Building Adversarially Robust Predictive Systems for Tabular Data

🧑‍💻 Zhipeng “Zippo” He 何志鹏 @ School of Information Systems
Queensland University of Technology

• XAMI LAB
• zhipeng.he@hdr.qut.edu.au
• github.com/ZhipengHe
• zhipenghe.me

PhD Final Seminar
October 08, 2025

Good morning everyone, and thank you for being here. My name is Zhipeng He, and today I’ll be presenting my thesis research on Building Adversarially Robust Predictive Systems for Tabular Data.

Supervisory Team

$ \(\newcommand{\one}{\unicode{x1d7d9}}\) “54F” $

• A/Prof. Chun Ouyang (QUT)
• Prof. Alistair Barros (QUT)
• A/Prof. Catarina Moreira (UTS)

My PhD research is supervised by Associate Professor Chun Ouyang, Professor Alistair Barros, and Associate Professor Catarina Moreira from UTS.

🧭 Outline

💡 Background & Motivation

🎯 Research Problem

🧩 Objective 1 — Foundation of Imperceptibility
Defining imperceptible properties on tabular data.

📊 Objective 2 — Benchmark of Tabular Attacks
Systematic evaluation framework for existing adversarial attacks.

⚙️ Objective 3 — Generative VAE-based Attack
Unified treatment of categorical & numerical features in latent space.

🌟 Conclusion & Future Directions
From conceptual clarity → systematic evaluation → practical robustness.

This presentation follows the structure of my thesis. I’ll begin with the motivation, and then introduce the research questions that guided this work.

I’ll then present three main parts: the foundation of imperceptibility, a benchmark study of existing attack methods, and finally propose a new generative adversarial attack.

I’ll conclude with a broader discussion of contributions and future directions.

💡 Background & Motivation

Let’s start from the background of my research.

Trustworthy AI: Lawful, Ethical, and Robust

The relation between different aspects of Artificial Intelligence (AI) trustworthiness (B. Li et al. 2023).

In current AI research, accuracy is not the only metrics to determine if a model is good or not any more.

Along with performance, robustness is another critical requirement for building trustworthy AI systems. It interactives with different aspects of AI trustworthiness, like Security, Performance and Generalisation.

But what does robustness mean in AI?

Li, Bo, Peng Qi, Bo Liu, Shuai Di, Jingen Liu, Jiquan Pei, Jinfeng Yi, and Bowen Zhou. 2023. “Trustworthy AI: From Principles to Practices.” ACM Computing Surveys 55 (9): 1–46. https://doi.org/10.1145/3555803.

What is Robustness in CS & ML ?

In Computer Science (CS), robustness has been more formally defined by the IEEE (IEEE 2008) as:

the degree to which a system or component can function correctly in the presence of invalid inputs or stressful conditions.

In Machine Learning (ML), robustness refers to:

the ability of a model to perform well on unseen or new data or variations in the input.

From computer science, the IEEE gave a formal definition: …

While in machine learning, robustness refers to …

Now that we have seen how robustness is defined in machine learning, the next question is — what kinds of inputs actually challenge this robustness? Let us look at the different sources of input variation.

IEEE. 2008. “IEEE Standard Computer Dictionary: A Compilation of IEEE Standard Computer Glossaries.” Piscataway, NJ, USA: IEEE. https://doi.org/10.1109/ieeestd.1991.106963.

What are the Input Variations?

Different sources of input variation that challenge robustness in ML

Adversarial robustness = robustness against worst-case, deliberately crafted perturbations (Szegedy et al. 2014)

The diagram shows the different sources of input variation that challenge ML robustness:
- perturbed data, such as adversarial examples,
- out-of-distribution samples,
- outliers,
- and concept drift.

Among these sources of input variation, adversarial robustness is the most significant one.

Since it is the intentional perturbation to the original data, it is the most challenging one to achieve the robustness.

Hence, we decide to focus on the adversarial robustness in this research.

Then we need to understand what are adversarial attacks and adversarial examples.

Szegedy, Christian, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2014. “Intriguing Properties of Neural Networks.” In 2nd International Conference on Learning Representations (ICLR 2014), edited by Yoshua Bengio and Yann LeCun. https://arxiv.org/abs/1312.6199.

What are Adversarial Attacks?

An adversarial attack is a method to generate adversarial examples.

Adversarial examples are specialised inputs created with the purpose of confusing a neural network, resulting in the misclassification of a given input. These notorious inputs are indistinguishable to the human eye but cause the network to fail to identify the contents of the image. (Goodfellow, Shlens, and Szegedy 2015)

An adversarial attack is a method to generate adversarial examples,

From the definition:

which focus on two perspectives:

• misleading the model predictions
• the perturbation is not noticeable by human eye.

Goodfellow, Ian J, Jonathon Shlens, and Christian Szegedy. 2015. “Explaining and Harnessing Adversarial Examples.” In 3rd International Conference on Learning Representations (ICLR 2015), edited by Yoshua Bengio and Yann LeCun. https://arxiv.org/abs/1412.6572.

What are Adversarial Attacks?

Illustration of the process of adversarial attack.

Let me use an illustration to show the process of adversarial attack.

A predictive model is trained on a dataset, and then it is deployed to make predictions on new data.

Then, we can use an adversarial attack to generate an adversarial example as input to the model, and the model will make a wrong prediction.

What are Adversarial Attacks?

For example, when applying Fast Gradient Sign Method (FGSM), we can generate an adversarial example:

Adversarial example generated with Fast Gradient Sign Method (FGSM) (Goodfellow, Shlens, and Szegedy 2015)

Even small, imperceptible perturbations can cause a model to make confidently incorrect predictions.

Foe example, when applying an attack called FGSM to an koala image.

It adds pixel level perturbation to the original image, and the adversarial example looks similar to the original image to human eye.

But this new adversarial example misclassifies the image classification model with high confidence.

Goodfellow, Ian J, Jonathon Shlens, and Christian Szegedy. 2015. “Explaining and Harnessing Adversarial Examples.” In 3rd International Conference on Learning Representations (ICLR 2015), edited by Yoshua Bengio and Yann LeCun. https://arxiv.org/abs/1412.6572.

From Computer Vision to Tabular Data

• Adversarial attacks have been extensively studied in Computer Vision
• But what about tabular data?

EHR Records

Credit Card Transactions

Network Traffic Logs

Adversarial attack is originated from and extensively studied in computer vision.

But in the real world, tabular data is also very important.

For example, in EHR records, credit card transactions, and network traffic logs are all tabular data.

Why Tabular Data Matters

Tabular data powers critical real-world systems: finance (Lunghi et al. 2023), healthcare (Sun et al. 2018), cybersecurity (D. Li et al. 2023)

Image (unstructured)
• High-dimensional, homogeneous
• Continuous pixels

Tabular (structured) (Borisov et al. 2024)
• Lower-dimensional, heterogeneous
• Numerical + categorical
• Feature dependencies

Would existing adversarial attacks still work on tabular data without adaptations?

The tabular data plays a very important role in different domains, like finance, healthcare, and cybersecurity.

If we compare image and tabular data,

image data is …

and tabular data is …

Then we have a question: …

Borisov, Vadim, Tobias Leemann, Kathrin Sebler, Johannes Haug, Martin Pawelczyk, and Gjergji Kasneci. 2024. “Deep Neural Networks and Tabular Data: A Survey.” IEEE Transactions on Neural Networks and Learning Systems 35 (6): 7499–519. https://doi.org/10.1109/TNNLS.2022.3229161.

Li, Deqiang, Qianmu Li, Yanfang (fanny) Ye, and Shouhuai Xu. 2023. “Arms Race in Adversarial Malware Detection: A Survey.” ACM Computing Surveys 55 (1): 1–35. https://doi.org/10.1145/3484491.

Lunghi, Daniele, Alkis Simitsis, Olivier Caelen, and Gianluca Bontempi. 2023. “Adversarial Learning in Real-World Fraud Detection: Challenges and Perspectives.” In Proceedings of the Second ACM Data Economy Workshop (DEC 2023), 27–33. New York, NY, USA: ACM. https://doi.org/10.1145/3600046.3600051.

Sun, Mengying, Fengyi Tang, Jinfeng Yi, Fei Wang, and Jiayu Zhou. 2018. “Identify Susceptible Locations in Medical Records via Adversarial Attacks on Deep Predictive Models.” In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining (KDD 2018), edited by Yike Guo and Faisal Farooq. New York, NY, USA: ACM. https://doi.org/10.1145/3219819.3219909.

Adversarial Threat Models

Adversarial attacks can be described along four dimensions (Papernot et al. 2016; Biggio and Roli 2018; Assion et al. 2019; Pelekis et al. 2025):

A taxonomy of adversarial attack threat models. Four dimensions: Influence, Knowledge, Constraints, Goals.

But before we start, we need to understand the adversarial attacks deeply.

This taxonomy covers four dimensions of adversarial attacks.

I will explain them one by one in following slides.

Assion, Felix, Peter Schlicht, Florens Gressner, Wiebke Gunther, Fabian Huger, Nico Schmidt, and Umair Rasheed. 2019. “The Attack Generator: A Systematic Approach Towards Constructing Adversarial Attacks.” In 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW 2019), 1370–79. IEEE. https://doi.org/10.1109/cvprw.2019.00177.

Biggio, Battista, and Fabio Roli. 2018. “Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning.” Pattern Recognition 84: 317–31. https://doi.org/10.1016/j.patcog.2018.07.023.

Papernot, Nicolas, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami. 2016. “The Limitations of Deep Learning in Adversarial Settings.” In 2016 IEEE European Symposium on Security and Privacy (EuroS&p 2016), 372–87. IEEE. https://doi.org/10.1109/eurosp.2016.36.

Pelekis, Sotiris, Thanos Koutroubas, Afroditi Blika, Anastasis Berdelis, Evangelos Karakolis, Christos Ntanos, Evangelos Spiliotis, and Dimitris Askounis. 2025. “Adversarial Machine Learning: A Review of Methods, Tools, and Critical Industry Sectors.” Artificial Intelligence Review 58 (8): 1–87. https://doi.org/10.1007/s10462-025-11147-4.

When to Deploy Adversarial Attacks?

Privacy Attack (training-time) out of scope

Poison Attack (training-time) out of scope

Evasion Attack (test-time)

Why focus on test-time attacks? (Pelekis et al. 2025)

• ❌ Privacy attacks: Extract sensitive training data to break the model
• ❌ Poison attacks: Corrupt model behavior during training to break the model
• ✅ Evasion attacks: Test adversarial robustness of deployed models against adversarial examples

The first dimension is when to deploy adversarial attacks.

We can deploy adversarial attacks at training time or test time.

But in my research, I focus on test-time attacks.

Becasue our purpose is not to break the model, but to test the model robustness.

Pelekis, Sotiris, Thanos Koutroubas, Afroditi Blika, Anastasis Berdelis, Evangelos Karakolis, Christos Ntanos, Evangelos Spiliotis, and Dimitris Askounis. 2025. “Adversarial Machine Learning: A Review of Methods, Tools, and Critical Industry Sectors.” Artificial Intelligence Review 58 (8): 1–87. https://doi.org/10.1007/s10462-025-11147-4.

What Access do Adversarial Attacks have?

White-Box Attacks ✅

Grey-Box Attacks ❌

Black-Box Attacks ❌

• Full access to model and dataset knowledge

• Partial access to model and dataset knowledge

• No access to model knowledge; but can query the model

White-box attacks represent the worst-case scenarios (Papernot et al. 2016)

👉 If a model is robust under white-box attacks, it can handle any other type of attacks.

The second dimension is what access do adversarial attacks have.

Based on the knowledge of model and dataset, we can classify adversarial attacks into three types:

• White-Box Attacks: Full access to model (parameters and architectures) and dataset knowledge
• Grey-Box Attacks: access to some of model parameters and datasets
• No access to model knowledge; but know the input and output of models.

We select the White-Box Attacks to measure the model robustness

Becasue it is the worst-case scenario.

If a model is robust under White-Box Attacks, it can handle any other type of attacks.

Papernot, Nicolas, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami. 2016. “The Limitations of Deep Learning in Adversarial Settings.” In 2016 IEEE European Symposium on Security and Privacy (EuroS&p 2016), 372–87. IEEE. https://doi.org/10.1109/eurosp.2016.36.

How to Constrain the Adversarial Attacks?

Bounded attacks ✅

• Perturbations restricted by a budget (\(\lVert \delta \rVert \leq \epsilon\))
  
• Keep perturbed inputs “close” to original

Bounded perturbations (\(\ell_\infty\) ball)

Unbounded attacks ✅

• Minimal perturbation to cross decision boundary
  
• Often harder to compute but insightful

Unbounded perturbations (decision boundary)

The next dimension describes how to constrain the adversarial attacks.

You can constrain the perturbation by two ways:

Bounded attacks used a fixed budget to constrain the perturbation. Unbounded attacks find the minimal perturbation.

I will test both of them in my research.

What are the Goals of Adversarial Attacks?

Confidence Reduction ❌

Nontargeted Misclassification ✅

Targeted Misclassification ❌

Source/Target Misclassification ❌

Given a credit score classification systems \(f: \mathbb{X}\to \mathbb{Y}\) with three classes \(\mathbb{Y} = \{\)Poor, Standard, Good\(\}\), select an input instance \(\boldsymbol{x}\in\mathbb{X}\) to craft a adversarial example \(\boldsymbol{x}^{adv}\):

1. Confidence Reduction: Attack not success: \(\boldsymbol{x}\) (Poor, 90% confidence) → \(\boldsymbol{x}^{adv}\) (Poor, 50% confidence)
2. Nontargeted Misclassification: Attack success:\(\boldsymbol{x}\) (any class, e.g., Poor) → \(\boldsymbol{x}^{adv}\) (a different class, Standard or Good)
3. Targeted Misclassification: Attack success: \(\boldsymbol{x}\) (any class, e.g., Poor or Standard) → \(\boldsymbol{x}^{adv}\) (specific class Good)
4. Source/Target Misclassification: Attack success:\(\boldsymbol{x}\) (specific class Poor) → \(\boldsymbol{x}^{adv}\) (specific class Good)

The last dimension is the goal of adversarial attacks.

The adversarial attacks can lead to four different levels of impact:

The first level is confidence reduction, which does not require the model to misclassify, but reduce the confidence. The other three levels require the model to be misclassified. From misclassification to any class

Our research focus on nontargeted misclassification. It is more practical in real world.

Summary of Research Scope

A taxonomy of adversarial attack threat models. Four dimensions: Influence, Knowledge, Constraints, Goals. Highlighted boxes show research scope.

Based on the four dimensions, I can summarize the research scope of PhD research here.

We focus on the test-time attacks, white-box attacks, both bounded and unbounded attacks, for the purpose of nontargeted misclassification.

Benchmarks in Adversarial Attacks

Most existing benchmarks focus on:

• images (Croce et al. 2021; Hingun et al. 2023; Cinà et al. 2025),
• graphs (Zheng et al. 2021),
• time-series (Siddiqui, Dengel, and Ahmed 2020).

The only tabular benchmark focuses on a single attack method (Simonetto, Ghamizi, and Cordy 2024), leaving comprehensive tabular evaluation underexplored.

Now we have the basic understanding of adversarial attacks, but if we look at existing adversarial attack research, we will find that most of them are focused on images, graphs, and time-series.

Only one benchmark focuses on tabular data, …

Cinà, Antonio Emanuele, Jérôme Rony, Maura Pintor, Luca Demetrio, Ambra Demontis, Battista Biggio, Ismail Ben Ayed, and Fabio Roli. 2025. “AttackBench: Evaluating Gradient-Based Attacks for Adversarial Examples.” In Proceedings of the Thirty-Ninth AAAI Conference on Artificial Intelligence (AAAI-25), edited by Toby Walsh, Julie Shah, and Zico Kolter, 2600–2608. Association for the Advancement of Artificial Intelligence (AAAI). https://doi.org/10.1609/aaai.v39i3.32263.

Croce, Francesco, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. 2021. “RobustBench: A Standardized Adversarial Robustness Benchmark.” In Proceedings of the Neural Information Processing Systems Track on Datasets and Benchmarks 1 (NeurIPS Datasets and Benchmarks 2021), edited by Joaquin Vanschoren and Sai-Kit Yeung. Vol. 1. Curran Associates, Inc. https://datasets-benchmarks-proceedings.neurips.cc/paper/2021/hash/a3c65c2974270fd093ee8a9bf8ae7d0b-Abstract-round2.html.

Hingun, Nabeel, Chawin Sitawarin, Jerry Li, and David Wagner. 2023. “REAP: A Large-Scale Realistic Adversarial Patch Benchmark.” In 2023 IEEE/CVF International Conference on Computer Vision (ICCV 2023), 4640–51. IEEE. https://doi.org/10.1109/ICCV51070.2023.00428.

Siddiqui, Shoaib Ahmed, Andreas Dengel, and Sheraz Ahmed. 2020. “Benchmarking Adversarial Attacks and Defenses for Time-Series Data.” In 27th International Conference on Neural Information Processing (ICONIP 2020), 12534:544–54. Lecture Notes in Computer Science. Cham: Springer International Publishing. https://doi.org/10.1007/978-3-030-63836-8_45.

Simonetto, Thibault, Salah Ghamizi, and Maxime Cordy. 2024. “Towards Adaptive Attacks on Constrained Tabular Machine Learning.” In ICML 2024 Workshop on the Next Generation of AI Safety. OpenReview.net. https://openreview.net/forum?id=DnvYdmR9OB.

Zheng, Qinkai, Xu Zou, Yuxiao Dong, Yukuo Cen, Da Yin, Jiarong Xu, Yang Yang, and Jie Tang. 2021. “Graph Robustness Benchmark: Benchmarking the Adversarial Robustness of Graph Machine Learning.” In Proceedings of the Neural Information Processing Systems Track on Datasets and Benchmarks 1 (NeurIPS Datasets and Benchmarks 2021), edited by Joaquin Vanschoren and Sai-Kit Yeung. Curran Associates, Inc. https://datasets-benchmarks-proceedings.neurips.cc/paper/2021/hash/6cdd60ea0045eb7a6ec44c54d29ed402-Abstract-round2.html.

Overall Problem

Researchers have been working on making models more robust to adversarial attacks on unstructured data. However, researchers have rarely investigated adversarial robustness for tabular data.

How can one construct predictive models that are robust to adversarial attacks for tabular data?

Based on the above background, we have a question:

“How can one construct predictive models that are robust to adversarial attacks for tabular data?”

To answer this question, we need to get into the details of adversarial attacks on tabular data.

Adversarial Attacks on Tabular Data

From the definition of adversarial examples, we have two central challenges:

• Effectiveness — Generate adversarial examples that can effectively mislead the model.
  • Bounded → FGSM (Goodfellow, Shlens, and Szegedy 2015), BIM (Kurakin, Goodfellow, and Bengio 2016), PGD (Madry et al. 2018)
  • Unbounded → DeepFool (Moosavi-Dezfooli, Fawzi, and Frossard 2016), C&W (Carlini and Wagner 2017) 👉 Most of above adversarial attacks are adapted from Computer Vision.

• Imperceptibility — Only limited work on this (Ballet et al. 2019; Chernikova and Oprea 2022).

  ❓ Can we use the same imperceptibility concept as in Computer Vision for tabular data?

From the definition of adversarial examples, we have two central challenges:

Effectiveness: generate adversarial examples that can effectively mislead the model. Most of the existing adversarial attacks are adapted from Computer Vision.

Another challenge is imperceptibility: only limited work on this.

You might have a question: we already adapt attacks from image to tabular data for effectiveness, but can we use the same imperceptibility concept as in Computer Vision for tabular data?

Ballet, Vincent, Xavier Renard, Jonathan Aigrain, Thibault Laugel, Pascal Frossard, and Marcin Detyniecki. 2019. “Imperceptible Adversarial Attacks on Tabular Data.” arXiv [Stat.ML]. http://arxiv.org/abs/1911.03274.

Carlini, Nicholas, and David Wagner. 2017. “Towards Evaluating the Robustness of Neural Networks.” In 2017 IEEE Symposium on Security and Privacy (SP 2017), 39–57. IEEE. https://doi.org/10.1109/sp.2017.49.

Chernikova, Alesia, and Alina Oprea. 2022. “FENCE: Feasible Evasion Attacks on Neural Networks in Constrained Environments.” ACM Transactions on Privacy and Security 25 (4): 1–34. https://doi.org/10.1145/3544746.

Goodfellow, Ian J, Jonathon Shlens, and Christian Szegedy. 2015. “Explaining and Harnessing Adversarial Examples.” In 3rd International Conference on Learning Representations (ICLR 2015), edited by Yoshua Bengio and Yann LeCun. https://arxiv.org/abs/1412.6572.

Kurakin, Alexey, Ian Goodfellow, and Samy Bengio. 2016. “Adversarial Examples in the Physical World.” arXiv [Cs.CV]. http://arxiv.org/abs/1607.02533.

Madry, Aleksander, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. “Towards Deep Learning Models Resistant to Adversarial Attacks.” In 6th International Conference on Learning Representations (ICLR 2018). OpenReview.net. https://openreview.net/forum?id=rJzIBfZAb.

Moosavi-Dezfooli, Seyed-Mohsen, Alhussein Fawzi, and Pascal Frossard. 2016. “DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks.” In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR 2016), 2574–82. IEEE. https://doi.org/10.1109/cvpr.2016.282.

Imperceptibility in Computer Vision

The same example also shows another key property: adversarial perturbations are designed to be imperceptible.

In Computer Vision, adversarial perturbations must be “indistinguishable to the human eye” (Goodfellow, Shlens, and Szegedy 2015) — the adversarial image should look identical to the original.

Let’s revisit this koala example. Only take care of the distance between the adversarial example and the original image.

The adversarial example looks similar to the original image to human eye, which is “imperceptible”.

To achieve this requirement …

Goodfellow, Ian J, Jonathon Shlens, and Christian Szegedy. 2015. “Explaining and Harnessing Adversarial Examples.” In 3rd International Conference on Learning Representations (ICLR 2015), edited by Yoshua Bengio and Yann LeCun. https://arxiv.org/abs/1412.6572.

Imperceptibility in Computer Vision

This is formalised using bounded perturbations under norms (e.g., \(\ell_\infty\)) (Madry et al. 2018). These constraints limit the size of pixel-level changes.

Bounded perturbations under norms (e.g., \(\ell_\infty\) norm)

We can use \(\ell_\infty\) norm to measure the imperceptibility in image by constrain the perturbation at the pixel level.

Madry, Aleksander, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. “Towards Deep Learning Models Resistant to Adversarial Attacks.” In 6th International Conference on Learning Representations (ICLR 2018). OpenReview.net. https://openreview.net/forum?id=rJzIBfZAb.

Imperceptibility in Tabular Data: A Challenge

The failure of image-based imperceptibility concepts for tabular data.

👉 CV-style definitions of imperceptibility (pixel norms) do not transfer to tabular data.

If we using the same imperceptibility concept in tabular data, we will find that the perturbations are obvious and unrealistic.

For example, the attack perturbs the pregnancy number from 1 to 6, but it is not feasible. Some of other features are also not realistic.

Based on the above example, we can see that the image-based imperceptibility concept does not apply to tabular data.

Redefining Imperceptibility for Tabular Data

Goal: adversarial examples should not just small perturbations, but also remain realistic.

Imperceptibility in tabular data means perturbations must preserve:

• Statistical consistency → numerical features follow realistic distributions

• Semantic validity → categorical values remain logically consistent

• Structural integrity → dependencies between features are not violated
  

We need to redefine the imperceptibility concept for tabular data.

To make sure the adversarial example is not only just small perturbations, but also remain realistic.

Such as:

• Statistical consistency: numerical features follow realistic distributions
• Semantic validity: categorical values remain logically consistent
• Structural integrity: dependencies between features are not violated

🎯 Research Problem

After the introduce of the adversarial attacks and current gaps in adversarial attacks for tabular data. Here is our research questions

Research Question & Objective 1

RQ1: What properties can be used to define the imperceptibility of adversarial attacks on tabular data?

Unlike images, tabular datasets require definitions that account for

• statistical consistency
  
• semantic validity
  
• structural integrity

This question establishes the conceptual foundations of imperceptibility.

Objective 1: Identify and formalise the set of properties of imperceptible adversarial attacks on tabular data.

The RQ1 is …

We will need to define the properties of imperceptible adversarial attacks on tabular data.

Research Question & Objective 2

RQ2: How do existing adversarial attacks perform under both effectiveness and tabular-specific imperceptibility criteria?

Two dimensions:
1. Ability to misclassify predictive models (effectiveness)
2. Extent to which perturbations achieve minimal perturbation and statistical consistency (imperceptibility)

Sub-questions:

• RQ2.1: How effective are existing adversarial attack algorithms on tabular data?
  
• RQ2.2: How imperceptible are existing adversarial attacks when evaluated against the defined properties?
  
• RQ2.3: To what extent can attacks achieve effectiveness while remaining imperceptible?
  

Objective 2: Develop an evaluation framework to benchmark adversarial attacks on tabular data.

The RQ2 is …

We will need to evaluate the effectiveness and imperceptibility of the existing adversarial attacks on tabular data to find what attacks can be both effective and imperceptible.

Research Question & Objective 3

RQ3: How can new adversarial attacks on tabular data be designed to generate both effective and imperceptible adversarial examples?

Sub-questions:

• RQ3.1: How effectively can new attack methods preserve statistical consistency while minimising perturbations?
  
• RQ3.2: How do proposed methods compare with existing attacks in terms of both effectiveness and imperceptibility?
  
• RQ3.3: How does adversarial training with newly designed attacks influence model robustness?
• RQ3.4: How do design choices such as perturbation constraints, hyperparameters, and feature selection strategies affect the attack effectiveness and imperceptibility?

Objective 3: Design new adversarial attack that unify effectiveness with tabular-specific imperceptibility.

The RQ3 is …

We will design a new adversarial attack that can be both effective and imperceptible based on the insights from the evaluation of the existing adversarial attacks in RQ2.

Design Science Research (DSR) Methodology

This thesis follows DSR methodology (Peffers et al. 2014; Hevner et al. 2004), guided by the three-cycle view (Hevner 2007):

• Relevance cycle: practical challenge of adversarial robustness in tabular data
• Rigor cycle: extends theoretical foundations of adversarial machine learning
• Design cycle: iterative development & evaluation of artifacts

Artifacts developed:

• Imperceptibility properties for tabular data
  
• Benchmark for systematic evaluation
  
• Proposed new attack method for tabular data

In my PhD research, I use the Design Science Research methodology to guide my research.

Following the three-cycle view,

we first explore the research background and problem definition in relevance cycle;

then extend the theoretical foundations of imperceptibility and new attacks design in rigor cycle;

finally, iteratively develop and evaluate the artifacts in design cycle, including: …

Hevner, A. 2007. “The Three Cycle View of Design Science.” Scandinavian Journal of Information Systems 19 (2): 4. https://aisel.aisnet.org/sjis/vol19/iss2/4.

Hevner, March, Park, and Ram. 2004. “Design Science in Information Systems Research.” MIS Quarterly: Management Information Systems 28 (1): 75. https://doi.org/10.2307/25148625.

Peffers, Ken, Tuure Tuunanen, Marcus A Rothenberger, and Samir Chatterjee. 2014. “A Design Science Research Methodology for Information Systems Research.” Journal of Management Information Systems, 45–77. https://doi.org/10.2753/MIS0742-1222240302.

Research Design

Start from common pipeline of adversarial attack on tabular data.

To understand my overall research design, let’s start from the common pipeline of adversarial attack on tabular data.

Research Design

RQ1 build the foundation of imperceptibility on tabular data.

From the characteristic of tabular data, we need to redefine the imperceptibility properties on tabular data as RQ1.

Research Design

RQ2 benchmark the adversarial attacks under effectiveness and imperceptibility.

The RQ2 will benchmark the existing adversarial attacks under effectiveness and the predefined imperceptibility properties in RQ1.

Research Design

RQ3 design the new adversarial attack methods that unify effectiveness with tabular-specific imperceptibility.

After the evaluation of the existing adversarial attacks in RQ2, we will consider the benchmark insights to design the new adversarial attack methods in RQ3.

The new attack methods will be evaluated to ensure both effectiveness and imperceptibility.

Also it will be used in adversarial training and compare robustness with original model.

Objective 1

🧩 Foundation of Imperceptibility on Tabular Data

Publication:

Zhipeng He, Chun Ouyang, Laith Alzubaidi, Alistair Barros, and Catarina Moreira. “Investigating imperceptibility of adversarial attacks on tabular data: An empirical analysis”. In: Intelligent Systems with Applications 25, 200461 (2025). DOI: 10.1016/j.iswa.2024.200461.

Let’s start from the first objective. …

For this objective, we have a publication published in the journal Intelligent Systems with Applications.

Establishing Criteria and Deriving Properties for Imperceptibility

We list five criteria to define the imperceptibility properties on tabular data.

The first one is “minimise the feature perturbation”, which is from the definition of adversarial examples.

The second and third are addressing the statistical characteristics of the tabular data.

The last two are addressing the semantic and structural integrity of the tabular data.

Based on the criteria, we can derive the seven properties of imperceptibility on tabular data.

The first four properties are quantitative properties; they can be measured by quantitative metrics.

and the last three properties are qualitative properties, they need to be evaluated by domain knowledge and case-based reasoning.

Quantitative Properties

Proximity

Sparsity

Deviation

Sensitivity

• Proximity: Measures how close \(\tilde{x}\) is to \(x\).

• Sparsity: Measures how many features are altered in \(\tilde{x}\).

• Deviation: Measures how far \(\tilde{x}\) is from the data distribution \(\mathcal{P}(\mathcal{D})\).

• Sensitivity: Measures the perturbation on narrow-variance features (\(x_0\) and \(x_2\)) over the dataset \(\mathcal{D}\).

Qualitative Properties

Three properties:

1. Immutability – features that are inherently fixed or should not be altered for ethical or practical reasons.
2. Feasibility – whether perturbed values remain semantically correct.
3. Feature Interdependency – how perturbations respect the feature relationships and dependencies.

Illustration of Quantitative Properties

• Depend on domain knowledge and case-based reasoning.
  

On the other hand, the last three properties are qualitative properties, they need to be evaluated by domain knowledge and case-based reasoning.

They are: Immutability, Feasibility, and Feature Interdependency.

I will use the dummy example to explain them.

Feature race is an immutable feature and we should not change it due to ethical reasons.

Wasily picked up by rule based filter

The feature Age has its feasible range, and attacks should not perturb it out of the range, such as 200.

Marriage status has the feature interdependency with relationship. If someone is never married, he should not be husband.

These properties focus on the semantic and logical validity of perturbations. and they cannot be fully measured by distance or distribution metrics.

Foundation for Evaluating Imperceptibility

• Provides a principled framework to capture imperceptibility in tabular data.
• Moves beyond ad hoc or isolated criteria used in previous work.

Take these seven properties together, we can provide a principled framework to capture imperceptibility in tabular data.

Also it moves beyond the ad hoc or isolated criteria used in previous work.

In the next objective, we will apply four quantitative properties to benchmark the existing adversarial attacks on tabular data.

Objective 2

📊 Benchmark of Tabular Attacks

Paper:

Zhipeng He, Chun Ouyang, Lijie Wen, Cong Liu, and Catarina Moreira. “TabAttackBench: A benchmark for adversarial attacks on tabular data”. In: arXiv [cs.LG] (2025). arXiv: 2505.21027.

Submitted to Expert Systems with Applications, under \(1^{st}\) revision.

In this objective, we have a paper submitted to the journal Expert Systems with Applications and now is under the first round revision based on the review comments.

Framework of Benchmarking

Here is an overall deisgn of the framework of benchmarking. I will walk through the details of each step in the framework in the following slides.

Dataset Selection

Select 10 datasets from tabular benchmarking suite (Gorishniy et al. 2021) under the following criteria:

1. Classification focus – Each dataset presents classification problems
2. Feasible size – Feature dimensionality (after one-hot encoding) is capped at ≤ 200
3. Realistic domains – Representative of real-world domains (health, finance, physics, etc.)

We follow the existing ML algorithm benchmark for tabular data to select 10 datasets under the following criteria

Then, all selected datasets are divided into training, validation and test sets.

Training and validating the predictive models on the training and validation sets.

Test set will be used to evaluate the performance of the predictive models and generate adversarial examples by the adversarial attacks.

Gorishniy, Yu V, Ivan Rubachev, Valentin Khrulkov, and Artem Babenko. 2021. “Revisiting Deep Learning Models for Tabular Data.” In Advances in Neural Information Processing Systems 34 (NeurIPS 2021), edited by Marc’aurelio Ranzato, Alina Beygelzimer, Yann N Dauphin, Percy Liang, and Jennifer Wortman Vaughan, 34:18932–43. Curran Associates, Inc. https://proceedings.neurips.cc/paper_files/paper/2021/hash/9d86d83f925f2149e9edb0ac3b49229c-Abstract.html.

Predictive Model Selection

1. Diversity - covering classical and modern architectures
2. Interpretability - balancing transparency with complexity
3. Performance - ensuring competitive accuracy on tabular tasks

To cover the diversity of predictive models, we select four models: Logistic Regression (LR), Multilayer Perceptrons (MLP) and two transformer-based models: TabTransformer and FT-Transformer.

LR and MLP are classical models, and Transformer-based models are modern models. LR is transparent and interpretable, and other nueral network models are not.

They all can achieve competitive accuracy on tabular tasks.

Adversarial Attack Selection

Next step, we extract the gradient information from the predictive models to generate adversarial examples.

Just like we scoped in the background, we consider both bounded and unbounded attacks.

Ubounded attacks: find minial perturbation just across the decision boundary.

Bounded attacks: perturb the input within a fixed budget and max the model loss to misclassify.

Evaluation Metrics

Effectiveness

Attack Success Rate (ASR):

• fraction of perturbed instances that being successfully misclassfied
• Higher is better

\[ \text{ASR} = \frac{1}{n}\sum_{i=1}^{n}\one( \boldsymbol{x}^{adv}\neq y) \]

After generating the adversarial examples, we evaluate the performance of the adversarial attacks from two aspects: effectiveness and imperceptibility.

The effectiveness is measured by the attack success rate.

It is the percentage of perturbed instances that being successfully misclassfied.

Higher is better.

Evaluation Metrics

Imperceptibility

4 Quantitative Properties: Lower is better

• Proximity: Average \(\ell_2\) distance between \(x\) and \(\tilde{x}\).
• Sparsity: Fraction of features changed in \(\tilde{x}\).
• Deviation: Outlier rate against the data distribution.
• Sensitivity: Variance-normalised perturbation size on narrow-variance features.

Imperceptibility Score (IS): Equal-weighted harmonic mean of above normalised properties

\[ \text{IS} = \frac{4}{\frac{1}{\text{Proximity}} + \frac{1}{\text{Sparsity}} + \frac{1}{\text{Deviation}} + \frac{1}{\text{Sensitivity}}} \]

👉 Harmonic mean penalises imbalance (one bad metric drags IS down).

For evaluation of imperceptibility, we use the four quantitative properties: proximity, sparsity, deviation and sensitivity from the previous objective 1.

To measure the overall imperceptibility, we use the harmonic mean of the four properties. It can balance the four properties and give a more comprehensive evaluation.

Trade-off analysis: ASR vs Imperceptibility (IS)

ASR vs IS 2D density. Higher attack success rate is better. Lower imperceptibility score is better.

In the benchmark, we conduct a trade-off analysis between the attack success rate and imperceptibility score.

We visualise the 2D density of the attack success rate and imperceptibility score. Higher attack success rate is better. Lower imperceptibility score is better.

Firstly, we use the Gaussian Noise as the baseline. Since we consider guassian noise is ineffective and perceptible.

Trade-off analysis: ASR vs Imperceptibility (IS)

Choose the threshold of maximum ASR value (0.659) and the minimum IS value (0.181) of Gaussian Noise.

Then, we choose the threshold of the attack success rate and imperceptibility score by using the maximum attack success rate and the minimum imperceptibility score.

Trade-off analysis: ASR vs Imperceptibility (IS)

Divided into four sectors by the thresholds.

By using the two thresholds, we can divide the 2D density into four sectors.

Trade-off analysis: ASR vs Imperceptibility (IS)

Guassion noise is ineffective and perceptible.

So the left top sector is the effective and imperceptible sector.

We prefer the high density region of attacks located in this sector.

The right top sector is the effective and perceptible sector.

the left bottom sector is the ineffective and imperceptible sector.

The right bottom sector is the ineffective and perceptible sector.

Trade-off analysis: ASR vs Imperceptibility (IS)

Only DeepFool and C&W lies in the effective & imperceptible sector.

Here is the final result of the trade-off analysis.

We can see that only Random Noise is ineffective and perceptible.

For bounded attacks, like FGSM, PGD and BIM, they are effective but with large imperceptibility score.

Two unbounded attacks, like C&W and DeepFool, can achieve both effectiveness and imperceptibility.

But C&W has two density regions: another one is ineffective but imperceptible. It means that C&W will garrentee to generate imperceptible examples even attack not success.

Imperceptibility Insights

• Sparsity
  • FGSM, PGD and BIM attacks alter nearly all numerical features
  • C&W and DeepFool attacks more selective on numerical features
  • However, categorical features mostly ignored by all attacks
    

• Proximity
  • FGSM, PGD and BIM attacks effective but with large perturbations.
  • C&W & DeepFool generate closest examples.

• Deviation
  • FGSM, PGD and BIM attacks often push samples out of distribution.
  • C&W and DeepFool attacks better preserve data alignment.
    

The t-SNE visualisation shows that FGSM attack keeps generating out-of-distribution examples on Adult dataset.

• Sensitivity
  • FGSM, PGD and BIM attacks show high variance and instability.
    
  • C&W perturbs narrow-range features least.

We also check four individual imperceptibility metrics evaluation.

The sparsity metric shows that …

The proximity metric shows that …

The deviation metric shows that …

for example, the t-SNE visualisation shows that FGSM attack keeps generating out-of-distribution examples on Adult dataset.

The sensitivity metric shows that …

Imperceptibility Insights

Overall Insight

• FGSM, PGD and BIM attacks are strong but unrealistic; C&W and DeepFool attacks achieve better balance between effectiveness and imperceptibility.
  👉 Unbounded attacks are the better choice for tabular data.

• All five attacks fail to handle categorical features during the generation of adversarial examples.
  👉 Further Question: What is the root cause of this issue?

Based on the above insights, we can know that: 1. Unbounded attacks are the better choice for tabular data. 2. All five attacks cannot fail to handle categorical features during the generation of adversarial examples. We need to further investigate the root cause of this issue.

Limitation in Categorical Feature Encoding

• While one-hot encoding simplifies the handling of categorical features by making them compatible with standard distance measurements (such as \(\ell_p\) norms) used for continuous features, it can introduce more sparse feature space.

Changing one categorical feature requires perturbation on at least two encoded features.

One-hot …

For example, changing one categorical feature requires perturbation on at least two encoded features.

How to Design New Attacks for Tabular Data?

💡 Insight 1: Propose based on unbounded attacks (C&W, DeepFool, etc.).

🧩 Insight 2: Consider the imperceptibility properties in the attack design.

⚙️ Insight 3: Unify both categorical and numerical feature spaces in attacks.

❓ Question: Can we incorporate the above insights to design a new attack for tabular data?

The benechmark provides us the insights to design new attacks for tabular data.

How to Design New Attacks for Tabular Data?

In the next objective, we will design the new attacks for tabular data based on the above insights.

Objective 3

⚙️ Generative VAE-based Attack

Paper:

Zhipeng He, Alexander Stevens, Chun Ouyang, Johannes De Smedt, Alistair Barros, and Catarina Moreira. “Crafting imperceptible on-manifold adversarial attacks for tabular data”. In: arXiv [cs.LG] (2025). arXiv: 2507.10998.

Submitted to Applied Soft Computing, under \(1^{st}\) revision.

For this objective, we have a paper submitted to the journal Applied Soft Computing and now is under the first round revision based on the review comments.

Based on the insights from the previous objective, the most significant limitation is the categorical feature encoding.

We want to unify the categorical and numerical feature spaces into same encoding space.

However, it is quite challenging to design a new encoding method for the tabular data. And that is not the focus of our research about adversarial attacks.

So we use a wrokaround to solve this issue.

Manifold Learning

Manifold Hypothesis: High-dimensional data often lies on a lower-dimensional manifold embedded within the high-dimensional input space.

The Latent Space of Variational Autoencoder (VAE) (Kingma and Welling 2014). Image Source: Tim von Hahn

Unify both categorical and numerical feature spaces into a continuous latent space.

👉 Addressing the issue of categorical feature encoding.

Learn the distribution of original data to generate in-distribution adversarial examples.

👉 Addressing the deviation property of imperceptibility.

That is manifold learning.

It projects the original input data into a continuous latent space.

By using the manifold learning,

we can unify the categorical and numerical feature spaces into same encoding space.

also, it can learn the distribution of original data to generate in-distribution adversarial examples.

Kingma, Diederik P, and Max Welling. 2014. “Auto-Encoding Variational Bayes.” In 2nd International Conference on Learning Representations (ICLR 2014), edited by Yoshua Bengio and Yann LeCun.

Overview of VAE-Based Attack

Step 1: VAE Training:

1. Optimise \(\mathcal{L}_{\mathrm{VAE}}\) until convergence
2. Freeze encoder & decoder for adversarial generation

\[ \begin{align} \mathcal{L}_{\mathrm{VAE}} &= \underbrace{ \mathbb{E}_{q_\phi(z\mid x)} \Big[ \underbrace{\|x^{\mathrm{num}} - \hat{x}^{\mathrm{num}}\|^2}_{\substack{\text{Numerical reconstruction} \\ \text{(MSE, Gaussian likelihood)}}} + \underbrace{\mathcal{L}_{\mathrm{cat}}(x^{\mathrm{cat}}, \hat{x}^{\mathrm{cat}})}_{\substack{\text{Categorical reconstruction} \\ \text{(Cross-entropy, Softmax probability)}}} \Big] }_{\text{Reconstruction Loss}} \\ &\quad + \beta \cdot \underbrace{D_{\mathrm{KL}}\big(q_\phi(z\mid x) \parallel p(z)\big)}_{\substack{\text{KL divergence} \\ \text{(Latent regularisation)}}} \,+\, \alpha \cdot \underbrace{\mathcal{L}_{\text{cls}}(h_\omega(z), y)}_{\substack{\text{Classification loss} \\ \text{(Class separation)}}}. \end{align} \]

VAE Architecture

The first step of the new VAE-based attack is to train the generative model from the original data.

We use variational autoencoder (VAE) to encode the original data into the latent space and decode the latent space back to the original data.

Different reconstruction loss is used to decode the numerical and categorical features.

Besides the basic reconstruction loss and KL divergence loss, we also add the classification-aware loss to encourage the latent space to become more discriminative.

After training, we freeze the encoder and decoder for adversarial example generation.

Overview of VAE-Based Attack

Step 2: Adversarial example generation:

1. Encode input: \(x \to z\)
   
2. Add perturbation \(\delta\) in latent space
   
3. Decode \((z+\delta) \to \tilde{x}\)
   
4. Optimise \(\delta\) via CW-style loss: \(\min_\delta \; \lambda \,\mathcal{L}_{cls}(\tilde{x}, y) + \|\delta\|_2\)

Perturbation in latent space

The second step is to generate the adversarial example in the latent space.

We first encode the input data into the latent space.

Then we add the perturbation in the latent space.

Finally, we decode the perturbed latent space back to the original data.

The perturbation is added in the latent space by optimising the CW-style loss. Since in the benchmark, we find that the unbounded attacks are the better choice for tabular data.

The reconstructed x will be the adversarial example.

Evaluation Setup

Better Standardlisation

Z-score normalisation to address the sensitivity property of imperceptibility.

Baseline Manifold Attacks from Computer Vision

1. PGD-VAE (Stutz, Hein, and Schiele 2019): Applied PGD in latent space of VAE.
2. Delta-Z (Creswell, Bharath, and Sengupta 2017): perturbs latent vectors multiplicatively to flip class-discriminative feature signs, making it suitable only for binary classification tasks.

New Metric for In-Distribution Success

Proposed In-Distribution Success Rate (IDSR) to measure the success rate of adversarial examples in the in-distribution, i.e., \(\mathrm{IDSR} = \mathrm{ASR} \times (1 - \mathrm{OR})\).

For evaluation the new attacks.

In addition to the evaluation settings in the benchmark, we use:

1. Z-score normalisation to process the numerical features, which considers the mean and variance of the numerical features. It will address the sensitivity property of imperceptibility.

2. We add another two VAE-based attacks as the baseline, one is PGD-VAE and the other is Delta-Z.

3. Add a new model called Soft Decision Tree (SDT) to mimic the tree-based model behaviour.

4. We propose a new metric for in-distribution success, which is the product of the attack success rate and the outlier rate.

Creswell, Antonia, Anil A Bharath, and Biswa Sengupta. 2017. “LatentPoison - Adversarial Attacks on the Latent Space.” arXiv [Cs.LG]. http://arxiv.org/abs/1711.02879.

Stutz, David, Matthias Hein, and Bernt Schiele. 2019. “Disentangling Adversarial Robustness and Generalization.” In 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 2019), 6969–80. IEEE. https://doi.org/10.1109/cvpr.2019.00714.

Reconstruction Evaluation

1. The trained VAE achieves strong reconstruction performance across all datasets.
   
2. The German dataset performs slightly worse, likely due to its limited number of samples.

The first evaluation is to measure the reconstruction performance of the trained VAE.

We want to ensure that the trained VAE can reconstruct the original data accurately.

From the radar chart, we can see that the proposed VAE achieves good reconstruction performance across most datasets.

The only dataset that performs slightly worse is the German dataset, which likely due to its limited number of samples.

For Pendigits dataset, it does not have categorical features, so the metric of categorical reconstruction is not applicable.

Reconstruction Evaluation

💡 Introducing the classification-aware loss (\(\mathcal{L}_{cls}\)) encourages the latent space to become more discriminative.

Left t-SNE: Baseline VAE (without \(\mathcal{L}_{cls}\)) on Phishing dataset
— classes overlap in latent space.

Right t-SNE: Proposed VAE (with \(\mathcal{L}_{cls}\)) on Phishing dataset
— clearer class separation.

We also get into the latent space to check whether the classification-aware loss can encourage the latent space to become more discriminative.

The left t-SNE without the classify loss shows that the classes overlap in the latent space. And the right t-SNE with the classify loss shows that the classes are more separated in the latent space.

It shows that the classification-aware loss can encourage the latent space to become more discriminative.

Why Use VAE Instead of GAN for Tabular Data?

The VAE’s probabilistic latent structure better preserves both numerical continuity and categorical consistency than Generative Adversarial Network (GAN) (Goodfellow et al. 2014), making it more suitable for imperceptible adversarial example generation on tabular data.

When designing the new manifold attack, another common question is why use VAE instead of GAN.

We also perform an ablation study to compare the performance of VAE and GAN in reconstruction performance.

In the radar chart, we can see that the VAE achieves better reconstruction performance than the GAN in all the datasets. So we choose VAE instead of GAN.

Goodfellow, Ian J, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. 2014. “Generative Adversarial Nets.” In Advances in Neural Information Processing Systems 27 (NeurIPS 2014). https://proceedings.neurips.cc/paper_files/paper/2014/hash/f033ed80deb0234979a61f95710dbe25-Abstract.html.

Evaluating Proposed Attack (IDSR + OR)

💡 Our VAE-based attack achieves the best overall In-Distribution Success Rate (IDSR) while maintaining a low Outlier Rate (OR), outperforming other VAE-based methods.

When evaluating the imperceptibility of the adversarial examples, we use the in-distribution success rate and outlier rate to plot a scatter plot.

In-distribution success rate measures the ability to generate successful adversarial examples in the in-distribution of the original data. The higher the better.

Outlier rate measures the percentage of outliers in the adversarial examples. The lower the better.

We find that our proposed VAE-based attack achieves the best overall IDSR while maintaining a low OR, outperforming other VAE-based methods and input space attacks.

Evaluating Attack Imperceptibility (t-SNE)

💡 The latent space visualisations (t-SNE) show that adversarial examples (green) generated by our VAE-based attack remain closely aligned with original inputs (blue).

Phishing dataset and MLP model.

PenDigits dataset and TabTransformer model.

Beside the in-distribution success rate and outlier rate, we also plot the t-SNE visualisation of the adversarial examples and the original data in the latent space.

It proves that the adversarial examples generated by our VAE-based attack remain closely aligned with the original data distribution.

By this way. our proposed VAE-based attack can achieve both effectiveness and imperceptibility.

Applying Our Attack to Adversarial Training

A common practice in adversarial training is to generate adversarial examples during training (Qian et al. 2022).

With effectiveness and imperceptibility established, the natural next step is to apply these adversarial examples during model training and observe whether they improve robustness.

Here is a common practice in adversarial training:

We can generate the adversarial examples during the training process and mixed them with the original data to train the model.

The new trained model can achieve better robustness to avoid the misclassifications of the adversarial examples.

Qian, Zhuang, Kaizhu Huang, Qiu-Feng Wang, and Xu-Yao Zhang. 2022. “A Survey of Robust Adversarial Training in Pattern Recognition: Fundamental, Theory, and Methodologies.” Pattern Recognition 131. https://doi.org/10.1016/j.patcog.2022.108889.

Applying Our Attack to Adversarial Training

💡 Adversarial training effectively reduces Attack Success Rate (robustness gain) while maintaining relatively high model accuracy across all models.

After applying the adversarial examples during model training, we evaluate the robustness of the model.

Basically, the models sacrifice around 10% of the accuracy to low down up to 30% of the attack success rate.

It shows that the adversarial training can effectively reduce the attack success rate while maintaining relatively high clean accuracy across all models.

And it is reasonable to trade off the accuracy to the robustness.

In conclusion, we have achieved the goal of building an adversarilly robust model for tabular data.

🌟 Conclusion & Future Directions

To sum up,

Summary

• Research Problem:

  • How can adversarial examples in tabular domains be both effective and imperceptible?

• Approach: Three-part progression:

  1. Formalised 7 properties of imperceptibility on tabular data.
     
  2. Evaluated existing attacks → exposed gaps and opportunities.
     
  3. Proposed VAE-based on-manifold attack enforcing imperceptibility constraints.

• Outcome:

  • Framework + benchmark + method = foundations, diagnostics, and artefact for advancing AML in tabular data.

my PhD research is to solve the problem of generating both effective and imperceptible adversarial examples for tabular data.

To answer this,

I first formalised the properties of imperceptibility on tabular data.

Then, I evaluated existing attacks to find gaps and oppotunities

Based on the benchmarking insights, I proposed a VAE-based attack to generate adversarial examples in the latent space to enfore imperceptibility properties.

Contributions

Conceptual

• Property-based framework: statistical consistency, semantic validity, structural integrity.

Analytical

• Quantitative + qualitative metrics → benchmark exposing drawbacks of existing attacks.

Methodological

• Generative VAE-based attack unifying categorical & numerical features in latent space.

Practical

• Realistic adversarial examples → pathway to adversarial training for more robust tabular models.

From theory to tools, the thesis bridges conceptual clarity → systematic evaluation → practical innovation.

My PhD research contributes to the adversarial machine learning in tabular data from four different levels:

From the theory to tools, the research bridges the conceptual clarity to the systematic evaluation and the practical innovation.

Limitations & Future Work

Limitations

• Benchmark mainly quantitative (qualitative constraints case-based only).
  
• Finite datasets, models, attack families.
  
• On-manifold attack depends on sufficient training data quality.

Future Work

• LLMs for imperceptibility → encode semantic/feasibility constraints.
  
• Non-uniform perturbations → adaptive perturbation by feature importance & semantics.
  
• Beyond white-box → explore grey-box & black-box attack settings.

Of course, there are some limitations in my research.

The benchmark is mainly quantitative (qualitative constraints case-based only).

Secondly, we cannot cover all the datasets, models, attack families, etc. We only select the most representative ones.

Thirdly, the on-manifold attack depends on sufficient training data quality. If the dataset is not large enough, the on-manifold attack will not be effective.

For the future work, we can:

1. As we mentioned, most of our systematic evaluation is based on the quantitative metrics. Because the qualitative constraints are case-based only, and hard to evaluate them comprehensively. However, LLMs can help us to encode the semantic/feasibility constraints. By incorporating the capability of LLMs, we evaluate the imperceptibility of the adversarial examples more comprehensively.

2. Explore the grey-box and black-box attack settings. Although we have considered the white-box attack because it is the worst-case scenario. But in the real world, we often have to deal with the grey-box and black-box attack settings.

3. In my research, I consider all features equally important. But in the real world, some features are more important than others. For example, you can use explainable AI to extract the feature importance. So we can perform adaptive perturbation by feature importance and semantics.

Closing Insight

Effort to “mend the fence before the sheep are lost”:
→ strengthening adversarial robustness for tabular data models.

Adversarial attacks misclassify models via “broken fence”.

Proactive adversarial training “mending the fence”.

I would like to use this analogy to end my presentation.

All the effort we do is to mend the fence before the sheep are lost.

References

Ahmed, Murtadha, Bo Wen, Luo Ao, and Yunfeng Liu. 2025. “Integrated Gradients-Based Defense Against Adversarial Word Substitution Attacks.” Neural Computing & Applications 37 (18): 12921–39. https://doi.org/10.1007/s00521-025-11135-3.

Assion, Felix, Peter Schlicht, Florens Gressner, Wiebke Gunther, Fabian Huger, Nico Schmidt, and Umair Rasheed. 2019. “The Attack Generator: A Systematic Approach Towards Constructing Adversarial Attacks.” In 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW 2019), 1370–79. IEEE. https://doi.org/10.1109/cvprw.2019.00177.

Ballet, Vincent, Xavier Renard, Jonathan Aigrain, Thibault Laugel, Pascal Frossard, and Marcin Detyniecki. 2019. “Imperceptible Adversarial Attacks on Tabular Data.” arXiv [Stat.ML]. http://arxiv.org/abs/1911.03274.

Biggio, Battista, and Fabio Roli. 2018. “Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning.” Pattern Recognition 84: 317–31. https://doi.org/10.1016/j.patcog.2018.07.023.

Borisov, Vadim, Tobias Leemann, Kathrin Sebler, Johannes Haug, Martin Pawelczyk, and Gjergji Kasneci. 2024. “Deep Neural Networks and Tabular Data: A Survey.” IEEE Transactions on Neural Networks and Learning Systems 35 (6): 7499–519. https://doi.org/10.1109/TNNLS.2022.3229161.

Carlini, Nicholas, and David Wagner. 2017. “Towards Evaluating the Robustness of Neural Networks.” In 2017 IEEE Symposium on Security and Privacy (SP 2017), 39–57. IEEE. https://doi.org/10.1109/sp.2017.49.

———. 2018. “Audio Adversarial Examples: Targeted Attacks on Speech-to-Text.” In 2018 IEEE Security and Privacy Workshops (SP Workshop 2018), 1–7. IEEE. https://doi.org/10.1109/spw.2018.00009.

Chernikova, Alesia, and Alina Oprea. 2022. “FENCE: Feasible Evasion Attacks on Neural Networks in Constrained Environments.” ACM Transactions on Privacy and Security 25 (4): 1–34. https://doi.org/10.1145/3544746.

Cinà, Antonio Emanuele, Jérôme Rony, Maura Pintor, Luca Demetrio, Ambra Demontis, Battista Biggio, Ismail Ben Ayed, and Fabio Roli. 2025. “AttackBench: Evaluating Gradient-Based Attacks for Adversarial Examples.” In Proceedings of the Thirty-Ninth AAAI Conference on Artificial Intelligence (AAAI-25), edited by Toby Walsh, Julie Shah, and Zico Kolter, 2600–2608. Association for the Advancement of Artificial Intelligence (AAAI). https://doi.org/10.1609/aaai.v39i3.32263.

Creswell, Antonia, Anil A Bharath, and Biswa Sengupta. 2017. “LatentPoison - Adversarial Attacks on the Latent Space.” arXiv [Cs.LG]. http://arxiv.org/abs/1711.02879.

Croce, Francesco, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. 2021. “RobustBench: A Standardized Adversarial Robustness Benchmark.” In Proceedings of the Neural Information Processing Systems Track on Datasets and Benchmarks 1 (NeurIPS Datasets and Benchmarks 2021), edited by Joaquin Vanschoren and Sai-Kit Yeung. Vol. 1. Curran Associates, Inc. https://datasets-benchmarks-proceedings.neurips.cc/paper/2021/hash/a3c65c2974270fd093ee8a9bf8ae7d0b-Abstract-round2.html.

Goodfellow, Ian J, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. 2014. “Generative Adversarial Nets.” In Advances in Neural Information Processing Systems 27 (NeurIPS 2014). https://proceedings.neurips.cc/paper_files/paper/2014/hash/f033ed80deb0234979a61f95710dbe25-Abstract.html.

Goodfellow, Ian J, Jonathon Shlens, and Christian Szegedy. 2015. “Explaining and Harnessing Adversarial Examples.” In 3rd International Conference on Learning Representations (ICLR 2015), edited by Yoshua Bengio and Yann LeCun. https://arxiv.org/abs/1412.6572.

Gorishniy, Yu V, Ivan Rubachev, Valentin Khrulkov, and Artem Babenko. 2021. “Revisiting Deep Learning Models for Tabular Data.” In Advances in Neural Information Processing Systems 34 (NeurIPS 2021), edited by Marc’aurelio Ranzato, Alina Beygelzimer, Yann N Dauphin, Percy Liang, and Jennifer Wortman Vaughan, 34:18932–43. Curran Associates, Inc. https://proceedings.neurips.cc/paper_files/paper/2021/hash/9d86d83f925f2149e9edb0ac3b49229c-Abstract.html.

Hevner, A. 2007. “The Three Cycle View of Design Science.” Scandinavian Journal of Information Systems 19 (2): 4. https://aisel.aisnet.org/sjis/vol19/iss2/4.

Hevner, March, Park, and Ram. 2004. “Design Science in Information Systems Research.” MIS Quarterly: Management Information Systems 28 (1): 75. https://doi.org/10.2307/25148625.

Hingun, Nabeel, Chawin Sitawarin, Jerry Li, and David Wagner. 2023. “REAP: A Large-Scale Realistic Adversarial Patch Benchmark.” In 2023 IEEE/CVF International Conference on Computer Vision (ICCV 2023), 4640–51. IEEE. https://doi.org/10.1109/ICCV51070.2023.00428.

IEEE. 2008. “IEEE Standard Computer Dictionary: A Compilation of IEEE Standard Computer Glossaries.” Piscataway, NJ, USA: IEEE. https://doi.org/10.1109/ieeestd.1991.106963.

Kingma, Diederik P, and Max Welling. 2014. “Auto-Encoding Variational Bayes.” In 2nd International Conference on Learning Representations (ICLR 2014), edited by Yoshua Bengio and Yann LeCun.

Kurakin, Alexey, Ian Goodfellow, and Samy Bengio. 2016. “Adversarial Examples in the Physical World.” arXiv [Cs.CV]. http://arxiv.org/abs/1607.02533.

Li, Bo, Peng Qi, Bo Liu, Shuai Di, Jingen Liu, Jiquan Pei, Jinfeng Yi, and Bowen Zhou. 2023. “Trustworthy AI: From Principles to Practices.” ACM Computing Surveys 55 (9): 1–46. https://doi.org/10.1145/3555803.

Li, Deqiang, Qianmu Li, Yanfang (fanny) Ye, and Shouhuai Xu. 2023. “Arms Race in Adversarial Malware Detection: A Survey.” ACM Computing Surveys 55 (1): 1–35. https://doi.org/10.1145/3484491.

Lunghi, Daniele, Alkis Simitsis, Olivier Caelen, and Gianluca Bontempi. 2023. “Adversarial Learning in Real-World Fraud Detection: Challenges and Perspectives.” In Proceedings of the Second ACM Data Economy Workshop (DEC 2023), 27–33. New York, NY, USA: ACM. https://doi.org/10.1145/3600046.3600051.

Madry, Aleksander, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. “Towards Deep Learning Models Resistant to Adversarial Attacks.” In 6th International Conference on Learning Representations (ICLR 2018). OpenReview.net. https://openreview.net/forum?id=rJzIBfZAb.

Moosavi-Dezfooli, Seyed-Mohsen, Alhussein Fawzi, and Pascal Frossard. 2016. “DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks.” In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR 2016), 2574–82. IEEE. https://doi.org/10.1109/cvpr.2016.282.

Papernot, Nicolas, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami. 2016. “The Limitations of Deep Learning in Adversarial Settings.” In 2016 IEEE European Symposium on Security and Privacy (EuroS&p 2016), 372–87. IEEE. https://doi.org/10.1109/eurosp.2016.36.

Peffers, Ken, Tuure Tuunanen, Marcus A Rothenberger, and Samir Chatterjee. 2014. “A Design Science Research Methodology for Information Systems Research.” Journal of Management Information Systems, 45–77. https://doi.org/10.2753/MIS0742-1222240302.

Pelekis, Sotiris, Thanos Koutroubas, Afroditi Blika, Anastasis Berdelis, Evangelos Karakolis, Christos Ntanos, Evangelos Spiliotis, and Dimitris Askounis. 2025. “Adversarial Machine Learning: A Review of Methods, Tools, and Critical Industry Sectors.” Artificial Intelligence Review 58 (8): 1–87. https://doi.org/10.1007/s10462-025-11147-4.

Qian, Zhuang, Kaizhu Huang, Qiu-Feng Wang, and Xu-Yao Zhang. 2022. “A Survey of Robust Adversarial Training in Pattern Recognition: Fundamental, Theory, and Methodologies.” Pattern Recognition 131. https://doi.org/10.1016/j.patcog.2022.108889.

Siddiqui, Shoaib Ahmed, Andreas Dengel, and Sheraz Ahmed. 2020. “Benchmarking Adversarial Attacks and Defenses for Time-Series Data.” In 27th International Conference on Neural Information Processing (ICONIP 2020), 12534:544–54. Lecture Notes in Computer Science. Cham: Springer International Publishing. https://doi.org/10.1007/978-3-030-63836-8_45.

Simonetto, Thibault, Salah Ghamizi, and Maxime Cordy. 2024. “Towards Adaptive Attacks on Constrained Tabular Machine Learning.” In ICML 2024 Workshop on the Next Generation of AI Safety. OpenReview.net. https://openreview.net/forum?id=DnvYdmR9OB.

Stutz, David, Matthias Hein, and Bernt Schiele. 2019. “Disentangling Adversarial Robustness and Generalization.” In 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 2019), 6969–80. IEEE. https://doi.org/10.1109/cvpr.2019.00714.

Sun, Mengying, Fengyi Tang, Jinfeng Yi, Fei Wang, and Jiayu Zhou. 2018. “Identify Susceptible Locations in Medical Records via Adversarial Attacks on Deep Predictive Models.” In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining (KDD 2018), edited by Yike Guo and Faisal Farooq. New York, NY, USA: ACM. https://doi.org/10.1145/3219819.3219909.

Szegedy, Christian, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2014. “Intriguing Properties of Neural Networks.” In 2nd International Conference on Learning Representations (ICLR 2014), edited by Yoshua Bengio and Yann LeCun. https://arxiv.org/abs/1312.6199.

Zheng, Qinkai, Xu Zou, Yuxiao Dong, Yukuo Cen, Da Yin, Jiarong Xu, Yang Yang, and Jie Tang. 2021. “Graph Robustness Benchmark: Benchmarking the Adversarial Robustness of Graph Machine Learning.” In Proceedings of the Neural Information Processing Systems Track on Datasets and Benchmarks 1 (NeurIPS Datasets and Benchmarks 2021), edited by Joaquin Vanschoren and Sai-Kit Yeung. Curran Associates, Inc. https://datasets-benchmarks-proceedings.neurips.cc/paper/2021/hash/6cdd60ea0045eb7a6ec44c54d29ed402-Abstract-round2.html.

Ahmed, Murtadha, Bo Wen, Luo Ao, and Yunfeng Liu. 2025. “Integrated Gradients-Based Defense Against Adversarial Word Substitution Attacks.” Neural Computing & Applications 37 (18): 12921–39. https://doi.org/10.1007/s00521-025-11135-3.

Assion, Felix, Peter Schlicht, Florens Gressner, Wiebke Gunther, Fabian Huger, Nico Schmidt, and Umair Rasheed. 2019. “The Attack Generator: A Systematic Approach Towards Constructing Adversarial Attacks.” In 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW 2019), 1370–79. IEEE. https://doi.org/10.1109/cvprw.2019.00177.

Ballet, Vincent, Xavier Renard, Jonathan Aigrain, Thibault Laugel, Pascal Frossard, and Marcin Detyniecki. 2019. “Imperceptible Adversarial Attacks on Tabular Data.” arXiv [Stat.ML]. http://arxiv.org/abs/1911.03274.

Biggio, Battista, and Fabio Roli. 2018. “Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning.” Pattern Recognition 84: 317–31. https://doi.org/10.1016/j.patcog.2018.07.023.

Borisov, Vadim, Tobias Leemann, Kathrin Sebler, Johannes Haug, Martin Pawelczyk, and Gjergji Kasneci. 2024. “Deep Neural Networks and Tabular Data: A Survey.” IEEE Transactions on Neural Networks and Learning Systems 35 (6): 7499–519. https://doi.org/10.1109/TNNLS.2022.3229161.

Carlini, Nicholas, and David Wagner. 2017. “Towards Evaluating the Robustness of Neural Networks.” In 2017 IEEE Symposium on Security and Privacy (SP 2017), 39–57. IEEE. https://doi.org/10.1109/sp.2017.49.

———. 2018. “Audio Adversarial Examples: Targeted Attacks on Speech-to-Text.” In 2018 IEEE Security and Privacy Workshops (SP Workshop 2018), 1–7. IEEE. https://doi.org/10.1109/spw.2018.00009.

Chernikova, Alesia, and Alina Oprea. 2022. “FENCE: Feasible Evasion Attacks on Neural Networks in Constrained Environments.” ACM Transactions on Privacy and Security 25 (4): 1–34. https://doi.org/10.1145/3544746.

Cinà, Antonio Emanuele, Jérôme Rony, Maura Pintor, Luca Demetrio, Ambra Demontis, Battista Biggio, Ismail Ben Ayed, and Fabio Roli. 2025. “AttackBench: Evaluating Gradient-Based Attacks for Adversarial Examples.” In Proceedings of the Thirty-Ninth AAAI Conference on Artificial Intelligence (AAAI-25), edited by Toby Walsh, Julie Shah, and Zico Kolter, 2600–2608. Association for the Advancement of Artificial Intelligence (AAAI). https://doi.org/10.1609/aaai.v39i3.32263.

Creswell, Antonia, Anil A Bharath, and Biswa Sengupta. 2017. “LatentPoison - Adversarial Attacks on the Latent Space.” arXiv [Cs.LG]. http://arxiv.org/abs/1711.02879.

Croce, Francesco, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. 2021. “RobustBench: A Standardized Adversarial Robustness Benchmark.” In Proceedings of the Neural Information Processing Systems Track on Datasets and Benchmarks 1 (NeurIPS Datasets and Benchmarks 2021), edited by Joaquin Vanschoren and Sai-Kit Yeung. Vol. 1. Curran Associates, Inc. https://datasets-benchmarks-proceedings.neurips.cc/paper/2021/hash/a3c65c2974270fd093ee8a9bf8ae7d0b-Abstract-round2.html.

Goodfellow, Ian J, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. 2014. “Generative Adversarial Nets.” In Advances in Neural Information Processing Systems 27 (NeurIPS 2014). https://proceedings.neurips.cc/paper_files/paper/2014/hash/f033ed80deb0234979a61f95710dbe25-Abstract.html.

Goodfellow, Ian J, Jonathon Shlens, and Christian Szegedy. 2015. “Explaining and Harnessing Adversarial Examples.” In 3rd International Conference on Learning Representations (ICLR 2015), edited by Yoshua Bengio and Yann LeCun. https://arxiv.org/abs/1412.6572.

Gorishniy, Yu V, Ivan Rubachev, Valentin Khrulkov, and Artem Babenko. 2021. “Revisiting Deep Learning Models for Tabular Data.” In Advances in Neural Information Processing Systems 34 (NeurIPS 2021), edited by Marc’aurelio Ranzato, Alina Beygelzimer, Yann N Dauphin, Percy Liang, and Jennifer Wortman Vaughan, 34:18932–43. Curran Associates, Inc. https://proceedings.neurips.cc/paper_files/paper/2021/hash/9d86d83f925f2149e9edb0ac3b49229c-Abstract.html.

Hevner, A. 2007. “The Three Cycle View of Design Science.” Scandinavian Journal of Information Systems 19 (2): 4. https://aisel.aisnet.org/sjis/vol19/iss2/4.

Hevner, March, Park, and Ram. 2004. “Design Science in Information Systems Research.” MIS Quarterly: Management Information Systems 28 (1): 75. https://doi.org/10.2307/25148625.

Hingun, Nabeel, Chawin Sitawarin, Jerry Li, and David Wagner. 2023. “REAP: A Large-Scale Realistic Adversarial Patch Benchmark.” In 2023 IEEE/CVF International Conference on Computer Vision (ICCV 2023), 4640–51. IEEE. https://doi.org/10.1109/ICCV51070.2023.00428.

IEEE. 2008. “IEEE Standard Computer Dictionary: A Compilation of IEEE Standard Computer Glossaries.” Piscataway, NJ, USA: IEEE. https://doi.org/10.1109/ieeestd.1991.106963.

Kingma, Diederik P, and Max Welling. 2014. “Auto-Encoding Variational Bayes.” In 2nd International Conference on Learning Representations (ICLR 2014), edited by Yoshua Bengio and Yann LeCun.

Kurakin, Alexey, Ian Goodfellow, and Samy Bengio. 2016. “Adversarial Examples in the Physical World.” arXiv [Cs.CV]. http://arxiv.org/abs/1607.02533.

Li, Bo, Peng Qi, Bo Liu, Shuai Di, Jingen Liu, Jiquan Pei, Jinfeng Yi, and Bowen Zhou. 2023. “Trustworthy AI: From Principles to Practices.” ACM Computing Surveys 55 (9): 1–46. https://doi.org/10.1145/3555803.

Li, Deqiang, Qianmu Li, Yanfang (fanny) Ye, and Shouhuai Xu. 2023. “Arms Race in Adversarial Malware Detection: A Survey.” ACM Computing Surveys 55 (1): 1–35. https://doi.org/10.1145/3484491.

Lunghi, Daniele, Alkis Simitsis, Olivier Caelen, and Gianluca Bontempi. 2023. “Adversarial Learning in Real-World Fraud Detection: Challenges and Perspectives.” In Proceedings of the Second ACM Data Economy Workshop (DEC 2023), 27–33. New York, NY, USA: ACM. https://doi.org/10.1145/3600046.3600051.

Madry, Aleksander, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. “Towards Deep Learning Models Resistant to Adversarial Attacks.” In 6th International Conference on Learning Representations (ICLR 2018). OpenReview.net. https://openreview.net/forum?id=rJzIBfZAb.

Moosavi-Dezfooli, Seyed-Mohsen, Alhussein Fawzi, and Pascal Frossard. 2016. “DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks.” In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR 2016), 2574–82. IEEE. https://doi.org/10.1109/cvpr.2016.282.

Papernot, Nicolas, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami. 2016. “The Limitations of Deep Learning in Adversarial Settings.” In 2016 IEEE European Symposium on Security and Privacy (EuroS&p 2016), 372–87. IEEE. https://doi.org/10.1109/eurosp.2016.36.

Peffers, Ken, Tuure Tuunanen, Marcus A Rothenberger, and Samir Chatterjee. 2014. “A Design Science Research Methodology for Information Systems Research.” Journal of Management Information Systems, 45–77. https://doi.org/10.2753/MIS0742-1222240302.

Pelekis, Sotiris, Thanos Koutroubas, Afroditi Blika, Anastasis Berdelis, Evangelos Karakolis, Christos Ntanos, Evangelos Spiliotis, and Dimitris Askounis. 2025. “Adversarial Machine Learning: A Review of Methods, Tools, and Critical Industry Sectors.” Artificial Intelligence Review 58 (8): 1–87. https://doi.org/10.1007/s10462-025-11147-4.

Qian, Zhuang, Kaizhu Huang, Qiu-Feng Wang, and Xu-Yao Zhang. 2022. “A Survey of Robust Adversarial Training in Pattern Recognition: Fundamental, Theory, and Methodologies.” Pattern Recognition 131. https://doi.org/10.1016/j.patcog.2022.108889.

Siddiqui, Shoaib Ahmed, Andreas Dengel, and Sheraz Ahmed. 2020. “Benchmarking Adversarial Attacks and Defenses for Time-Series Data.” In 27th International Conference on Neural Information Processing (ICONIP 2020), 12534:544–54. Lecture Notes in Computer Science. Cham: Springer International Publishing. https://doi.org/10.1007/978-3-030-63836-8_45.

Simonetto, Thibault, Salah Ghamizi, and Maxime Cordy. 2024. “Towards Adaptive Attacks on Constrained Tabular Machine Learning.” In ICML 2024 Workshop on the Next Generation of AI Safety. OpenReview.net. https://openreview.net/forum?id=DnvYdmR9OB.

Stutz, David, Matthias Hein, and Bernt Schiele. 2019. “Disentangling Adversarial Robustness and Generalization.” In 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 2019), 6969–80. IEEE. https://doi.org/10.1109/cvpr.2019.00714.

Sun, Mengying, Fengyi Tang, Jinfeng Yi, Fei Wang, and Jiayu Zhou. 2018. “Identify Susceptible Locations in Medical Records via Adversarial Attacks on Deep Predictive Models.” In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining (KDD 2018), edited by Yike Guo and Faisal Farooq. New York, NY, USA: ACM. https://doi.org/10.1145/3219819.3219909.

Szegedy, Christian, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2014. “Intriguing Properties of Neural Networks.” In 2nd International Conference on Learning Representations (ICLR 2014), edited by Yoshua Bengio and Yann LeCun. https://arxiv.org/abs/1312.6199.

Zheng, Qinkai, Xu Zou, Yuxiao Dong, Yukuo Cen, Da Yin, Jiarong Xu, Yang Yang, and Jie Tang. 2021. “Graph Robustness Benchmark: Benchmarking the Adversarial Robustness of Graph Machine Learning.” In Proceedings of the Neural Information Processing Systems Track on Datasets and Benchmarks 1 (NeurIPS Datasets and Benchmarks 2021), edited by Joaquin Vanschoren and Sai-Kit Yeung. Curran Associates, Inc. https://datasets-benchmarks-proceedings.neurips.cc/paper/2021/hash/6cdd60ea0045eb7a6ec44c54d29ed402-Abstract-round2.html.

Thank you!

• XAMI LAB
• zhipeng.he@hdr.qut.edu.au
• github.com/ZhipengHe
• zhipenghe.me

Check out the slides here 👇

🔗 https://slides.zhipenghe.me/2025-PhD-Final-Seminar

That’s all for my presentation of the confirmation seminar. Thanks for listening.