Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Constrained Adaptive Attack: Effective Adversarial Attack Against Deep Neural Networks for Tabular Data

Thibault Simonetto, Salah Ghamizi, Maxime Cordy

TL;DR

This work tackles adversarial robustness for deep neural networks operating on tabular data, where feature constraints create a challenge for conventional attacks. It introduces CAPGD, a parameter-free gradient attack with momentum and adaptive steps, and a repair mechanism to enforce constraint satisfaction, demonstrated to outperform prior gradient attacks and subsume them. Building on CAPGD, the authors propose CAA, a hybrid attack that sequentially applies CAPGD and MOEVA to maximize effectiveness while reducing computational cost, achieving the strongest results across four datasets and five architectures with substantial accuracy drops and speedups over baselines. The findings establish CAPGD and CAA as essential components of a robust evaluation protocol for tabular ML, with implications for defense design and adversarial training strategies, particularly under realistic feature constraints expressed by Ω.

Abstract

State-of-the-art deep learning models for tabular data have recently achieved acceptable performance to be deployed in industrial settings. However, the robustness of these models remains scarcely explored. Contrary to computer vision, there are no effective attacks to properly evaluate the adversarial robustness of deep tabular models due to intrinsic properties of tabular data, such as categorical features, immutability, and feature relationship constraints. To fill this gap, we first propose CAPGD, a gradient attack that overcomes the failures of existing gradient attacks with adaptive mechanisms. This new attack does not require parameter tuning and further degrades the accuracy, up to 81% points compared to the previous gradient attacks. Second, we design CAA, an efficient evasion attack that combines our CAPGD attack and MOEVA, the best search-based attack. We demonstrate the effectiveness of our attacks on five architectures and four critical use cases. Our empirical study demonstrates that CAA outperforms all existing attacks in 17 over the 20 settings, and leads to a drop in the accuracy by up to 96.1% points and 21.9% points compared to CAPGD and MOEVA respectively while being up to five times faster than MOEVA. Given the effectiveness and efficiency of our new attacks, we argue that they should become the minimal test for any new defense or robust architectures in tabular machine learning.

Constrained Adaptive Attack: Effective Adversarial Attack Against Deep Neural Networks for Tabular Data

TL;DR

This work tackles adversarial robustness for deep neural networks operating on tabular data, where feature constraints create a challenge for conventional attacks. It introduces CAPGD, a parameter-free gradient attack with momentum and adaptive steps, and a repair mechanism to enforce constraint satisfaction, demonstrated to outperform prior gradient attacks and subsume them. Building on CAPGD, the authors propose CAA, a hybrid attack that sequentially applies CAPGD and MOEVA to maximize effectiveness while reducing computational cost, achieving the strongest results across four datasets and five architectures with substantial accuracy drops and speedups over baselines. The findings establish CAPGD and CAA as essential components of a robust evaluation protocol for tabular ML, with implications for defense design and adversarial training strategies, particularly under realistic feature constraints expressed by Ω.

Abstract

State-of-the-art deep learning models for tabular data have recently achieved acceptable performance to be deployed in industrial settings. However, the robustness of these models remains scarcely explored. Contrary to computer vision, there are no effective attacks to properly evaluate the adversarial robustness of deep tabular models due to intrinsic properties of tabular data, such as categorical features, immutability, and feature relationship constraints. To fill this gap, we first propose CAPGD, a gradient attack that overcomes the failures of existing gradient attacks with adaptive mechanisms. This new attack does not require parameter tuning and further degrades the accuracy, up to 81% points compared to the previous gradient attacks. Second, we design CAA, an efficient evasion attack that combines our CAPGD attack and MOEVA, the best search-based attack. We demonstrate the effectiveness of our attacks on five architectures and four critical use cases. Our empirical study demonstrates that CAA outperforms all existing attacks in 17 over the 20 settings, and leads to a drop in the accuracy by up to 96.1% points and 21.9% points compared to CAPGD and MOEVA respectively while being up to five times faster than MOEVA. Given the effectiveness and efficiency of our new attacks, we argue that they should become the minimal test for any new defense or robust architectures in tabular machine learning.
Paper Structure (55 sections, 6 equations, 7 figures, 10 tables, 2 algorithms)

This paper contains 55 sections, 6 equations, 7 figures, 10 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Our contributions can be summarized as follows:
  3. Related work
  4. Tabular Deep Learning
  5. Realistic Adversarial Examples
  6. Problem formulation
  7. Constrained Projected Gradient Descent
  8. Experimental settings
  9. Datasets
  10. Architectures
  11. Perturbation parameters
  12. Evaluation metrics
  13. Our Constrained Adaptive PGD
  14. CAPGD algorithm
  15. Step size selection
  16. ...and 40 more sections

Figures (7)

  • Figure 1: Visualization of the complementarity of CAPGD, CPGD and LowProFool with the number of successful adversarial examples.
  • Figure 2: Visualization of the complementarity of CAPGD, MOEVA and BF* with the number of successful adversarial examples.
  • Figure 3: Impact of CAA budget on the robust accuracy for CTU dataset.
  • Figure 4: Visualization of the utility of CAA's components. For attack A (respectively B) we compute the set of clean examples $C_A$ (respectively $C_B)$) on which the attack is successful. The percentage represents the proportion of the set $C_A \cup C_B$ is covered by $C_B$. CAPGD-NADA is CAPGD without adaptive step, CAPGD-NRAN is CAPGD without the random start, CAPGD-NINI is CAPGD without the clean example initizialisation and CAPGD NREP is CAPGD without repair at each iteration.
  • Figure 5: Robust accuracy with CAA with varying maximum perturbation $\epsilon$ budget.
  • ...and 2 more figures