Transferable Adversarial Robustness for Categorical Data via Universal Robust Embeddings
Authors: Klim Kireev
Maksym Andriushchenko
Carmela Troncoso
Nicolas Flammarion
Venue: NeurIPS 2023 poster (2023)
Keywords: Tabular data
Categorical data
Robust ML
Adversarial Robustness
TL;DR: We propose methods to both train robust neural network for categorical data, and transfer the robustness to classical ML models, such as random forests, gradient-boosted trees etc.

Abstract: Research on adversarial robustness is primarily focused on image and text data. Yet, many scenarios in which lack of robustness can result in serious risks, such as fraud detection, medical diagnosis, or recommender systems often do not rely on images or text but instead on tabular data. Adversarial robustness in tabular data poses two serious challenges. First, tabular datasets often contain categorical features, and therefore cannot be tackled directly with existing optimization procedures. Second, in the tabular domain, algorithms that are not based on deep networks are widely used and offer great performance, but algorithms to enhance robustness are tailored to neural networks (e.g. adversarial training).

In this paper, we tackle both challenges. We present a method that allows us to train adversarially robust deep networks for tabular data and to transfer this robustness to other classifiers via universal robust embeddings tailored to categorical data. These embeddings, created using a bilevel alternating minimization framework, can be transferred to boosted trees or random forests making them robust without the need for adversarial training while preserving their high accuracy on tabular data. We show that our methods outperform existing techniques within a practical threat model suitable for tabular data.

Transferable Adversarial Robustness for Categorical Data via Universal Robust Embeddings
Klim Kireev, Maksym Andriushchenko, Carmela Troncoso, Nicolas Flammarion EPFL
Abstract
Research on adversarial robustness is primarily focused on image and text data. Yet, many scenarios which lack of robustness can result in serious risks, such as fraud detection, medical diagnosis, or recommender systems often do not rely images or text but instead on tabular data. Adversarial robustness in tabular data poses two serious challenges. First, tabular datasets often contain categorical features, and therefore cannot be tackled directly with existing optimization procedures. Second, in the tabular domain, algorithms that not based deep networks widely used and offer great performance, but algorithms to enhance robustness are tailored neural networks (e.g. adversarial training). The code for method is publicly available at
Wraansferabl-CCat-Roosttttt
In this paper, we tackle both challenges. We present method that allows us to train adversarially robust deep networks for tabular data and to transfer this robustness to other classifiers via universal robust embeddings tailored to categorical data. These embeddings, created using bilevel alternating minimization framework, can be transferred to boosted trees random forests making them robust without the need for adversarial training while preserving their high accuracy on tabular data, We show that our methods outperform existing techniques within practical threat model suitable for tabular data. The code for our method is publicly available !
Introduction
Works on adversarial machine learning primarily focus on deep networks and mostly evaluated on image data. Apruzzese et al. (2022) estimate that approximately 70%-80% of works in the literature fall in this category. Yet, large number of high-stake tasks across fields like medical diagnosis (Shehab et al. 2022 fraud detection (Altman 2021). click-through rate prediction (Yang & Zhai 2022). or credit scoring (Shi et al., 2022) neither only rely on deep networks nor operate on images (Grinsztajn et al. 2022). These tasks often involve many discrete categorical features (e.g.. country, email, day of the week), and the predominant models used are discrete tree-based (e.g.. boosted tree ensembles, random forests). These two characteristics raise number of challenges when trying to achieve robustness using previous works which focus on continuous features and continuous models (Goodfellow et al. 2014 Madry et al. 2018).
Accurate modelling of adversarial capability. The de-facto standard in adversarial robustness evaluation (Croce et al. 2020) is to model robustness to perturbations bounded in some f, ball, mostly the image domain. This approach. however, was shown not accurately represent the capabilities of a real adversary in other domains (Kireev et al. 2022 Apruzzese et al. (2022). Instead, realistic threat model would constrain the adversary with respect to their financial capabilities. This can be achieved by associating financial cost with every input feature transformation, limiting the adversary to perform transformations within their total financial budget. Such a constraint common
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

for computer security problems as it ties security, in this case, robustness, to real- limitations. The inaccuracy of threat models in the literature translates on lack of well-motivvtee benchmarks for robustness research on tabular data, unlike for image-oriented vision tasks (Croce et al. 2020 Koh et al. 2020).
Accounting for discrete categorical features. Tabular data is usually heterogeneous and often includes categorical features which can be manipulated by an adversary in a non-uniform way, depending on the characteristics of the real-world concept they represent. For example, buying an email address not the same as buying credit card or moving to a different city. Moreover, for given feature, not all transformations have equal cost or are even possible: for example, one can easily change their email address *0gmail, com, while changing the domain name to *Crr com can be impossible, since this domain name is unavailable for new users. Hence, the definitions of perturbation sets describing the capabilities of potential adversaries should support complex and heterogeneous constraints.
Robustness for models other than neural networks. Gradient-based attacks based on projected gradient descent provide a simple and efficient method for crafting adversarial examples. They are effectively used for adversarial training, which became a de-facto standard defence against adversarial perturbations (Madry et al., 2018). Albeit defences and attacks are proposed for decision tree models, they often employ combinatorial methods and can be very inefficient time-wise (Kantchelian et al., 2016; Calzavara et al.) 2020, Kireev et al. [0022). However, in tasks involving tabular data, these models must be prioritized as they are widely used because they can provide superior performance on some tabular datasets than neural networks (Girinsztajn et al. (022).
Contributions. Our contributions address the challenges outlined above follows:
We propose a practical adversarial training algorithm supporting complex and heterogeneous constraints for categorical data that can accurately reflect financial costs for the adversary. Our training algorithm based on the continuous relaxation of a discrete optimization problem and employs approaches from projections onto an intersection of convex sets.
We propose method to generate universal robust embeddings, which can be used for transferring robustness from neural networks to other types of machine learning models such as decision trees or random forests.
We use existing datasets to build the first benchmark that allows to evaluate robustness for tabular tasks in which the adversary is constrained by financial capabilities.
Using the proposed benchmark, we empirically show that our proposed methods provide significantly better robustness than previous works.
2
Related works
Here we discuss the most relevant references related to the topics outlined in the introduction.
Gradient-based adversarial training. Adversarial training is the key algorithm for making neural networks robust to standard ép ép-bounded adversarial examples. (Zegedy et al. (2013) demonstrate that modern deep networks are susceptible to adversarial examples that can be easily found via gradient descent. Madry et al. (2018) perform successful adversarial training for deep networks where each iteration of training uses projected gradient descent to find approximately optimal adversarial examples. Related to our method of universal first-layer embeddings, Bakiskan et al. (2022) perform partial adversarial training (i.c., training the whole network adversariallyynormally and then reinitializing some layer and training them in the opposite way) which is somewhat, showing that earlier layers are more important for robustness. On related note, Zhang et al. (2019) do adversarial training on the whole network but do multiple layer with the goal of speeding up adversarial training. Yang al. (2022) use metric learning with adversarial training to produce word embeddings robust to word-level adversarial attacks which can be used for downstream tasks. Dong et al. (202T) also produce robust word embeddings via a smart relaxation of the underlying discrete optimization problem. We take inspiration from this line of work when we adapt adversarial training for neural networks to categorical features and transfer the
-aakardd-- passes on the first
first-layer embeddings to tree-based models.
2

---

Robustness of tree-based models. Tree-based models such as XGBoost (Chen & Guestrin 2016) are widely used in practice but not amenable gradient- bassed adversarial training. Most of the works on adversarial robustness for trees focus on fo adversarial examples since they are easier to work with due to the coordinate-aligner structure of decision trees. Kantchelian et al. (2016) is the first algorithm for training robust tree ensembles which are trained on a pool of adversarial examples updated on every iteration of boosting. This approach is refined by approximately solving the associated min-max problem for lx robustness in Chen et al. (2019) and by minimizing an upper bound on the robust loss in Andriushchenko & Hein (2019) on each split of every decision tree the ensemble. Chen et al. (2021) extend the & approach of Chen et al. (2019) to arbitrary box constraints and apply it to a cost-awart threat model on continuous features. Only few works tackle non- robust training of trees since their ponndinate-aligned structure is not conducive to other norms. Most related work to ours is Wang et al. (2020) extend the upper bounding approach of Andrisshhheeo & Hein (2019) for arbitrary pp-norms. However, they report that (o robust training in most cases works similarly to & robust training, though in a few cases l adversarial training yields better performance. Moreover, they do not categorical features which are typically present in tabular data which is the focus of our work.
Threat modeling for tabular data. Many prior works do not consider a realistic threat model and adversarial capabilities. First, popular benchmarks like Madry et al. (2018); Croce et al. (2020) assume that the adversary has an equal budget for perturbing each feature which is clearly not realistic for tabular data. To fix this, [Chen et al. (2021) propose to consider different perturbation costs for different features. Kireev et al. (2022) argue that, imperceptibility and semantic similarity not necessarily meaningful considerations for tabular datasets, these costs must be based on financial constraints i.e., how much money it costs for the adversary execute an attack for particular example. The importance of monetary costs was corroborated by studies involving practitioners dealing with adversarial machine learning in real applications (Apruzzese et al.) 2022, Grosse et al.) 2023). Second, popular benchmarks treat equally changes from the correct to any other class, but in practice the adversary is typically interested only specific class change, e-g., modifying fraudulent transaction to be classified as non non-fraudulent. To address this shortcoming, past works (Zhang & Evans 2019 [hhnn et al., 2022) propose class-sensitive robustness formulations where an unequal cost can be assigned to every pair of classes that can be changed by the adversary. As a result, this type of adversarial training can achieve a better robustness-accuracy tradeoff against a cost-sensitive adversary. We take into account all these works and consider a cost-based threat model where we realistically model the costs and classes which are allowed to be changed for the particular datasets we use.
3 Definitions
Input domain and Model. The input fommin'ssfaaurra space X is composed of m features: X C X, x X2 X ..... x Xm. We denote as x; the value of the i-th feature of x E X. Features v; can be categorical, ordinal, or numeric, and we define tabular data as data consisting of these three types of features in any proportion. Categorical features are features such that X, is a finite set of size [x.] = tg. i.c., t; the number of possible values that can take x;. We denote by t Σ 44. We also denote as I/), the j-th value of the feature 2₁. We further assume that each example x E X is associated with binary label y E {0, 1}. Finally, consider general learning model with parameters and output (0,z). The model we consider in our framework can take on two forms: differentiable, such neural network, or non-differentiable, like tree-based model.
Perturbation set. Following the principles described by AAruzzese et al, (2022); Kireev et al. (2022). we make the assumption that realistic adversary is constrained by financial limitations. Specifically, we denote the cost of modifying the feature x; to x² as (, x²). For categorical features with finite set X., the cost function 04 (x, at)) can be conveniently represented using a cost matrix C₁ E R4xt, The cost of changing the feature x; from the value j to the value i is given by
ca cx(x(,=)) = c.
If such transformation is impossible, c²fht is set to co. In a realistic threat model, any cost matrix C is possible, and costs need not be symmetric. The only reasonable assumption is that CP indicating no cost for staying at the same value. See realistic cost matrix examples in the Appendix A
3

---

We assume that the cost of modifying features is additive: the total cost of crafting an adversarial example x' from an example a can be expressed as:
m
cx x3) Σ (())))))
(I)
Encoding and Embeddings. Categorical features are typically preprocessed by encoding each value I; using one-hot encoding vector Ig. For instance, if a categorical feature 2; can take four possible
values {1, 3, 4] and z; 2. it is represented 2, (0) We can then represent the feature-wise cost function as
x4)
|w @ (T: F/i| I,,,, (T,, T(),
where 1 denotes the weighted 1 norm and w; C,T5, is the costs of transforming x; any other possible value in X3. Then according to Equation (T). the per sample cost function is:
c(z, x') w|, O T - >'Il = (T,
(3)
where the vectors H, T are the contenation of the vectors wA, H, TVJ respectively for vi: 0 0. i m.
The one-hot-encoded representation may not be optimal for subsequent processing due to high dimensionality or data sparsity. We instead use embeddings and replace the categorical features with their corresponding embedding vector (xx) E R The model can then be represented by function f of the features as
(0,, x) = f(0, o(x)).
The embedding function á is composed of embedding functions Φ; for the subvector x; as Φ(x) (d:))= The embedding function Φ; of the i-th feature can always be represented by matrix Q; since 2; takes discrete values. The columns of this matrix are embedding vectors which satisfy
(x;) QiIi.
Therefore, we parametrize the embedding function o(x, Q) with family of matrices Q (Q.).
Numerical features. For numerical features, we use a binning procedure which a common practice in tabular machine learning. This technique facilitates the use of decision-tree-based classifiers as they naturally handle binned data (Chen & Guestrin, 2016; Ke al., (017b). Binning transforms numerical features into categorical ones, allowing unique treatment of all the features. It is worth
noting that for differentiable classifiers, the approach by Kireev al. (2022) can enable us to directly use numerical features without binning.
4 Adversarial training
In this section, outline our adversarial training procedure. When adapted to our specific setup, the adversarial training problem (Madry et al. 2018) can be formulated as:
min E max E((f(((z', 0.Q
(4)
F.E c( SE
Such model would be robust adversaries that can modify the value of any feature x,, long the total cost of the modification is less than E. While this formulation perfectly formalizes our final goal, direct optimization of this objective is infeasible in practice:
1. Optimizing directly with categorical features can be computationally demanding due the need for discrete optimization algorithms. In our evaluation, we employ a graph-search- based procedure developed by Kireev al. (2022). However, finding single example using this algorithm can take between 1 to 10 seconds, making it impractical for multi-epoch training even on medium datasets (approximately 100K samples).
2. There currently no existing algorithm in the literature that enables us to operate within this cost-based objective for decision-tre tree based classifiers.

---

Algorithm 1 Cat-PGD. Relaxed projected gradient descent for categorical data.
Input: Data point ž, y, Attack rate ot, Cost bound e, Cost matrices C, PGD ste_sse D sleps Output: Adversarial sample F'.
== 0
for 2 PGD_steps do
V = Vol(f(Q(E +)).
= + aV
: 0
q ==
for 1 to D D_steps do
2 = Iisiptiina (ū, 8 p)
P 8+P
8 = eenst (z + q; C)
9 q 8
end for
end for = 7
4.1 Adversarial training for differentiable models
We begin by examining the scenario where our model f is a deep neural network. In this case, we are constrained solely by the first restriction. To address this constraint, we employ a relaxation technique: instead of working with the discrete set of feature vectors, we consider the convex hull of their one-hot encoding vectors. For each feature, this relaxation allows us to replace the optimization over x/ E X; with an optimization over Ve E 2220 More precisely, we first replace the feature space X; by the set { E {0,1]* 1) Σ = 1} using the one-hot encoding vectors, We then relax
this discrete set into { E 2 E, = 1}. The original constraint {a' E X, clx, x') S $) is therefore relaxed as
( E
R 20: Σ
J = 1, (T, I E and 5' = (#:)m
The set obtained corresponds to the convex hull the one-hot encoded vectors, providing the tightest convex relaxation of the initial discrete set of vectors T. In contrast, the relaxation proposed by Kireey al. 2022) relaxes X, to T leading to significantly worse performance as shown in Section 5.
The adversarial training objective for the neural networks then becomes:
min 0.Q 2
max 4. (s. | | 1, ERR for Isism
{(S(Q='
In order to perform the inner maximization, we generate adversarial examples using projected gradient descent. The projection is computed using the Dykstra projection algorithm (Boyle & Dykstra 1986) which enables projection algorithm, we first project onto the convex hull of each categorical feature (llsimptices). followed by a projection onto a weighted ball (Teost). This dual projection approach allows us to generate perturbations that simultaneously respect the cost constraints of the adversary and stay inside the convex hull of original categorical features. We refer this method as Cat-PGD, and its formal description can be found in Algorithm
project onto the intersection of multiple constraints. In each iteration of the
4.2 Bilevel alternating minimization for universal robust embeddings
While the technique described above is not directly applicable to non-differentiable models like decision trees, we can still leverage the strengths of both neural networks and tree-based models. By transferring the learnt robust embeddings from the first layer of the neural network to the decision tree classifier, we can potentially combine the robustness of the neural network with the accuracy of boosted decision trees.
5

---

Algorithm 2 Bilevel alternating minimization for universal robust embeddings
Input: Set of training samples X, y, cost bound é, _sseeps __sleps, PGD PGD_steps, N ilers. Output: Embeddings .iters Randomly initialize Q.
for 2 1 to N iters do
0. := 0, Q; := Qi
for j to 0 steps do
f = 8 a ().
end for
0, : 0% steps
for to Q steps do
N' = Attack(z, ( V, PGD stepsstepppsccm Q 0:)
0 = (V 0.),.))
end for
0,+1= == 0 g0-ttpps Qi+1 Q,-00 end for
Difference between input and output embeddings. Using embeddings obtained from the last layer of neural network is common approach in machine learning (Zhuang al. 2019). However, in our study, we prefer to train and utilize embeddings from the first layer where the full information about the original features is still preserved. This choice is motivated by the superior performance of cecision-tree-baac
classifiers over neural networks on tabular data in certain tasks. By using first layer embeddings, we avoid potential loss of information (unless the embedding matrix Q has exactly identical rows which are unlikely in practice) that would occur if we were to use embeddings from the final layer.
To show this effect we ran a simple experiment where we compare first and last layer embeddings as an input for a random forest classifier. We report the results in Appendix C.1
Step 1: bilevel alternating minimization framework. A natural approach is to use standard adversarial training to produce robust first layer embeddings. However, we noticed that this method is not effective in producing optimal first layer embeddings. Instead, we specifically produce robust first layer embeddings and ignore the robustness property for the rest of the layers. This idea leads to a new objective that we propose:
arg min e (I(QE, arg
Bilevel minimization: min
max 1.- (T.a')Se
((f(Q)) (((()(,)).)))..
ENED
B.ED
1 1, 15mm
(6)
This optimization problem can be seen as the relaxation of the original adversarial training objective. This relaxation upper bounds the original objective because robustly optimize only over Q and not jointly over Q and 0. If we disregard the additional inner maximization, it is a classical bilevel optimization problem. Such problem
be solved using alternating gradient descent (Ghadimi & Wang] 2018). To optimize this objective for neural networks on large tabular datasets, we propose to stochastic gradient descent. We alternate between Q_steps for the inner minimum and é steps for the outer minimum. At each step, we run projected gradient descent for _GD_sleps using the relaxation described in Eq. We detail this approach in Algorithm
Step 2: embedding merging algorithm. We observed that directly transferring the embeddings Q has little effect in terms of improving the robustness of decision trees (Appendix C.I). This is expected since even if two embeddings are very close to each other, a decision tree can still generate split between them. To address this issue and provide decision trees with information about the relationships between embeddings, we propose a merging algorithm outlined in Algorithm The main idea of the algorithm is merge embeddings in Q that very close to each other and therefore pass the information about distances between them to the decision tree.
Step 3: standard training of trees using universal robust embeddings. As the final step, we use standard tree training techniques with the merged embeddings Q'. This approach allows us to avoid the need for custom algorithms to solve the relaxed problem described in Eq. 5 Instead, we can

---

Algorithm 3 Embeddings merging algorithm
Input: Embeddings Q. percentile
Output: Embeddings Q''
1) D :=
2) For each qj. 9k E Q: compute dyk- 11g; - 9k ll2 and put it to D.
3) Sort D
4) For a given percentile, compute threshold s.t. all d >> belong the percentile
5) Cluster Q using & as maximum distance between two points in one cluster
6) each cluster compute average embedding vector and put into Q'
leverage highly optimized libraries such as XGBoost or LightGBM (Chen & Guestrin 2016 Ke et al. 2017b). The motivation behind this multi-step approach is to combine the benefits gradient-baser optimization for generating universal robust embeddings with the accuracy of tree-based models specifically designed for tabular data with categorical features.
Evaluation
In this section evaluate the performance of our methods.
Models. We use three 'classic' classifiers widely used for tabular data tasks: RandomForest (Liaw & Wiener] 2002), LGBM (Ke et al.) (017a), and Gradient Boosted Stumps. Both for adversarial training and for robust embeddings used in this section, we use TabNe(Arik & Prister (2019) which a popular choice for tabular data. Additionally, we also show the same trend with Fr-Traosformer in Appendix The model hyperparameters are listed in Appendix B
C
Attack. For evaluation, we use the graph-search based attack described by Kireev et al. 2022). This attack is model-agnostic and can generate adversarial examples for both discrete and continuous data, and is thus ideal for our tabular data task.
Comparison to previous work. In evaluation, compare method with two previous proposals: the method of Wang et al.] (2020), where the authors propose a verified decision trees robustness algorithm for i bounded perturbations; and the method of Kireev et al. (2022), which considers financial costs of the adversary, but using a different cost model than us and weaker relaxation.
5.1 Tabular data robustness evaluation benchmark
There is no consistent way to evaluate adversarial robustness for tabular data in the literature. Different works use different datasets, usually without providing a justification neither for the incentive of the adversary nor for the perturbation set. For example, Wang et al. (2020) and [Cen et al. (202I) use the breast cancer dataset, where participants would not have incentives to game the classifier, as it would reflect poorly on their health. Even they had an incentive, is hard to find plausible transformation methods all features relate to breast images taken by doctors. To solve this issue, we build our own benchmark. We select datasets according to the following criteria:
Data include both numerical and categorical features, with financial interpretation so that it is possible to model the adversarial manipulations and their cost.
Tasks on the datasets have a financial meaning, and thus evaluating robustness requires cost-aware adversary.
Size is large enough accurately represent the underlying distribution of the data and avoid overfitting. Besides that, should enable the training of complex models such as neural networks.
It is worth mentioning that the financial requirement and the degree of sensitivity of data are highly correlated. This kind of data is usually not public and even hardly accessible due to privacy reasons. Moreover, the datasets are often imbalanced. Some of these issues can be solved during preprocessing stage (e.g., by balancing the dataset), but privacy requirements imply that benchmarks must mostly rely anonymized or synthetic versions of dataset.
7

---

Cat-PGD
Kireev et al, 2022
IEEECIS
Credit
BAF
Clean Accuracy, %
77.5
80
74
72.5
70
70.0
67.5
70
68
66
10
101
10
10a
10:
107
109
76
Robust Accuracy. %
77.5
74
80
75.0
72.5
75
70
70.0
68
67.5
66
65.0
10a
101
10*
0
10"
10. 10'
10a
10
Cost Bound, $
Figure 1: Clean and robust model accuracy for cost-aware adversarial training. Each point represents a TabNet model trained with an assumption of an adversary's budget of S attacked by the adversary with that budget. Our method outperforms Kireev et al. (2022) in all setups.
Datasets. We select three publicly-availan datasets that fit the criteria above. All three datasets are related to real-world financial problems where robustness can be crucially important. For each dataset, we select adversarial capabilities for which we can outline plausible modification methodology, and we can assign a plausible cost for this transformation.
IEEECIS. The IEEECIS fraud detection dataset (Kaggle 2019) contains information about around 600K financial transactions. The task is to predict whether transaction is fraudulent or benign.
BAF. The Bank Account Fraud dataset proposed in NeurlPS 2022 by Jesus al. (022
to evaluate different properties of ML algorithms for tabular data. The task is to predict if given credit application fraud. contains 1M entries for credit approval applications with different categorical and numerical features related to fraud detection.
Credit. The credit card transaction dataset (Altman 2021) contains around 20M simulated card transactions, mainly describing purchases of goods. The authors simulate "virtual world" with a "virtual population" and claim that the resulting distribution is close to a real banking private dataset, which they cannot distribute.
All datasets balanced for experiments. The features for the adversarial perturbations along with the corresponding cost model are described in Appendix A
5.2 Results
Cost-aware Adversarial Training. We follow standard evaluation procedure: first perform adversarial training of the TabNet models using different cost bounds s, representing different financial constraints for the adversary. Then, we evaluate these models' robustness using the attack by Kireev et al. (202)) configured for the same cost adversarial constraint as used during the training. The details about training hyperparameters are listed in the Appendix B
show the resulting clean and robust performance Figure I Our method outperforms baseline in both metrics. The better performance can be attributed to better representation of the threat model. For example, us consider the email address feature in IEEECIS. The cost to change this feature varies from 0. 12$ (c.g., hotmail.com) to (for emails that no longer available). It

---

Table 1: Universal robust embedding evaluation. We report clean and robust accuracy (in per- centage) for Light Gradient Boosting (LGBM), Random Forest (RF), Gradient Boosted Stumps (GBS), and CatBoost (CB). We indicate the robustness technique applied as suffix: -R for robust embeddings, -W for the training proposed by Wang et al. (2020), and -C for method in Chen et al. (2019). Models fed with robust embeddings have higher robustness and outperform both clean and
1 1-ttrineed models (Wang et al. 2020
Dataser
RF
RF-R
RF-C
LGBM
LGBM-R
GBS
GBS-R
GBS-W
CB
CB-R
IEEECIS
Clean
83.6
81.0
69.0
81.2
79.3
66.9
66.3
52.4
76.5
76.1
Robust
48.0
81.0
69.0
53.9
78.5
44.7
66.3
11.1
51.1
72.0
BAF
Clean
72.3
65.8
61.3
74.1
68.1 1
74.1
68.1
64.8
74.4
67.2
Robust
42.8
65.8
61.3
49.2
67.5
46.8
67.7
33.5
48.2
67.2
Credit
Clean
78.0
73.4
83.1
79.6
82.1
80.6
61.7
83.3
79.7
Robust 55.2
66.7
69.9
72.5
70.9
71.4
61.3
71.7
71.9
is unlikely that an adversary uses an expensive email (sometimes even impossible as in the case of unavailable domains), and therefore such domains are useful for classification as they indicate non-fraudulent transactions. On the other hand, an adversary can easily buy a gmail.com address even when their budget is few dollars. Our method captures this difference. We see how there is steep decrease in accuracy when the cost of the modification is low (under 18) and thus the training needs to account for likely adversarial actions. Then, enters plateau when the cost of emails increases and changes possible given the adversary's 's budget. When the budget grows enough to buy more expensive emails, the accuracy decreases again. We also observe that the gain in clean accuracy is higher than for robust accuracy. This effect is due to better representation of the underlying categorical data distribution.
Universal Robust Embeddings. In order to evaluate our Bilevel alternating minimization framework, we run Algorithm 2 on TabNet to produce robust embeddings, and we merge these embeddings using Algorithm 3 After that, we attack the model using budgets set to 10$ for IEEECIS, IS for BAF, and 100S for Credit. These budgets enable the adversary to perform most of the possible transformations. We compare our methods boosted decision-trees with the method of Wang et al. (2020) is computationally infcasible for an adequate number of estimators and high dimensional data.
mradeent-bossted stumps because training gradient
We show the results in Table In almost all setups, our method yields significant increase in robustness. For example, for IEEECIS we increase the robust accuracy of LGBM by 24%, obtaining model that combines both high clean and robust accuracy, and that outperforms TabNet. Our method outperforms Wang et al. (2020) both for clean and robust accuracy. These results confirm that training based on only I distance is not sufficient for tabular data
We also compare the performance of the dif- ferent methods with respect to the time spent on training and merging (see Table 2). We see that our method is considerably faster than previous work. The improvement is tremen- dous for IEEECIS and Credit where the dimensionality of the input is more than 200 and the number of estimators are 80 and 100 respectively. In the Appendix C we also dis- cuss how robust embeddings can be applied to neural network of the same type.
Dataset
Training RE
GBS-RE
GBS-W
IEEECIS BAF Credit
9.5
0.06
233.3
3.17
0.02
4.97
3.24
0.07
174.7
Table 2: Computation time. Time is measured in
minutes. The total time of training RE and training GBS-RE is less than Wang et al. (2020) 's training
6 Conclusion
In this work, we propose methods to improve the robustness models trained on categorical data both for deep networks and tree-based models. We construct a benchmark with datasets that enable

---

robustness evaluation considering the financial constraints of real-world adversary. Using this benchmark, we empirically show that our methods outperform previous work while providing significant gain in efficiency.
Limitations and Future Work. In our work, we focused on development of a method to improve the robustness of machine learning model, having as small degradation in performance possible. However, there are applications where even small accuracy drop would incur more financial losses than potential adversarial behaviour. These setups can be still not appropriate for our framework. Quantifying these trade-off can be a promising direction for future work, and one way of doing it would be to follow uuliity-based approach introduced in Kireev al. (2022). Besides that, we do cover the extreme cases where the dataset is either too small and causes overfitting too large and makes adversarial training more expensive. Addressing these extreme cases can be also considered as a research direction. Finally, we leave out of the scope potential problems in the estimation of adversarial capability, e.g., if the cost model which we assume wrong and how can affect both the robustness and utility of our system.
Acknowledgements
M.A. supported by the Google Fellowship and Open Phil Al Fellowship.
References
Altman, E. Synthesizing credit card transactions. In Proceedings of the Second ACM International Conference Al in Finance, pp. 1 1-9, 2021.
Andriushchenko, M. and Hein, M. Provably robust boosted decision stumps and trees against adversarial attacks. Advances in Neural Information Processing Systems, 32, 2019.
Apruzzese, G., Anderson, H. S., Dambra, S., Freeman, D., Pierazzi, F,, and Roundy, K. A. real attackers don't compute gradients"; Bridging the gap between adversarial ml research and practice. arXiv preprint arXiv:2212.14315. 2022.
Arik, S. Ó. and Pfister, T. Tabnet: Attentive interpretable tabular learning. arxiv. arXiv preprint vrXiv:2004.13911 2019,
Bakiskan, C., Cekic, M., and Madhow, U. Early layers are more important for adversarial robustness. In ICLR 2022 Workshop on New Frontiers in Adversarial Machine Learning, 2022.
Boyle, J. P. and Dykstra, R. L. A method for finding projections onto the intersection of convex sets in hilbert spaces. In Dykstra, R., Robertson, T., and Wright, F. T. Advances in Order Restricted Statistical Inference, pp. 28-47, New York, NY, 1986. Springer New York. ISBN 978-1-4613-9940-7..
Advances
Calzavara, S., Lucchese, C., Tolomei, G., Abebe, S. A., and Orlando, S. Treant: training evasion- aware decision trees. Data Mining and Knowledge Discovery, 34: 14:1300-44 2020.
Chen, H., Zhang, H., Boning, D., and Hsieh, C.-J. Robust decision trees against adversarial examples. In International Conference on Machine Learning, pp. 1122-1131, PMLR, 2019.
Chen, T. and Guestrin, C. Xgboost: A scalable tree boosting system. In Proceedings of the 22nd acm sigkdd international conference on knowledge discovery and data mining, pp. 785-794, 2016.
Chen, Y., Wang, S., Jiang, W., Cidon, A., and Jana, S. [Cost-Aware) robust tree ensembles for security applications. In 30th USENIX Security Symposium (USENIX Security 21), pp. 2291-2308, 2021.
Croce, F., Andriushchenko, M., Sehwag, V., Debenedetti, E., Flammarion, N., Chiang, M., Mittal, P., and Hein, M. Robustbench: standardized adversarial robustness benchmark, arXiv preprint arXiv:2010.09670, 2020.
10

---

Dong, X., Luu, A. T., R., and Liu, H. Towards robustness against natural language word substitutions. International Conference on Learning Representations, 2021. URL https //openreview. //openceeiee..et/fformm/
Ghadimi, S. and Wang. M. Approximation methods for bilevel programming. arXiv preprint arXiv: 02260222.6 2018.
Goodfellow, I. J., Shlens, and Szegedy, C. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.
Gorishniy, Y., Rubachev, I., Khrulkov, V., and Babenko, A. Revisiting deep learning models for tabular data. Advances in Neural Information Processing Systems, 34: 1932--1994,, 2021.
Grinsztajn, L., Oyallon, E., and Varoquaux, G. Why do tree-based models still outperform deep learning on tabular data? arXiv preprint arXiv:2207.0888 08881, 2022.
Grosse, K., Bieringer, L., Besold, T. R.,, Biggio, B., and Krombholz, K. Machine learning security in industry: A quantitative survey. IEEE Trans. Inf. Forensics Secur. 18:1749-1762 2023,
Jesus, S., Pombal, J., Alves, D., Cruz, A., Saleiro, P., Ribeiro, R. P., Gama, J., and Bizarro, P. Turning the Tables: Biased, Imbalanced, Dynamic Tabular Datasets for ML Evaluation. Advances Neural Information Processing Systems, 2022.
Kaggle. IEEE-CIS fraud detection, 2019.
URL
com/ c/
fredddrruudetttciioon
Kantchelian, A., Tygar, J. D., and Joseph, A. Evasion and hardening tree ensemble classifiers, In International conference on machine learning, pp. 2387-2396. PMLR, 2016.
Ke, G. Meng, Q., Finley, T., Wang. T., Chen, W., Ma, W. Ye. Q., and Liu, T.-Y. Lightgbm: A highly efficient gradient boosting decision tree. In Guyon, I., Luxburg. U. V., Bengio, S., Wallach, H., Fergus, R., Vishwanathan, S., and Garnett, R. (eds.). Advances in Neural Information Processing Systems, volume 30. Curran Associates, Inc., 2017a. URL /tL/attps//prroeednags http:/pproccdddnng.eeeeerepppppp neurips
pdf
Ke, G., Meng, Q., Finley. T., Wang. T., Chen, W., Ma, W., Ye. Q., and Liu, T.-Y. Lightghm: A highly efficient gradient boosting decision tree. Advances in neural information processing systems, 30, 2017b.
Kireev, K., Kulynych, B., and Troncoso, C. Adversarial robustness for tabular data through cost and utility awareness. arXiv preprint arXiv:2208. 13058, 2022.
Koh, P. W., Sagawa, S., Marklund, H., Xie, S. M., Zhang, M., Balsubramani, A., Hu, W., Yasunaga, M., Phillips, R. L.,, Beery, S., et al. Wilds: A benchmark of in-the-wild distribution shifts 2021. arXiv preprint arXhv:2012.074211 2020.
Langley, P. Crafting papers machine learning. In Langley, P. (ed.), Proceedings of the 17th International Conference on Machine Learning (ICMI. 2000), pp. 1207-1216, Stanford, CA,, 2000. Morgan Kaufmann.
Liaw, A. and Wiener, M. Classification and regression by randomforest. News, 2(3):18 2-22, 2002.
URL httthtt////RAA R- R-project org//ooo//ooo doc//nes//RRe/ /Rnews/
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018. 8.
URL https:://ppererr//// htt.:pppeweeeeeee.e..ecoooodataa www.:/oormmmdddriIllrr....
Shehab, M., Abualigah, I.., Shambour, Q. Abu-Hashemt M. A., Shambour, K. Y., Alsalibi, A. L., and Gandomi, A. H. Machine learning in medical applications: A review of state-of-the- art methods. Computers Biology and Medicine, 145:105458, 2022. ISSN 0010-4825. doi: 2022 105458. Betmme//aariiieee//////000000000
http:///wwwwscceneeeereee... com/
Shen, H., Chen, S., Wang, R., and Wang, Adversarial learning with cost-sensitive classes. IEEE Transactions Cybernetics, 2022.

---

Shi, S., Tse, R., Luo, W., D' Addona, S., and Pau, G. Machine learning- driven credit risk: systemic review. Neural Computing and Applications. 34, 07 2022. doi: 10.10777600221-00---777---
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. Intriguing properties of neural networks. arXiv preprint 1312.6199, 2013.
Wang, Y., Zhang, H., Chen, H., Boning, D., and Hsieh, C.-J. On Ip-norm robustness of ensemble decision stumps and trees. In International Conference on Machine Learning, pp. 10104-10114. PMLR, 2020.
Yang. Y. and Zhai, Click-through rate prediction in online advertising: A literature review. Information Processing & Management, 59(2): 2022. ISSN 0306-4573, doi: https://doi.org/ 20.10016f..pm.22011102222
URL https: //tp://wwwww.... www.:eecccnnccrrrttccoomm com wtt.s//cici//////ricccc...
p1//0306457321003241
Yang. Y., Wang, X., and He, K. Robust textual embedding against word-level adversarial attacks. arXiv preprint arXiv:2202. 138/7, 2022.
Zhang, D., Zhang, T., Lu, Y., Zhu, Z., and Dong, B. You only propagate once: Accelerating adversarial training via maximal principle. Advances in Neural Information Processing Systems, 32, 2019.
Zhang, X. and Evans, D. Cost-sensitive robustness against adversarial examples. ICLR, 2019.
Zhuang, F., Qi, Z., Duan, K., Xi, D., Zhu, Y., Zhu, H., Xiong, H., and He, Q. A comprehensive survey on transfer learning. arxiv e-prints. arXiv preprint
2019.
12

---

A Cost modelling and data preprocessing
For all datasets used in the evaluation, we perform threat modelling based on the information about possible perturbations. In this section, we describe how we assign cost matrices modifications of the features in each dataset and the common methods which we use for data preprocessing. Note that in this section for some features mostly provide the methods and examples, and all the exact values are listed in the source code texp/loaders.... prices might fluctuate, and our goal provide an estimate demonstrate the capabilities of our methods.
It is also worth mentioning that the exact
A.1 Data Preprocessing
All the datasets were balanced for training using random undersampling. Numerical features were binned in 10 bins since further increase the number of bins gave no additional improvement. In order to avoid numerical issues, we set the minimal possible cost to 0.1$, and the maximal possible cost to 10000$ (100 times greater than the largest e used the evaluation). For the attack, we assume that the adversary is attacking only for one target class (e.g. their aim is to get transaction marked as ..
A.2 IEEECIS
In evaluation on IEEECIS we use the following features for our perturbation set:
Peeaildoomin Email domain which can be used by an adversary. We assume that an adversary can either buy existing prices from dedicated online shops (c.g. adversary can buy *@ *@yahoo.com com email for 0.12$ at buyaccs. com). In the second case, estimate minimal expenditures register one. For example, some emails require buying services an internet provider ( (*@ earthlink in this case, estimate the minimal price of such service and count it as adversarial cost (508 for earthlink.net).
email or create it themself. In the first case we take the
DyveceType- Device type represents the operating system installed on the adversary's 's device. This feature can be easily manipulated since the adversary controls the device and can change device information sent to the system use an emulator. We ascribe minimal cost (0.1$) to this type of perturbation.
Card type Card type is a brand of a credit or debit card used by the adversary. For this feature, we assume that the adversary needs to buy stolen credit debit card. We estimate the cost of such purchase to be 20S for Visa or MasterCard and 25$ for less common Discovery or American Express. This estimation is based on stolen card prices in the darknet online marketplaces.
A.3 BAF
In the evaluation the BAF dataset we use the following features for perturbation set:
income Income of credit applicant. This feature can be perturbed by buying a fake paystub, which costs around 10S.
zip-count_4w Number of applicants with the same zip code. The adversary can change their address by paying just around 1$ (In US).
Device-related features Here we consider features which are related to the device/OS used by adversary, and which can be manipulated the same way as DeviceType in IEEECIS. foreign_reque request, source, keep_alive allieaavvveeeee session, device oos belongs to this feature type. The cost model for these features is the same for DeviceType.
email is free This feature represents if the adversary uses a paid email or a free one. Since going from paid to free is cheap, we represent this transition with the smallest price of 0. 0. For going from a free email to the paid one we use the cheapest paid email from IEEECIS, and set this cost to 10$.
13

---

phone home valid. phone mobile valid Validity of the provided phone number. The logic is the same as with the previous feature. It costs almost nothing (0.1$) change from valid to non-valid, and 10$ vice versa.
device distinct emaily 8w Number of distinct email addresses used by the adversary. This feature can only be increased since the adversary presumably cannot delete its records from the system. The cost for an increase is small (0. (0.1S), IS), decreasing is impossible.
A.4 Credit
Finally, for the Credit dataset use:
Merchant City Location where the purchase was made. Without any prior knowledge, we assume that this feature only be manipulated physically by moving different location. Therefore, in this case, the cost change is the cost of a transport ticket to this location. As the lower bound, Therefore, the total cost of changing this feature from city A to city B, we estimate as the distance from A to B, multiplied by 0.1$.
a transport price of 0.1$ per km of distance between two cities.
card_lype, card For these features we use the same cost model as for the Capd feature in IEEECIS dataset.
B Additional details on experiments
B.1 Experimental setup
the final experiments were done on AMD Ryzen 4750G CPU, Nvidia RTX 3070 GPU, and Ubuntu 22.04 OS.
B.2 Hyperparameters
We list our evaluation parameters in Table [] The TabNet parameters are denoted according to the original paper Arik & Pfister (201)). We set the virtual batch size to 512. Most of the hyperparameters were selected via a grid search.
During adversarial training with a large 6, we encountered catastrophic overfitting on IEEECIS and Credit. For example during adversarial training with 100 IEFECIS observe the overfitting pattern in test robust accuracy (Table In these situations, we reduced the number of epochs.
C Additional experiments
In this section, we show some additional experiments clarifying our design decisions and describing some properties of universal robust embeddings.
C.1 Comparison of first and last layer embeddings
As we mentioned in our paper, only sider the first-layer em- beddings of the neural network. The main justification for this de- sign choice is that for many tabular datasets, "classical" methods like
Model
Normal Training
FL Embeddings
LL Embeddings
LGBM
81.2
81.0
78.9
RF
83.6
83.0
78.8
Table 3: Standard accuracy for the first vs. last layer embeddings. The first layer embeddings (FL) consistently outperform the last layer embeddings (LL).
LGBM or Random Forest can outperform neural networks. good example of this case is the IEEECIS dataset. Both in the original Kaggle competition and in experiments, decision trees show better performance than neural networks. To demonstrate this effect we run simple experiment where we pass the last-layer embeddings to the LGBM and RF and compare the performance with
14

---

Table 1: Hyperparameters used in the evaluation
Parameter
Value range
All Datasets
0.9
Dykstra iterations
20
IEFECIS
Batch size
2048
Number of epocks
400
PGD iteration number
20
TabNet hyperparameters
ND 32, NA 32, Nateps Nsteps =4
$
0.1, 0.5, 3.0,0.,,, 10.0, 30.0, 50.0, 100.0]
BAF
Batch size
1024
Number of epochs
30
PGD iteration number
20
TabNet hyperparameters
ND NA = Nstes
0.1, 0.5, 3.0, 10.0, 30.0]
Credit
Batch size
2048
Number of epochs
100
PGD iteration number
20
TabNet hyperparaameerss
Nn 64, Na = 64, N Nsteps
e, x1O$
[1.0, 10.0, 30.0, 100.0, 300.0]
Table 2: Overfitting behaviour
Epoch
1
10
15
20
30
Test Robust Accuracy
51.5
52.4
55.0
61.2
53.4
52.1
normal LGBM/RF training. We report the results in Table The results are rather expected: due to the data processing inequality, we can expect information loss if the data processed inferior classifier for this task (i.c., neural network). Therefore, we can conclude that first-layer embeddings better choice if want preserve the standard accuracy of the decision-tre tree based classifier.
C.2 Influence of the embedding merging algorithm
Another topic which we want to cover in this section is the effect the embedding merging algorithm. In this subsection, we would like to answer two questions:
1. Do we need the merging algorithm?
2. If yes, does it work without properly trained embeddings?
We can answer both questions using Table 4 We evaluate robust embeddings both with normal adversarial training and bilevel optimization for different values of the parameter т. For comparison, we also apply the merging algorithm randomly generated embedding, in order perform the ablation study for the effect of merging. We see that even merging with small significantly improves robustness, keeping the clean accuracy on high level for robust embeddings, while for random embeddings it has no effect. Also, we see that, although normal adversarial training has some effect on robust accuracy after embedding transfer, the bilevel optimization algorithm provides the models with much better robustness accuracy trade-off.
15

---

Table Evaluation the embedding merging algorithm. We report clean and robust accuracy of boosted decision stump classifier on BAF dataset (in percentage) with both random and robust embeddings. For the robust embeddings we evaluate both normal adversarial training, and the bilevel minimization algorithm. 0.0 means that no merging is performed.
Method
0.0
0.02
0.05
0.1
0.15
0.2
Robust Emb. (Bilevel), Clean
74.9
74.5
74.1
71.9
71.6
68.1
Robust Emb. (Bilevel), Robust
48.3
48.3
51.9
61.4
70.9
67.7
Robust Emb. (Normal AT), Clean
74.3
73.5
72.4
71.8
70.8
70.8
Robust Emb. (Normal AT), Robust
48.3
51.5
51.0
55.1
53.3
53.4
Random Embeddings, Clean
74.5
71.9
71.7
71.7
71.7
68.8
Random Embeddings, Robust
49.1
44.8
44.7
44.7
44.7
47.3
C.3 Experiments FT transformer
In order to show that our approach not tied to one particular neural network architecture, we performed the same experiments with the more recent FT-Transformer model (Gorishniy et al. 2021). We applied robust embeddings generated for FT-Transformer to the models used in Section 5 The results shown in Table Overall, robust performance, and therefore we conclude that our method is also suitable for this type neural networks.
that FT- FT-Tranfformer embeddings give better clean and
Table 5: Robust embeddings for FT-Transformer. We evaluate robust embeddings generated with FT-Transformer (RE-FT) (Gorishniy al. 202T). the same scenario as for the Table !
Model
No Emb.
RE
RE-FT
RF, Clean
72.3
65.8
67.5
RF, Robust
42.8
65.8
67.1
GBS, Clean
74.1
68.1
71.5
GBS, Robust
46.8
67.7
71.5
LGBM, Clean
74.1
68.1
71.4
LGBM, Robust
49.2
67.5
71.4
CB, Clean
74.4
67.2
70.8
CB, Robust
48.2
67.2
70.8
C.4 Effeet of embedding transfer for neural networks
In this section, we cover the effect of robust embeddings on the original neural network trained over the clean data. To measure this effect we apply robust embeddings to TabNet model trained on clean data. The results are reported in Table 6 It shows that the target neural network definitely benefits from this procedure, though the resulting models still have less robustness than models trained with optimal defence since Cat-PGD is available for
CatPGD We do not propose this technique neural networks, however, it can provide some robustness if adversarial training is not available for some reason (for example due to computational recourses limitation).
16

---

Table 6: Embedding Transfer. We evaluate TabNet models trained on clean data with robust embeddings applied to them, in the same setting do for the Table We compare its performance with clean models (NN) and models trained with CatPGD (NN-CatPGD).
Model
NN
NN-RE
NN-CatPGD
IEEECIS, Clean
79.0
69.0
74.9
IEEECIS, Robust
40.1
61.9
72.6
BAF, Clean
75.5
69.9
70.9
BAF, Robust
48.3
67.9
70.4
Credit, Clean
83.1
82.1
72.8
Credit, Robust
70.6
71.5
72.6
17


Reviews:
[{"review_id": "wh8Gb1FMfm", "reviewer": "Reviewer_saBk", "summary": "The authors propose an adversarial training algorithm for tabular data with categorical features which can produce robust embeddings for use with downstream non-differentiable models like decision trees.  The authors evaluate on three datasets and with several downstream models on the robust embeddings.", "questions": "N/A", "limitations": "The authors did not discuss limitations in the main body as far as I can tell.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "Adversarial training has generated massive numbers of papers but these overwhelmingly focus on image data, yet tabular data is more popular than image data in high-stakes industrial use-cases of ML.  Therefore, the potential for impact is high (at least insofar as adversarial robustness is impactful).  I also appreciate the attempt to enhance robustness for decision tree models too since they are still more popular than neural networks in industrial tabular ML.\n\nThe writing is also generally easy to understand.", "weaknesses": "My main concerns regard the thoroughness of experiments.\n\nGradient boosted decision tree methods like XGBoost and CatBoost often achieve superior performance compared to neural networks on many datasets which is one of the reasons they are still very popular.  Do they maintain their advantage over neural networks after adversarial training (both in terms of robustness and clean accuracy)?  If not, then there might not be a use-case for the robust embeddings.\n\nAlong the same lines, it would be good to use modern neural network architectures like FT Transformer or SAINT and also better non-neural models like XGBoost and CatBoost.\n\nA major problem for adversarial defenses is gradient masking, or defense that might be hard to attack using certain attack algorithms but are not fundamentally robust.  The categorical variable setting in particular is especially difficult to attack, so it seems hard to know whether or not a model is truly robust.  You might consider trying other attacks as well to verify that the models are truly robust.  For example, you could try prompt tuning optimization strategies like PEZ (from “Hard Prompts Made Easy: Gradient-Based Discrete Optimization for Prompt Tuning and Discovery”).\n\nAdversarial training is known to overfit, especially on small datasets.  It might be worth trying out the proposed algorithms on smaller datasets too.\n\nCredit card fraud detection, in practice, is an area where every tiny tiny amount of accuracy is profitable.  Given the performance degradations involved here over non-robust models, it might be worthwhile to find application areas which are not so sensitive to clean accuracy as a motivating demonstration.\n\nMinor: The conclusion is just a re-statement of the abstract.  Would be useful to put directions for future work.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank you for the detailed response. We discuss the raised concerns below.\n> *Gradient boosted decision tree methods like XGBoost and CatBoost often achieve superior performance compared to neural networks ... Do they maintain their advantage over neural networks after adversarial training (both in terms of robustness and clean accuracy)?*\n\nWe agree that it is an important question. In the current literature, there is no clear consensus about which method is always superior: neural networks or gradient-boosted trees. Our results demonstrate a similar trend. Figure 1 and Table 1 show that for Credit and BAF datasets NN and LGBM performance is close, while for IEEECIS, TabNet has clearly superior performance even after robust embedding transfer. Therefore the answer is yes, tree-based classifiers can maintain the advantage and are a suitable use case for our robust embeddings.\n\n> *Along the same lines, it would be good to use modern neural network architectures like FT Transformer or SAINT and also better non-neural models like XGBoost and CatBoost.*\n\nWe agree that the validation on a different neural network can benefit our ablation study. We incorporated the FT transformer into our pipeline to check if there is a significant difference. However, we did not manage to get better clean performance with the FT transformer on IEEECIS and Credit. Nonetheless, we did manage to get 0.5% clean improvement on BAF, and due to time constraints, we focused on this dataset. We performed the same experiments with robust embeddings and we report them in the table below. It shows that embeddings trained with FT transformers demonstrate better performance compared with TabNet embeddings. Possibly it is better due to improved clean performance. We will include these results in the revised version of the paper.\n| _Model_  | No Emb. | RE | RE-FT |\n|--------|:------:|:------:|:-------:|\n| RF, _Clean_  | 72.3 | 65.8 | 67.5 |\n| RF, _Robust_ | 42.8 | 65.8 | 67.1 |\n| GBS, _Clean_ | 74.1 | 68.1 | 71.5 |\n| GBS, _Robust_ | 46.8 | 67.7 | 71.5 |\n| LGBM, _Clean_  | 74.1 | 68.1 | 71.4 |\n| LGBM, _Robust_ | 49.2 | 67.5 | 71.4 |\n| CatBoost, _Clean_  | 74.4 | 67.2 | 70.8 |\n| CatBoost, _Robust_ | 48.2 | 67.2 | 70.8 |\n\nIn the paper, we performed experiments with LightGBM, a recent alternative (2017) which performs similarly or slightly better than XGBoost (2014). We thank you for pointing out CatBoost, as it is more recent than the gradient-boosted stumps (GBS) approach we evaluated. We performed the evaluation for this model (see table below, where the robust version is marked as -RE). The results are similar to other models, though it clearly performs better than basic GBS. We will include these results in the revised version of the paper.\n| _Dataset_   | CatBoost | CatBoost-RE |\n|--------|:------:|:------:|\n| IEEECIS _Clean_ | 76.5 | 76.1 |\n| IEEECIS _Robust_ | 51.1 | 72.0 |\n| BAF _Clean_ | 74.4 | 67.2 |\n| BAF _Robust_ | 48.2 | 67.2 |\n| Credit _Clean_ | 83.3 | 79.7 |\n| Credit _Robust_  | 71.7 | 71.9 |\n\n\n\n> *A major problem for adversarial defenses is gradient masking, or defense that might be hard to attack using certain attack algorithms but are not fundamentally robust. …You might consider trying other attacks as well to verify that the models are truly robust.*\n\nFirst, we would like to note that the attack we use in our evaluation is not gradient-based. This rules out the possibility of gradient masking as defined in the original paper [Practical Black-Box Attacks against Machine Learning](https://arxiv.org/abs/1602.02697). \n\nInstead, our attack attempts to solve the discrete optimization problem directly using a graph search method. Of course, it is always possible that our attack is suboptimal since the underlying problem is NP-hard. In order to ensure that we are not underestimating the adversary, we compare it to the performance of Uniform Cost Search (UCS). UCS does not rely on any heuristic. It performs an exhaustive search and always finds an optimal solution within its cost budget. Since UCS is very time-consuming, we could only run it on IEEECIS models. For all cases, we find that the difference in attack success between our attack and UCS is less than 1%. These results are in line with the findings of Kireev et al. (2022) (see Figure 1 in their paper). Since UCS is theoretically optimal, we conclude that there is not much room for improvement beyond the results of our graph search attack algorithm and thus our results do not underestimate the adversary’s power and can be taken as a reliable measurement of the robustness of the models.\n\n> *Adversarial training is known to overfit, especially on small datasets. It might be worth trying out the proposed algorithms on smaller datasets too.*\n\nWe thank the reviewer for the comment. In our evaluation, we used the datasets on different scales (100K - 1M), and to avoid overfitting we grid-searched the capacity parameters of the Neural Network for each dataset. In the revised version of the paper, we will include the experiments on reduced versions of the dataset, and if our method is less effective there, we will include a discussion on this to the limitations section.\n\n> *Given the performance degradations involved here over non-robust models, it might be worthwhile to find application areas which are not so sensitive to clean accuracy as a motivating demonstration.*\n\nWe agree that the decrease in clean accuracy is a concern. However, it is also up to the model owner to decide which model to deploy to maximize profits while reducing potential losses from fraudulent transactions. This is precisely the goal of Figure 1: to provide information about the trade-offs with respect to different cost bounds. \n\nWe would also like to note that fraud detection is of particular interest in the adversarial context precisely because they are linked to financial gains, both on the side of the model owner *and* adversary. This is why we selected them for our evaluation."}, {"review_id": "GWoH6NAa62", "reviewer": "Reviewer_a4Uk", "summary": "This study presents novel approaches aimed at enhancing the robustness of models trained on categorical data on the deep networks and tree-based models. It addresses the challenges posed by real-world adversaries within the constraints of financial resources. Through extensive empirical analysis, they demonstrate that our proposed methods not only surpass prior research but also offer a substantial improvement in efficiency.", "questions": "1. The assumption in line 138 is that the cost of modifying features is additive.  \n    If the two features have the inverse function for the final decision, is it reasonable to use this assumption?\n     \n2.  What parameters will affect the cost bound for different datasets? \n\n3. Table 3 should be Table 2? ", "limitations": "The paper didn't discuss the limitations of their work.", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "The paper is good-written and easy to follow.\nThe proposed method of universal robust embeddings is used for transferring robustness from neural networks to other types of machine learning models and obtains better robustness for tabular tasks in which the adversary is constrained by financial capabilities.\n\n\n", "weaknesses": "The proposed method is only applied to the financial dataset based on the meaningful cost of modifying features.\nThere are some confusion on the definition of this cost. Please refer to the questions.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank you for the positive feedback.\n\n> *1. The assumption in line 138 is that the cost of modifying features is additive. If the two features have the inverse function for the final decision, is it reasonable to use this assumption?*\n\nYes, we are confident that it is a reasonable assumption since it is the most natural one. E.g., on the IEEECIS dataset, the attacker can change the following features: *email domain*, *device type*, and *card type*. Changing a feature incurs a certain cost for the adversary (for example buying an email address) and if the attacker wants to change multiple of them, the costs will add up. Moreover, even if the two features have the inverse function on the final decision, the adversary can change them to the “opposite” directions (to cause a misclassification) or choose not to change some of them at all if it is not profitable according to the total cost.\n\n\n> *2. What parameters will affect the cost bound for different datasets?*\n\nThe cost bound depends on the financial capabilities of the attacker, i.e., on the amount that they are willing to spend to generate an adversarial example. It is completely up to the model owner to decide which cost bound is appropriate to represent a potential adversary. In all cases, we note that our method improves upon all cost bounds simultaneously compared to existing methods (see Figure 1).\n\n\n> *3. Table 3 should be Table 2?*\n\nThanks for spotting this!  We will fix this in the revised version of the paper.\n"}, {"review_id": "UgvgDYrLg1", "reviewer": "Reviewer_9uXH", "summary": "This paper presents a method to train adversarially robust deep networks for tabular data and to transfer this robustness to other classifiers via universal robust embeddings tailored to categorical data. These embeddings created using a bilevel alternating minimization framework can be transferred to boosted trees or random forests making them robust without the need for adversarial training while preserving their high accuracy on tabular data. This paper shows that the proposed methods outperform existing techniques within a practical threat model suitable for tabular data.", "questions": "This paper selects three publicly-available datasets that fit the criteria and all datasets were balanced for the provided experiments. Yet, the datasets for the tabular data to evaluate the adversarial robustness are not that common compared with the dataset of image and text. It could be more persuasive if the authors provide further clarifications for the standards and details to process the tabular data. ", "limitations": "This paper presents a method to train adversarially robust deep networks for tabular data and construct a benchmark with datasets. Nevertheless, it could be more sufficient with improvements. The detailed comments can be seen in the weaknesses.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This paper proposes a practical adversarial training algorithm supporting complex and heterogeneous constraints for categorical data that can accurately reﬂect financial costs for the adversary. The proposed training algorithm is based on the continuous relaxation of a discrete optimization problem and employs approaches from projections onto an intersection of convex sets.\n2. This paper proposes a method to generate universal robust embeddings, which can be used for transferring robustness from neural networks to other types of machine learning models such as decision trees or random forests. This paper uses existing datasets to build the first benchmark to evaluate robustness for tabular tasks in which the adversary is constrained by financial capabilities.\n", "weaknesses": "1. There is currently no existing algorithm in the literature to operate within this cost-based objective for decision-tree based classifiers. Yet, it would be easier to understand the proposed approach if this paper could provide more explanations about the difference of using gradient-based adversarial training on the tabular data rather than the image or text data. \n2. During adversarial training with a large budget, this paper encountered the catastrophic overftting on IEEECIS and Credit. The authors reduced the number of epochs in these situations. It would be more convincing if the authors could present the empirical evidences and the related analysis of the catastrophic overftting in this paper for the tabular data. \n3. This paper claims that most of the hyperparameters used in the evaluation were selected via a grid search. Yet, it could be more sufficient if this paper could provide the performance of the proposed approach with different hyperparameters to further analyze the threat modeling for tabular data.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the positive assessment of our work.\n\n> *Yet, it would be easier to understand the proposed approach if this paper could provide more explanations about the difference of using gradient-based adversarial training on the tabular data rather than the image or text data.*\n\nThere are two main differences:\n(a) the perturbation set is inherently discrete for categorical data (contrary, e.g., to perturbations for images which are typically modeled as continuous perturbation sets) and \n(b) categorical data changes have an associated (financial) cost as opposed to modifying images where it is hard to quantify a cost model for pixel changes. Existing methods do not support cost-based constraints. \n\nThus, new methods tailored to tabular data and the tabular adversary constraints are needed (such as our Cat-PGD described in Section 4.1). Our paper also points out that the tabular scenario requires careful design of the optimization problem to enable efficient computations. For example, our method relies on a tight relaxation of the problem to the continuous domain; and uses non-differentiable tree-based models which are not widely used for text data and require new techniques to handle. \nWe will make these points clearer in the revised version of the paper. \n\n> *During adversarial training with a large budget, this paper encountered the catastrophic overftting on IEEECIS and Credit. The authors reduced the number of epochs in these situations. It would be more convincing if the authors could present the empirical evidences and the related analysis of the catastrophic overftting in this paper for the tabular data.*\n\nWe agree this is an important practical issue, and apologize for not having included initially the empirical evidence we gathered during our experiments. We will add such analysis in the revised version of the paper. \n\nShortly, in our experiments we noticed that, when trained with large budgets, neural networks overfit: the robust accuracy measured using the discrete graph-search-based attack started to drop after a certain epoch. For example for $\\varepsilon=100$ on IEEECIS trained with 10 PGD iterations, we observed the following process:\n\n| Epoch                | 1    | 5    | 10   | 15   | 20   | 30   |\n|----------------------|------|------|------|------|------|------|\n| Test Robust Accuracy | 51.5 | 52.4 | 55.0 | 61.2 | 53.4 | 52.1 |\n\nAfter 20 epochs, the test robust accuracy suddenly gets degraded (as in catastrophic overfitting), and drops to the level of a clean model (i.e., close to $50\\\\%$).\n\n\nTo address the issue, we applied measures proposed in the catastrophic overfitting literature, e.g.,  increasing the number of PGD iterations or initializating with Gaussian noise. These measures  drastically improved the situation, eliminating the sudden drop. Yet, they did not completely eliminate the issue.  After 150 epochs, we still see a slight robust accuracy drop (only 2%). \n> *This paper claims that most of the hyperparameters used in the evaluation were selected via a grid search. Yet, it could be more sufficient if this paper could provide the performance of the proposed approach with different hyperparameters to further analyze the threat modeling for tabular data.*\n\nWhile we selected most hyperparameters via a grid search, we analyzed in detail the only  hyperparameter that is related to the threat modeling: the cost bound of the adversary $\\varepsilon$. For example, we trained multiple models with different $\\varepsilon$’s in Figure 1 to analyze the effect of the adversary’s budget on the tradeoff between robustness and accuracy. We are happy to include additional results along these lines if you have some particular suggestions.\n\n> *It could be more persuasive if the authors provide further clarifications for the standards and details to process the tabular data.*\n\nWe provide these details in Appendix: **A.1 Data Preprocessing** contains details regarding general data preprocessing, and **A.2 IEEECIS**, **A.3 BAF**, **A.4 Credit** contain details regarding the costs associated with each categorical feature. We will include an explicit reference to this part of the appendix in the revised version of the paper. Also, we are open to add more details if something is still missing in our description of the data or preprocessing pipeline.\n"}, {"review_id": "9GOEzY3a8M", "reviewer": "Reviewer_9Bah", "summary": "This paper investigates adversarial robustness of tabular data. By transferring embeddings achieved by bilevel alternating minimization framework, tree-based models can then learn robustness without the need of adversarial training.", "questions": "The paper focuses on tabular data. However, the proposed approach seems to fit the mixture of any categorical and numerical data. A discussion regarding the limitations/scope of the approach would be beneficial.", "limitations": "No negative societal concern", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The proposed approach is novel and seems to be general for wide application with categorical features.\n\nThe robustness is considered under the financial constraints which is very practical.\n\nEmpirical results validate the good performance of the proposed approach.\n\nThe ablation study in the appendix is interesting and insightful.", "weaknesses": "In line 172 “There is currently no existing algorithm in the literature that enables us to operate within this cost-based objective for decision-tree based classifiers.” The claim seems not precise. Chen et al. (2021) has defined a similar cost-aware threat model, gained robustness for tree models, and can support categorical data. So it should serve as a descent baseline for the proposed approach. First, comparing to Chen et al. (2021), the paper should elaborate more details regarding the threat model and training approach differences in related work. Current sentences in related work are unclear for differences. Empirical comparisons for both robustness and efficiency should be provided to make the difference more clear. I am happy to raise the score if this concern is addressed.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank you for pointing out the novelty and practicality of our approach. We omitted the comparison with Chen et al. (2021) in our work, since we consider its threat model to be sufficiently different. The two key differences are:\n\n1. Chen et al. operate within per-feature constraints, while we argue that a realistic adversary is bounded by a total per-sample budget. At a high level, the difference here is similar to the difference between $\\ell_1$ and $\\ell_\\infty$ sets. Let us consider an ML problem with 100-dimensional feature input (for example multiple categorical variables) where some of the features can be changed for \\\\$100 and some for \\\\$10. Assume an adversary willing to spend \\\\$150. If we use Chen et al’s per-feature constraint we need to either prohibit all feature changes (since an adversary can change any of them) and lose all utility; or permit all of them,losing all robustness. This situation arises because in Chen et al. model there is no difference between modifying 1 or 100 features. If we take a per-sample budget as in our approach, the adversary would not be able to modify more than 15 features (\\\\$15*10) or even less if the total number of categorical features is less than 15.\n\n2. The constraints of Chen et al. are assumed to be symmetrical and uniform for categorical features (supporting other models would require significant modifications of their algorithm) without preserving the feature space. In its current form, Chen et al.’s algorithm does not work with categorical features (and in their evaluation, they use datasets with numerical features). In theory, we could apply it to categorical features if we first encoded them and then set per-feature constraints. However, such encoding would need to account for the cost model. Example: the adversary is capped at \\\\$200 and the categorical feature has four values: New York, Boston, Chicago, Istanbul. Assume that if the starting value is Istanbul, all changes should be prohibited (flights to the US cost more than \\\\$200). If it is New York, only Istanbul should be prohibited. In Chen et al. this could not be supported without significant modifications to the algorithm, thus the feature constraint must be the same for all samples.\n\nDue to these reasons, we chose Wang et al. (2020) as a baseline since their proposed $\\ell_1$ constraint model is closer to our setting. \nHowever, for the sake of completeness, we have performed an empirical comparison to the method of Chen et al. during the rebuttal time. To this end, we have done a best-effort adaptation of Chen et al’s code to address the issues above, and we compared it with our method on random forest (since this classifier was used in both our and their evaluation):\n\n | Dataset   | Ours | Chen et al. |\n|---------------|------|---------|\n| IEEECIS, _Clean_ | 81.0 | 69.0 | \n| IEEECIS, _Robust_ | 81.0 | 69.0 |\n| BAF, _Clean_ | 65.8 |  61.3 |\n| BAF, _Robust_ | 65.8 |  61.3 |\n\nWe could not compare to the $\\texttt{Credit}$ dataset as Chen et al’s published code does not work well with the high-dimensional input of this dataset and thus its execution could not finish until the rebuttal deadline. \n\nAs both our and Chen et al. pipelines produce the same model if no robust training is applied, we conclude that we did our best for the comparison, and our approach significantly outperforms Chen et al.’s  within our financial threat model. \n\n> *The paper focuses on tabular data. However, the proposed approach seems to fit the mixture of any categorical and numerical data. A discussion regarding the limitations/scope of the approach would be beneficial.*\n\nWe thank you for this suggestion. Unfortunately, there is no clear definition in the literature of what tabular data comprises. In our paper, we take the definition of *“a mixture of categorical and numerical data”*. We can highlight this better to ensure that the scope of our methods is well-defined.\n"}, {"review_id": "vtNdaMdxHO", "reviewer": "Reviewer_EHdN", "summary": "This paper proposes to use the input embeddings from neural networks as universal robust embeddings. They can be used to enhance the robustness of robustness of machine learning models.", "questions": "- Universal Robust Embeddings come from adversarial neural network models while they are not tested on them. Do Universal Robust Embeddings keep useful in neural network models?\n- How does the embedding for each cluster generated in Algorithm 3?\n \n", "limitations": "No.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "This paper is well written and well formulated.", "weaknesses": "- It is better to add more theoretical analysis about why embeddings from neural networks still work on other machine learning models.\n- Minor writing issues:\n    - \"Robustness for models other than neural networks\" should be \"Robustness for models other than neural networks. \" in Line 49\n    -  \"asdecision trees\", in Line 64\n    -  ”virtual world” with a ”virtual population”, in Line 277\n   ", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank you for your comments.\n\n> *It is better to add more theoretical analysis about why embeddings from neural networks still work on other machine learning models.*\n\nWe agree with this suggestion. We mentioned the potential reasons behind this in Lines 197-200: *“By using first layer embeddings, we avoid a potential loss of information (unless the embedding matrix Q has exactly identical rows which are unlikely in practice) that would occur if we were to use embeddings from the final layer.”* We can formalize this statement as a proposition and include a proof in the appendix. At a high level, if the embedding matrix does not contain completely identical embeddings before merging, any potential split that existed before the embedding process is preserved if the threshold is sufficiently low.\n\n> Minor writing issues:\n>- \"Robustness for models other than neural networks\" should be \"Robustness for models other than neural networks. \" in Line 49\n>- \"asdecision trees\", in Line 64\n>- ”virtual world” with a ”virtual population”, in Line 277\n\nWe thank you for carefully reading our paper. We will definitely fix these typos in the revised version of the paper.\n\n> *Universal Robust Embeddings come from adversarial neural network models while they are not tested on them. Do Universal Robust Embeddings keep useful in neural network models?*\n\nUniversal robust embeddings should also lead to substantial robustness in neural networks. However, since one can directly train robust neural networks *end-to-end* using Cat-PGD (described in Algorithm 1), we did not include such results in the paper. To answer your question we performed an experiment using robust embedding for a clean neural network similar to the experiments in Table 1. The results are the following:\n\n| _Dataset_        | NN | NN-RE |  NN-CatPGD |\n|------------------|:----------:|:-------------:| :----------------:|\n| IEEECIS _Clean_  | 79.0     | 69.0        | 74.9 |\n| IEEECIS _Robust_ | 40.1     | 61.9        |  72.6 |\n| BAF _Clean_      | 75.5     | 69.9        | 70.9  |\n| BAF _Robust_     | 48.3    | 67.9        | 70.4 |\n| Credit _Clean_   | 83.1     | 82.1        | 72.8  |\n| Credit _Robust_  | 70.6     | 71.5        | 72.6 |\n\n\nThese results show that the target neural network definitely benefits from this procedure, though the resulting models still have less robustness than models trained with CatPGD (Figure 1). We will include this experiment in the revised version of the paper to support the idea of *universality* of our robust embeddings.\n\n> *How does the embedding for each cluster generated in Algorithm 3?*\n\nAt the end of the algorithm, we assign the **center** of each cluster as a separate embedding (we compute the center as the standard mean of all vectors belonging to a cluster). We will clarify this step in Algorithm 3."}]

Author rebuttal:
We thank the reviewers for the feedback. We are glad that our work received positive comments such as: 
- *“the potential for impact is high (at least insofar as adversarial robustness is impactful)”* (**Reviewer saBk**).
- *“The paper is good-written and easy to follow”* (**Reviewer a4Uk**)
- *”This paper proposes a practical adversarial training algorithm supporting complex and heterogeneous constraints for categorical data that can accurately reﬂect financial costs for the adversary.”* (**Reviewer 9uXH**)
- *“The proposed approach is novel and seems to be general for wide application with categorical features.”* (**Reviewer 9Bah**)
- *”This paper is well written and well formulated”* (**Reviewer EHdN**)

Following the suggestions by the reviewers, we have improved our empirical evaluation by adding extra experiments: 
-  Comparison to the method of Chen et al. (2021)
-  CatBoost evaluation
-  Experiments on FT Transformer
-  Comparison of our attack with an exhaustive graph search
-  Catastrophic overfitting clarification
-  Experiments on transferring embeddings to a neural network model

We will carefully take into account all writing suggestions including:
- **Reviewer saBk**: add future directions to the conclusions.
- **Reviewer saBk** and **Reviewer a4Uk**: add a limitation section.
- Fix the typos pointed out by the reviewers.

We thank the reviewers again, and we are happy to engage in a follow-up discussion.

Meta-review: This paper makes an important investigation into training adversarially robust models for tabular data. The paper also considers both neural models and decision trees in this setting. The reviewers are all positive about this work - the problem setting is important and less well-studied, the experimental investigation seems sound (all the concerns raised were sufficiently addressed). It would be great if the authors could add the additional experiments that came up in the reviews to the next version of this paper. Congratulations on the nice work!
Decision: Accept (poster)