Title: Constrained Adaptive Attack: Effective Adversarial Attack Against Deep Neural Networks for Tabular Data
Venue: NeurIPS 2024
Accepted: yes
Keywords: machine learning

security

adversarial attacks

tabular data

threat models

constrained machine learning
Abstract: State-of-the-art deep learning models for tabular data have recently achieved acceptable performance to be deployed in industrial settings. However, the robustness of these models remains scarcely explored. Contrary to computer vision, there are no effective attacks to properly evaluate the adversarial robustness of deep tabular models due to intrinsic properties of tabular data, such as categorical features, immutability, and feature relationship constraints. To fill this gap, we first propose CAPGD, a gradient attack that overcomes the failures of existing gradient attacks with adaptive mechanisms. This new attack does not require parameter tuning and further degrades the accuracy, up to 81\% points compared to the previous gradient attacks. Second, we design CAA, an efficient evasion attack that combines our CAPGD attack and MOEVA, the best search-based attack.  We demonstrate the effectiveness of our attacks on five architectures and four critical use cases. Our empirical study demonstrates that CAA outperforms all existing attacks in 17 over the 20 settings, and leads to a drop in the accuracy by up to 96.1\% points and 21.9\% points compared to CAPGD and MOEVA respectively while being up to five times faster than MOEVA. Given the effectiveness and efficiency of our new attacks, we argue that they should become the minimal test for any new defense or robust architectures in tabular machine learning.

Constrained Adaptive Attack: Effective Adversarial Attack Against Deep Neural Networks for Tabular Data

Abstract

State-of-the-art deep learning models for tabular data have recently achieved acceptable performance to be deployed in industrial settings. However, the robustness of these models remains scarcely explored. Contrary to computer vision, there are no effective attacks to properly evaluate the adversarial robustness of deep tabular models due to intrinsic properties of tabular data, such as categorical features, immutability, and feature relationship constraints. To fill this gap, we first propose CAPGD, a gradient attack that overcomes the failures of existing gradient attacks with adaptive mechanisms. This new attack does not require parameter tuning and further degrades the accuracy, up to 81% points compared to the previous gradient attacks. Second, we design CAA, an efficient evasion attack that combines our CAPGD attack and MOEVA, the best search-based attack. We demonstrate the effectiveness of our attacks on five architectures and four critical use cases. Our empirical study demonstrates that CAA outperforms all existing attacks in 17 over the 20 settings, and leads to a drop in the accuracy by up to 96.1% points and 21.9% points compared to CAPGD and MOEVA respectively while being up to five times faster than MOEVA. Given the effectiveness and efficiency of our new attacks, we argue that they should become the minimal test for any new defense or robust architectures in tabular machine learning.

1 Introduction

Evasion attack is the process of slightly altering an original input into an adversarial example designed to force a machine learning (ML) model to output a wrong decision. Robustness to adversarial examples is a problem of growing concern among the secure ML community, with over 10,000 publications on the subject since 2014 [7]. Recent studies also report real-world occurrences of evasion attacks, which demonstrate the importance of studying and defending against this phenomenon [20].

While research has studied the robustness of deep learning models in Computer Vision (CV) and Natural Language Processing (NLP) tasks, many real-world applications instead deal with tabular data, including in critical fields like finance, energy, and healthcare. If classical 'shallow' models (e.g. random forests) have been the go-to solution to learn from tabular data [21], deep learning models are becoming competitive [5]. This raises anew the need to study the robustness of these models.

However, robustness assessment for tabular deep learning models brings a number of new challenges that previous solutions - because they were originally designed for CV or NLP tasks - do not consider. One such challenge is the fact that tabular data exhibit feature constraints , i.e. complex relationships and constraints across features. The satisfaction of these feature constraints can be a

non-convex or even non-differentiable problem; this implies that established evasion attack algorithms relying on gradient computation do not create valid adversarial examples (i.e., constraint satisfying) [18]. Meanwhile, attacks designed for tabular data also ignore feature type constraints [3] or, in the best case, consider categorical features without feature relationships [40, 41, 4] and are evaluated on datasets that exclusively contain such features. This restricts their application to other domains that present heterogeneous feature types.

The only published evasion attacks that support feature constraints are Constrained Projected Gradient Descent (CPGD) and Multi-Objective Evolutionary Adversarial Attack (MOEVA) [35]. CPGD is an extension of the classical gradient-based PGD attack with a new loss function that encodes how far the generated examples are from satisfying the constraints. Although theoretically elegant and practically efficient, this attack suffers from a low success rate due to its difficulty to converge toward both model classification and constraint satisfaction [35]. Conversely, MOEVA is based on genetic algorithms. It offers an outstanding success rate compared to CPGD and works on shallow and deep learning models. However, it is computationally expensive and requires numerous hyper-parameters to be tuned (population size, mutation rate, generations, etc.). This prevents this attack from scaling to larger models and datasets.

Overall, research on adversarial robustness for tabular machine learning in general (and tabular deep learning in particular) is still in its infancy. This is in stark contrast to the abundant literature on adversarial robustness in CV [28] and NLP tasks [15]. Given this limited state of knowledge, the objective of this paper is to propose novel and effective attack methods for tabular models subject to feature constraints.

We hypothesize that gradient-based algorithms have not been explored adequately in [35] and that the introduction of dedicated adaptive mechanisms can outperform CPGD. To verify this, we design a new adaptive attack, named Constrained Adaptive PGD (CAPGD), whose only free parameter is the number of iterations and that does not require additional parameter tuning (Section 4). We demonstrate that the different mechanisms we introduced in CAGPD contribute to improving the success rate of this attack compared to CPGD, by 81% points. Across all our datasets, the set of adversarial examples that CAPGD generates subsumes all the examples generated by any other gradient-based method. Furthermore, CAPGD is 75 times faster than MOEVA, while the latter reaches the highest success rate across all datasets.

These results motivate us to design Constrained Adaptive Attack (CAA), an adaptive attack that combines our new gradient-based attack (CAPGD) with MOEVA for an increased success rate at a lower computational cost. Our experiments show that CAA reaches the highest success rate for all models/datasets we considered, except in one case where CAA is second-best. With this attack, we offer a strong baseline for future research on evasion attacks for tabular models, which should become the minimal test for robust tabular architectures and other defense mechanisms.

Our contributions can be summarized as follows:

We design a new parameter-free attack, CAPGD that introduces momentum and adaptive steps to effectively evade tabular models while enforcing the feature constraints. We show that CAPGD outperforms the other gradient-based attacks in terms of capability to generate valid (constraint-satisfying) adversarial examples.

We propose a new efficient and effective evasion attack (CAA) that combines gradient and search attacks to optimize both effectiveness and computational cost.

We evaluate CAA in a large-scale evaluation over four datasets, five architectures, and two training methods (standard and adversarial training). Our results show that CAA outperforms all other attacks and is up to 5 times more efficient.

2 Related work

2.1 Tabular Deep Learning

Tabular data remains the most commonly used form of data [34], especially in critical applications such as medical diagnosis [38, 36], financial applications [18, 11, 8], user recommendation systems [46], cybersecurity [9, 1], and more. Improving the performance and robustness of tabular

machine learning models for these applications is becoming critical as more ML-based solutions are cleared to be deployed in critical settings.

Borisov et al. [5] showed that traditional deep neural networks tend to yield less favorable results in handling tabular data when compared to more shallow machine learning methods, such as XGBoost. However, recent approaches like RLN [33] and TabNet [2] are catching up and even outperforming shallow models in some settings. We argue that DNNs for Tabular Data are sufficiently mature and competitive with shallow models and require therefore a thorough investigation of their safety and robustness. Our work is the first exhaustive study of these critical properties.

2.2 Realistic Adversarial Examples

Initially applied to computer vision, adversarial examples have also been adapted and evaluated on tabular data. Ballet et al. [3] considered feature importance to craft the attacks, Mathov et al. [30] considered mutability, type, boundary, and data distribution constraints, Kireev et al. [24] suggested considering both the cost and benefit of perturbing each feature, and Simonetto et al. [35] introduced domain-constraints (relations between features) as a critical element of the attack.

While domain constraints satisfaction is essential for successful attacks, research on robustness for industrial settings (eg Ghamizi et al. [18] with a major bank) also demonstrated that imperceptibility remains important for critical systems with human-in-the-loop mechanisms, which could deflect attacks with manual checks from human operators. Imperceptibility is domain-specific, and multiple approaches have been suggested [3, 24, 16]. None of these approaches was confronted with human assessments or compared with each other, and in our study, we decided to use the most established L 2 norm. Our algorithms and approaches are generalizable to further distance metrics and imperceptibility definitions.

Overall, except the work from Simonetto et al. [35], none of the existing attacks for tabular machine learning supports the feature relationships inherent to realistic tabular datasets, as summarized in Table 1. Nevertheless, we evaluate all the approaches that support continuous values and where a public implementation is available to confirm our claims: LowProFool, BF*, CPGD, and MOEVA.

3 Problem formulation

We formulate the problem of evasion attacks under constraints. We assume the attack to be untargeted (i.e. it aims to force misclassification in any incorrect class); the formulation for targeted attacks is similar and omitted for space reasons.

̸

We denote by x ∈ R d an input example and by y ∈ { 1 , . . . , C } its correct label. Let h : R d → R C be a classifier and h c k ( x ) the classification score that h outputs for input x to be in class c k . Let ∆ ⊆ R d be the space of allowed perturbations. Then, the objective of an evasion attack is to find a δ ∈ ∆ such that argmax c ∈{ 1 ,...,C } h c ( x + δ ) = y.

In image classification, the set ∆ is typically chosen as the perturbations within some l p -ball around x , that is, ∆ p = { δ ∈ R d , || δ || p ≤ ϵ } for a maximum perturbation threshold ϵ . This restriction aims at preserving the semantics of the original input by assuming that small enough perturbations will yield images that humans perceive the same as the original images and would therefore classify the perturbed input into the same class (while the classifier predicts another class). This also guarantees that the example remains meaningful, that is, x + δ is not an image with random noise.

Tabular data are by nature different from images. They typically represent objects of the considered application domain (e.g. botnet traffic [10], financial transaction [18]). We denote by φ : Z → R d the feature mapping function that maps objects of the problem space Z to a d -dimensional feature space defined by the feature set F = { f 1 , f 2 , ...f d } . Each object z ∈ Z must inherently respect some natural condition to be valid (to be able to exist in reality). In the feature space, these conditions translate into a set of constraints on the feature values, which we denote by Ω . By construction, any input example x obtained from a real-world object z satisfies Ω , noted x | = Ω .

Thus, in the case of tabular data, we additionally require the perturbation δ applied to x to yield a valid example x + δ satisfying Ω , that is, ∆ p ( x ) = { δ ∈ R d : || δ || p ≤ ϵ ∧ x + δ | = Ω } .

To define the constraint language expressing Ω , we consider the four types of constraint introduced by Simonetto et al. [35]. These four constraint types cover all the constraints of the datasets in our empirical study. Hence, immutability defines what features cannot be changed by an attacker; boundaries defines upper / lower bounds for feature values; type specifies a feature to take continuous, discrete, or categorical values; and feature relationships capture numerical relations between features. Feature relationship constraints can be expressed with the following grammar:

̸

Equation 1 means that a constraint formula ω can either be an intersection ( ∧ ), or a union ( ∨ ) of two other constraint formulae ω 1 , ω 2 , or ω can be a comparison operator ⪰∈ { <, ≤ , = , = , ≥ , > } between two values ψ 1 and ψ 2 .

Equation 2 details the numeric expressions that are supported by the grammar. A numeric expression ψ can be constant c , an operation ⊕ ∈ { + , -, ∗ , / } between two other numerical expressions ψ 1 and ψ 2 , or a specific feature f i , or the i -th feature of the clean sample. The difference between f i and x i is that f i corresponds to the current value of the evaluated example and x i corresponds to its original value in the clean example.

Let's consider one complex constraint from the LCLD credit scoring use case: the term of the loan can only be 36 or 60 months and the number of open accounts is lower than the number of allowed accounts for this client. Such a constraint can be formally written as:

.

We provide other examples in Appendix A.1.

3.1 Constrained Projected Gradient Descent

Constrained Projected Gradient Descent (CPGD) is an extension of the PGD attack [29] to generate adversarial examples satisfying constraints in tabular machine learning. It integrates constraint satisfaction into the loss function that PGD optimizes. This is achieved by translating each constraint ω into a differentiable function penalty ( x, ω ) that values to zero if x | = ω ; otherwise, the function represents how far x is from satisfying ω . We follow the definition of Table 5 in Appendix A.1 to translate each construct of the constraints grammar into a penalty function.

For instance, the penalty function of ω 1 in Equation 3 is:

Based on this, CPGD produces adversarial examples from an initial sample x orig classified as y by iteratively computing:

where x 0 = x orig (the original input), R Ω is a domain-specific repair operator [35], P S is the projection onto S = { x ∈ R d , || x -x orig || p ≤ ϵ } , ∇L is the gradient of loss function L , defined as

In the original CPGD implementation, the step size η ( k ) follows a predefined decay schedule, η ( k ) = ϵ × 10 -(1+ ⌊ k/ ⌊ K/M ⌋⌋ ) , with M = 7 , and K = max ( k ) . L ′ ( x ) abbreviates L ( x, y, h, Ω) .

3.2 Experimental settings

Our experiments are driven by the following datasets, models, and attack parameters. More details about the datasets and models are given in Appendix A.5.

Datasets To conduct our study, we selected tabular datasets that present feature constraints from their respective application domain. URL [22] is a dataset of legitimate and phishing URLs. With only 14 linear domain constraints and 63 features, it is the simplest of our empirical study. LCLD [17] is a credit-scoring dataset with non-linear constraints. The WiDS [27] dataset contains medical data on the survival of patients admitted to the ICU. It has only 30 linear domain constraints. The CTU [10] dataset reports legitimate and botnet traffic from CTU University. The challenge of this dataset lies in its large number of linear domain constraints (360). We detail the datasets in the Appendix A.4.

Architectures Weevaluate five top-performing architectures from a recent survey on tabular ML [5]: TabTransformer [23] and TabNet [2] are transformer-based models. RLN [33] uses a regularization coefficient to minimize a counterfactual loss. STG [43] optimizes feature selection with stochastic gates, and VIME [44] relies on self-supervised learning. These architectures achieve performance equivalent to XGBoost, the best shallow machine learning model for our use cases.

Perturbation parameters We use the L2-norm to measure the distance between original and perturbed inputs, because this norm is suitable for both numerical and categorical features. We set ϵ to 0.5 for all datasets. Each dataset has a critical (negative) class, respectively phishing URLs, rejected loans, flagged botnets, and not surviving patients. Hence, we only attack clean examples from the critical class that are not already misclassified by the model and report robust accuracy of models.

Evaluation metrics We measure the effectiveness of our attack using robust accuracy defined as the accuracy of valid examples generated by a given attack. If a clean example is misclassified, we do not perturb it. If the attack generates an invalid example, we consider it as correctly classified. We measure the efficiency of the attacks in computational time.

4 Our Constrained Adaptive PGD

The relative lack of effectiveness of CPGD as reported in its original publication leads us to investigate the cause of these weaknesses. We investigate four factors that may affect the success rate of the attack: (1) we conjecture that the fixed step size and predefined decay in CPGD might be suboptimal because the choice of the step size is known to largely impact the effectiveness of gradient-based attacks [31]; (2) CPGD is unaware of the trend, i.e. it does not consider whether the optimization is evolving successfully and is not able to react to it; (3) CPGD does not check constraint satisfaction between the iterations, which could 'lock' the algorithm into a part of the invalid data space; (4) CPGD starts with the original example, whereas classical gradient-based attacks often benefit from random initialization.

4.1 CAPGD algorithm

We propose Constrained Adaptive PGD (CAPGD), a new constraint-aware gradient-based attack that aims to overcome the limitations of CPGD and improve its effectiveness. We detail CAPGD in Algorithm 1 in Appendix A.2, and summarize its components below.

Step size selection We introduce a step-size adaptation. We follow the exploration-exploitation principle by gradually reducing the gradient step [13]. However, unlike CPGD, this reduction does not follow a fixed schedule but is determined by the optimization trend. If the value of the loss function grows, we keep the same step size; otherwise, we halve it. That is, we start with a step η (0) = 2 ϵ , and we identify checkpoints w 0 = 0 , w 1 , ..., w n at which we decide whether it is necessary to halve the size of the current step. We halve the step size if any of the following two conditions holds:

Since the last checkpoint, we count how many cases since the last checkpoint w j -1 the update step has successfully increased L ′ . The condition holds if the loss has increased for at least a fraction of ρ steps (we set ρ = 0.75):

The step has not been reduced at the last checkpoint and the loss is less or equal to the loss of the last checkpoint:

where L ′ ( x ) is the loss function, L ( w j ) max is the highest loss value in the first j +1 iterations.

Repair operator While equality constraints are included in the penalty function, optimization alone does not achieve exact equality of feature values. Our new repair operator R Ω improved from [35] addresses this by setting the value of the left-hand side of an equation of the form f i = ψ to match the evaluation of the right-hand side in each iteration. It maintains other dataset constraints such as bounds, mutability, and feature types but does not ensure other relational constraints are met. The operator can violate maximum perturbation constraints, yet at each iteration, the perturbation is corrected back within the allowed maximum. This approach has been shown to improve the success rate of CAPGD, as demonstrated by our ablation study in Table 8. We provide the algorithm in Appendix A.2.

Initial state As for initialization, we apply the attack from two initial states: the original example x orig and a random example sampled from S (the Lp-ball around x orig ). The goal behind this second initialization is to reduce the risk of being immediately locked into local optima that encompass only invalid examples. Our experiments later reveal the complementary of these two initializations.

Gradient step Finally, we introduce in CAPGD a momentum [14]. Let η ( k ) be the step size at iteration k , then we first compute z ( k +1) before the updated example x ( k +1) .

where α ∈ [0 , 1] (we use α = 0 . 75 following [13]) regulates the influence of the previous update on the current, and P S is the projection onto S = { x ∈ R d , || x -x orig || p ≤ ϵ } .

4.2 Comparison of CAPGD to gradient-based attacks

To evaluate the benefits of CAPGD, we compare it with CPGD as well as LowProFool, to the best of our knowledge, the only other public gradient attack for tabular models that can be extended to support all types of features.

CAPGD is more successful than existing gradient attacks. In Table 2, we compare the robust accuracy across our four datasets and five architectures with CPGD, LowProFool, and CAPGD. CAPGD significantly outperforms CPGD and LowProFool. It decreases the robust accuracy on URL, LCLD, and WIDS datasets to as low as 10.9%, 0.2%, and 10.2% respectively.

LowProFool

CAPGD

CPGD

6597

132

3

The results also reveal that gradient attacks are ineffective on the CTU dataset. These results demonstrate that gradient-based attacks are not enough and motivate us to consider combining CAPGD with search-based attacks, as investigated in Section 5.

CAPGD subsumes all gradient attacks. We analyze in detail the original examples from which attacks could generate valid and successful adversarial examples. For each attack, we take the union of the sets of clean examples across 5 seeds. We generate the Venn diagram for CPGD, LowProFool, and CAPGD, for all datasets and model architectures. We sum the partition values in Figure 1. CAPGD generates adversarial examples for 6597 original examples from which none of the other gradient attacks could produce adversarial examples. In contrast, all successful adversarial examples by CPGD (132) and LowProFool (3) are also generated by CAPGD.

All components of CAPGD contribute to its effectiveness. We analyze in detail each of the components of CAPGD in Appendix B.1. These results and ablation studies confirm the complementarity of our new mechanisms and their contribution to the effectiveness of CAPGD.

5 CAA: an ensemble of gradient and search attacks

We next propose Constrained Adaptive Attack (CAA), an effective and efficient ensemble of gradient- and searchbased attacks. The idea underlying CAA is that gradientbased attacks for tabular data are more efficient but less successful than search-based attacks. Thus, CAA integrates the best search-based attacks from each family in a complementary way, such that we maximize the set of adversarial examples that can be generated.

5.1 Design of CAA

Following our related work study, we consider the search attacks MOEVA and BF* Kulynych et al. [26], Kireev et al. [25]. As a first step, we compare in Figure 2 these two attacks in terms of the original examples for which they could generate successful adversarial examples. We also include CAPGD in this comparison, since we have

MOEVA

CAPGD

BF*

477

5299

953

953

357

5

3

shown that this attack subsumes the other gradient-based attacks. Our results reveal that CAPGD and MOEVA together subsume BF* except for 5 examples. Additionally, CAPGD and MOEVA are complementary, with CAPGD generating 477 unique examples and MOEVA 953. Overall, the combination of CAPGD with MOEVA yields the strongest method including only one gradient-based

attack and one search-based attack. One could also include BF* for a slight increase in effectiveness, but this would come at the computational cost of running this attack in addition to the other two; our experimental results (presented below) actually reveal that BF* brings a substantial computational cost compared to CAPGD and MOEVA. Hence, we stick to CAPGD and MOEVA only.

The principle of CAA is thus to successively apply CAPGD and MOEVA, in that order. By applying CAPGD first, CAA has the opportunity to generate valid adversarial examples at low computational cost (benefiting from the performance of gradient attacks compared to search attacks). If CAPGD fails on an original example, CAA executes the slower but more effective MOEVA method.

5.2 Effectiveness and efficiency of CAA

We evaluated the effectiveness (robust accuracy) and efficiency (computation time) of CAA compared to the other methods. The hyperparameters of all attacks are fixed for all experiments (see Section A.6 of the appendix) and follow the recommendation given in their original paper.

Table 3 shows that CAA achieves the best performance in all cases but one: for STG model and LCLD dataset, BF* achieves a robust accuracy 0.6 percentage points lower than CAA - these are the unique original examples from which BF* could generate successful adversarial examples. Overall, CAA leads to a decrease in accuracy of up to 96.1%, 84.3%, and 21.7% compared to CAPGD, BF*, and MOEVA respectively.

The main advantage of CAA is its ability to find "easy" constrained adversarial using the cheaper gradient attack CAPGD, before processing harder examples with expensive search. We compare in the right panel of Table 3 the cost of running each attack, i.e., its execution time. CAA shines particularly in terms of efficiency. CAA reduces execution costs by up to 5 times compared to MOEVA. It is significantly faster than MOEVA for LCLD, URL, and WIDS datasets (except STG), and marginally more costly for CTU.

CAA is up to 418 times faster than BF*. In particular, in the only case where BF* marginally outperforms CAA, BF* requires 3.4 times more computation to generate the adversarial examples.

In Appendix B.5, we evaluate our attack on shallow models in direct and transferability settings.

1

2

3

4

5

Epsilon

0

.

0

0

.

2

0

.

4

0

.

6

0

.

8

1

.

0

Robust Accuracy

(a) Maximum ϵ perturbation

20

40

60

80

100

Number of CAPGD iterations

0

.

0

0

.

2

0

.

4

0

.

6

0

.

8

1

.

0

Robust Accuracy

(b) Gradient attack iterations

200

400

600

800

1000

Number of MOEVA iterations

0

.

0

0

.

2

0

.

4

0

.

6

0

.

8

1

.

0

Robust Accuracy

TabTr.

RLN

VIME

STG

TabNet

(c) Search attack iterations

CAPGD and MOEVA fail to generate adversarial examples on CTU for 2 out of 5 models. In Appendix B.3, we provide a possible explanation for this dataset by evaluating our attacks on different sub-sets of constraints with varying complexity.

5.3 Impact of attack budget

We study the impact of the attacker's budget on the effectiveness of CAA, in terms of (i) maximum perturbation ϵ and (ii) the number of iterations of its components. We focus on the CTU dataset, which models are the only ones to remain robust through our previous experiments. All the datasets are evaluated in Appendix B.2. Figure 3 reveals in (a) that the maximum perturbation distance ϵ has little impact on the effectiveness of the attack. Increasing the number of iterations for the gradient attack component (b) does not have an impact on the success rate of CAA. Increasing the budget of the search attack component (c) significantly impacts the robustness of some models. While TabTransformer and STG remain robust, the robust accuracy of RLM and VIME drops below 0.4 when doubling the number of search iterations to 200, and to zero with 1000 search iterations.

5.4 Impact of Adversarial training

We evaluate the effectiveness of our attack against models made robust with Madry's adversarial training (AT) [29], using examples generated by the PGD attack. We consider this defense because adversarial training-based methods were shown to be the only reliable defense against evasion attacks [37, 6]. In Table 4, we show the clean accuracy and the robust accuracy (against CAA) of the adversarially trained models (big numbers in Table 4). We also show the accuracy difference with the models trained with standard training (small numbers). In Appendix B.4, we evaluate additional defenses based on adversarial training and data augmentations.

Adversarial training can degrade clean and robust performance. As a preliminary check, we investigate whether adversarial training degrades the clean performance of the models. This is important to ensure that a non-increase of robust accuracy does not originate from clean performance degradation (instead of being due to CAA's strength). Our evaluation shows that adversarial training significantly degrades clean performance of the STG and Tabnet architectures. The accuracy of STG models drops to 15.6% and 62.6% for LCLD and WIDS respectively. As for Tabnet models, the clean accuracy drops to 0.0% (LCLD) and 0.2% (CTU). In all other cases, clean accuracy remains stable.

CAA remains effective against adversarial training for some architectures. The effectiveness of CAA against robust models is architecture- and dataset-dependent. The attack remains effective on VIME architecture applied to LCLD and WIDS, with robust accuracy as low as 10.1% and 52.2% respectively, as well as on RLN architecture on the WIDS dataset (66.6% robust accuracy and only +5.7% improvement compared to standard training). However, the robustness against CAA of Tabtransformer architecture is significantly improved on URL and LCLD datasets by respectively 47.8% and 62.4%, and marginally improved on WIDS dataset by 19.2%. Similarly, RLN robustness to CAA improves on URL (+45.4%) and LCLD (+63%).

6 Limitations

We identify three main limitations of our work.

Marginal overhead of CAA: In scenarios where CAPGD struggles to attack tabular models, CAA CAA can exhibit a computation overhead (<14%) compared to MOEVA. However, in 4 out of 5 evaluated settings, CAA is faster than MOEVA (up to 5 times).

CAPGD effectiveness with complex constraints: CAPGD effectiveness drops when increasing the constraint's complexity in the number of constraints or the number of features involved in each constraint.

Coherence of constraints: The mechanisms of CAA assume that the constraints definitions are sound. Incoherences between boundary constraints and feature relation constraints can lead to invalid adversarial examples with large ϵ budgets.

7 Broader Impact

Our work proposes CAA, the most effective evasion attack against constrained tabular ML. We also provided for each dataset at least one combination of architecture combined with AT where CAA can be mitigated. We expect that our work will have a more positive impact by leading to improved defenses in the scarcely explored field of robust tabular ML.

8 Conclusion

In this work, we first propose CAPGD, a new parameter-free gradient attack for constrained tabular machine learning. We also design CAA, a new Constrained Adaptive Attack that combines the best gradient-based attack (CAPGD) and the best search-based attack (MOEVA). We evaluate our attacks over four datasets and five architectures and demonstrated that our new attacks outperform all previous attacks in terms of effectiveness and efficiency. We believe that our work is a springboard for further research on the robustness of tabular machine learning and to open multiple research perspectives on constrained tabular ML. We hope that CAA will contribute to a faster development of adversarial defenses and recommend it as part of a standard evaluation pipeline of new tabular machine models.

Acknowledgments and Disclosure of Funding

This research was funded in whole, or in part, by the Luxembourg National Research Fund (FNR), grant reference NCER22/IS/16570468/NCER-FT and grant BRIDGES/2022/IS/17437536. This research was supported by BGL BNP Paribas Luxembourg. In particular, we would like to thank Anne Goujon and Andrey Boytsov for their support with the financial use case. The experiments presented in this paper were carried out using the HPC facilities of the University of Luxembourg [39] (see hpc.uni.lu ).

References

Hojjat Aghakhani, Fabio Gritti, Francesco Mecca, Martina Lindorfer, Stefano Ortolani, Davide Balzarotti, Giovanni Vigna, and Christopher Kruegel. 2020. When malware is packin'heat; limits

of machine learning classifiers based on static analysis features. In Network and Distributed Systems Security (NDSS) Symposium 2020 .

Sercan Ö Arik and Tomas Pfister. 2021. Tabnet: Attentive interpretable tabular learning. In Proceedings of the AAAI conference on artificial intelligence , Vol. 35. 6679-6687.

Vincent Ballet, Jonathan Aigrain, Thibault Laugel, Pascal Frossard, Marcin Detyniecki, et al. 2019. Imperceptible Adversarial Attacks on Tabular Data. In NeurIPS 2019 Workshop on Robust AI in Financial Services: Data, Fairness, Explainability, Trustworthiness and Privacy (Robust AI in FS 2019) .

Hongyan Bao, Yufei Han, Yujun Zhou, Xin Gao, and Xiangliang Zhang. 2023. Towards efficient and domain-agnostic evasion attack with high-dimensional categorical inputs. In Proceedings of the AAAI Conference on Artificial Intelligence , Vol. 37. 6753-6761.

Vadim Borisov, Tobias Leemann, Kathrin Sessler, Johannes Haug, Martin Pawelczyk, and Gjergji Kasneci. 2022. Deep Neural Networks and Tabular Data: A Survey. IEEE Transactions on Neural Networks and Learning Systems (2022), 1-21. https://doi.org/10.1109/ tnnls.2022.3229161

Nicholas Carlini. 2023. A LLM assisted exploitation of AI-Guardian. arXiv preprint arXiv:2307.15008 (2023).

Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. 2019. On evaluating adversarial robustness. arXiv preprint arXiv:1902.06705 (2019).

Francesco Cartella, Orlando Anunciaçao, Yuki Funabiki, Daisuke Yamaguchi, Toru Akishita, and Olivier Elshocht. 2021. Adversarial Attacks for Tabular Data: Application to Fraud Detection and Imbalanced Data. (2021).

Alesia Chernikova and Alina Oprea. 2019. Fence: Feasible evasion attacks on neural networks in constrained environments. arXiv preprint arXiv:1909.10480 (2019).

Alesia Chernikova and Alina Oprea. 2022. Fence: Feasible evasion attacks on neural networks in constrained environments. ACM Transactions on Privacy and Security 25, 4 (2022), 1-34.

Jillian M Clements, Di Xu, Nooshin Yousefi, and Dmitry Efimov. 2020. Sequential Deep Learning for Credit Risk Monitoring with Tabular Financial Data. arXiv preprint arXiv:2012.15330 (2020).

Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. 2020. Robustbench: a standardized adversarial robustness benchmark. arXiv preprint arXiv:2010.09670 (2020).

Francesco Croce and Matthias Hein. 2020. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In ICML .

Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. 2018. Boosting adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition . 9185-9193.

Salijona Dyrmishi, Salah Ghamizi, and Maxime Cordy. 2023. How do humans perceive adversarial text? A reality check on the validity and naturalness of word-based adversarial attacks. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , Anna Rogers, Jordan Boyd-Graber, and Naoaki Okazaki (Eds.). Association for Computational Linguistics, Toronto, Canada, 8822-8836. https: //doi.org/10.18653/v1/2023.acl-long.491

Salijona Dyrmishi, Salah Ghamizi, Thibault Simonetto, Yves Le Traon, and Maxime Cordy. 2023. On the empirical effectiveness of unrealistic adversarial hardening against realistic adversarial attacks. In 2023 IEEE symposium on security and privacy (SP) . IEEE, 1384-1400.

Nathan George. 2018. Lending Club loan data. https://www.kaggle.com/datasets/ wordsforthewise/lending-club .

Salah Ghamizi, Maxime Cordy, Martin Gubri, Mike Papadakis, Andrey Boystov, Yves Le Traon, and Anne Goujon. 2020. Search-based adversarial testing and improvement of constrained credit scoring systems. In Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering . 10891100.

Gilad Gressel, Niranjan Hegde, Archana Sreekumar, Rishikumar Radhakrishnan, Kalyani Harikumar, Krishnashree Achuthan, et al. 2021. Feature importance guided attack: a model agnostic adversarial attack. arXiv preprint arXiv:2106.14815 (2021).

Kathrin Grosse, Lukas Bieringer, Tarek R. Besold, Battista Biggio, and Alexandre Alahi. 2024. When Your AI Becomes a Target: AI Security Incidents and Best Practices. Proceedings of the AAAI Conference on Artificial Intelligence 38, 21 (Mar. 2024), 23041-23046. https: //doi.org/10.1609/aaai.v38i21.30347

John T Hancock and Taghi M Khoshgoftaar. 2020. Survey on categorical data for neural networks. Journal of Big Data 7 (2020), 1-41.

Abdelhakim Hannousse and Salima Yahiouche. 2021. Towards benchmark datasets for machine learning based website phishing detection: An experimental study. Engineering Applications of Artificial Intelligence 104 (2021), 104347.

Xin Huang, Ashish Khetan, Milan Cvitkovic, and Zohar Karnin. 2020. Tabtransformer: Tabular data modeling using contextual embeddings. arXiv preprint arXiv:2012.06678 (2020).

Klim Kireev, Bogdan Kulynych, and Carmela Troncoso. 2022. Adversarial Robustness for Tabular Data through Cost and Utility Awareness. arXiv preprint arXiv:2208.13058 (2022).

Klim Kireev, Bogdan Kulynych, and Carmela Troncoso. 2023. Adversarial Robustness for Tabular Data through Cost and Utility Awareness. In The Second Workshop on New Frontiers in Adversarial Machine Learning .

Bogdan Kulynych, Jamie Hayes, Nikita Samarin, and Carmela Troncoso. 2018. Evading classifiers in discrete domains with provable optimality guarantees. arXiv preprint arXiv:1810.10939 (2018).

Meredith Lee, Jesse Raffa, Marzyeh Ghassemi, Tom Pollard, Sharada Kalanidhi, Omar Badawi, Karen Matthys, and Leo Anthony Celi. 2020. WiDS (Women in Data Science) Datathon 2020: ICU Mortality Prediction. PhysioNet.

Teng Long, Qi Gao, Lili Xu, and Zhangbing Zhou. 2022. A survey on adversarial attacks in computer vision: Taxonomy, visualization and future directions. Computers & Security 121 (2022), 102847. https://doi.org/10.1016/j.cose.2022.102847

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 (2017).

Yael Mathov, Eden Levy, Ziv Katzir, Asaf Shabtai, and Yuval Elovici. 2022. Not all datasets are born equal: On heterogeneous tabular data and adversarial examples. Knowledge-Based Systems 242 (2022), 108377.

Marius Mosbach, Maksym Andriushchenko, Thomas Trost, Matthias Hein, and Dietrich Klakow. 2018. Logit pairing methods can fool gradient-based attacks. NeurIPS 2018 Workshop on Security in Machine Learning (2018).

Sylvestre-Alvise Rebuffi, Sven Gowal, Dan Andrei Calian, Florian Stimberg, Olivia Wiles, and Timothy A Mann. 2021. Data augmentation can improve robustness. Advances in Neural Information Processing Systems 34 (2021), 29935-29948.

Ira Shavitt and Eran Segal. 2018. Regularization learning networks: deep learning for tabular datasets. Advances in Neural Information Processing Systems 31 (2018).

Ravid Shwartz-Ziv and Amitai Armon. 2021. Tabular Data: Deep Learning is Not All You Need. arXiv preprint arXiv:2106.03253 (2021).

Thibault Simonetto, Salijona Dyrmishi, Salah Ghamizi, Maxime Cordy, and Yves Le Traon. 2022. A Unified Framework for Adversarial Attack and Defense in Constrained Feature Space. In Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence, IJCAI-22 , Lud De Raedt (Ed.). International Joint Conferences on Artificial Intelligence Organization, 1313-1319. https://doi.org/10.24963/ijcai.2022/183 Main Track.

Sulaiman Somani, Adam J Russak, Felix Richter, Shan Zhao, Akhil Vaid, Fayzan Chaudhry, Jessica K De Freitas, Nidhi Naik, Riccardo Miotto, Girish N Nadkarni, et al. 2021. Deep learning and the electrocardiogram: review of the current state-of-the-art. EP Europace (2021).

Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. 2020. On adaptive attacks to adversarial example defenses. Advances in Neural Information Processing Systems 33 (2020), 1633-1645.

Dennis Ulmer, Lotta Meijerink, and Giovanni Cinà. 2020. Trust Issues: Uncertainty Estimation Does Not Enable Reliable OOD Detection On Medical Tabular Data. In Machine Learning for Health . PMLR, 341-354.

S. Varrette, H. Cartiaux, S. Peter, E. Kieffer, T. Valette, and A. Olloh. 2022. Management of an Academic HPC & Research Computing Facility: The ULHPC Experience 2.0. In Proc. of the 6th ACM High Performance Computing and Cluster Technologies Conf. (HPCCT 2022) . Association for Computing Machinery (ACM), Fuzhou, China.

Yutong Wang, Yufei Han, Hongyan Bao, Yun Shen, Fenglong Ma, Jin Li, and Xiangliang Zhang. 2020. Attackability characterization of adversarial evasion attack on discrete data. In Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining . 1415-1425.

Han Xu, Pengfei He, Jie Ren, Yuxuan Wan, Zitao Liu, Hui Liu, and Jiliang Tang. 2023. Probabilistic categorical adversarial attack and adversarial training. In International Conference on Machine Learning . PMLR, 38428-38442.

Lei Xu, Maria Skoularidou, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. 2019. Modeling tabular data using conditional GAN. In Advances in Neural Information Processing Systems , Vol. 33.

Yutaro Yamada, Ofir Lindenbaum, Sahand Negahban, and Yuval Kluger. 2020. Feature Selection using Stochastic Gates. In Proceedings of Machine Learning and Systems 2020 . 8952-8963.

Jinsung Yoon, Yao Zhang, James Jordon, and Mihaela van der Schaar. 2020. Vime: Extending the success of self-and semi-supervised learning to tabular domain. Advances in Neural Information Processing Systems 33 (2020), 11033-11043.

Sangdoo Yun, Dongyoon Han, Seong Joon Oh, Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. 2019. Cutmix: Regularization strategy to train strong classifiers with localizable features. In Proceedings of the IEEE/CVF International Conference on Computer Vision . 6023-6032.

Shuai Zhang, Lina Yao, Aixin Sun, and Yi Tay. 2019. Deep learning based recommender system: A survey and new perspectives. ACM Computing Surveys (CSUR) 52, 1 (2019), 1-38.

Appendix

A Experimental protocol

A.1 Constraints penalty function

The penalty function transforms each constraint formulation into a differentiable loss function to be minimized by gradient descent (or search algorithm). Table 5 inspired from [35] shows the supported constraints, their translation to penalty function, and examples for each supported constraint. Let's consider one complex constraint from the LCLD credit scoring use case: The term of the loan can only be 36 or 60 months and the number of open accounts is lower than the number of allowed accounts for this client. Such a constraint can be formally written as term ∈ { 36 , 60 } ) ∧ ( open_acc ≤ total_acc ) . The AND operator ∧ is equivalent to a sum of losses, while the OR operator ∨ is described as min ( | c -a | , | c -b | , ... ) in a loss function. Finally, the a ≤ b operator is equivalent to a min (0 , a -b ) in a loss function. Hence, the complex constraint translates as the following penalty: min ( | term -36 | , | term -60 | ) + max (0 , open_acc -total_acc ) .

A.2 CAPGD Algorithm

Algorithm 1 summarizes the process of CAPGD. At each iteration, we compute the perturbation according to the definition of Equation (l. 7-9). We keep track of the best loss and accordingly best adversarial example found so far (l. 10-12). If we reach a checkpoint in W and one of the conditions of Equation 7 or Equation 8 we half the step size η (l. 13-17). We return the best adversarial example x max .

Algorithm 2 describes the repair operator. For each constraint Ω , if the constraint is an equality = and the left operand ω. left_operand is a feature (l. 3), we verify if the constraint is respected. If not ( penalty ( x, Ω) > 0)( l. 4) , we reset the value corresponding to feature ω. left_operand in x such that it equals the penalty function of the right operand ω. right_operand (l. 5). According to the grammar Equation 1 and the penalty function definition in Table 5, the value feature ω. left_operand must equal the penalty function of ω. right_operand to satify the constraint.

A.3 CAA Algorithm

Algorithm 3 summarizes the process of CAA. The algorithm takes as input the clean examples X , their associated labels Y , and the classifier H such that H ( x ) = argmax c ∈{ 1 ,...,C } h c ( x ) (including its weights, loss function and probability function), Ω the set of domain constraints, and ϵ the maximum perturbation. We start by creating the mask of examples that are already adversarial (i.e. misclassified by the model) (l.3). We then split the clean examples that are already adversarial X ′ (l.4), and the candidates X C on which we will execute the attacks. For each of our attacks (l.6), we generate a set of potentially adversarial examples from the candidate clean examples (l.7). Once again, we compute the mask of examples that are adversarial according to the subprocedure is _ adv described below. According to the mask, we add the successful attack to the output X ′ (l.8) and remove the associated clean examples from the candidate set X C . Hence, for a given example, the

̸

next attack is only executed if no attack has been successful, reducing the overall cost of CAA. At the end of CAA, we had the remaining candidates, for which we have not found adversarial examples to the output set of potentially adversarial examples X ′ , to ease the calculation of robust accuracy (e.g. in transferable settings).

The sub procedure is _ adv goes through all the examples X i [ k ] ∈ X i and adds True to the mask, if all of the following conditions hold:

X i [ k ] respects the domain constraints,

X i [ k ] classification by H is different from its true label Y c [ k ] ,

X i [ k ] pertubation w.r.t to X c [ k ] is lower or equal to ϵ .

A.4 Datasets

Our dataset design followed the same protocol as Simonetto et al.[35]. We present in Table 6 the attributes of our datasets and the test performance achieved by each of the architectures.

Credit scoring - LCLD (licence: CC0: Public Domain) We engineer a dataset from the publicly available Lending Club Loan Data 1 . This dataset contains 151 features, and each example represents a loan that was accepted by the Lending Club. However, among these accepted loans, some are not repaid and charged off instead. Our goal is to predict, at the request time, whether the borrower will be repaid or charged off. This dataset has been studied by multiple practitioners on Kaggle. However, the original version of the dataset contains only raw data and to the extent of our knowledge, there is no featured engineered version commonly used. In particular, one shall be careful when reusing feature-engineered versions, as most of the versions proposed present data leakage in the training set that makes the prediction trivial. Therefore, we propose our own feature engineering. The original dataset contains 151 features. We remove the example for which the feature 'loan status' is different from 'Fully paid' or 'Charged Off' as these represent the only final status of a loan: for other values, the outcome is still uncertain. For our binary classifier, a 'Fully paid' loan is represented as 0 and a 'Charged Off' as 1. We start by removing all features that are not set for more than 30% of the examples in the training set. We also remove all features that are not available at loan request time, as this would introduce bias. We impute the features that are redundant (e.g. grade and sub-grade) or too granular (e.g. address) to be useful for classification. Finally, we use one-hot encoding for categorical features. We obtain 47 input features and one target feature. We split the dataset using random sampling stratified on the target class and obtained a training set of 915K examples and a testing set of 305K. They are both unbalanced, with only 20% of charged-off loans (class 1). We trained a neural network to classify accepted and rejected loans. It has 3 fully connected hidden layers with 64, 32, and 16 neurons.

For each feature of this dataset, we define boundary constraints as the extremum value observed in the training set. We consider the 19 features that are under the control of the Lending Club as immutable. We identify 10 relationship constraints (3 linear, and 7 non-linear ones).

URLPhishing - ISCX-URL2016 (license CC BY 4.0) Phishing attacks are usually used to conduct cyber fraud or identity theft. This kind of attack takes the form of a URL that reassembles a legitimate URL (e.g. user's favorite e-commerce platform) but redirects to a fraudulent website that asks the user for their personal or banking data. [22] extracted features from legitimate and fraudulent URLs

as well as external service-based features to build a classifier that can differentiate fraudulent URLs from legitimate ones. The feature extracted from the URL includes the number of special substrings such as 'www", '&", ',", '$", "and", the length of the URL, the port, the appearance of a brand in the domain, in a subdomain or in the path, and the inclusion of 'http" or 'https". External service-based features include the Google index, the page rank, and the presence of the domain in the DNS records. The complete list of features is present in the reproduction package. [22] provide a dataset of 5715 legit and 5715 malicious URLs. We use 75% of the dataset for training and validation and the remaining 25% for testing and adversarial generation.

We extract a set of 14 relation constraints between the URL features. Among them, 7 are linear constraints (e.g. length of the hostname is less or equal to the length of the URL) and 7 are Boolean constraints of the type ifa > 0 then b > 0 (e.g. if the number of http > 0 then the number slash '/" > 0).

Botnet attacks - CTU-13 (license CC BY NC SA 4.0) This is a feature-engineered version of CTU-13 proposed by [9]. It includes a mix of legit and botnet traffic flows from the CTU University campus. Chernikova et al. aggregated the raw network data related to packets, duration, and bytes for each port from a list of commonly used ports. The dataset is made of 143K training examples and 55K testing examples, with 0.74% examples labeled in the botnet class (traffic that a botnet generates). Data have 756 features, including 432 mutable features. We identified two types of constraints that determine what feasible traffic data is. The first type concerns the number of connections and requires that an attacker cannot decrease it. The second type is inherent constraints in network communications (e.g. maximum packet size for TCP/UDP ports is 1500 bytes). In total, we identified 360 constraints.

WiDS (license: PhysioNet Restricted Health Data License 1.5.0 2 ) [27] dataset contains medical data on the survival of patients admitted to the ICU. The goal is to predict whether the patient will survive or die based on biological features (e.g. for triage). This very unbalanced dataset has 30 linear relation constraints.

A.5 Model architectures

Table 7 summarizes the family, model architecture, and hyperparameters tuned during the training of our models.

TabTransformer is a transformer-based model [23]. It uses self-attention to map the categorical features to an interpretable contextual embedding, and the paper claims this embedding improves the robustness of models to noisy inputs.

TabNet is another transformer-based model [2]. It uses multiple sub-networks that are used in sequence. At each decision step, it uses sequential attention to choose which features to reason. TabNet aggregates the outputs of each step to obtain the decision.

RLN or Regularization Learning Networks [33] uses an efficient hyperparameter tuning scheme in order to minimize a counterfactual loss. The authors train a regularization coefficient to weights in the neural network in order to lower the sensitivity and produce very sparse networks.

STG or Stochastic Gates [43] uses stochastic gates for feature selection in neural network estimation problems. The method is based on probabilistic relaxation of the l 0 norm of features or the count of the number of selected features.

VIME or Value Imputation for Mask Estimation [44] uses self and then semi-supervised learning through deep encoders and predictors.

A.6 Attacks parameters

For existing attacks, we reuse the hyperparameters proposed in their respective papers. For LowProFool, we use a small step size of η = 0 . 001 , λ = 8 . 5 rade off factor between fooling the classifier and generating imperceptible adversarial example, and run the attack for N iter = 20 , 000 iterations. All other gradient attacks run for N iter = 10 iterations. The schedule of decreasing steps of CPGD uses M = 7 . In CAPGD, we fix the checkpoints as w j = ⌈ p j N iter ⌉ ≤ N iter, with p j ∈ [0 , 1] defined as p 0 = 0 , p 1 = 0 . 22 and

. The influence of the previous update on the current update is set to α = 0 . 75 , and ρ = 0 . 75 for the halving of the step. MOEVA runs for n gen = 100 iterations generating n off = 100 offspring per iteration. Among the offspring, n pop = 200 survive and are used for mating in the next iteration. With BF*, we discretize numerical features in n bin = 150 bins. We run the attack for a maximum of N iter = 100 iterations. CAA applies CAPGD and MOEVA with the same parameters.

A.7 Hardware

We run our experiments on an HPC cluster node with 32 cores and 64GB of RAM dedicated to our task. Each node consists of 2 AMD Epyc ROME 7H12 @ 2.6 GHz for a total of 128 cores with 256 GB of RAM.

A.8 Reproduction package and availability

The source code, datasets and pre-trained models to reproduce the experiments of this paper are available with the submission. The source code will be available publicly upon acceptance under the MIT license or similar.

B Additional results

B.1 Components of CAPGD

All components of CAPGD contribute to its effectiveness. We conduct an ablation study on the components of CAPGD. We evaluate CAPGD without the repair operator at each iteration (NREP), without the initialization with clean example (NINI), without the initialization with random sampling (NRAN), and without the adaptive step (NADA). Table 8 reveals that removing a component of CAPGD reduces its effectiveness. Interestingly, not all components affect all datasets similarly. For instance, removing the repair at each gradient iteration only affects the LCLD datasets' success rate. For URL and WIDS, CAPGD-NREP remains in the confidence interval of CAPGD. Removing any other components always negatively affects CAPGD, up to an improvement of 32.1% of the robust accuracy for CAPGD-NADA on the WIDS dataset and TabNet model.

CAPGD components are complementary. None of the components of CAPGD negatively affects its capability of finding an adversarial example for a given clean example. In Figure 4, we analyze the coverage of each CAPGD variant A (Covering Attack) with regard to another variant B (Coverred Attack). For A and B, we compute the set of clean examples C A and C B on which the attacks are

CAPGD

NREP

NINI

NRAN

NADA

CAPGD

NREP

NINI

NRAN

NADA

Coverring Attack (B)

1.00

0.99

0.99

1.00

0.99

0.93

1.00

0.93

0.96

0.94

0.98

0.98

1.00

0.99

0.99

0.87

0.88

0.87

1.00

0.91

0.83

0.83

0.83

0.87

1.00

0.0

0.2

0.4

0.6

0.8

1.0

successful. The percentage in the heatmaps represents the proportion of C A ∪ C B covered by C B , that is

where | C | is the cardinality of C . Attack B subsumes A when coverage = 1 . In practice, to avoid random effect, we run the attack for N = 5 seeds, and take the union of clean examples on which we generate a successful example.

Figure 4 reveals that CAPGD subsumes all its variants with coverage over 99%, while none of the variants subsumes CAPGD. Therefore all components of CAPGD are necessary to obtain the strongest attack.

B.2 Budget of attacker

In this section, we study the impact of CAA's budget on its effectiveness. We consider 3 budgets: the maximum perturbation ϵ allowed, the number of iterations in the gradient attack CAPGD (without changing MOEVA's budget), and the number of iterations in the search attack MOEVA (without changing CAPGD's budget).

For each budget, we provide figures and detailed numerical results in tables, corresponding to the same experiment.

Maximum perturbation ϵ Figure 5 (numerical results in Table 9) reveals that increasing the maximum perturbation ϵ for CAA reduces the robust accuracy of the model in 16/20 cases.

Number of CAPGD iterations Figure 6 (numerical results in Table 10) reveals that increasing the number of iterations for the gradient attack component has a limited impact on the success rate of CAA. The maximum drop of accuracy is 3.5% points between 10 and 100 iterations for WIDS/TabNet.

Number of MOEVA iterations Figure 8 (numerical results in Table 11) reveals that increasing the number of iterations for the search attack component only reduces the robust accuracy in 4/20 cases (URL/VIME, URL/STG, CTU/VIME, and CTU/RLN).

We also observe that for TabTransformer and LCLD the robust accuracy increases with the number of search iterations. MOEVA is a multi-objective genetic algorithm. An inherent problem of multiobjective optimization is the trade-off between the objectives. If all solutions in the population are on the Pareto front, the algorithm must decide which solutions to discard for the next iteration, potentially discarding a valid adversarial example in our case.

Figure 7 shows the evolution of the success rate of MOEV A with the number of iterations in the same settings as in Figure 8b for TabTransformer. We find that the success rate reaches a maximum with 100 iterations. We argue that valid adversarial examples were discarded when the search continued to 1000 iterations. To confirm our hypothesis, we run the same experiment with a 10 times larger search population, such that more solutions are preserved at each iteration. We observe that in this setting, MOEVA converges slower (due to less selection pressure) but the success rate strictly increases with the number of generations. Increasing the population size also increases the execution time (by 3.4x in this case), due to the selection operator overhead.

Our approach CAA aims at minimizing the memory and computation overheads while maximizing the success rate, and CAA can be tuned to lead to lower robust accuracy with more iterations if the search space is expanded (for example with larger populations).

1

2

3

4

5

Epsilon

0

.

0

0

.

2

0

.

4

0

.

6

0

.

8

Robust Accuracy

TabTr.

RLN

VIME

STG

TabNet

(a) URL

1

2

3

4

5

Epsilon

0

.

0

0

.

2

0

.

4

0

.

6

Robust Accuracy

TabTr.

RLN

VIME

STG

TabNet

1

2

3

4

5

Epsilon

0

.

0

0

.

2

0

.

4

0

.

6

0

.

8

1

.

0

Robust Accuracy

TabTr.

RLN

VIME

STG

TabNet

(c) CTU

1

2

3

4

5

Epsilon

0

.

0

0

.

2

0

.

4

0

.

6

Robust Accuracy

TabTr.

RLN

VIME

STG

TabNet

(d) WIDS

20

40

60

80

100

Number of CAPGD iterations

0

.

1

0

.

2

0

.

3

0

.

4

0

.

5

0

.

6

Robust Accuracy

TabTr.

RLN

VIME

STG

TabNet

(a) URL

20

40

60

80

100

Number of CAPGD iterations

0

.

0

0

.

2

0

.

4

Robust Accuracy

TabTr.

RLN

VIME

STG

TabNet

20

40

60

80

100

Number of CAPGD iterations

0

.

0

0

.

2

0

.

4

0

.

6

0

.

8

1

.

0

Robust Accuracy

TabTr.

RLN

VIME

STG

TabNet

(c) CTU

20

40

60

80

100

Number of CAPGD iterations

0

.

0

0

.

2

0

.

4

0

.

6

Robust Accuracy

TabTr.

RLN

VIME

STG

TabNet

(d) WIDS

0

200

400

600

800

1000

Generations

0

.

0

0

.

2

0

.

4

0

.

6

0

.

8

1

.

0

Success rate

Population baseline (203)

Population x 10

200

400

600

800

1000

Number of MOEVA iterations

0

.

0

0

.

2

0

.

4

0

.

6

Robust Accuracy

TabTr.

RLN

VIME

STG

TabNet

(a) URL

200

400

600

800

1000

Number of MOEVA iterations

0

.

0

0

.

1

0

.

2

0

.

3

0

.

4

0

.

5

Robust Accuracy

TabTr.

RLN

VIME

STG

TabNet

200

400

600

800

1000

Number of MOEVA iterations

0

.

0

0

.

2

0

.

4

0

.

6

0

.

8

1

.

0

Robust Accuracy

TabTr.

RLN

VIME

STG

TabNet

(c) CTU

200

400

600

800

1000

Number of MOEVA iterations

0

.

0

0

.

2

0

.

4

0

.

6

Robust Accuracy

TabTr.

RLN

VIME

STG

TabNet

(d) WIDS

B.3 Constraints complexity

In this section, we study the impact of the constraints' complexity on CAA's effectiveness.

CAPGD and MOEVA fail to generate adversarial examples on CTU for 2 out of 5 models. CTU dataset has a large number of constraints compared to the other datasets, and some are particularly challenging. We argue that some of these constraints hinder gradient attacks and are harder to optimize. To confirm our hypothesis and provide additional insights, we split the constraints of CTU based on their complexity. We consider two aspects of constraint complexity: the number of constraints to satisfy and the number of features involved in a single constraint.

We split the constraints of CTU as follows:

CG0 One constraint involving 90 features in the form of ∑ F i = ∑ F j where both sums represent the total number of sent packets.

CG1 One constraint involving 90 features in the form of ∑ F i = ∑ F j where both sums represent the total number of received packets.

CG2 34 constraints in the form of BYTE/PACKETS ≤ 1500 , to model the fact that each packet contains at most 1500 bytes.

CG3 324 constraints in the form of A ≤ B where A and B are statistical properties (min, max, sum) for each port, and direction.

First, we ran an ablation study, where we ignored one bucket of constraint at a time. Next, we studied the success rate when we considered each bucket separately. Finally, we reported the impact of the number of constraints to optimize from CG3, the largest bucket.

The results in Table 12 show that for gradient attacks, removing one type of constraint is not enough to improve the success rate. Constraints across multiple remaining categories are not satisfied. The individual bucket study confirms that only when considering constraints of type CG2 alone, CAPGD improves its success rate (in VIME and TabNet). When only considering CG3 constraints, reducing the number of constraints improves the success rate (by reducing robust accuracy from 95.3% when considering 100% of CG3 constraints to 84.5% and 43.0% respectively when considering 50% and 10% of the constraints).

B.4 Additional defenses

In addition to the application of adversarial training alone, we evaluate the robustness of the models when training with data augmentation. [32] showed that combining data augmentation with adversarial training can increase the robustness of models. We also observe in RobustBench [12], that top-performing models are trained with data augmentation. We consider two data augmentation techniques: Cutmix [45] and CT-GAN [42]. To train our model, at each batch, we use an equal proportion of clean, adversarial examples, data augmentation examples, and adversarial examples generated on top of data augmentation examples.

We evaluated CAA on these two defenses and report in Table 13 the robust accuracy of these defenses, compared to the robustness of the vanilla Madry AT on all our datasets and models. The results are the average over 5 seeds run to ensure reliable evaluation. Our experiments show that these new defenses can significantly improve the robustness of the models to CAA, but that our new attack remains effective for URL and LCLD datasets across all architectures, and for WIDS on TabTransformer and STG architectures.

B.5 Generalization to shallow models

Shallow models and in particular tree-based models such as Random Forest (RF) XGBoost remain among the best models for tabular data on average [5]. We evaluate the robustness of these models against CAA in two settings: (1) direct attack where CAA (using its search component MOEVA) attacks directly the RF and XGBOOST models, and (2) transfer attacks, where we craft the examples on our deep learning (DL) models and evaluate them in the RF and XGBOOST models. Table ?? shows that (1) DL models of our study achieve comparable clean performance to the shallow models, (2) both RF and XGBOOST models are vulnerable to direct CAA attacks (down to 9.1% of robust accuracy on LCLD XGBoost), and (3) CAA attacks on DNN transfer to RF (down to 5.3% robust accuracy) and XGBoost (down to 9.4% robust accuracy) models.

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: The paper's contributions are two-folds: two new attacks (CAPGD and CAA) and an extensive study of five architectures and four datasets. These contributions match the structure of our paper and the figures and claims reported in the abstract and introduction match the figures of the experimental study.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: We discuss the limitation of CAPGD in Section 4.2, and the limitations of CAA against adversarial training in Section 5.4. Overall, we provided ablations studies for our new algorithms and analysis of the impact budget and computation ressources of our approaches.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory Assumptions and Proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [NA] .

Justification: The paper does not include theoretical results.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental Result Reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: We dedicate Section 3.2 and the Appendix A to present the experimental protocol and disclose all the information needed to reproduce all the experimental results.

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: We submitted the source code, data and pre-trained models to reproduce the experiments in supplementary. As mentioned in Section A.8, the source code and pre-trained models will be publicly available upon acceptance under open-source licenses.

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental Setting/Details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: Yes, the parameters used for our experiments are summarized in Section 3.2, detailed in Appendix A.6, and provided in source code. Furthermore, in Section 5.3 and Appendix B.2, we study the impact of the main attack parameters.

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment Statistical Significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [Yes]

Justification: We report the 95% CI in all tables and figures when average results over random runs are needed in experiments.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments Compute Resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: We report the exact hardware used for our experiment in Appendix A.7. The execution time is included in the main paper as part of our experiments in Table 3.

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code Of Ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: We read and conform to the code of ethics and all laws and regulations in our jurisdiction.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader Impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [Yes]

Justification: We have provided a "Broader Impact" section to explain the negative impacts of our new approach, and how by studying countermeasures in our work, we expect our research to bring more benefits to the defense community than the attackers.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: The paper poses no such risks.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: Appendix A.4 cites the original creators of the datasets and provides their licences.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New Assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [Yes]

Justification: We provide the algorithms of the attack in the Appendix to help understand our implementation. The reproduction package contains the code of all algorithms and experiments and is documented to guide all users.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and Research with Human Subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects, nor any element that requires an Institutional Review Board (IRB) approval.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper aims to study the problem of finding adversarial examples for tabular datasets. Different from attacking image models or text models, attacking tabular models requires finding adversarial examples which are legal, which do not violate the relation between features. Moreover, it also requires to tackle both numerical and categorical features.\n\nSTRENGTHS:\n1. The studied problem is important and under less investigation compared to adversarial attacks in CV and NLP. \n2. The paper is well written and easy to follow. \n3. The experiment analysis is convincing and sufficient.\n\nWEAKNESSES:\nHowever, I still have concerns on this paper. Specifically, many terms / techniques used in the method are not originally proposed by this paper. For example,  \n1. In terms of the main objective (as discussed in Section 3.1), one key step to let adversarial examples satisfy the feature constraints (in Eq.1 and Eq.2) is to translate into a differentiable function. However, this is proposed by the previous work Simonetto et al, 2021. \n2. In terms of the solving algorithm (as discussed in Section 4.1), the author propose CAPGD, which seems a fine-tuning / lightweight modification of the previous method CPGD. This also limit the technical contribution of this paper. \n3. Finally, the author claims trying both CAPGD (proposed in this paper) and MOEVA (previous work) and BF* (previous work) can improve the attack successful rate. \n\nOverall, I do not hesitate about the effectiveness of combining these strategies for solving the attack problem. Instead, I am concerned of the originality and the significance of the work. Besides, although the authors discussed the reasons on why differentiable models are considered in this paper, I still believe that undifferentiable models like XGBoost is one important branch of models for solving the tabular data classification tasks. I encourage the authors also investigate possible solutions for undifferentiable models.\n\nQUESTIONS:\nPlz see the weakness.\n\nLIMITATIONS:\nI didn't see such a discussion.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-06-22"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces two novel adversarial attacks, specifically designed to target the evasion of deep neural networks (DNNs) in classification tasks involving tabular data satisfying real-world constraints. The first attack, CAPGD, is a gradient-based method that enhances the constrained PGD (CPGD) attack proposed in [33] by incorporating improvements from the APGD definition [12], such as the addition of momentum and an optimized step size selection. The second attack, CAA, combines the efficient but less effective CAPGD with another search-based attack, MOEVA, which is more effective but less efficient regarding the computational time required to perform the attack.\nThe extensive experimental evaluation on four tabular datasets and five DNNs for tabular data demonstrates that CAPGD significantly improves the success rate of generating successful adversarial examples compared to CPGD. Furthermore, CAA achieves a reasonable trade-off between efficacy and computational efficiency, offering higher attack efficacy than CAPGD and requiring less computational time than MOEVA.\n\nSTRENGTHS:\nI find this paper particularly compelling as it proposes a new evasion attack against deep learning models for tabular data with real constraints that clearly outperforms the other state-of-the-art proposals. The paper demonstrates two key strengths:\n\n- Despite the two proposed attacks are improvements and combinations of existing approaches to generate realistic attacks, they are based on reasonable and novel observations. In particular, the design of CAA is motivated by the evidence that CAPGD and MOEVA are complementary. These attacks significantly outperform the state-of-the-art CPGD [33].\n\n- The experimental analysis is comprehensive and convincing. The experiments are performed on 5 different deep learning models employed to classify tabular data on 4 different datasets with variable number of constraints. Both the accuracy and efficiency of the attacks are evaluated. Furthermore, additional results are shown varying the maximum perturbation and the value of important parameters of the attacks are shown. Finally, an ablation study shows the impact of each improvement introduced in CAPGD.\n\nWEAKNESSES:\nEven though the proposal is good, I think that some weaknesses about the presentation of the proposal and the analysis of the results need to be addressed in the final version of the paper:\n\n**The description of CAPGD should be improved**: the description of CAPGD can be enhanced by better explaining the role of the repair operator. Specifically, the authors mention that constraints of the form $f = \\psi$ are enforced at every iteration by the repair operator. However, it is not clear whether applying this operator at every iteration guarantees the generation of an adversarial example that satisfies all dataset constraints and the maximum perturbation constraint by the end of the execution. This is a crucial property, as the attack cannot be tested if it does not satisfy the constraints, potentially wasting the time required to generate the attack.\n\n**The depth of the analysis of the results should be improved**: the depth of the analysis of the results can be improved by discussing particular results to understand their causes and how to mitigate these cases. For instance, CAPGD and MOEVA fail to generate adversarial examples on the CTU dataset for 2 out of 5 models (Table 3 and results in the Appendix). This failure may be due to the high number of constraints (360) considered for this dataset, since the two attacks are more effective on the other datasets for which at most 30 constraints are considered. It would be interesting to evaluate the efficacy of the two attacks by varying the number of constraints considered for the CTU dataset, to better highlight the limitations of the proposed attacks.\nAdditionally, CAA generates less effective attacks with higher epsilon values (Figure 5b), and MOEVA generates less effective attacks with a higher number of iterations (Figure 7b). Even though these results are sporadic, they are counterintuitive, as the search space for adversarial examples increases with higher epsilon and more mutation rounds. A detailed discussion of these phenomena would provide valuable insights.\n\n**The limitations section is missing**: the paper should include a limitations section summarizing the limitations of the presented attack algorithms and their evaluation. For example, the evaluation is performed only against an $L_2$ attacker, whereas other norm-based or synthetic attackers could have been considered. The attacks may not work well against specific datasets and models when $\\epsilon$ is small. While these limitations are reported in the paper, they are scattered throughout. A dedicated section would clarify these points.\n\n**Typos and inconsistencies**: there are some typos and inconsistencies in the notation, such as:\n- $R_\\Omega$ in Eq. 3 is not defined when the equation is presented.\n- $x^{(k+1)}$ -> $x^{(k-1)}$ in Eq. 7.\n- The classifier is represented by $H$ in Algorithm A.2, but $h$ is used in the main body of the paper. Additionally, $X$ appears twice in the function in line 3 of Algorithm A.2.\n\nCorrecting these typos and inconsistencies will improve the clarity and readability of the paper.\n\nFinally, another weakness is more generic:\n\n**The proposed attacks are really specific**: the paper is proposing two effective algorithms to forge realistic evasion attacks against deep learning models used for classifying tabular data, an under-explored setting. I think that the contribution is appreciable. However, the chosen setting may limit the impact of the results, since, at the best of my knowledge, tree-based models continue to be the state-of-the-art for classification tasks on tabular data [a]. \n\n[a] Ravid Shwartz-Ziv and Amitai Armon, Tabular Data: Deep Learning is Not All You Need, Information Fusion Volume 81, May 2022, Pages 84-90\n\n**Updates after the authors' response**\nThe authors have provided a satisfying response addressing all the concerns that I have raised as weaknesses. The authors are willing to introduce the findings provided in the response in the next version of their paper, as far as I understood. Moreover, they will also include a dedicated limitations section and correct the typos.\n\nQUESTIONS:\n- Is CAPGD guaranteed to generate an attack that satisfies the dataset and perturbation constraints at the end of execution?\n\n- CAPGD and MOEVA may be unable to generate adversarial examples in specific settings (see results on two models on the CTU dataset in Table 3). What is the reason? Could it be due to the high number of constraints of the dataset? How does the success rate of the two attacks vary considering different numbers and types of constraints (linear and nonlinear)?\n\n- Why may CAA and MOEVA show a smaller success rate when considering higher epsilon values and a higher number of rounds (see Figures 5b and 7b)?\n\nLIMITATIONS:\nThe authors should sum up the limitations of their proposals in a specific section in the paper. The negative societal impact is discussed by the authors who claim that their work may give birth to new and stronger defenses. Finally, the experimental and implementation details have been extensively documented.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2024-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes two adversarial attack methods targeting deep learning models for tabular data. The two methods are: CAPGD (Constrained Adaptive Projected Gradient Descent) and CAA (Constrained Adaptive Attack). CAPGD is a modification based on constrained PGD with step size adjusting, repair operator, additional random initialization, and momentum. CAA is a combination of CAPGD and MOEVA (Multi-Objective Evolutionary Adversarial Attack), which is a search-based attack method. The two methods are combined by iteratively applying the two with CAPGD first. The authors demonstrate the effectiveness of these attacks across five architectures and four datasets.\n\nSTRENGTHS:\nStrengths:\n\n1. Clarity: The motivation and rationale behind the proposed algorithms are clearly presented in a logical order.\n\n2. The paper provides an extensive empirical evaluation of the proposed attacks across multiple datasets and architectures, showcasing their superiority in terms of effectiveness and computational efficiency.\n\nWEAKNESSES:\nWeakness:\n\n1.\tLack of novelty and contribution: CAPGD is modified base don CPGD with a series of commonly used optimization techniques. CAA is a combination of CAPGD and MOEVA, which was proposed by a previous work. \n2.\tThe implementation of CAA, involving the combination of CAPGD and MOEVA, might be complex and resource-intensive, which could limit its practical applicability in some settings. \n3.\tLack of evaluation against defense mechanisms: Section 5.4 briefly discussed potential defense mechanisms, Madry’s adversarial training, which was proposed six years ago. There have been many works proposed since then. It is not fair to say that it is the only reliable defense against evasion attacks.\n\nMinor:\n\n•\tOn page 1, line 30, “This raises anew the need to study …”. Maybe it should be “This raises a new need to study …”?\n\nQUESTIONS:\nNA, see above.\n\nLIMITATIONS:\nNo discussion found for limitation.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2024-07-09"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper considers the evaluation of the robustness of deep learning models applied to tabular data. The authors introduce two novel adversarial attack methods: Constrained Adaptive Projected Gradient Descent (CAPGD) and Constrained Adaptive Attack (CAA). These methods are designed to exploit the vulnerabilities of tabular data models, which often include categorical features, immutability constraints, and feature relationship constraints that are not typically considered in attacks designed for computer vision (CV) or natural language processing (NLP).\n\nCAPGD improves on existing gradient-based attacks by incorporating adaptive mechanisms and eliminating the need for parameter tuning, significantly enhancing the success rate and efficiency of generating valid adversarial examples. CAA further combines CAPGD with the Multi-Objective Evolutionary Adversarial Attack (MOEVA), optimizing both effectiveness and computational cost. The paper demonstrates the superior performance of CAA across various datasets and models, suggesting it should become a standard test for evaluating the robustness of tabular models.\n\nSTRENGTHS:\n- The paper is well-motivated and logically structured, contributing significantly to advancing adversarial machine learning, particularly in the domain of tabular data.\n- The proposed CAA method is SOTA on effectiveness and efficiency, making it a good benchmark for testing the robustness of tabular data models, similar to the role of AutoPGD/AutoAttack in computer vision tasks.\n- The paper includes extensive and systematic experiments, providing solid empirical evidence for the effectiveness of the proposed attacks.\n\nWEAKNESSES:\n- The paper does not provide a clear explanation of the penalty function in Equation (4). A more detailed clarification is needed to understand how this function is formulated and applied.\n- The description of constraints in Equations (1) and (2) is somewhat abstract and difficult to interpret. The authors should refine the descriptions of these constraints to improve clarity.\n\nQUESTIONS:\n- Are there any other constraints in tabular data besides categorical features, immutability, and feature relationship constraints?\n- Why are gradient attacks ineffective on the CTU dataset?\n- Why is feature engineering necessary for the datasets? Have all four datasets considered in the paper undergone feature engineering? It seems that the WiDS dataset has not undergone feature engineering. Is that correct?\n\nLIMITATIONS:\nNone", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-11"}