PaperlayerView exact revision on arXiv

Source-linked AI summary

Probabilistic Robustness-driven Universal Adversarial Perturbations with Explainability against Deep Reinforcement Learning-based Intrusion Detection System

Hongsen Zhang, Lu Zhang, Mingjing Xu, Yi Zhang, Gregory Epiphaniou, Carsten Maple

arXiv:2609.30605v1cs.LG

TL;DR

DRL-based intrusion detection can be vulnerable to universal perturbations that degrade detection across traffic. This paper integrates probabilistic robustness into UAP generation and adds XAI-guided perturbation shaping under realistic domain constraints. The authors report that PX-UAP consistently outperforms state-of-the-art UAP methods in attack effectiveness.

  • Problem

    Universal adversarial perturbations can apply one input-agnostic perturbation across traffic, while prior IDS UAP work has not explicitly used a distribution-level objective in UAP design.

    Source: §1 · p. 2

  • Method

    The paper introduces PR-driven UAP generation for DRL-based IDS and PX-UAP, which uses XAI to guide perturbation shaping under realistic domain constraints.

    Source: §1 · p. 2, §3 · p. 3, §3.1 · p. 4

  • Results

    PX-UAP consistently outperforms state-of-the-art UAP methods for intrusion detection in attack effectiveness.

    Source: §5 · p. 10

  • Takeaways & Limitations

    The work presents PR-driven and XAI-guided UAP design as an approach to attacking DRL-based IDS under realistic domain constraints.

    Source: §3 · p. 3, §3.1 · p. 4, §5 · p. 10

    The evaluation considers a white-box attacker targeting malicious flows in CICIDS2018, with L2-bounded feature-space perturbations subject to realistic domain constraints.

    Source: §3.1 · pp. 3–4

Abstract

from arXiv · show

Deep reinforcement learning (DRL) enables adaptive intrusion detection in dynamic network environments but also exposes intrusion detection systems (IDS) to adversarial threats such as universal adversarial perturbations (UAPs), which apply a single input-agnostic perturbation to degrade detection performance across traffic. Probabilistic Robustness (PR), as a post-hoc evaluation metric, provides a principled, population-level measure of adversarial impact that conceptually aligns with the universality objective of UAPs, i.e., PR quantifies the prevalence of misclassification in the input space, making it a natural signal for guiding UAP generation. Hence, we propose PR-based UAP, which represents the first integration of an explicit PR-driven objective into generating UAPs against DRL-based IDS. Building on this formulation, we introduce PX-UAP, which leverages explainable artificial intelligence (XAI) to guide perturbation shaping under realistic domain constraints, and provides a rigorous theoretical analysis of its design. Extensive experiments demonstrate that PX-UAP consistently outperforms state-of-the-art UAP methods in attack effectiveness.

1 Introduction

DRL-based IDS can adapt to changing network environments, but adversarial perturbations—including universal attacks—can induce misclassification across traffic. This work introduces PR-driven UAP generation for DRL-based IDS, adds XAI-guided shaping with theoretical analysis, and reports that PX-UAP outperforms state-of-the-art UAP methods in attack effectiveness.

1 Introduction

  • In network-flow IDS, practical traffic manipulations can perturb flow-level features and induce misclassification.Examples include packet padding, fragmentation, traffic injection, and transmission-timing adjustments.Source: §1 · p. 2
  • A UAP applies one input-agnostic perturbation across many traffic samples, unlike instance-specific attacks requiring per-sample optimization.This can allow precomputation and efficient application under latency constraints and limited attacker resources.Source: §1 · p. 2
  • PR-based UAP introduces an explicit PR-driven objective into UAP generation against DRL-based IDS.The authors motivate PR as a population-level measure aligned with UAPs’ aim of inducing misclassification across the input space.Source: §1 · p. 2
  • PX-UAP uses XAI feature attributions to shape universal perturbations for IDS.The authors identify this as the first use of feature attributions to shape a UAP strategy in IDS.Source: §1 · p. 2
  • The PX-UAP analysis establishes a constrained universal evasion objective and an attribution-guided, entropy-regularized perturbation scheme with a first-order improvement guarantee.Source: §1 · p. 2
  • PX-UAP consistently outperforms state-of-the-art UAP methods for intrusion detection in attack effectiveness.The experiments report this result across the evaluated methods.Source: §1 · p. 2

2 Related Works

Prior IDS UAP work addresses some feature-validity constraints, while existing PR research largely evaluates robustness or attack performance after the fact. The section identifies PR-driven UAP design as an unaddressed combination.

2.1 Adversarial Attack on Network IDS

  • Earlier IDS UAP studies do not account for protocol compliance, valid feature ranges, and inter-feature dependencies; Zhang et al. [10] address feature relationships and grouping.Source: §2.1 · p. 3

2.2 Probabilistic Robustness

  • Prior PR work assesses robustness or evaluates candidate-attack performance post hoc, leaving PR-driven UAP design unexplored.Figure 1 contrasts worst-case and probabilistic robustness.Source: §2.2 · p. 3, Figure 1 · p. 3

3 Methodology

The methodology introduces PR-based UAP, which makes the PR-derived radius k an explicit optimization objective for universal attacks against DRL-based IDS. It then builds PX-UAP by weighting perturbations with feature attributions and analyzes the design theoretically.

3.1 Threat model

  • The threat model is a white-box targeted evasion attack on CICIDS2018, with L2-bounded feature perturbations constrained by MF, RF, and UF roles.Only modified features may be perturbed; related features are recalculated and unmodified features stay unchanged.Source: §3.1 · pp. 3–4

3.2 Rationale behind the proposed PR-based UAP

  • A shared perturbation with larger k guarantees misclassification over a broader neighborhood, aligning radius maximization with the universal attack objective.PR is distribution-aware, and a smaller PR indicates more misclassified samples in the perturbation region.Source: §3.2 · pp. 4–5

3.3 The proposed PR-based UAP attack

  • PR-based UAP optimizes the PR-derived radius k directly, replacing post-hoc candidate selection with a continuous k-driven update.The method computes a gradient for the selected k and uses it to update the universal perturbation.Source: §3.3 · pp. 5–6

3.4 PX-UAP attack

  • PX-UAP uses batch-aggregated Integrated Gradients importance to weight PR-based perturbations over the top-n features, then selects the candidate with higher FNR.Importance scores are normalized before Softmax weighting; candidate selection compares PX-UAP with PR-based UAP after projection and recalculation.Source: §3.4 · pp. 6–7

3.5 Theoretical analysis

  • The theoretical analysis formalizes constrained malicious-to-benign evasion, motivates IG feature priority via completeness, interprets Softmax as entropy-regularized allocation, and states a first-order improvement guarantee.The objective aligns with increasing FNR on malicious inputs.Source: §3.5 · pp. 7–8

4 Experiments

Experiments evaluate the attacks on a DQN-based IDS and compare PR-based UAP with UAP baselines, then assess PX-UAP, component ablations, and additional settings. Results report gains from PR-based UAP and further improvements with XAI guidance.

4 Experiments

  • The experiments introduce the evaluation setup and report comparisons, with further results provided in Appendix F.Figure 3 covers PR-based UAP and baselines, PX-UAP variants by Topn, and ablations.Source: §4 · p. 8, Figure 3 · p. 9

4.1 Experimental Settings

  • The main evaluation trains a DQN agent on CICIDS2018, treats benign traffic as benign and merges other categories as malicious, and uses its four-hidden-layer MLP policy network as the IDS classifier.Flows have 76 normalized features; effectiveness is evaluated by FNR and accuracy under an L2 perturbation budget ε ∈[0.04, 0.15], with results averaged over 150 runs.Source: §4.1 · p. 8

4.2 PR-based UAP result

  • PR-based UAP remains the top-performing baseline across the evaluated ε range, matching PCC_UAP at ε = 0.09 before continuing to improve and stabilizing for ε ≥0.13.At ε = 0.09, PCC_UAP matches PR-based UAP at FNR = 0.72 and ACC = 0.73.Source: §4.2 · p. 9, Figure 3 · p. 9

4.3 PX-UAP result

  • PX-UAP improves on PR-based UAP, with ≈10% greater effectiveness at ε ∈[0.04, 0.07] and additional gains in the high-ε stable range; Topn=3 performs best overall.In the mid-range, only Topn=3 achieves an ≈5% improvement around ε ≈0.075.Source: §4.3 · p. 9, Figure 3 · p. 9

4.4 Ablation Studies

  • Combining all three attack components yields substantial improvement, with k*-driven optimization playing a critical role; initialization and AE selection have limited impact overall.AE selection improves effectiveness under FGM initialization but provides limited benefit under PGD initialization.Source: §4.4 · pp. 9–10

4.5 Additional Results

  • Additional evaluations report generalization across datasets, DRL agents, and architectures, strong cross-model transfer under a black-box setting, and gains over baselines under both tested ε-step settings.The ε-step comparison uses a fixed unified setting and settings tuned for each method.Source: §4.5 · p. 10

5 Conclusion

The paper introduces PR-based UAP for DRL-based IDS and develops PX-UAP, which uses XAI to shape perturbations under realistic domain constraints. Experiments report that PX-UAP consistently outperforms state-of-the-art UAP methods in attack effectiveness.

5 Conclusion

  • The work integrates PR into UAP generation against DRL-based IDS for the first time.The conclusion presents this as a novel UAP attack framework.Source: §5 · p. 10
  • PX-UAP uses XAI to guide perturbation shaping under realistic domain constraints and is accompanied by a rigorous theoretical justification.Source: §5 · p. 10
  • Experiments show PX-UAP consistently outperforms state-of-the-art UAP methods for intrusion detection in attack effectiveness.Source: §5 · p. 10

A Supplementary Materials for Theoretical Analysis

The supplementary material gives a first-order justification for PX-UAP, describes the attack-generation algorithms, specifies network feature constraints, and reports algorithm hyperparameters.

A Supplementary Materials for Theoretical Analysis

  • The theoretical analysis gives a first-order improvement guarantee for weighted perturbations under standard local assumptions, explaining PX-UAP's budget reallocation toward decision-critical feasible dimensions.It describes the PR-based direction as discovered through PR/k optimization and the IG-to-Softmax step as reallocating the fixed L2 budget.Source: A Supplementary Materials for… · p. 13

B Addition Algorithims

  • Algorithm 2 initializes uap at zero, repeatedly shuffles a sampled seedset, and computes a masked, normalized gradient perturbation with budget ϵ when classifier labels for x and x + uap match.Source: B Addition Algorithims · p. 14

C Network Realistic Domain Constraints

  • The network constraints divide features into Modified, Related, and Unmodified groups: only Modified Features are perturbed, Related Features are recalculated, and Unmodified Features stay fixed.The perturbation is projected onto the L2 ball of radius ε.Source: C Network Realistic Domain Constraints · p. 14

D Hyperparameter Setting for Algorithms

E Variants detail for Ablation Study

The ablation variants isolate attack initialization, AE candidate selection, and perturbation optimization. The additional-results section reports complementary F1 evaluations, dataset and architecture generalizability, black-box transferability, and epsilon-step sensitivity.

E Variants detail for Ablation Study

  • The ablation varies PGD-based initialization, k-based AE candidate selection, and k*-driven optimization to examine the attack components.The components are abbreviated AE Initia., K-Sel., and Opt.; Table 4 is identified as detailing the attack and ablation variants.Source: E Variants detail for Ablation Study · p. 16, Table 4 · p. 16
  • FUAP and KFUAP use a random-start FGM initializer, while variants marked “(N)” repeat initialization and “K” selects the AE candidate with the largest k.Otherwise, the sole available AE candidate is selected.Source: E Variants detail for Ablation Study · p. 16
  • Only PR-based UAP updates the perturbation using ∇xk*; the other variants use the selected AE candidate directly as the generated perturbation.Source: E Variants detail for Ablation Study · p. 16

F Additional Experimental Result

F.1 F1 score of the results in main paper

The supplementary F1 results provide another view of detection performance under attack. PR-based UAP has the lowest F1 among the reported baselines, while the PX-UAP settings and ablations show additional performance patterns.

F.1 F1 score of the results in main paper

  • F1 combines true positives, false positives, and false negatives, complementing accuracy and FNR as a measure of detection performance.It offers an additional, more balanced evaluation perspective.Source: §F.1 · p. 17
  • PR-based UAP has the lowest F1 among the reported baselines across the considered ϵ range and is the only candidate below 0.3 for ϵ > 0.13.At ϵ = 0.09, its FNR matches PCC_UAP, but its F1 is lower.Source: §F.1 · p. 17, Figure 4 · p. 17
  • Topn = 3 produces the largest F1 reduction, and PX-UAP degrades performance for ϵ < 0.07 and ϵ ≥ 0.10.In the ablation, PR-based UAP has the lowest F1 among the variants.Source: §F.1 · p. 17, Figure 5 · p. 17
  • The reported F1 results provide a complementary evaluation perspective on the effectiveness of the proposed UAP methods.Source: §F.1 · p. 18

F.2 Generalizability across Datasets and DRL Architectures

The experiments test PR-based UAP across datasets, DRL architectures, and surrogate-to-target transfer settings. The method outperforms PCC_UAP in the reported dataset and architecture comparisons, and retains attack performance across transfer scenarios.

F.2 Generalizability across Datasets and DRL Architectures

  • On NSL-KDD and UNSW-NB15, PR-based UAP and PX-UAP outperform PCC_UAP, with reported FNRs of approximately 0.43 and 0.78, respectively.The evaluation uses dataset-specific ϵ ranges because the datasets differ in dimensionality and feature structure.Source: §F.2 · p. 18, Figure 6 · p. 18
  • PR-based UAP outperforms PCC_UAP on DQN-6-128, PPO-4-64, and A2C-4-64; PX-UAP further improves attack performance.The comparisons use CICIDS2018 with different DRL agents and network architectures.Source: §F.2 · pp. 18–19, Figure 7 · p. 18

F.3 Transferability Evaluation under the Black-Box Setting

  • Across off-diagonal surrogate-target model pairs, PR-based UAP retains decent attack performance, providing evidence of transferability beyond the white-box setting.The transfer evaluation crafts UAPs on a white-box surrogate and applies them to other target models.Source: §F.3 · p. 19, Figure 8 · p. 19

F.4 Ablation study of epsilon step

The epsilon-step ablation tests whether attack effectiveness depends on step-size selection. PR-based UAP outperforms the baselines under both a shared full-ϵ step and best-performing step settings.

F.4 Ablation study of epsilon step

  • The main experiments use one ϵ-step per update, applying a full-ϵ step uniformly across methods to keep comparisons focused on UAP design rather than step-size schedules.Source: §F.4 · p. 19
  • The sensitivity analysis tests ϵ, ϵ/5, ϵ/10, ϵ/20, and an adaptive schedule, then selects each method’s best-performing setting for comparison.The adaptive schedule uses ϵ/5 for iterations 1–10, ϵ/10 for 11–20, and ϵ/20 for 21–30; the selected settings are UAP (adaptive), PCC_UAP (ϵ/10), and PR-based UAP (ϵ/5 or full ϵ).Source: §F.4 · pp. 19–20, Figure 9 · p. 20
  • PR-based UAP outperforms PCC_UAP and UAP under their best-performing step settings, as well as under the shared full-ϵ step setting.Source: §F.4 · p. 20, Figure 10 · p. 20

G Limitation and future work

The study evaluates attack transferability as evidence of effectiveness under black-box settings, but its main threat model remains white-box. Future work targets more restrictive black-box scenarios to better approximate practical deployment.

G Limitation and future work

H Experiment Device

Experiments used a specified laptop workstation and Windows 10. The broader-impact discussion notes potential defensive value and misuse risk, and states that experiments were conducted offline in controlled settings.

H Experiment Device

  • Experiments ran on a laptop with a Ryzen 9 5900HX, RTX 3080 Laptop GPU with 16 GB VRAM, 32 GB DDR4 RAM, and 2 TB PCIe Gen3 SSD, using Windows 10 64-bit.Source: H Experiment Device · p. 20

I Broader Impact

  • The study may help security practitioners understand DRL-based IDS vulnerabilities and motivate more robust cybersecurity defenses.Source: I Broader Impact · p. 21
  • Because the attack methods could be misused to evade real-world IDS, the study was conducted in controlled offline experimental settings for academic research and defensive development.Source: I Broader Impact · p. 21

Related papers

Loading 2609.30605v1…