Constrained Adversarial Perturbation
Virendra Nishad, Bhaskar Mukhoty, Hilal AlQuabeh, Sandeep K. Shukla, Sayak Ray Chowdhury
TL;DR
This work introduces CAPX, a constrained universal perturbation method that enforces domain-specific feature constraints via an augmented Lagrangian min–max optimization, yielding perturbations with high attack success rates and substantially reduced runtimes across finance, IT networks, healthcare, and cyber-physical systems. The framework supports extensions to CAPx for individual perturbations and includes a data-driven procedure to learn feature constraints from normal data, improving applicability in domains with structured inputs. Empirical results show CAPX outperforms baselines like UAP and ConAML in both efficacy and efficiency, while CAPx demonstrates competitive performance for input-specific attacks. The findings underscore the need for robustness guarantees and defense strategies that account for domain constraints in adversarial settings.
Abstract
Deep neural networks have achieved remarkable success in a wide range of classification tasks. However, they remain highly susceptible to adversarial examples - inputs that are subtly perturbed to induce misclassification while appearing unchanged to humans. Among various attack strategies, Universal Adversarial Perturbations (UAPs) have emerged as a powerful tool for both stress testing model robustness and facilitating scalable adversarial training. Despite their effectiveness, most existing UAP methods neglect domain specific constraints that govern feature relationships. Violating such constraints, such as debt to income ratios in credit scoring or packet flow invariants in network communication, can render adversarial examples implausible or easily detectable, thereby limiting their real world applicability. In this work, we advance universal adversarial attacks to constrained feature spaces by formulating an augmented Lagrangian based min max optimization problem that enforces multiple, potentially complex constraints of varying importance. We propose Constrained Adversarial Perturbation (CAP), an efficient algorithm that solves this problem using a gradient based alternating optimization strategy. We evaluate CAP across diverse domains including finance, IT networks, and cyber physical systems, and demonstrate that it achieves higher attack success rates while significantly reducing runtime compared to existing baselines. Our approach also generalizes seamlessly to individual adversarial perturbations, where we observe similar strong performance gains. Finally, we introduce a principled procedure for learning feature constraints directly from data, enabling broad applicability across domains with structured input spaces.