Adversarial Robustness for Tabular Data through Cost and Utility Awareness

Abstract

value of a person's salary, another to their age, and another to a categorical value representing their marital status.The properties of the image domain have shaped the way adversarial examples and adversarial robustness are approached in the literature [11] and have greatly influenced adversarial robustness research in the text domain.In this paper, we argue that adversarial examples in tabular domains are of a different nature, and adversarial robustness has a different meaning.Thus, the definitions and techniques used to study these phenomena need to be revisited to reflect the tabular context.We argue that two high-level differences need to be addressed.First, imperceptibility, which is the main requirement considered for image and text adversarial examples, is ill-defined and can be irrelevant for tabular data.Second, existing methods assume that all adversarial inputs have the same value for the adversary, whereas in tabular domains different adversarial examples can bring drastically different gains.Imperceptibility and semantic similarity are not necessarily the primary constraints in tabular domains.The existing literature commonly formalizes the concept of "an example deliberately crafted to cause a misclassification" as a natural example, i.e., an example coming from the data distribution, that is imperceptibly modified by an adversary in a way that the classifier's decision changes.Typically, imperceptibility is formalized as closeness according to a mathematical distance such as L p [21,22].In tabular data, however, imperceptibility is not necessarily relevant.Let us consider the following toy example of financialfraud detection: Assume a fraud detector takes as input two features: (1) transaction amount, and (2) device from which the transaction was sent.The adversary aims to create a fraudulent financial transaction.The adversary starts with a natural example (amount=$200, device=Android phone) and changes the feature values until the detector no longer classifies the example as fraud.In this example, imperceptibility is not well-defined.Is a modification to the amount feature from $200 to $201 imperceptible?What increase or decrease would we consider perceptible?The issue is even more apparent with categorical data, for which standard distances such as L 2 , L ∞ cannot even capture imperceptibility: Is a change of the device feature from Android to an iPhone imperceptible?Even if imperceptibility was well-defined, imperceptibility might not be relevant.Should we only be concerned about adversaries making "imperceptible" changes, e.g., modifying amount from $200 to $201?What about attack vectors in Abstract-Many safety-critical applications of machine learning, such as fraud or abuse detection, use data in tabular domains.Adversarial examples can be particularly damaging for these applications.Yet, existing works on adversarial robustness primarily focus on machine-learning models in image and text domains.We argue that, due to the differences between tabular data and images or text, existing threat models are not suitable for tabular domains.These models do not capture that the costs of an attack could be more significant than imperceptibility, or that the adversary could assign different values to the utility obtained from deploying different adversarial examples.We demonstrate that, due to these differences, the attack and defense methods used for images and text cannot be directly applied to tabular settings.We address these issues by proposing new cost and utility-aware threat models that are tailored to the adversarial capabilities and constraints of attackers targeting tabular domains.We introduce a framework that enables us to design attack and defense mechanisms that result in models protected against cost or utility-aware adversaries, for example, adversaries constrained by a certain financial budget.We show that our approach is effective on three datasets corresponding to applications for which adversarial examples can have economic and social implications.

Topics & Concepts