Research map / Adversarial robustness and security / Certified and empirical robustness
Constrained Adaptive Attack: Effective Adversarial Attack Against Deep Neural Networks for Tabular Data
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes CAPGD, a parameter-free adaptive gradient attack for constrained tabular deep learning, and CAA, which chains CAPGD with the search attack MOEVA to evade feature-constrained tabular models more effectively and efficiently.
Problem
Evaluating adversarial robustness of deep tabular models is hard because of categorical features, immutability, and feature relationship constraints; existing gradient attacks (CPGD) fail to produce valid adversarial examples and search attacks (MOEVA) are slow.
Approach
CAPGD adds adaptive step-size halving based on loss trend, a repair operator that enforces equality constraints each iteration, random and clean initializations, and momentum on top of CPGD. CAA runs CAPGD first and falls back to MOEVA only on examples CAPGD fails to attack.
Key results
- CAPGD lowers robust accuracy on LCLD with RLN to 0.2% and on URL with TabTransformer to 10.9%, outperforming CPGD by up to 81 percentage points.
- CAA achieves the lowest robust accuracy in 17 of 20 settings and reduces accuracy by up to 21.7 points relative to MOEVA.
- CAA is up to 5 times faster than MOEVA, e.g. 17 s vs 75 s on URL/TabTransformer.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Combine CAPGD followed by MOEVA | Tabular models · 20 dataset-model settings | robust accuracy: up to 21.7% | Helped |
| Combine CAPGD followed by MOEVA | Tabular models · URL, LCLD, WIDS; CTU except STG | execution time: up to 5 times | Helped |
| Combine CAPGD followed by MOEVA | STG on LCLD · LCLD | robust accuracy: 0.6 percentage points | Hurt |
| Add adaptive step-size selection (ablation) | CAPGD · URL, LCLD, CTU, WIDS | robust accuracy: up to 32.1% | Helped |
| Add random initialization (ablation) | CAPGD · URL, LCLD, CTU, WIDS | robust accuracy | Helped |
| Add clean-example initialization (ablation) | CAPGD · URL, LCLD, CTU, WIDS | robust accuracy | Helped |
| Apply repair at each iteration (ablation) | CAPGD · LCLD | robust accuracy | Helped |
| Apply repair at each iteration (ablation) | CAPGD · URL and WIDS | robust accuracy | No clear effect |
| Increase maximum perturbation epsilon (ablation) | CAA · 16/20 dataset-model cases | robust accuracy | Helped |
| Increase CAPGD iterations (ablation) | CAA · URL, LCLD, CTU, WIDS | robust accuracy: 3.5% points | Mixed |
| Increase MOEVA search iterations (ablation) | CAA · CTU, RLN and VIME | robust accuracy: below 0.4; zero with 1000 search iterations | Helped |
| Adversarially train the model | TabTransformer · URL and LCLD | robust accuracy against CAA: 47.8%; 62.4% | Helped |
Surprising findings
- Gradient attacks (CPGD, LowProFool, CAPGD) are ineffective on the CTU dataset across all architectures, with robust accuracy unchanged at about 95-97%.
- Adversarial training with Madry PGD degraded clean accuracy to 0.0% for TabNet on LCLD, indicating that the robust accuracy gains partly reflect clean performance loss.
Limitations
- Gradient attacks fail on the CTU dataset, so CAA relies on the costly search attack MOEVA there.
- Imperceptibility is measured only with the L2 norm, with no human assessment.
- Results are for five architectures and four datasets, a limited scope.
Experimental setup
Datasets: LCLD URL (ISCX-URL2016) CTU-13 WiDS
Benchmarks: LCLD URL CTU-13 WiDS
Metrics: robust accuracy attack duration in seconds
Baselines: CPGD LowProFool MOEVA BF* CAPGD
Builds on: PGD CPGD MOEVA LowProFool Madry adversarial training
Closest papers by meaning
- TabularBench: Benchmarking Adversarial Robustness for Tabular Deep Learning in Real-world Use-cases (NeurIPS 2024 · similarity 0.91)
- Efficient Robustness Evaluation via Constraint Relaxation (AAAI 2025 · similarity 0.85)
- TabM: Advancing tabular deep learning with parameter-efficient ensembling (ICLR 2025 · similarity 0.84)
- CG-TGAN: Conditional Generative Adversarial Networks with Graph Neural Networks for Tabular Data Synthesizing (AAAI 2025 · similarity 0.84)
- AttackBench: Evaluating Gradient-based Attacks for Adversarial Examples (AAAI 2025 · similarity 0.84)
- SuperDeepFool: a new fast and accurate minimal adversarial attack (NeurIPS 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.