Source-linked AI summary
Imperceptible Adversarial Attacks on Tabular Data
Vincent Ballet, Xavier Renard, Jonathan Aigrain, Thibault Laugel, Pascal Frossard, Marcin Detyniecki
TL;DR
Adversarial attacks are a security concern, but research has focused mainly on images despite the use of tabular classifiers in industry. This paper formalizes imperceptibility for tabular data and proposes LowProFool; experiments report low-perceptibility examples with high fooling rates. The approach is a white-box attack, requiring access to the model and full dataset.
Problem
Adversarial attacks can produce unwarranted predictions, while research has focused mainly on images despite industrial use of tabular classifiers and the need for credible manipulations.
Source: §1 · p. 1Method
Results
Takeaways & Limitations
The reported examples are tied to a discrepancy between classifier-learned feature importance and a priori feature importance.
Source: §6 · p. 8The approach is a white-box attack requiring access to both the model and the whole dataset.
Source: §7 · p. 8
Abstract
from arXiv · showhide
Security of machine learning models is a concern as they may face adversarial attacks for unwarranted advantageous decisions. While research on the topic has mainly been focusing on the image domain, numerous industrial applications, in particular in finance, rely on standard tabular data. In this paper, we discuss the notion of adversarial examples in the tabular domain. We propose a formalization based on the imperceptibility of attacks in the tabular domain leading to an approach to generate imperceptible adversarial examples. Experiments show that we can generate imperceptible adversarial examples with a high fooling rate.
1 Introduction
Adversarial-ML research has focused mainly on images, although many industrial classifiers use tabular data. The paper formalizes imperceptibility for tabular attacks and introduces LowProFool, reporting low perceptibility while keeping fooling rates high.
1 Introduction
- For a loan application, the attack should preserve credibility by minimizing changes to expert-salient features and relying instead on less important ones.The paper uses income and age as examples of salient features.Source: §1 · p. 1
- The paper frames tabular adversarial examples around imperceptibility and introduces a formalization for this setting.The introduction points to a subsequent approach for generating such examples.Source: §1 · p. 1
- LowProFool generates adversarial examples with low perceptibility compared with state-of-the-art attacks while keeping the fooling rate high.The experiments use four literature datasets.Source: §1 · p. 2
2 Imperceptible adversarial attacks on images
Image-domain adversarial examples have been defined using different notions of how much perturbation is acceptable, including small or imperceptible changes and visible patches. The paper notes that ℓp distance may not reliably track human-perceived similarity and turns next to tabular data.
2 Imperceptible adversarial attacks on images
- Image-domain definitions differ: some require close misclassified inputs [Carlini and Wagner, 2017] or imperceptible perturbations [Szegedy et al., 2014], while others allow visible patches [Karmon et al., 2018].Source: §2 · p. 2
- The ℓp norm bounds perturbation size in one common image-domain formulation, but it may not match human-perceived similarity.Similar-looking images can have large ℓp distances, while semantically different images can appear close by that metric.Source: §2 · p. 2
- The paper shifts to tabular data because image-domain notions of imperceptibility do not directly capture its specificities.Source: §2 · p. 2
3 Formalization of the notion of imperceptible attacks on tabular data
For tabular data, imperceptibility depends on which features an expert is likely to inspect, and adversarial examples must also remain coherent with the data. The formalization weights perturbations by feature importance and constrains the result to a valid sample that changes the classifier’s label.
3 Formalization of the notion of imperceptible attacks on tabular data
- Tabular features are not interchangeable, and assessing whether values are altered or class-relevant requires expert knowledge.Source: §3 · p. 2
- Imperceptibility is measured as an ℓp norm weighted by feature importance, reflecting which features an expert is likely to scrutinize.The paper argues that ℓp norms are not subject to the same extent to image-domain flaws because tabular data cannot be manipulated like images.Source: §3 · p. 3
- Coherence requires perturbed values to respect dataset-specific feature types and bounds, such as nonnegative age or discrete boolean values.Source: §3 · p. 3
- The attack assumes less relevant features can move an example to the target class despite having a higher perturbation norm than a shortest path to the classifier boundary.The intended trade-off is lower expert-perceived perturbation despite that higher norm.Source: §3 · p. 3
- A valid adversarial example must change the classifier’s label to the target while keeping the perturbed sample within the set of coherent samples.The formalization defines the optimal perturbation subject to both conditions.Source: §3 · p. 3
4 Generation of Imperceptible Adversarial Examples on Tabular Data
LowProFool optimizes a target-class loss together with a feature-importance-weighted perturbation penalty. Gradient descent guides samples toward the target while λ controls the trade-off between low perceptibility and crossing the classifier boundary.
4 Generation of Imperceptible Adversarial Examples on Tabular Data
- The algorithm iteratively updates and clips perturbations, then returns the lowest-perceptibility iterate that changes the predicted class.Its stated inputs include the classifier, sample, target, loss, λ, feature importance, iteration limit, and scaling factor.Source: §4 · p. 4
- The objective combines target-class loss with a penalty on the feature-importance-weighted perturbation.The loss moves the sample toward the target class, while the regularizer minimizes perturbation perceptibility.Source: §4 · pp. 3–4
- λ controls the trade-off between minimizing the weighted perturbation norm and maximizing the proportion of samples that cross the classification boundary.Source: §4 · p. 4
- LowProFool uses gradient descent to guide perturbations toward the target class while penalizing changes to important features.The method searches for a minimum of its objective function.Source: §4 · p. 4
5 Experimentation framework
The experiments evaluate attack success, perturbation size, and perturbation scale relative to dataset spacing across four financial datasets. LowProFool has a high fooling rate, while comparisons with DeepFool vary between raw and feature-weighted perturbation norms.
5.1 Metrics for adversarial attacks on tabular data
- Success is measured by label-flipping rate, perturbation size by ordinary and feature-weighted norms, and perturbation scale by average weighted nearest-neighbor distance.Source: §5.1 · pp. 4–5
5.2 Data
- Experiments use four financial datasets, treat discrete features as continuous, drop non-ordered categorical features, and reserve 250 test and 50 validation samples per dataset.Source: §5.2 · p. 5
5.3 Parameters of the adversarial attack
- LowProFool uses binary cross-entropy and an ℓ2 weighted-norm penalty, Pearson correlations for feature importance, feature-range clipping, and neural networks; it is compared with FGSM and DeepFool.Source: §5.3 · p. 5
5.4 Experimental results
- LowProFool succeeds almost 95% of the time; DeepFool reaches about 100% on each dataset, while FGSM ranges from 0% to 59%.Source: §5.4 · p. 6
- LowProFool’s mean ℓ2 perturbation norm is 1.7 times DeepFool’s across four datasets, while FGSM’s norms are an order of magnitude larger than both.Source: §5.4 · p. 6
- DeepFool consistently has worse weighted perturbation results than LowProFool; on Default Credit Card, their weighted mean norm ratio is 60%.Source: §5.4 · p. 6
- Except on Australian Credit, mean perturbation norms average 60% below nearest-neighbor distances, and weighted mean norms average 77% below weighted distances.Source: Figure 2 · p. 6, §5.4 · p. 6
6 Discussion
LowProFool improves perturbation imperceptibility relative to DeepFool, but its success rate trades off against weighted perturbation size. The discussion also identifies optimization, hyperparameter, and coherence considerations that qualify these results.
6 Discussion
- At a 95% success-rate target, LowProFool reaches low weighted-perturbation ratios against DeepFool, though neither 100% success nor satisfactory weighted mean norm is achieved.Figure 3 compares success-rate and mean weighted-perturbation ratios for the two attacks.Source: §6 · p. 6, Figure 3 · p. 7
- With fixed iterations, penalizing highly perceptible features can leave samples far from the classifier frontier short of crossing it.The objective function’s trade-off favors imperceptibility over reaching the frontier in such cases.Source: §6 · p. 7
- Hyperparameters fitted on the whole validation set may not generalize enough to let some outliers cross the frontier or sufficiently reduce perceptibility.These parameters control movement speed and the trade-off between class change and perceptibility.Source: §6 · p. 7
- DeepFool’s unconstrained ℓ2 objective and adaptive step make generating adversarial examples easier than LowProFool’s perceptibility-weighted optimization.The authors note that DeepFool does not constrain perturbation perceptibility.Source: §6 · p. 8
- FGSM, despite working sufficiently well on images, appears unsuccessful on tabular data.Source: §6 · p. 8
- LowProFool substantially outperforms DeepFool on the reported perceptibility metrics without much reduction in success rate.The authors attribute the adversarial examples’ existence to a discrepancy between learned feature importance and the a priori importance vector v.Source: §6 · p. 8
- 5.9% of the average closest-neighbor distance is the average weighted perturbation for the Default Credit dataset.The authors interpret this as evidence that generated examples are closer to their originals than to other samples.Source: §6 · p. 8
- A posteriori clipping did not produce the deadlocks the authors had anticipated in practice.The concern was that clipping could restrict the only direction favored by the objective, such as a move toward negative age.Source: §6 · p. 8
7 Limitations and perspectives
The attack assumes white-box access to the model and the whole dataset. The authors propose surrogate-model black-box attacks as a future direction, contingent on having a minimum number of oracle queries.
7 Limitations and perspectives
- LowProFool assumes the attacker can access both the model and the whole dataset.Source: §7 · p. 8
- The authors propose investigating black-box attacks using a surrogate model, assuming a minimum number of oracle queries.They cite prior demonstrations of substitute models and transferable adversarial examples as context.Source: §7 · p. 8
8 Conclusion
The conclusion formalizes perceptibility and coherence for tabular adversarial examples and presents LowProFool as a generation method. It reports successful fooling and imperceptibility metrics while noting limits for gradient-based methods on discrete features.
8 Conclusion
- The paper formalizes perceptibility and coherence for adversarial examples in tabular data, where image-domain formalizations do not apply.Source: §8 · p. 8
- LowProFool is proposed to generate tabular adversarial examples using that formalization.Source: §8 · p. 8
- The proposed metrics show successful model fooling and generation of imperceptible adversarial examples.Source: §8 · p. 8
- Gradient-based methods such as LowProFool have limitations for discrete features, which the authors identify for future investigation.Source: §8 · p. 8