Constrained Adaptive Attack: Effective Adversarial Attack Against Deep Neural Networks for Tabular Data

Authors: thibault  simonetto
salah  ghamizi
maxime  cordy
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-15 18:36:11

Abstract: State-of-the-art deep learning models for tabular data have recently achieved acceptable performance to be deployed in industrial settings. However, the robustness of these models remains scarcely explored. Contrary to computer vision, there are no effective attacks to properly evaluate the adversarial robustness of deep tabular models due to intrinsic properties of tabular data, such as categorical features, immutability, and feature relationship constraints. To fill this gap, we first propose CAPGD, a gradient attack that overcomes the failures of existing gradient attacks with adaptive mechanisms. This new attack does not require parameter tuning and further degrades the accuracy, up to 81\% points compared to the previous gradient attacks. Second, we design CAA, an efficient evasion attack that combines our CAPGD attack and MOEVA, the best search-based attack.  We demonstrate the effectiveness of our attacks on five architectures and four critical use cases. Our empirical study demonstrates that CAA outperforms all existing attacks in 17 over the 20 settings, and leads to a drop in the accuracy by up to 96.1\% points and 21.9\% points compared to CAPGD and MOEVA respectively while being up to five times faster than MOEVA. Given the effectiveness and efficiency of our new attacks, we argue that they should become the minimal test for any new defense or robust architectures in tabular machine learning.

Main paper: 
 introduction: 
 Evasion attack is the process of slightly altering an original input into an adversarial example designed to force a machine learning (ML) model to output a wrong decision. Robustness to adversarial examples is a problem of growing concern among the secure ML community, with over 10,000 publications on the subject since 2014 [7] . Recent studies also report real-world occurrences of evasion attacks, which demonstrate the importance of studying and defending against this phenomenon [20] .While research has studied the robustness of deep learning models in Computer Vision (CV) and Natural Language Processing (NLP) tasks, many real-world applications instead deal with tabular data, including in critical fields like finance, energy, and healthcare. If classical "shallow" models (e.g. random forests) have been the go-to solution to learn from tabular data [21] , deep learning models are becoming competitive [5] . This raises anew the need to study the robustness of these models.However, robustness assessment for tabular deep learning models brings a number of new challenges that previous solutions -because they were originally designed for CV or NLP tasks -do not consider. One such challenge is the fact that tabular data exhibit feature constraints, i.e. complex relationships and constraints across features. The satisfaction of these feature constraints can be a non-convex or even non-differentiable problem; this implies that established evasion attack algorithms relying on gradient computation do not create valid adversarial examples (i.e., constraint satisfying) [18] . Meanwhile, attacks designed for tabular data also ignore feature type constraints [3] or, in the best case, consider categorical features without feature relationships [39, 40, 4] and are evaluated on datasets that exclusively contain such features. This restricts their application to other domains that present heterogeneous feature types.The only published evasion attacks that support feature constraints are Constrained Projected Gradient Descent (CPGD) and Multi-Objective Evolutionary Adversarial Attack (MOEVA) [35] . CPGD is an extension of the classical gradient-based PGD attack with a new loss function that encodes how far the generated examples are from satisfying the constraints. Although theoretically elegant and practically efficient, this attack suffers from a low success rate due to its difficulty to converge toward both model classification and constraint satisfaction [35] . Conversely, MOEVA is based on genetic algorithms. It offers an outstanding success rate compared to CPGD and works on shallow and deep learning models. However, it is computationally expensive and requires numerous hyper-parameters to be tuned (population size, mutation rate, generations, etc.). This prevents this attack from scaling to larger models and datasets.Overall, research on adversarial robustness for tabular machine learning in general (and tabular deep learning in particular) is still in its infancy. This is in stark contrast to the abundant literature on adversarial robustness in CV [28] and NLP tasks [15] . Given this limited state of knowledge, the objective of this paper is to propose novel and effective attack methods for tabular models subject to feature constraints.We hypothesize that gradient-based algorithms have not been explored adequately in [35] and that the introduction of dedicated adaptive mechanisms can outperform CPGD. To verify this, we design a new adaptive attack, named Constrained Adaptive PGD (CAPGD), whose only free parameter is the number of iterations and that does not require additional parameter tuning (Section 4). We demonstrate that the different mechanisms we introduced in CAGPD contribute to improving the success rate of this attack compared to CPGD, by 81% points. Across all our datasets, the set of adversarial examples that CAPGD generates subsumes all the examples generated by any other gradient-based method. Furthermore, CAPGD is 75 times faster than MOEVA, while the latter reaches the highest success rate across all datasets.These results motivate us to design Constrained Adaptive Attack (CAA), an adaptive attack that combines our new gradient-based attack (CAPGD) with MOEVA for an increased success rate at a lower computational cost. Our experiments show that CAA reaches the highest success rate for all models/datasets we considered, except in one case where CAA is second-best. With this attack, we offer a strong baseline for future research on evasion attacks for tabular models, which should become the minimal test for robust tabular architectures and other defense mechanisms.Our contributions can be summarized as follows:1. We design a new parameter-free attack, CAPGD that introduces momentum and adaptive steps to effectively evade tabular models while enforcing the feature constraints. We show that CAPGD outperforms the other gradient-based attacks in terms of capability to generate valid (constraint-satisfying) adversarial examples.2. We propose a new efficient and effective evasion attack (CAA) that combines gradient and search attacks to optimize both effectiveness and computational cost.3. We evaluate CAA in a large-scale evaluation over four datasets, five architectures, and two training methods (standard and adversarial training). Our results show that CAA outperforms all other attacks and is up to 5 times more efficient.2 Related workThe penalty function transforms each constraint formulation into a differentiable loss function to be minimized by gradient descent (or search algorithm). Table 5 inspired from [35] shows the supported constraints, their translation to penalty function, and examples for each supported constraint. Let's consider one complex constraint from the LCLD credit scoring use case: The term of the loan can only be 36 or 60 months and the number of open accounts is lower than the number of allowed accounts for this client. Such a constraint can be formally written as term ∈ {36, 60}) ∧ (open_acc ≤ total_acc). The AND operator ∧ is equivalent to a sum of losses, while the OR operator ∨ is described as min(|c -a|, |c -b|, ...) in a loss function. Finally, the a ≤ b operator is equivalent to a min(0, a -b) in a loss function. Hence, the complex constraint translates as the following penalty: min(|term -36|, |term -60|) + max(0, open_acc -total_acc). 
tabular deep learning: 
 Tabular data remains the most commonly used form of data [34] , especially in critical applications such as medical diagnosis [38, 36] , financial applications [18, 11, 8] , user recommendation systems [45] , cybersecurity [9, 1] , and more. Improving the performance and robustness of tabular Borisov et al. [5] showed that traditional deep neural networks tend to yield less favorable results in handling tabular data when compared to more shallow machine learning methods, such as XGBoost. However, recent approaches like RLN [33] and TabNet [2] are catching up and even outperforming shallow models in some settings. We argue that DNNs for Tabular Data are sufficiently mature and competitive with shallow models and require therefore a thorough investigation of their safety and robustness. Our work is the first exhaustive study of these critical properties.Initially applied to computer vision, adversarial examples have also been adapted and evaluated on tabular data. Ballet et al. [3] considered feature importance to craft the attacks, Mathov et al. [30] considered mutability, type, boundary, and data distribution constraints, Kireev et al. [24] suggested considering both the cost and benefit of perturbing each feature, and Simonetto et al. [35] introduced domain-constraints (relations between features) as a critical element of the attack.While domain constraints satisfaction is essential for successful attacks, research on robustness for industrial settings (eg Ghamizi et al. [18] with a major bank) also demonstrated that imperceptibility remains important for critical systems with human-in-the-loop mechanisms, which could deflect attacks with manual checks from human operators. Imperceptibility is domain-specific, and multiple approaches have been suggested [3, 24, 16] . None of these approaches was confronted with human assessments or compared with each other, and in our study, we decided to use the most established L 2 norm. Our algorithms and approaches are generalizable to further distance metrics and imperceptibility definitions.Overall, except the work from Simonetto et al. [35] , none of the existing attacks for tabular machine learning supports the feature relationships inherent to realistic tabular datasets, as summarized in Table 1 . Nevertheless, we evaluate all the approaches that support continuous values and where a public implementation is available to confirm our claims: LowProFool, BF*, CPGD, and MOEVA. 
problem formulation: 
 We formulate the problem of evasion attacks under constraints. We assume the attack to be untargeted (i.e. it aims to force misclassification in any incorrect class); the formulation for targeted attacks is similar and omitted for space reasons.We denote by x ∈ R d an input example and by y ∈ {1, . . . , C} its correct label. Let h : R d → R C be a classifier and h c k (x) the classification score that h outputs for input x to be in class c k . Let ∆ ⊆ R d be the space of allowed perturbations. Then, the objective of an evasion attack is to find a δ ∈ ∆ such that argmax c∈{1,...,C} h c (x + δ) ̸ = y.In image classification, the set ∆ is typically chosen as the perturbations within some l p -ball around x, that is, ∆ p = {δ ∈ R d , ||δ|| p ≤ ϵ} for a maximum perturbation threshold ϵ. This restriction aims at preserving the semantics of the original input by assuming that small enough perturbations will yield images that humans perceive the same as the original images and would therefore classify the perturbed input into the same class (while the classifier predicts another class). This also guarantees that the example remains meaningful, that is, x + δ is not an image with random noise.Tabular data are by nature different from images. They typically represent objects of the considered application domain (e.g. botnet traffic [10] , financial transaction [18] ). We denote by φ : Z → R d the feature mapping function that maps objects of the problem space Z to a d-dimensional feature space defined by the feature set F = {f 1 , f 2 , ...f d }. Each object z ∈ Z must inherently respect some natural condition to be valid (to be able to exist in reality). In the feature space, these conditions translate into a set of constraints on the feature values, which we denote by Ω. By construction, any input example x obtained from a real-world object z satisfies Ω, noted x |= Ω.Thus, in the case of tabular data, we additionally require the perturbation δ applied to x to yield a valid example x + δ satisfying Ω, that is,∆ p (x) = {δ ∈ R d : ||δ|| p ≤ ϵ ∧ x + δ |= Ω}.To define the constraint language expressing Ω, we consider the four types of constraint introduced by Simonetto et al. [35] . These four constraint types cover all the constraints of the datasets in our empirical study. Hence, immutability defines what features cannot be changed by an attacker; boundaries defines upper / lower bounds for feature values; type specifies a feature to take continuous, discrete, or categorical values; and feature relationships capture numerical relations between features. Feature relationship constraints can be expressed with the following grammar:EQUATIONEquation 1 means that a constraint formula ω can either be an intersection (∧), or a union (∨) of two other constraint formulae ω 1 , ω 2 , or ω can be a comparison operator ⪰∈ {<, ≤, =, ̸ =, ≥, >} between two values ψ 1 and ψ 2 .Equation 2 details the numeric expressions that are supported by the grammar. A numeric expression ψ can be constant c, an operation ⊕ ∈ {+, -, * , /} between two other numerical expressions ψ 1 and ψ 2 , or a specific feature f i , or the i-th feature of the clean sample. The difference between f i and x i is that f i corresponds to the current value of the evaluated example and x i corresponds to its original value in the clean example.Let's consider one complex constraint from the LCLD credit scoring use case: the term of the loan can only be 36 or 60 months and the number of open accounts is lower than the number of allowed accounts for this client. Such a constraint can be formally written as:EQUATION.We provide other examples in Appendix A.1.Constrained Projected Gradient Descent (CPGD) is an extension of the PGD attack [29] to generate adversarial examples satisfying constraints in tabular machine learning. It integrates constraint satisfaction into the loss function that PGD optimizes. This is achieved by translating each constraint ω into a differentiable function penalty(x, ω) that values to zero if x |= ω; otherwise, the function represents how far x is from satisfying ω. We follow the definition of Table 5 in Appendix A.1 to translate each construct of the constraints grammar into a penalty function.For instance, the penalty function of ω 1 in Equation 3 is:EQUATIONBased on this, CPGD produces adversarial examples from an initial sample x orig classified as y by iteratively computing:EQUATIONwhere x 0 = x orig (the original input), R Ω is a domain-specific repair operator [35] , P S is the projection onto S = {x ∈ R d , ||x -x orig || p ≤ ϵ}, ∇L is the gradient of loss function L, defined asEQUATIONIn the original CPGD implementation, the step size η (k) follows a predefined decay schedule, η (k) = ϵ × 10 -(1+⌊k/⌊K/M ⌋⌋) , with M = 7, and K = max(k). L ′ (x) abbreviates L(x, y, h, Ω).Our experiments are driven by the following datasets, models, and attack parameters. More details about the datasets and models are given in Appendix A.5.Datasets To conduct our study, we selected tabular datasets that present feature constraints from their respective application domain. URL [22] Architectures We evaluate five top-performing architectures from a recent survey on tabular ML [5] : TabTransformer [23] and TabNet [2] are transformer-based models. RLN [33] uses a regularization coefficient to minimize a counterfactual loss. STG [42] optimizes feature selection with stochastic gates, and VIME [43] relies on self-supervised learning. These architectures achieve performance equivalent to XGBoost, the best shallow machine learning model for our use cases.We use the L2-norm to measure the distance between original and perturbed inputs, because this norm is suitable for both numerical and categorical features. We set ϵ to 0.5 for all datasets. Each dataset has a critical (negative) class, respectively phishing URLs, rejected loans, flagged botnets, and not surviving patients. Hence, we only attack clean examples from the critical class that are not already misclassified by the model and report robust accuracy of models.Evaluation metrics We measure the effectiveness of our attack using robust accuracy defined as the accuracy of valid examples generated by a given attack. If a clean example is misclassified, we do not perturb it. If the attack generates an invalid example, we consider it as correctly classified. We measure the efficiency of the attacks in computational time. 
our constrained adaptive pgd: 
 The relative lack of effectiveness of CPGD as reported in its original publication leads us to investigate the cause of these weaknesses. We investigate four factors that may affect the success rate of the attack: (1) we conjecture that the fixed step size and predefined decay in CPGD might be suboptimal because the choice of the step size is known to largely impact the effectiveness of gradient-based attacks [31] ; (2) CPGD is unaware of the trend, i.e. it does not consider whether the optimization is evolving successfully and is not able to react to it; (3) CPGD does not check constraint satisfaction between the iterations, which could "lock" the algorithm into a part of the invalid data space; (4) CPGD starts with the original example, whereas classical gradient-based attacks often benefit from random initialization.We propose Constrained Adaptive PGD (CAPGD), a new constraint-aware gradient-based attack that aims to overcome the limitations of CPGD and improve its effectiveness. We detail CAPGD in Algorithm 1 in Appendix A.2, and summarize its components below.Step size selection We introduce a step-size adaptation. We follow the exploration-exploitation principle by gradually reducing the gradient step [13] . However, unlike CPGD, this reduction does not follow a fixed schedule but is determined by the optimization trend. If the value of the loss function grows, we keep the same step size; otherwise, we halve it. That is, we start with a step η (0) = 2ϵ, and we identify checkpoints w 0 = 0, w 1 , ..., w n at which we decide whether it is necessary to halve the size of the current step. We halve the step size if any of the following two conditions holds:1. Since the last checkpoint, we count how many cases since the last checkpoint w j-1 the update step has successfully increased L ′ . The condition holds if the loss has increased for at least a fraction of ρ steps (we set ρ = 0.75):EQUATION2. The step has not been reduced at the last checkpoint and the loss is less or equal to the loss of the last checkpoint:EQUATION)where L ′ (x) is the loss function, Lmax is the highest loss value in the first j + 1 iterations.Repair operator While equality constraints are included in the penalty function, optimization alone does not achieve exact equality of feature values. Our new repair operator R Ω improved from [35] addresses this by setting the value of the left-hand side of an equation of the form f i = ψ to match the evaluation of the right-hand side in each iteration. It maintains other dataset constraints such as bounds, mutability, and feature types but does not ensure other relational constraints are met.The operator can violate maximum perturbation constraints, yet at each iteration, the perturbation is corrected back within the allowed maximum. This approach has been shown to improve the success rate of CAPGD, as demonstrated by our ablation study in Table 8 . We provide the algorithm in Appendix A.2.As for initialization, we apply the attack from two initial states: the original example x orig and a random example sampled from S (the Lp-ball around x orig ). The goal behind this second initialization is to reduce the risk of being immediately locked into local optima that encompass only invalid examples. Our experiments later reveal the complementary of these two initializations.Gradient step Finally, we introduce in CAPGD a momentum [14] . Let η (k) be the step size at iteration k, then we first compute z (k+1) before the updated example x (k+1) .EQUATIONx(k+1) = R Ω P S x (k) + α • (z (k+1) -x (k) ) + (1 -α) • (x (k) -x (k-1) )where α ∈ [0, 1] (we use α = 0.75 following [13] ) regulates the influence of the previous update on the current, and P S is the projection ontoS = {x ∈ R d , ||x -x orig || p ≤ ϵ}.To evaluate the benefits of CAPGD, we compare it with CPGD as well as LowProFool, to the best of our knowledge, the only other public gradient attack for tabular models that can be extended to support all types of features.CAPGD is more successful than existing gradient attacks. In Table 2 , we compare the robust accuracy across our four datasets and five architectures with CPGD, LowProFool, and CAPGD. CAPGD significantly outperforms CPGD and LowProFool. It decreases the robust accuracy on URL, LCLD, and WIDS datasets to as low as 10.9%, 0.2%, and 10.2% respectively. The results also reveal that gradient attacks are ineffective on the CTU dataset. These results demonstrate that gradient-based attacks are not enough and motivate us to consider combining CAPGD with search-based attacks, as investigated in Section 5. We next propose Constrained Adaptive Attack (CAA), an effective and efficient ensemble of gradient-and searchbased attacks. The idea underlying CAA is that gradientbased attacks for tabular data are more efficient but less successful than search-based attacks. Thus, CAA integrates the best search-based attacks from each family in a complementary way, such that we maximize the set of adversarial examples that can be generated. 
design of caa: 
 Following our related work study, we consider the search attacks MOEVA and BF* Kulynych et al. [26] , Kireev et al. [25] . As a first step, we compare in Figure 2 attack and one search-based attack. One could also include BF* for a slight increase in effectiveness, but this would come at the computational cost of running this attack in addition to the other two; our experimental results (presented below) actually reveal that BF* brings a substantial computational cost compared to CAPGD and MOEVA. Hence, we stick to CAPGD and MOEVA only.The principle of CAA is thus to successively apply CAPGD and MOEVA, in that order. By applying CAPGD first, CAA has the opportunity to generate valid adversarial examples at low computational cost (benefiting from the performance of gradient attacks compared to search attacks). If CAPGD fails on an original example, CAA executes the slower but more effective MOEVA method.We evaluated the effectiveness (robust accuracy) and efficiency (computation time) of CAA compared to the other methods. The hyperparameters of all attacks are fixed for all experiments (see Section A.6 of the appendix) and follow the recommendation given in their original paper. The main advantage of CAA is its ability to find "easy" constrained adversarial using the cheaper gradient attack CAPGD, before processing harder examples with expensive search. We compare in the right panel of In Appendix B.5, we evaluate our attack on shallow models in direct and transferability settings. CAPGD and MOEVA fail to generate adversarial examples on CTU for 2 out of 5 models. In Appendix B.3, we provide a possible explanation for this dataset by evaluating our attacks on different sub-sets of constraints with varying complexity.We study the impact of the attacker's budget on the effectiveness of CAA, in terms of (i) maximum perturbation ϵ and (ii) the number of iterations of its components. We focus on the CTU dataset, which models are the only ones to remain robust through our previous experiments. All the datasets are evaluated in Appendix B.2. Figure 3 reveals in (a) that the maximum perturbation distance ϵ has little impact on the effectiveness of the attack. Increasing the number of iterations for the gradient attack component (b) does not have an impact on the success rate of CAA. Increasing the budget of the search attack component (c) significantly impacts the robustness of some models. While TabTransformer and STG remain robust, the robust accuracy of RLM and VIME drops below 0.4 when doubling the number of search iterations to 200, and to zero with 1000 search iterations.We evaluate the effectiveness of our attack against models made robust with Madry's adversarial training (AT) [29] , using examples generated by the PGD attack. We consider this defense because adversarial training-based methods were shown to be the only reliable defense against evasion attacks [37, 6] . In Table 4 , we show the clean accuracy and the robust accuracy (against CAA) of the adversarially trained models (big numbers in Table 4 ). We also show the accuracy difference with the models trained with standard training (small numbers). In Appendix B.4, we evaluate additional defenses based on adversarial training and data augmentations.Adversarial training can degrade clean and robust performance. As a preliminary check, we investigate whether adversarial training degrades the clean performance of the models. This is important to ensure that a non-increase of robust accuracy does not originate from clean performance degradation (instead of being due to CAA's strength). Our evaluation shows that adversarial training significantly degrades clean performance of the STG and Tabnet architectures. The accuracy of STG models drops to 15.6% and 62.6% for LCLD and WIDS respectively. As for Tabnet models, the clean accuracy drops to 0.0% (LCLD) and 0.2% (CTU). In all other cases, clean accuracy remains stable.CAA remains effective against adversarial training for some architectures. The effectiveness of CAA against robust models is architecture-and dataset-dependent. The attack remains effective on VIME architecture applied to LCLD and WIDS, with robust accuracy as low as 10.1% and 52.2% respectively, as well as on RLN architecture on the WIDS dataset (66.6% robust accuracy and only +5.7% improvement compared to standard training). However, the robustness against CAA of Tabtransformer architecture is significantly improved on URL and LCLD datasets by respectively 47.8% and 62.4%, and marginally improved on WIDS dataset by 19.2%. Similarly, RLN robustness to CAA improves on URL (+45.4%) and LCLD (+63%). 
limitations: 
 We identify three main limitations of our work.Marginal overhead of CAA: In scenarios where CAPGD struggles to attack tabular models, CAA CAA can exhibit a computation overhead (<14%) compared to MOEVA. However, in 4 out of 5 evaluated settings, CAA is faster than MOEVA (up to 5 times).CAPGD effectiveness with complex constraints: CAPGD effectiveness drops when increasing the constraint's complexity in the number of constraints or the number of features involved in each constraint.The mechanisms of CAA assume that the constraints definitions are sound. Incoherences between boundary constraints and feature relation constraints can lead to invalid adversarial examples with large ϵ budgets. 
broader impact: 
 Our work proposes CAA, the most effective evasion attack against constrained tabular ML. We also provided for each dataset at least one combination of architecture combined with AT where CAA can be mitigated. We expect that our work will have a more positive impact by leading to improved defenses in the scarcely explored field of robust tabular ML. 
conclusion: 
 In this work, we first propose CAPGD, a new parameter-free gradient attack for constrained tabular machine learning. We also design CAA, a new Constrained Adaptive Attack that combines the best gradient-based attack (CAPGD) and the best search-based attack (MOEVA). We evaluate our attacks over four datasets and five architectures and demonstrated that our new attacks outperform all previous attacks in terms of effectiveness and efficiency. We believe that our work is a springboard for further research on the robustness of tabular machine learning and to open multiple research perspectives on constrained tabular ML. We hope that CAA will contribute to a faster development of adversarial defenses and recommend it as part of a standard evaluation pipeline of new tabular machine models. ψ1 = ψ2 | ψ1 -ψ2 | rec_per_month = record/month | rec_per_month -(record/month) | ψ1 ≤ ψ2 max(0, ψ1 -ψ2) open_acc ≤ total_acc max(0, open_acc -total_acc) ψ1 < ψ2 max(0, ψ1 -ψ2 open_acc < total_acc max(0, open_acc -total_acc +τ ) +10 -5 ) ω1 ∧ ω2 ω1 + ω2 ((term = 36) ∨ (term = 60))∧ min(| term -36 |, | term -60 |)+ (open_acc ≤ total_acc) max(0, open_acc -total_acc) ω1 ∨ ω2 min(ω1, ω2) (term = 36) ∨ (term = 60) min(| term -36 |, | term -60 |) Appendix A Experimental protocol A. 
code of ethics: 
 Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines? 
broader impacts: 
 Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?Answer: [Yes] Justification: We have provided a "Broader Impact" section to explain the negative impacts of our new approach, and how by studying countermeasures in our work, we expect our research to bring more benefits to the defense community than the attackers. Guidelines:• The answer NA means that there is no societal impact of the work performed.• If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact. • Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations. • The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 
safeguards: 
 Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)? Answer: [NA] Justification: The paper poses no such risks. Guidelines:• The answer NA means that the paper poses no such risks.• Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. • We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort. 12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected? Answer: [Yes] Justification: Appendix A.4 cites the original creators of the datasets and provides their licences.Guidelines:• The answer NA means that the paper does not use existing assets.• The authors should cite the original paper that produced the code package or dataset.• The authors should state which version of the asset is used and, if possible, include a URL. • The name of the license (e.g., CC-BY 4.0) should be included for each asset.• For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided. • If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. • For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. • If this information is not available online, the authors are encouraged to reach out to the asset's creators. 
new assets: 
 Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?Answer: [Yes]Justification: We provide the algorithms of the attack in the Appendix to help understand our implementation. The reproduction package contains the code of all algorithms and experiments and is documented to guide all users.Guidelines:• The answer NA means that the paper does not release new assets.• Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc. • The paper should discuss whether and how consent was obtained from people whose asset is used. • At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file. 
crowdsourcing and research with human subjects: 
 Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?Answer: [NA] Justification: The paper does not involve crowdsourcing nor research with human subjects.Guidelines:• The answer NA means that the paper does not involve crowdsourcing nor research with human subjects. • Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper. • According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector. 
institutional review board (irb) approvals or equivalent for research with human subjects: 
 Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?Answer: [NA] Justification: The paper does not involve crowdsourcing nor research with human subjects, nor any element that requires an Institutional Review Board (IRB) approval. Guidelines:• The answer NA means that the paper does not involve crowdsourcing nor research with human subjects. • Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper. • We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution. • For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review. 
 
 Appendix: Algorithm 1 summarizes the process of CAPGD. At each iteration, we compute the perturbation according to the definition of Equation (l. 7-9). We keep track of the best loss and accordingly best adversarial example found so far (l. 10-12). If we reach a checkpoint in W and one of the conditions of Equation 7or Equation 8 we half the step size η (l. [13] [14] [15] [16] [17] . We return the best adversarial example x max .Algorithm 2 describes the repair operator. For each constraint Ω, if the constraint is an equality = and the left operand ω.left_operand is a feature (l. 3), we verify if the constraint is respected. If not (penalty(x, Ω) > 0)(l.4), we reset the value corresponding to feature ω.left_operand in x such that it equals the penalty function of the right operand ω.right_operand (l. 5). According to the grammar Equation 1 and the penalty function definition in Table 5 , the value feature ω.left_operand must equal the penalty function of ω.right_operand to satify the constraint.Algorithm 3 summarizes the process of CAA. The algorithm takes as input the clean examples X, their associated labels Y , and the classifier H such that H(x) = argmax c∈{1,...,C} h c (x) (including its weights, loss function and probability function), Ω the set of domain constraints, and ϵ the maximum perturbation. We start by creating the mask of examples that are already adversarial (i.e. misclassified by the model) (l.3). We then split the clean examples that are already adversarial X ′ (l.4), and the candidates X C on which we will execute the attacks. For each of our attacks (l.6), we generate a set of potentially adversarial examples from the candidate clean examples (l.7). Once again, we compute the mask of examples that are adversarial according to the subprocedure is_adv described below. According to the mask, we add the successful attack to the output X ′ (l.8) and remove the associated clean examples from the candidate set X C . Hence, for a given example, the Algorithm 1: CAPGD 1: Input: L, h S, Ω, x (0) , y, η, N iter , W = {w 0 , . . . , w n } 2: Output:x max 3: x (1) ← P S x (0) + η∇L ′ (x (0) ) 4: L max ← max{L ′ (x (0) ), L ′ (x (1) )} 5: x max ← x (0) if L max ≡ L ′ (x (0) ) else x max ← x (1) 6: for k = 1 to N iter -1 do 7: z (k+1) ← P S x (k) + η∇L ′ (x (k) ) 8:x(k+1) ← P S x (k) + α(z (k+1) -x (k) ) +(1 -α)(x (k) -x (k-1) ) 9:x (k+1) ← R Ω (x (k+1) )10:if L ′ (x (k+1) ) > L max then 11:x max ← x (k+1) and L max ← L ′ (x (k+1) )12:end if if ω is an EqualityConstraint and ω.left_operand ∈ F then 4:if penalty(x, ω) > 0 then 5:x ω.left_operand ← penalty(x, ω.right_operand)6:end if7:end if 8: end for Algorithm 3: CAA The sub procedure is_adv goes through all the examples X i [k] ∈ X i and adds T rue to the mask, if all of the following conditions hold:1: Input: X, Y, H, Ω, ϵ 2: Output: X ′ 3: adv_mask = is_adv(X, X, Y, H, Ω, ϵ) 4: X ′ ← X[adv_mask] 5: X c ← X[¬adv_mask], Y c = Y [¬adv_mask] 6: for Attack in {CAP GD, M OEV A} do 7: X i ← Attack(X c , Y c , H, Ω, ϵ) 8: adv_mask ← is_adv(X i , X c , Y c , H, Ω, ϵ) 9: X ′ ← X ′ ∪ X i [adv_mask] 10: X c ← X c [¬adv_mask], Y c ← Y c [¬adv_mask] 11: end for 12: X ′ ← X ′ ∪ X c 13: SubProcedure is_adv(X i , X c , Y c , H, Ω, ϵ) : 14: adv_mask ← {} 15: for k = 1 to N iter |X| do 16: adv ← (X i [k] |= Ω) ∧ (H(X i [k]) ̸ = Y c [k]) ∧ (L p (X i [k], X c [k]) ≤ ϵ)• X i [k] respects the domain constraints, • X i [k] classification by His different from its true label Y c [k],• X i [k] pertubation w.r.t to X c [k] is lower or equal to ϵ.Our dataset design followed the same protocol as Simonetto et al. [35] . We present in Table 6 the attributes of our datasets and the test performance achieved by each of the architectures.Credit scoring -LCLD (licence: CC0: Public Domain) We engineer a dataset from the publicly available Lending Club Loan Data1 . This dataset contains 151 features, and each example represents a loan that was accepted by the Lending Club. However, among these accepted loans, some are not repaid and charged off instead. Our goal is to predict, at the request time, whether the borrower will be repaid or charged off. This dataset has been studied by multiple practitioners on Kaggle. However, the original version of the dataset contains only raw data and to the extent of our knowledge, there is no featured engineered version commonly used. In particular, one shall be careful when reusing feature-engineered versions, as most of the versions proposed present data leakage in the training set that makes the prediction trivial. Therefore, we propose our own feature engineering. The original dataset contains 151 features. We remove the example for which the feature "loan status" is different from "Fully paid" or "Charged Off" as these represent the only final status of a loan: for other values, the outcome is still uncertain. For our binary classifier, a 'Fully paid" loan is represented as 0 and a "Charged Off" as 1. We start by removing all features that are not set for more than 30% of the examples in the training set. We also remove all features that are not available at loan request time, as this would introduce bias. We impute the features that are redundant (e.g. grade and sub-grade) or too granular (e.g. address) to be useful for classification. Finally, we use one-hot encoding for categorical features. We obtain 47 input features and one target feature. We split the dataset using random sampling stratified on the target class and obtained a training set of 915K examples and a testing set of 305K. They are both unbalanced, with only 20% of charged-off loans (class 1). We trained a neural network to classify accepted and rejected loans. It has 3 fully connected hidden layers with 64, 32, and 16 neurons.For each feature of this dataset, we define boundary constraints as the extremum value observed in the training set. We consider the 19 features that are under the control of the Lending Club as immutable. We identify 10 relationship constraints (3 linear, and 7 non-linear ones).URL Phishing -ISCX-URL2016 (license CC BY 4.0) Phishing attacks are usually used to conduct cyber fraud or identity theft. This kind of attack takes the form of a URL that reassembles a legitimate URL (e.g. user's favorite e-commerce platform) but redirects to a fraudulent website that asks the user for their personal or banking data. [22] extracted features from legitimate and fraudulent URLs as well as external service-based features to build a classifier that can differentiate fraudulent URLs from legitimate ones. The feature extracted from the URL includes the number of special substrings such as "www", "&", ",", "$", "and", the length of the URL, the port, the appearance of a brand in the domain, in a subdomain or in the path, and the inclusion of "http" or "https". External service-based features include the Google index, the page rank, and the presence of the domain in the DNS records. The complete list of features is present in the reproduction package. [22] provide a dataset of 5715 legit and 5715 malicious URLs. We use 75% of the dataset for training and validation and the remaining 25% for testing and adversarial generation.We extract a set of 14 relation constraints between the URL features. Among them, 7 are linear constraints (e.g. length of the hostname is less or equal to the length of the URL) and 7 are Boolean constraints of the type if a > 0 then b > 0 (e.g. if the number of http > 0 then the number slash "/" > 0).Botnet attacks -CTU-13 (license CC BY NC SA 4.0) This is a feature-engineered version of CTU-13 proposed by [9] . It includes a mix of legit and botnet traffic flows from the CTU University campus. Chernikova WiDS (license: PhysioNet Restricted Health Data License 1.5.02 ) [27] dataset contains medical data on the survival of patients admitted to the ICU. The goal is to predict whether the patient will survive or die based on biological features (e.g. for triage). This very unbalanced dataset has 30 linear relation constraints.Table 7 summarizes the family, model architecture, and hyperparameters tuned during the training of our models.TabTransformer is a transformer-based model [23] . It uses self-attention to map the categorical features to an interpretable contextual embedding, and the paper claims this embedding improves the robustness of models to noisy inputs.TabNet is another transformer-based model [2] . It uses multiple sub-networks that are used in sequence. At each decision step, it uses sequential attention to choose which features to reason. TabNet aggregates the outputs of each step to obtain the decision.RLN or Regularization Learning Networks [33] uses an efficient hyperparameter tuning scheme in order to minimize a counterfactual loss. The authors train a regularization coefficient to weights in the neural network in order to lower the sensitivity and produce very sparse networks.STG or Stochastic Gates [42] uses stochastic gates for feature selection in neural network estimation problems. The method is based on probabilistic relaxation of the l 0 norm of features or the count of the number of selected features.VIME or Value Imputation for Mask Estimation [43] uses self and then semi-supervised learning through deep encoders and predictors.For existing attacks, we reuse the hyperparameters proposed in their respective papers. For LowPro-Fool, we use a small step size of η = 0.001, λ = 8.5 rade off factor between fooling the classifier and generating imperceptible adversarial example, and run the attack for N iter = 20, 000 iterations. All other gradient attacks run for N iter = 10 iterations. The schedule of decreasing steps of CPGD uses M = 7. In CAPGD, we fix the checkpoints as w j = ⌈p j N iter ⌉ ≤ N iter , with p j ∈ [0, 1] defined as p 0 = 0, p 1 = 0.22 and p j+1 = p j + max{p j -p j-1 -0.03, 0.06}.. The influence of the previous update on the current update is set to α = 0.75, and ρ = 0.75 for the halving of the step. MOEVA runs for n gen = 100 iterations generating n of f = 100 offspring per iteration. Among the offspring, n pop = 200 survive and are used for mating in the next iteration.With BF*, we discretize numerical features in n bin = 150 bins. We run the attack for a maximum of N iter = 100 iterations. CAA applies CAPGD and MOEVA with the same parameters.We run our experiments on an HPC cluster node with 32 cores and 64GB of RAM dedicated to our task. Each node consists of 2 AMD Epyc ROME 7H12 @ 2.6 GHz for a total of 128 cores with 256 GB of RAM.The source code, datasets and pre-trained models to reproduce the experiments of this paper are available with the submission. The source code will be available publicly upon acceptance under the MIT license or similar.All components of CAPGD contribute to its effectiveness. We conduct an ablation study on the components of CAPGD. We evaluate CAPGD without the repair operator at each iteration (NREP), without the initialization with clean example (NINI), without the initialization with random sampling (NRAN), and without the adaptive step (NADA). Table 8 reveals that removing a component of CAPGD reduces its effectiveness. Interestingly, not all components affect all datasets similarly. For instance, removing the repair at each gradient iteration only affects the LCLD datasets' success rate.For URL and WIDS, CAPGD-NREP remains in the confidence interval of CAPGD. Removing any other components always negatively affects CAPGD, up to an improvement of 32.1% of the robust accuracy for CAPGD-NADA on the WIDS dataset and TabNet model.CAPGD components are complementary. None of the components of CAPGD negatively affects its capability of finding an adversarial example for a given clean example. In Figure 4 successful. The percentage in the heatmaps represents the proportion ofC A ∪ C B covered by C B , that is coverage = |C B | |C A ∪ C B |where |C| is the cardinality of C. Attack B subsumes A when coverage = 1. In practice, to avoid random effect, we run the attack for N = 5 seeds, and take the union of clean examples on which we generate a successful example.Figure 4 reveals that CAPGD subsumes all its variants with coverage over 99%, while none of the variants subsumes CAPGD. Therefore all components of CAPGD are necessary to obtain the strongest attack.In this section, we study the impact of CAA's budget on its effectiveness. We consider 3 budgets: the maximum perturbation ϵ allowed, the number of iterations in the gradient attack CAPGD (without changing MOEVA's budget), and the number of iterations in the search attack MOEVA (without changing CAPGD's budget). For each budget, we provide figures and detailed numerical results in tables, corresponding to the same experiment.Maximum perturbation ϵ Figure 5 (numerical results in Table 9 ) reveals that increasing the maximum perturbation ϵ for CAA reduces the robust accuracy of the model in 16/20 cases.Number of CAPGD iterations Figure 6 (numerical results in Table 10 ) reveals that increasing the number of iterations for the gradient attack component has a limited impact on the success rate of CAA. The maximum drop of accuracy is 3.5% points between 10 and 100 iterations for WIDS/TabNet.Number of MOEVA iterations Figure 8 (numerical results in Table 11 ) reveals that increasing the number of iterations for the search attack component only reduces the robust accuracy in 4/20 cases (URL/VIME, URL/STG, CTU/VIME, and CTU/RLN).We also observe that for TabTransformer and LCLD the robust accuracy increases with the number of search iterations. MOEVA is a multi-objective genetic algorithm. An inherent problem of multiobjective optimization is the trade-off between the objectives. If all solutions in the population are on the Pareto front, the algorithm must decide which solutions to discard for the next iteration, potentially discarding a valid adversarial example in our case.Figure 7 shows the evolution of the success rate of MOEVA with the number of iterations in the same settings as in Figure 8b for TabTransformer. We find that the success rate reaches a maximum with 100 iterations. We argue that valid adversarial examples were discarded when the search continued to 1000 iterations. To confirm our hypothesis, we run the same experiment with a 10 times larger search population, such that more solutions are preserved at each iteration. We observe that in this setting, MOEVA converges slower (due to less selection pressure) but the success rate strictly increases with the number of generations. Increasing the population size also increases the execution time (by 3.4x in this case), due to the selection operator overhead.Our approach CAA aims at minimizing the memory and computation overheads while maximizing the success rate, and CAA can be tuned to lead to lower robust accuracy with more iterations if the search space is expanded (for example with larger populations). In this section, we study the impact of the constraints' complexity on CAA's effectiveness.CAPGD and MOEVA fail to generate adversarial examples on CTU for 2 out of 5 models. CTU dataset has a large number of constraints compared to the other datasets, and some are particularly challenging. We argue that some of these constraints hinder gradient attacks and are harder to optimize. To confirm our hypothesis and provide additional insights, we split the constraints of CTU based on their complexity. We consider two aspects of constraint complexity: the number of constraints to satisfy and the number of features involved in a single constraint.We split the constraints of CTU as follows:• CG0 One constraint involving 90 features in the form of F i = F j where both sums represent the total number of sent packets. • CG1 One constraint involving 90 features in the form of F i = F j where both sums represent the total number of received packets. • CG2 34 constraints in the form of BY T E/P ACKET S ≤ 1500, to model the fact that each packet contains at most 1500 bytes. • CG3 324 constraints in the form of A ≤ B where A and B are statistical properties (min, max, sum) for each port, and direction.First, we ran an ablation study, where we ignored one bucket of constraint at a time. Next, we studied the success rate when we considered each bucket separately. Finally, we reported the impact of the number of constraints to optimize from CG3, the largest bucket.The results in Table 12 show that for gradient attacks, removing one type of constraint is not enough to improve the success rate. Constraints across multiple remaining categories are not satisfied. The individual bucket study confirms that only when considering constraints of type CG2 alone, CAPGD improves its success rate (in VIME and TabNet). When only considering CG3 constraints, reducing the number of constraints improves the success rate (by reducing robust accuracy from 95.3% when considering 100% of CG3 constraints to 84.5% and 43.0% respectively when considering 50% and 10% of the constraints). In addition to the application of adversarial training alone, we evaluate the robustness of the models when training with data augmentation. [32] showed that combining data augmentation with adversarial training can increase the robustness of models. We also observe in RobustBench [12] , that top-performing models are trained with data augmentation. We consider two data augmentation techniques: Cutmix [44] and CT-GAN [41] . We evaluated CAA on these two defenses and report in Table 13 the robust accuracy of these defenses, compared to the robustness of the vanilla Madry AT on all our datasets and models. The results are the average over 5 seeds run to ensure reliable evaluation. Our experiments show that these new defenses can significantly improve the robustness of the models to CAA, but that our new attack remains effective for URL and LCLD datasets across all architectures, and for WIDS on TabTransformer and STG architectures. Guidelines:• The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper. • The authors are encouraged to create a separate "Limitations" section in their paper.• The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be. • The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated. • The authors should reflect on the factors that influence the performance of the approach.For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon. • The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size. • If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness. • While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.• The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper. • The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions). • The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.) • The assumptions made should be given (e.g., Normally distributed errors). • It should be clear whether the error bar is the standard deviation or the standard error of the mean. Justification: We report the exact hardware used for our experiment in Appendix A.7. The execution time is included in the main paper as part of our experiments in Table 3 .Guidelines:• The answer NA means that the paper does not include experiments.• The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage. • The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute. • The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).Justification: We read and conform to the code of ethics and all laws and regulations in our jurisdiction.Guidelines:• The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.• If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics. • The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).38th Conference on Neural Information Processing Systems (NeurIPS 2024).https://www.kaggle.com/wordsforthewise/lending-clubhttps://physionet.org/content/widsdatathon2020/view-license/1.0.0/ 


Decision: **Summary of the paper**

This paper proposes a new attack method for generating adversarial perturbations against deep neural networks for tabular data. Specifically, the authors propose adaptive mechanisms that overcome the problems of existing gradient-based attack methods. Then, they strengthen their attack method by combining it with an existing search-based attack. With a set of experiments, the authors demonstrate the effectiveness of the attack.

**Summary of the discussion**
* The reviewers observed several strengths of this paper, including its novelty, the importance of the problem domain, and the extensive number of experiments.
* Reviewer XFcC pointed out two weaknesses.
  * First, the definition of the penalty function needs to be clarified.
  * Second, some descriptions are difficult to understand, and more clarification is needed.
  * The authors provided more detailed explanations in the rebuttal, saying they would address the reviewer’s concern in the revised version.
  * After the discussion, the reviewer increased the rating from 6 to 7.
* Reviewer JEHw pointed out three weaknesses.
  * First, the reviewer believes the proposed method lacks novelty. Regarding the novelty of the work, the authors emphasized that finding the appropriate attack method for tabular data was already the first challenge they overcame and that combining existing attacks is an active line of research.
  * Second, the proposed method might be too complicated and resource-intensive. Regarding resource consumption, the authors mentioned that the proposed method only induces marginal overhead if the constraint evaluation is parallelized.
  * Third, the reviewer says the authors only compared to old defense mechanisms. For the last weakness, the authors admitted that it is a critical point and then provided more results against five additional defenses in the revised version.
  * After the discussion, the reviewer increased the rating from 4 to 6.
* Reviewer 5k6D pointed out five weaknesses.
  * First, the algorithm description is not clear. Regarding the first weakness, the authors clarified the part the reviewer asked for, i.e., the role of the repair operator.
  * Second, the analysis of the result can be improved further. Regarding the second weakness, the authors admitted the reviewer's concerns and provided some rough analysis of the part the reviewer mentioned.
  * Third, there is no dedicated section for the proposed method's limitations. Regarding the third concern, the authors added a dedicated section for the limitation of their work.
  * Fourth, there are typos and inconsistencies in notations. Regarding the minor issues in writing, the authors addressed the concerns by fixing typos.
  * Last, the proposed method's impact is limited to a specific domain. Regarding the reviewer's point that tree-based models outperform deep neural networks on tabular data, the authors claimed that the proposed method has potential application to any existing model, including tree-based models.
  * After the discussion, the reviewer increased the rating from 6 to 7.
* Reviewer aMTd pointed out three weaknesses of the paper.
  * First, the proposed idea has already been explored by existing work. Regarding the first weakness, the authors admitted that the idea of a differentiable penalty function is not their novel contribution. However, they also point out that the penalty function alone is not enough for an effective adversarial attack, emphasizing their contribution in improving the mechanism.
  * Second, the proposed method looks like a mere improvement of an existing algorithm. Regarding the second concern, the authors list four novel mechanisms they introduced in their method. The authors also pointed out that finding the proper attack method was already a big challenge when attacking tabular data.
  * Third, the reviewer raised a concern about the authors’ meta-attack design. Regarding the last concern, the author appreciated the reviewer’s concern regarding their meta-attack design and emphasized its contributions.
  * After the discussion, the reviewer increased the rating from 4 to 5.

**Justification of my evaluation**

* My rating is 6 (or 7 with lower confidence).
* To the best of my knowledge, adversarial attacks on tabular data have not been explored enough, and this work contains enough contributions for acceptance.
* During the discussion, the authors communicated very effectively with the reviewers. All the reviewers increased their ratings after the discussion, which is impressive.

I recommend accepting this work (spotlight). However, I’m unsure whether I can recommend it for the spotlight. I’d ask the SAC for some guidance.

Reviews: review: paper_summary: paper_summary: This paper considers the evaluation of the robustness of deep learning models applied to tabular data. The authors introduce two novel adversarial attack methods: Constrained Adaptive Projected Gradient Descent (CAPGD) and Constrained Adaptive Attack (CAA). These methods are designed to exploit the vulnerabilities of tabular data models, which often include categorical features, immutability constraints, and feature relationship constraints that are not typically considered in attacks designed for computer vision (CV) or natural language processing (NLP).

CAPGD improves on existing gradient-based attacks by incorporating adaptive mechanisms and eliminating the need for parameter tuning, significantly enhancing the success rate and efficiency of generating valid adversarial examples. CAA further combines CAPGD with the Multi-Objective Evolutionary Adversarial Attack (MOEVA), optimizing both effectiveness and computational cost. The paper demonstrates the superior performance of CAA across various datasets and models, suggesting it should become a standard test for evaluating the robustness of tabular models.
strength_weakness: strength_weakness: - The paper does not provide a clear explanation of the penalty function in Equation (4). A more detailed clarification is needed to understand how this function is formulated and applied.
- The description of constraints in Equations (1) and (2) is somewhat abstract and difficult to interpret. The authors should refine the descriptions of these constraints to improve clarity.
questions: questions: - Are there any other constraints in tabular data besides categorical features, immutability, and feature relationship constraints?
- Why are gradient attacks ineffective on the CTU dataset?
- Why is feature engineering necessary for the datasets? Have all four datasets considered in the paper undergone feature engineering? It seems that the WiDS dataset has not undergone feature engineering. Is that correct?
limitations: limitations: None
paper_summary: paper_summary: The paper proposes two adversarial attack methods targeting deep learning models for tabular data. The two methods are: CAPGD (Constrained Adaptive Projected Gradient Descent) and CAA (Constrained Adaptive Attack). CAPGD is a modification based on constrained PGD with step size adjusting, repair operator, additional random initialization, and momentum. CAA is a combination of CAPGD and MOEVA (Multi-Objective Evolutionary Adversarial Attack), which is a search-based attack method. The two methods are combined by iteratively applying the two with CAPGD first. The authors demonstrate the effectiveness of these attacks across five architectures and four datasets.
strength_weakness: strength_weakness: Weakness:

1.	Lack of novelty and contribution: CAPGD is modified base don CPGD with a series of commonly used optimization techniques. CAA is a combination of CAPGD and MOEVA, which was proposed by a previous work. 
2.	The implementation of CAA, involving the combination of CAPGD and MOEVA, might be complex and resource-intensive, which could limit its practical applicability in some settings. 
3.	Lack of evaluation against defense mechanisms: Section 5.4 briefly discussed potential defense mechanisms, Madry’s adversarial training, which was proposed six years ago. There have been many works proposed since then. It is not fair to say that it is the only reliable defense against evasion attacks.

Minor:

•	On page 1, line 30, “This raises anew the need to study …”. Maybe it should be “This raises a new need to study …”?
questions: questions: NA, see above.
limitations: limitations: No discussion found for limitation.
paper_summary: paper_summary: This paper introduces two novel adversarial attacks, specifically designed to target the evasion of deep neural networks (DNNs) in classification tasks involving tabular data satisfying real-world constraints. The first attack, CAPGD, is a gradient-based method that enhances the constrained PGD (CPGD) attack proposed in [33] by incorporating improvements from the APGD definition [12], such as the addition of momentum and an optimized step size selection. The second attack, CAA, combines the efficient but less effective CAPGD with another search-based attack, MOEVA, which is more effective but less efficient regarding the computational time required to perform the attack.
The extensive experimental evaluation on four tabular datasets and five DNNs for tabular data demonstrates that CAPGD significantly improves the success rate of generating successful adversarial examples compared to CPGD. Furthermore, CAA achieves a reasonable trade-off between efficacy and computational efficiency, offering higher attack efficacy than CAPGD and requiring less computational time than MOEVA.
strength_weakness: strength_weakness: Even though the proposal is good, I think that some weaknesses about the presentation of the proposal and the analysis of the results need to be addressed in the final version of the paper:

**The description of CAPGD should be improved**: the description of CAPGD can be enhanced by better explaining the role of the repair operator. Specifically, the authors mention that constraints of the form $f = \psi$ are enforced at every iteration by the repair operator. However, it is not clear whether applying this operator at every iteration guarantees the generation of an adversarial example that satisfies all dataset constraints and the maximum perturbation constraint by the end of the execution. This is a crucial property, as the attack cannot be tested if it does not satisfy the constraints, potentially wasting the time required to generate the attack.

**The depth of the analysis of the results should be improved**: the depth of the analysis of the results can be improved by discussing particular results to understand their causes and how to mitigate these cases. For instance, CAPGD and MOEVA fail to generate adversarial examples on the CTU dataset for 2 out of 5 models (Table 3 and results in the Appendix). This failure may be due to the high number of constraints (360) considered for this dataset, since the two attacks are more effective on the other datasets for which at most 30 constraints are considered. It would be interesting to evaluate the efficacy of the two attacks by varying the number of constraints considered for the CTU dataset, to better highlight the limitations of the proposed attacks.
Additionally, CAA generates less effective attacks with higher epsilon values (Figure 5b), and MOEVA generates less effective attacks with a higher number of iterations (Figure 7b). Even though these results are sporadic, they are counterintuitive, as the search space for adversarial examples increases with higher epsilon and more mutation rounds. A detailed discussion of these phenomena would provide valuable insights.

**The limitations section is missing**: the paper should include a limitations section summarizing the limitations of the presented attack algorithms and their evaluation. For example, the evaluation is performed only against an $L_2$ attacker, whereas other norm-based or synthetic attackers could have been considered. The attacks may not work well against specific datasets and models when $\epsilon$ is small. While these limitations are reported in the paper, they are scattered throughout. A dedicated section would clarify these points.

**Typos and inconsistencies**: there are some typos and inconsistencies in the notation, such as:
- $R_\Omega$ in Eq. 3 is not defined when the equation is presented.
- $x^{(k+1)}$ -> $x^{(k-1)}$ in Eq. 7.
- The classifier is represented by $H$ in Algorithm A.2, but $h$ is used in the main body of the paper. Additionally, $X$ appears twice in the function in line 3 of Algorithm A.2.

Correcting these typos and inconsistencies will improve the clarity and readability of the paper.

Finally, another weakness is more generic:

**The proposed attacks are really specific**: the paper is proposing two effective algorithms to forge realistic evasion attacks against deep learning models used for classifying tabular data, an under-explored setting. I think that the contribution is appreciable. However, the chosen setting may limit the impact of the results, since, at the best of my knowledge, tree-based models continue to be the state-of-the-art for classification tasks on tabular data [a]. 

[a] Ravid Shwartz-Ziv and Amitai Armon, Tabular Data: Deep Learning is Not All You Need, Information Fusion Volume 81, May 2022, Pages 84-90

**Updates after the authors' response**
The authors have provided a satisfying response addressing all the concerns that I have raised as weaknesses. The authors are willing to introduce the findings provided in the response in the next version of their paper, as far as I understood. Moreover, they will also include a dedicated limitations section and correct the typos.
questions: questions: - Is CAPGD guaranteed to generate an attack that satisfies the dataset and perturbation constraints at the end of execution?

- CAPGD and MOEVA may be unable to generate adversarial examples in specific settings (see results on two models on the CTU dataset in Table 3). What is the reason? Could it be due to the high number of constraints of the dataset? How does the success rate of the two attacks vary considering different numbers and types of constraints (linear and nonlinear)?

- Why may CAA and MOEVA show a smaller success rate when considering higher epsilon values and a higher number of rounds (see Figures 5b and 7b)?
limitations: limitations: The authors should sum up the limitations of their proposals in a specific section in the paper. The negative societal impact is discussed by the authors who claim that their work may give birth to new and stronger defenses. Finally, the experimental and implementation details have been extensively documented.
paper_summary: paper_summary: This paper aims to study the problem of finding adversarial examples for tabular datasets. Different from attacking image models or text models, attacking tabular models requires finding adversarial examples which are legal, which do not violate the relation between features. Moreover, it also requires to tackle both numerical and categorical features.
strength_weakness: strength_weakness: However, I still have concerns on this paper. Specifically, many terms / techniques used in the method are not originally proposed by this paper. For example,  
1. In terms of the main objective (as discussed in Section 3.1), one key step to let adversarial examples satisfy the feature constraints (in Eq.1 and Eq.2) is to translate into a differentiable function. However, this is proposed by the previous work Simonetto et al, 2021. 
2. In terms of the solving algorithm (as discussed in Section 4.1), the author propose CAPGD, which seems a fine-tuning / lightweight modification of the previous method CPGD. This also limit the technical contribution of this paper. 
3. Finally, the author claims trying both CAPGD (proposed in this paper) and MOEVA (previous work) and BF* (previous work) can improve the attack successful rate. 

Overall, I do not hesitate about the effectiveness of combining these strategies for solving the attack problem. Instead, I am concerned of the originality and the significance of the work. Besides, although the authors discussed the reasons on why differentiable models are considered in this paper, I still believe that undifferentiable models like XGBoost is one important branch of models for solving the tabular data classification tasks. I encourage the authors also investigate possible solutions for undifferentiable models.
questions: questions: Plz see the weakness.
limitations: limitations: I didn't see such a discussion.

Comments: title: Summary of our improvements
Summary of our improvements
Official Comment by Reviewer 5k6D
Compliments to the authors for their high-quality response.
comment: I thank the authors for the detailed response. My concerns have been well resolved. In addition, I appreciate the additional experimental results reported in the rebuttal, which demonstrate the practicality of the proposed attacks. Therefore, I would like to increase my score from 6 to 7 accordingly.
Dear reviewer,
we thank you again for your constructive feedbacks, and your suggestions to improve our work.

We would like to highlight that we have addressed during this rebuttal all your concerns and interrogations and we have provided additional insights and results to support our claims.
In particular, we have adressed the weaknesses you raised as follows:

*  W1: Lack of novelty and contribution.

=> A1: We have elabotated on the complex process of desiging our new CAPGD attack, that required analyzing multiple improvement mechanisms, their interactions, thus leading to only including in CAPGD the most relevant mechanisms. Our CAPGD design is the best that could be achieved for gradient attacks in tabular ML. We also detailed the inception of our new meta-attack, CAA and explained why its design is not straightforward and required the analysis, selection and evaluation of 10 existing attacks. 

* W2: The implementation of CAA might be complex and resource-intensive

=> A2: We elaborated on our previous analysis on the computation cost and execution time of CAA compared to MOEVA (Table 3 of our manuscript) and explained that CAA is marginally more ressource-intensive than MOEVA in one over 4 datasets and significantly more efficient than MOEVA in the 3 remaining datasets.

* W3: Lack of evaluation against defense mechanisms

=> A3: We have implemented 5 new defenses using extensive data augmentation and adversarial training. Our new defenses leverage some of the best and most recent generative models of tabular data and required the training of complex generative models to generate 100 times more synthetic examples and achieve the best adversarial training defenses. Our new extensive experiments show that these new defenses can significantly improve the robustness of the models to CAA, but that our new CAA attack remains effective for URL and LCLD datasets across all architectures, and for WIDS on TabTransformer and STG architectures. 

If you find our answers and discussion satisfactory, we would greatly appreciate it if you could increase your score accordingly. If there are any remaining issues or questions, we would be more than happy to address them before the discussion period ends.

Thank you again for your insights and the discussion points you raised.
Dear reviewer,
we thank you again for your constructive feedbacks, and your support of our work.
We would like to highlight that we have addressed during this rebuttal all your concerns and interrogations and we have provided additional insights and results to support our claims.
In particular, we have adressed your interrogations as follows:

*  Q1: Are there any other constraints in tabular data besides categorical features, immutability, and feature relationship constraints?

=> A1: To the best of our knowledge, our work covers all the constraints related to tabular data.

* Q2: Why are gradient attacks ineffective on the CTU dataset?

=> A2: We provided a detailed analysis in the common answer with an analysis of the constraints of CTU. CTU is robust because of the number of constraints and the number of features involved in each constraint.

* Q3: Why is feature engineering necessary for the datasets?

=> A3: We did not run any additional feature engineering on the datasets. Each dataset was designed by a different source and may have required dedicated feature engineering. We were not involved in this step.

If you find our answers and discussion satisfactory, we would greatly appreciate it if you could increase your score accordingly. If there are any remaining issues or questions, we would be more than happy to address them before the discussion period ends.

Thank you again for your insights and the discussion points you raised.
I appreciate your investigation, which provides an intuition about the robustness of STG. Adding these observations to the paper will certainly strengthen your contribution. Thanks again; I will continue the discussion with the reviewers.
We thank you for your praise of our rebuttal and we are happy to see you increase your score following our answers. 
To answer your observation on Table 3 on the author's response PDF. We confirm that STG architecture is the hardest to attack both with gradient and search attacks. We show consistent robustness of STG in Table 3 of our main submission across all the datasets. 

STG [A] is a novel architecture that implements an embedded nonlinear feature selection method by introducing the stochastic gates to the input layer (the feature space) of a neural network. The randomness introduced on the fly to select the features for training and inference significantly hinders evasion attacks, both gradient and search attacks.

There is a similar phenomenon in the benchmark by Croce et al. for computer vision (Robustbench). In their evaluation of AutoAttack, they clearly "rule out classifiers which have (1) zero gradients with respect to the input, (2) randomized classifiers, and (3) classifiers that use an optimization loop at inference time" [B].
Contrary to their benchmark, we decided to cover one architecture per family of mechanisms from the Tabular ML literature, including stochastic mechanisms (STG belongs to categories 2 and 3 discarded in Robustbench).

In Table 3 of our main paper, while we demonstrate that STG is the most robust, our study uncovers some cases where STG robust accuracy could still be significantly decreased with CAA (LCLD, URL), while other datasets will be challenging targets for future research (CTU).

We appreciate your feedback on this pattern and the discussion it raises. In the appendix, we described the mechanisms of each architecture but did not connect the mechanisms with the observed robustness. Following your insight, we will also update this section to explain how each mechanism could impact the robustness (a complete verification of each mechanism impact would be a natural follow-up for dedicated papers).

Thank you again for this discussion and the points you raised. They have significantly improved our final version.   

[A] Yamada, Yutaro, et al. "Feature selection using stochastic gates." ICML, 2020.

[B] Croce et al. "Robustbench: a standardized adversarial robustness benchmark."(NeurIPS, 2021).
We thank you for your response and positive feedback on our extended analysis and new results. We appreciate that you have increased your score to 5 and are happy to provide any additional insight or answer any interrogation you may have to fully satisfy your requirements for a clear acceptance of our work.
We thank the reviewer's response. I agree with the reviewer that this method is potential to be served as a good baseline strong attack in the related literature, thanks to the authors' effort on trying different strategies for performance improvement. It is also insightful to see the transferability of attacking between different types of models. Thus, I increase the rating to 5.
I sincerely thank the authors for their wide and deep response. Their points sound reasonable and clarify the open points that I raised in the review. I hope that the authors will discuss their new results in the next version of their paper. 

I have only an observation about the results in Table 3 of the attached PDF. It seems to me that attacking STG is difficult independently of the considered constraints since its robust accuracy is always 95.3%. Understanding if the model is really robust or if a better attack is needed could be an interesting future work.

I will modify my review to acknowledge your response and improve my score, given the depth of your analysis and dedication you have shown in your response.