion of deep neural networks (DNNs) in classification tasks involving tabular data satisfying real-world constraints. The first attack, CAPGD, is a gradient-based method that enhances the constrained PGD (CPGD) attack proposed in [33] by incorporating improvements from the APGD definition [12], such as the addition of momentum and an optimized step size selection. The second attack, CAA, combines the efficient but less effective CAPGD with another search-based attack, MOEVA, which is more effective but less efficient regarding the computational time required to perform the attack.\nThe extensive experimental evaluation on four tabular datasets and five DNNs for tabular data demonstrates that CAPGD significantly improves the success rate of generating successful adversarial examples compared to CPGD. Furthermore, CAA achieves a reasonable trade-off between efficacy and computational efficiency, offering higher attack efficacy than CAPGD and requiring less computational time than MOEVA.", "questions": "- Is CAPGD guaranteed to generate an attack that satisfies the dataset and perturbation constraints at the end of execution?\n\n- CAPGD and MOEVA may be unable to generate adversarial examples in specific settings (see results on two models on the CTU dataset in Table 3). What is the reason? Could it be due to the high number of constraints of the dataset? How does the success rate of the two attacks vary considering different numbers and types of constraints (linear and nonlinear)?\n\n- Why may CAA and MOEVA show a smaller success rate when considering higher epsilon values and a higher number of rounds (see Figures 5b and 7b)?", "limitations": "The authors should sum up the limitations of their proposals in a specific section in the paper. The negative societal impact is discussed by the authors who claim that their work may give birth to new and stronger defenses. Finally, the experimental and implementation details have been extensively documented.", "rating": 7, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "I find this paper particularly compelling as it proposes a new evasion attack against deep learning models for tabular data with real constraints that clearly outperforms the other state-of-the-art proposals. The paper demonstrates two key strengths:\n\n- Despite the two proposed attacks are improvements and combinations of existing approaches to generate realistic attacks, they are based on reasonable and novel observations. In particular, the design of CAA is motivated by the evidence that CAPGD and MOEVA are complementary. These attacks significantly outperform the state-of-the-art CPGD [33].\n\n- The experimental analysis is comprehensive and convincing. The experiments are performed on 5 different deep learning models employed to classify tabular data on 4 different datasets with variable number of constraints. Both the accuracy and efficiency of the attacks are evaluated. Furthermore, additional results are shown varying the maximum perturbation and the value of important parameters of the attacks are shown. Finally, an ablation study shows the impact of each improvement introduced in CAPGD.", "weaknesses": "Even though the proposal is good, I think that some weaknesses about the presentation of the proposal and the analysis of the results need to be addressed in the final version of the paper:\n\n**The description of CAPGD should be improved**: the description of CAPGD can be enhanced by better explaining the role of the repair operator. Specifically, the authors mention that constraints of the form $f = \\psi$ are enforced at every iteration by the repair operator. However, it is not clear whether applying this operator at every iteration guarantees the generation of an adversarial example that satisfies all dataset constraints and the maximum perturbation constraint by the end of the execution. This is a crucial property, as the attack cannot be tested if it does not satisfy the constraints, potentially wasting the time required to generate the attack.\n\n**The depth of the analysis of the results should be improved**: the depth of the analysis of the results can be improved by discussing particular results to understand their causes and how to mitigate these cases. For instance, CAPGD and MOEVA fail to generate adversarial examples on the CTU dataset for 2 out of 5 models (Table 3 and results in the Appendix). This failure may be due to the high number of constraints (360) considered for this dataset, since the two attacks are more effective on the other datasets for which at most 30 constraints are considered. It would be interesting to evaluate the efficacy of the two attacks by varying the number of constraints considered for the CTU dataset, to better highlight the limitations of the proposed attacks.\nAdditionally, CAA generates less effective attacks with higher epsilon values (Figure 5b), and MOEVA generates less effective attacks with a higher number of iterations (Figure 7b). Even though these results are sporadic, they are counterintuitive, as the search space for adversarial examples increases with higher epsilon and more mutation rounds. A detailed discussion of these phenomena would provide valuable insights.\n\n**The limitations section is missing**: the paper should include a limitations section summarizing the limitations of the presented attack algorithms and their evaluation. For example, the evaluation is performed only against an $L_2$ attacker, whereas other norm-based or synthetic attackers could have been considered. The attacks may not work well against specific datasets and models when $\\epsilon$ is small. While these limitations are reported in the paper, they are scattered throughout. A dedicated section would clarify these points.\n\n**Typos and inconsistencies**: there are some typos and inconsistencies in the notation, such as:\n- $R_\\Omega$ in Eq. 3 is not defined when the equation is presented.\n- $x^{(k+1)}$ -> $x^{(k-1)}$ in Eq. 7.\n- The classifier is represented by $H$ in Algorithm A.2, but $h$ is used in the main body of the paper. Additionally, $X$ appears twice in the function in line 3 of Algorithm A.2.\n\nCorrecting these typos and inconsistencies will improve the clarity and readability of the paper.\n\nFinally, another weakness is more generic:\n\n**The proposed attacks are really specific**: the paper is proposing two effective algorithms to forge realistic evasion attacks against deep learning models used for classifying tabular data, an under-explored setting. I think that the contribution is appreciable. However, the chosen setting may limit the impact of the results, since, at the best of my knowledge, tree-based models continue to be the state-of-the-art for classification tasks on tabular data [a]. \n\n[a] Ravid Shwartz-Ziv and Amitai Armon, Tabular Data: Deep Learning is Not All You Need, Information Fusion Volume 81, May 2022, Pages 84-90\n\n**Updates after the authors' response**\nThe authors have provided a satisfying response addressing all the concerns that I have raised as weaknesses. The authors are willing to introduce the findings provided in the response in the next version of their paper, as far as I understood. Moreover, they will also include a dedicated limitations section and correct the typos.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your support and your insightful feedback. We appreciate your comments towards improving the quality of the paper. We clarify and answer your concerns below. \n\n**W1/Q1 - Explaining the role of the repair operator. Is CAPGD guaranteed to generate an attack that satisfies the dataset and perturbation constraints at the end of execution?**\n\nThe repair operator's role is to ensure equality constraints are satisfied during optimization. \nWhile equality constraints are included in the penalty function, optimization alone does not achieve exact equality of feature values. \nThe repair operator addresses this by setting the value of the left-hand side of an equation to match the evaluation of the right-hand side in each iteration.\nIt maintains other dataset constraints such as bounds, mutability, and feature types but does not ensure other relational constraints are met. \nThe operator can violate maximum perturbation constraints, yet at each iteration, the perturbation is corrected back within the allowed maximum.\nThis approach has been shown to improve the success rate of CAPGD, as demonstrated by our ablation study in Table 7. \n\n**W2/Q2 - Attacks fail to generate adversarial examples on CTU for 2/5 models. Is it the high number of constraints? Impact of different numbers and types of constraints ?**\n\nThank you for raising this comment. Indeed, CTU dataset exhibits a large number of constraints compared to the other datasets, and some are particularly challenging. We show in the common answer (C1) that these constraints are harder to optimize. \n\n**W2/Q3 - CAA epsilon values - Why may CAA show a smaller success rate when considering higher epsilon values?**\n\nThank you for pointing out the pattern in Fig5b. Indeed, CAA's performance can decrease with higher budgets. We provide below a complementary analysis of this behavior.\n\nWe investigated the case of augmenting the EPS budget of CAA on LCLD dataset with STG model.\nWe found that when augmenting the EPS budget from 1 to 5, the success rate of CAPGD drops from 27.1% to 0.4% and is not entirely balanced by MOEVA's improvement from 4.3% to 12.4%.\n\nThe drop in CAPGD performance is caused in almost all cases by the violation of boundary constraint after the repair operator when the repair operator fixes the constraints of the type A = B / C. \n\nEach of these features is defined in the dataset with their respective maximum and minimum values. Given Max(B) and Min(C), the repair operator will lead to Max(A) = Max(B) / Min( C), however in the definition of the dataset proposed by Simonetto et. al. [33], Max (A) is lower than Max(B) / Min( C). Hence our repair operator contradicts the boundary constraint definitions. This phenomenon appears only for large perturbations. This violation should be solved by fixing the dataset's definition of the boundary constraints to take into account the feature relationships. \n\nWe have included in the limitation section of our paper (in the final version, and in the author's response above C3) a discussion on the quality of the constrained datasets available and the coherence between their boundary constraints and their feature constraints.\n\n**W2/Q3 - MOEVA Iterations - Why may MOEVA show a smaller success rate with a higher number of generations?**\n\nMOEVA is a multi-objective genetic algorithm. An inherent problem of multi-objective optimization is the trade-off between the objectives. If all solutions in the population are on the Pareto front, the algorithm must decide which solutions to discard for the next iteration, potentially discarding a valid adversarial example in our case.\n\nFigure 1 in the Author's response PDF shows the evolution of the success rate of MOEVA with the number of iterations in the same settings as in Figure 7b for TabTransformer. \nWe find that the success rate reaches a maximum at 100 iterations. \nWe argue that valid adversarial examples were discarded when the search continued to 1000 iterations.\nTo confirm our hypothesis, we run the same experiment with a 10 times larger search population, such that more solutions are preserved at each iteration.\nWe observe that in this setting, MOEVA converges slower (due to less selection pressure) but the success rate strictly increases with the number of generations. \nIncreasing the population size also increases the execution time (by 3.4x in this case), due to the selection operator overhead.\n\nOur approach CAA aims at minimizing the memory and computation overheads while maximizing the success rate, and CAA can be tuned to lead to lower robust accuracy with more iterations if the search space is expanded (for example with larger populations). We thank you for this remark and we have introduced a discussion on the impact of the population size in the appendix.\n\n**W3 - Limitation sections:** \n\nThank you for this suggestion. We added a limitation section in the common author response (C4), and to the updated paper for the final version.\n\n**W4 - Typos:**\n\nThank you for pointing this out, we have corrected them for the final version.\n\n**W5 - The proposed attacks are specific:**\n\nWe agree that tree-based models are in many settings outperforming Deep Neural Network (DNN) architectures. DNN architectures are catching up, in particular for large datasets as demonstrated in [A], hence the need to evaluate their robustness. \n\nHowever, we also argue that CAA is relevant to any model (including tree-based models) with two settings: \n\n- in transferability, by generating adversarial examples on a surrogate model and evaluating their success rate on the target (tree-based) model,\n- by applying CAA (through the search-based component MOEV, which is model agnostic).\n\nIn the common author response, we provide an empirical study for both settings and show that CAA remains effective against random forest and XGBOOST models.\n\n[A] Borisov et al. \"Deep neural networks and tabular data: A survey. 2021.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "e6Kw1F4JGY", "reviewer": "Reviewer_aMTd", "summary": "This paper aims to study the problem of finding adversarial examples for tabular datasets. Different from attacking image models or text models, attacking tabular models requires finding adversarial examples which are legal, which do not violate the relation between features. Moreover, it also requires to tackle both numerical and categorical features.", "questions": "Plz see the weakness.", "limitations": "I didn't see such a discussion.", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The studied problem is important and under less investigation compared to adversarial attacks in CV and NLP. \n2. The paper is well written and easy to follow. \n3. The experiment analysis is convincing and sufficient.", "weaknesses": "However, I still have concerns on this paper. Specifically, many terms / techniques used in the method are not originally proposed by this paper. For example,  \n1. In terms of the main objective (as discussed in Section 3.1), one key step to let adversarial examples satisfy the feature constraints (in Eq.1 and Eq.2) is to translate into a differentiable function. However, this is proposed by the previous work Simonetto et al, 2021. \n2. In terms of the solving algorithm (as discussed in Section 4.1), the author propose CAPGD, which seems a fine-tuning / lightweight modification of the previous method CPGD. This also limit the technical contribution of this paper. \n3. Finally, the author claims trying both CAPGD (proposed in this paper) and MOEVA (previous work) and BF* (previous work) can improve the attack successful rate. \n\nOverall, I do not hesitate about the effectiveness of combining these strategies for solving the attack problem. Instead, I am concerned of the originality and the significance of the work. Besides, although the authors discussed the reasons on why differentiable models are considered in this paper, I still believe that undifferentiable models like XGBoost is one important branch of models for solving the tabular data classification tasks. I encourage the authors also investigate possible solutions for undifferentiable models.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your review. We appreciate that you acknowledge the importance of the problem and the quality and persuasiveness of our analysis. We will address below your doubts about the originality and significance of our work. \n\n**W1 - Existing differentiable function:**\n\nWe acknowledge that integrating the constraints as a differentiable penalty function is not novel in this work and was proposed by CPGD [33]. Nevertheless, the results in [33] (confirmed in Table 2 of our paper) indicate that leveraging the constraints penalty function is not sufficient to achieve high effectiveness with gradient-based attacks. An attack that only uses a differentiable penalty such as CPGD remains ineffective in the challenging datasets we address. Thus, the need for the novel mechanisms we introduce in CAPGD and CAA.\n\n**W2 - CAPGD novelty:**\n\nWe understand your concern regarding the similarities between CPGD and CAPGD, being both gradient attacks where the constraints are included as penalty functions. However, we respectfully disagree for the following reasons:\n\n(1) Compared to the previous attack, CPGD, our new attack CAPGD introduces 4 novel mechanisms to increase the effectiveness of the attack: the repair operator, the adaptive step, the momentum, and multiple initialization.\nWe demonstrate the effectiveness and complementarity of each component.\nFor instance, removing the constraints repair operator, a novelty of this paper, reduces the effectiveness of the attack by up to 24.1 robust accuracy points.\nCAPGD significantly increases the effectiveness of gradient-based attacks on 3/4 datasets, while preserving the efficiency advantage of gradient-based attacks w.r.t. search attacks.\n\n(2) Designing CAPGD is not intuitive. The literature on adversarial attacks proposed many mechanisms to improve their effectiveness, including random sampling, reinitialization, adaptive steps, and revert to best, and the first challenge was to identify which mechanisms are relevant to our use case, namely which mechanisms are compatible and beneficial to the constraints satisfaction objective. In particular, we found out that combining all the mechanisms in the literature was not optimal, and we achieved the best performances without reverting to the example with the higher loss when the step size changes. We provided in Appendix B.1 a study of the components of CAPGD and their complementarity. \n\nWe hope this clarifies our argument on why CAPGD is not a straightforward improvement of CPGD. We are open to further discussion and would be happy to elaborate on any points if needed.\n\n\n**W3 - Applying a combination of attacks:**\n\nWe appreciate your concern regarding the design of our meta-attack CAA.  Nevertheless, we respectfully believe that its design represents a significant contribution for two reasons:\n\n(1) By applying a combination of complementary and strong attacks, we aim to become the standard for evaluating the robustness of models to adversarial attacks in Tabular Machine Learning. \n\nIdentifying both \"complementary\" and \"strong\" attacks for a meta-attack is not straightforward. We presented in Table 1 of our manuscript 10 attacks proposed for Tabular Machine Learning. Some are gradient-based and others are search-based. We first identified which attacks natively support all the constraints, and which could eventually be extended. We ended with 2 gradient attacks CPGD (native support) and LowProFool (extension needed), and two search attacks BF* and MOEVA. Next, we demonstrated that our new attack CAPGD subsumes CPGD and LowProfool and that MOEVA subsumes BF*. Then we needed to validate the complementarity of CAPGD and MOEVA (Figure 2 of our manuscript). Finally, we confirmed with an extensive evaluation (Table 3 of our manuscript) that our new CAA attack combining MOEVA and CAPGD still preserves the benefits of each (efficiency of CAPGD and effectiveness of MOEVA). Each step required formal analysis, extensive engineering, and exhaustive experiments. \n\n(2) Meta-attacks, that combine existing attacks are an active line of research. In Computer Vision, AutoAttack by Croce et al.[12] is a meta attack combining existing attacks (APGD+FAB) to benefit from the complementarity of search and gradient attacks. The attack has revolutionized the research of robustness assessment in computer vision and led to a significant improvement of novel defense mechanisms. \n\nWe strongly believe that CAA will be as impactful for Tabular Machine Learning as AutoAttack, especially as it was carefully designed to achieve both efficiency for simple cases and effectiveness for challenging cases and has very limited hyper-parameters.\n\nThank you once again for your constructive feedback, we will update the final manuscript according to your feedback to better showcase the significance of our meta-attack.\n\n**W4 - Undifferentiable models:**\n\nWe agree that tree-based models such as XGBoost are in many settings outperforming Deep Neural Network (DNN) architectures. DNN architectures are catching up, in particular for large datasets as demonstrated in [5], hence the need to evaluate their robustness. \n\nHowever, we also argue that CAA is relevant to any model (including tree-based models) with two settings: \n\n- in transferability, by generating adversarial examples on a surrogate model and evaluating their success rate on the target (tree-based) model,\n- by applying CAA (through the search-based component MOEVA that is model agnostic).\n\nIn the common author response (C3), we provide an empirical study for both settings and show that CAA remains effective against random forest and XGBOOST models. \n\nWe will also update the appendix in the final version of the paper with a discussion on undifferentiable models.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We thank the reviewers for their comments. The reviewers agree on the importance of the problem we tackle and are satisfied with the comprehensiveness of our study and analyses.

Our work proposes the most effective and efficient attacks for Tabular Machine Learning in constrained domains. Our new attack CAA is up to 5 times faster than the SOTA search attack MOEVA and up to 83% percentage points more effective than the SOTA gradient attack CPGD.

To address the reviewers' feedback, we implemented and evaluated 5 new defenses against CAA, provided a generalization study on 2 new models, and analyzed in detail the constraints of the CTU case. These new results are in the attached PDF. 

We address below the common comments of the reviewers:

**C1- Novelty of the work (JEHw, aMTd):** 

We would like to clarify that research on adversarial robustness for tabular ML is still in its infancy. Our work investigates how adaptive attacks and meta-attacks can form a new and strong standard for such robustness assessment. In computer vision, comparable endeavors had a significant impact (e.g. AutoAttack [12]) and yielded de-facto evaluation standards (e.g. RobustBench [A]). We aim to push such needed advances for tabular ML, while considering its specificities — i.e. the existence of validity constraints.

However, the development of adaptive mechanisms for tabular attacks is not straightforward: blindly combining existing mechanisms (developed for computer vision) yields suboptimal results. Therefore, our work carefully investigates specific adaptations, including a tabular-specific repair mechanism, to form a novel optimized attack (CAPGD).

Furthermore, the development of a meta-attack requires careful selection of the baseline methods. We are the first to investigate this question, through extensive experimentation and the demonstration that not all attacks are needed (some attacks are subsumed by others). We reveal that combining CAPGD with MOEVA yields the best comprehensiveness-efficiency trade-off. CAA, the resulting meta attack, therefore acts as the new baseline for adversarial attacks on tabular ML models.

**C2- Analysis of CTU constraints: (XFcC, 5k6D)** 

CAPGD and MOEVA fail to generate adversarial examples on CTU for 2 out of 5 models. CTU dataset has a large number of constraints compared to the other datasets, and some are particularly challenging. We argue that some of these constraints hinder gradient attacks and are harder to optimize. 

To confirm our hypothesis and provide additional insights, we split the constraints of CTU based on their type into 4 buckets (Table 2 of the Author Response PDF).

First, we ran an ablation study, where we ignored one bucket of constraint at a time. Next, we studied the success rate when we considered each bucket separately. Finally, we reported the impact of the number of constraints to optimize from CG3, the largest bucket.

The results in Table 3 show that for gradient attacks, removing one type of constraint is not enough to improve the success rate. Constraints across multiple remaining categories are not satisfied. The individual bucket study confirms that only when considering constraints of type CG2 alone, CAPGD improves its success rate (in VIME and TabNet). When only considering CG3 constraints, reducing the number of constraints improves the success rate (by reducing robust accuracy from 95.3% when considering 100% of CG3 constraints to 84.5% and 43.0% respectively when considering 50% and 10% of the constraints).

We hope this fine-grained constraint analysis addresses the interrogations of reviewers #XFcC and #5k6D, and confirms that for CTU dataset, both the number of constraints and the complexity of individual constraints make the constrained adversarial optimization challenging for gradient attacks. 

Thank you for pointing out this pattern, we will extend the appendix with a section dedicated to the aforementioned analysis of the constraints of CTU. 

**C3- Generalization of our approach to shallow/tree models: (5k6D, aMTd)** 

We train Random Forests (RF) and XGBOOST models to achieve the best performance on our datasets and we present in Table 5 of the attached PDF, the robust accuracy of both models against CAA for the four datasets in two settings: (1) Direct attack where CAA (using its search component MOEVA) attacks directly the RF and XGBOOST models, and (2) Transfer attacks, where we craft the examples on our deep learning (DL) models and evaluate them in the RF and XGBOOST models. 

Our new study shows that (1) DL models of our study achieve comparable clean performance to the shallow models, (2) both RF and XGBOOST models are vulnerable to direct CAA attacks (down to 9.1% of robust accuracy on LCLD XGBoost), and (3) CAA attacks on DNN transfer to RF (down to 5.3% robust accuracy) and XGBoost (down to 9.4% robust accuracy) models.

This study confirms the relevance and significance of our attacks on tabular models, including undifferentiable models.

**C4- Dedicated "Limitations" section: (All)** 

We have scattered the limitations of our approaches across the paper and we summarize them for completeness.

- *Marginal overhead of CAA:* In settings where CAPGD fails to attack tabular models, CAA can exhibit a computation overhead (<14%) compared to MOEVA. However, in 4/5 evaluated settings, CAA is faster than MOEVA (up to 5 times).
- *CAPGD effectiveness with complex constraints:* CAPGD effectiveness drops when increasing the constraint's complexity such as the number of constraints or the number of features involved in each constraint.
- *Coherence of constraints:* The mechanisms of CAA assume that the constraints definitions are sound. Incoherences between boundary constraints and feature relation constraints can lead to invalid adversarial examples with large EPS budgets. 

We will introduce both the study of tree-based models and the dedicated limitation section in the final version of the paper.

Meta-review: **Summary of the paper**

This paper proposes a new attack method for generating adversarial perturbations against deep neural networks for tabular data. Specifically, the authors propose adaptive mechanisms that overcome the problems of existing gradient-based attack methods. Then, they strengthen their attack method by combining it with an existing search-based attack. With a set of experiments, the authors demonstrate the effectiveness of the attack.

**Summary of the discussion**
* The reviewers observed several strengths of this paper, including its novelty, the importance of the problem domain, and the extensive number of experiments.
* Reviewer XFcC pointed out two weaknesses.
  * First, the definition of the penalty function needs to be clarified.
  * Second, some descriptions are difficult to understand, and more clarification is needed.
  * The authors provided more detailed explanations in the rebuttal, saying they would address the reviewer’s concern in the revised version.
  * After the discussion, the reviewer increased the rating from 6 to 7.
* Reviewer JEHw pointed out three weaknesses.
  * First, the reviewer believes the proposed method lacks novelty. Regarding the novelty of the work, the authors emphasized that finding the appropriate attack method for tabular data was already the first challenge they overcame and that combining existing attacks is an active line of research.
  * Second, the proposed method might be too complicated and resource-intensive. Regarding resource consumption, the authors mentioned that the proposed method only induces marginal overhead if the constraint evaluation is parallelized.
  * Third, the reviewer says the authors only compared to old defense mechanisms. For the last weakness, the authors admitted that it is a critical point and then provided more results against five additional defenses in the revised version.
  * After the discussion, the reviewer increased the rating from 4 to 6.
* Reviewer 5k6D pointed out five weaknesses.
  * First, the algorithm description is not clear. Regarding the first weakness, the authors clarified the part the reviewer asked for, i.e., the role of the repair operator.
  * Second, the analysis of the result can be improved further. Regarding the second weakness, the authors admitted the reviewer's concerns and provided some rough analysis of the part the reviewer mentioned.
  * Third, there is no dedicated section for the proposed method's limitations. Regarding the third concern, the authors added a dedicated section for the limitation of their work.
  * Fourth, there are typos and inconsistencies in notations. Regarding the minor issues in writing, the authors addressed the concerns by fixing typos.
  * Last, the proposed method's impact is limited to a specific domain. Regarding the reviewer's point that tree-based models outperform deep neural networks on tabular data, the authors claimed that the proposed method has potential application to any existing model, including tree-based models.
  * After the discussion, the reviewer increased the rating from 6 to 7.
* Reviewer aMTd pointed out three weaknesses of the paper.
  * First, the proposed idea has already been explored by existing work. Regarding the first weakness, the authors admitted that the idea of a differentiable penalty function is not their novel contribution. However, they also point out that the penalty function alone is not enough for an effective adversarial attack, emphasizing their contribution in improving the mechanism.
  * Second, the proposed method looks like a mere improvement of an existing algorithm. Regarding the second concern, the authors list four novel mechanisms they introduced in their method. The authors also pointed out that finding the proper attack method was already a big challenge when attacking tabular data.
  * Third, the reviewer raised a concern about the authors’ meta-attack design. Regarding the last concern, the author appreciated the reviewer’s concern regarding their meta-attack design and emphasized its contributions.
  * After the discussion, the reviewer increased the rating from 4 to 5.

**Justification of my evaluation**

* My rating is 6 (or 7 with lower confidence).
* To the best of my knowledge, adversarial attacks on tabular data have not been explored enough, and this work contains enough contributions for acceptance.
* During the discussion, the authors communicated very effectively with the reviewers. All the reviewers increased their ratings after the discussion, which is impressive.

I recommend accepting this work (spotlight). However, I’m unsure whether I can recommend it for the spotlight. I’d ask the SAC for some guidance.
Decision: Accept (spotlight)