Research map / Adversarial robustness and security / Certified and empirical robustness
Attack-free Evaluating and Enhancing Adversarial Robustness on Categorical Data
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes IGSG, an attack-free metric combining integrated gradients and smoothed gradients to evaluate adversarial robustness on categorical data, and an IGSG-based regularizer (IGSGreg) that improves robust training over adversarial training baselines.
Problem
Evaluating and enhancing adversarial robustness of classifiers on categorical (tabular) inputs, where attack-based evaluation and adversarial training are computationally expensive due to the NP-hard nature of L0-bounded perturbations.
Approach
Combine feature-wise integrated gradient (feature reliance) and smoothed gradient magnitude (decision boundary curvature) into an attack-free robustness metric IGSG, and use it as a regularization term during training instead of adversarial sample generation.
Key results
- IGSGreg reaches 86.5% adversarial accuracy under FSGS on PEDec versus 74.3% for the best baseline (JR and AFD).
- IGSG computes 17-240 times faster than OMPGS for robustness evaluation (Table 2).
- IGSG correlates with ASR and mf-score with Pearson coefficients above 0.65 across evaluated MLP models.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| apply IGSG-based regularization | MLP · PEDec under FSGS attack | adversarial accuracy: 74.3±0.2 -> 86.5±3.8 | Helped |
| apply IGSG-based regularization | MLP · Census under FSGS attack | adversarial accuracy: 63.4±3.8 -> 67.2±3.5 | Helped |
| apply IGSG-based regularization | MLP · Splice under FSGS attack | adversarial accuracy: 44.0±2.6 | No clear effect |
| apply IGSG-based regularization | MLP · Splice, PEDec, and Census clean evaluation | accuracy: 95.9±0.7; 95.5±0.2; 95.5±0.2 | No clear effect |
| use SG regularization only instead of IG and SG regularization (ablation) | IGSGreg · PEDec under FSGS attack, budget 5 | adversarial accuracy: 86.5±3.8 -> 12.7±1.8 | Hurt |
| use IG regularization only instead of IG and SG regularization (ablation) | IGSGreg · Splice under FSGS attack, budget 5 | adversarial accuracy: 44.0±2.6 -> 40.3±5.0 | Hurt |
| replace smoothed gradient regularization with vanilla gradient regularization (ablation) | IGSGreg · Census under FSGS attack, budget 5 | adversarial accuracy: 67.2±3.5 -> 54.1±1.6 | Hurt |
| use SG regularization only instead of IG and SG regularization (ablation) | IGSGreg · Census under FSGS attack, budget 5 | adversarial accuracy: 67.2±3.5 -> 47.9±2.1 | Hurt |
| use IG regularization only instead of IG and SG regularization (ablation) | IGSGreg · PEDec under FSGS attack, budget 5 | adversarial accuracy: 86.5±3.8 -> 84.2±2.9 | Hurt |
| replace smoothed gradient regularization with vanilla gradient regularization (ablation) | IGSGreg · PEDec under FSGS attack, budget 5 | adversarial accuracy: 86.5±3.8 -> 81.6±3.8 | Hurt |
| use IG regularization only instead of IG and SG regularization (ablation) | IGSGreg · Census under FSGS attack, budget 5 | adversarial accuracy: 67.2±3.5 -> 57.8±0.8 | Hurt |
| replace smoothed gradient regularization with vanilla gradient regularization (ablation) | IGSGreg · Splice under FSGS attack, budget 5 | adversarial accuracy: 44.0±2.6 -> 39.7±2.4 | Hurt |
Surprising findings
- Standard adversarial training (Adv Train) performs poorly on the high-dimensional PEDec dataset, attributed to robust overfitting in categorical spaces.
- Splice has a few particularly sensitive features that make all baseline defenses perform poorly against attacks.
Limitations
- Regularization may not help in extreme cases such as datasets dominated by a single feature or where all features contribute equally (per impact statement).
- Evaluated only on tabular/categorical datasets with MLP and Transformer; text classification left for future work.
Experimental setup
Datasets: Splice PEDec Census-Income (KDD)
Benchmarks: Splice PEDec Census-Income
Metrics: adversarial accuracy accuracy attack success rate mf-score Pearson correlation computation time speed-up
Baselines: Std Train Adv Train Fast-BAT TRADES AFD PAdvT IGR JR
Builds on: Integrated Gradients SmoothGrad OMPGS PAdvT Adversarial Feature Desensitization
Closest papers by meaning
- Robust Adversarial Attacks Against Unknown Disturbance via Inverse Gradient Sample (ICLR 2026 · similarity 0.89)
- Towards Understanding the Robustness Against Evasion Attack on Categorical Data (ICLR 2022 · similarity 0.89)
- Fantastic Robustness Measures: The Secrets of Robust Generalization (NeurIPS 2023 · similarity 0.88)
- Do Perceptually Aligned Gradients Imply Robustness? (ICML 2023 · similarity 0.88)
- Rethinking Invariance Regularization in Adversarial Training to Improve Robustness-Accuracy Trade-off (ICLR 2025 · similarity 0.86)
- Indirect Gradient Matching for Adversarial Robust Distillation (ICLR 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.