Reproduce “Constrained Adaptive Attack: Effective Adversarial Attack Against Deep Neural Networks for Tabular Data” on OpenResearch

About this paper

Thibault Simonetto, Salah Ghamizi, Maxime Cordy

Researchers from the University of Luxembourg and RIKEN AIP developed Constrained Adaptive Attack (CAA), an ensemble method that effectively and efficiently generates valid adversarial examples for deep learning models on tabular data by rigorously enforcing domain-specific feature constraints. CAA achieved superior attack effectiveness, reducing robust accuracy by up to 96.1 percentage points compared to existing methods, while being up to 5 times faster than the previous best search-based attack.

Key insights

• Adaptive mechanisms (step size, repair operator, dual initialization, momentum) are crucial and complementary for significantly improving the success rate of gradient-based adversarial attacks on constrained tabular data.
• An ensemble approach combining an efficient gradient-based attack (CAPGD) with a highly effective search-based attack (MOEVA) yields both state-of-the-art attack effectiveness and substantial computational efficiency gains by leveraging their complementary strengths.
• Adversarial training for tabular models provides variable robustness, often degrading clean accuracy, and does not universally defend against advanced attacks like CAA, highlighting persistent vulnerabilities.

Summary by alphaXiv.