应对表格域对抗攻击与防御的核心挑战：一致性与连贯性的方法论框架
Addressing Key Challenges of Adversarial Attacks and Defenses in the Tabular Domain: A Methodological Framework for Coherence and Consistency
AI总结：
针对表格域对抗样本需保持特征连贯性但现有评估指标存在缺失的问题，提出保持连贯性的扰动方法、CSAD异常检测及结合SHAP的综合评估体系，实验揭示攻防权衡并奠定研究基础。
摘要：
在表格数据上训练的机器学习模型易受对抗攻击，即便在攻击者仅能获取模型输出的现实场景中也是如此。由于表格数据包含特征间复杂的相互依赖关系，这给对抗样本带来了独特挑战：对抗样本必须保持连贯性并遵循这些相互依赖关系，才能与良性数据难以区分。此外，现有的攻击评估指标（如成功率、扰动幅度和查询次数）未能考虑这一挑战。为弥补这些不足，我们提出了一种在保持样本连贯性的同时扰动依赖特征的技术。此外，我们还提出了一种有效的新型异常检测方法——类别特异性异常检测（Class-Specific Anomaly Detection, CSAD），以及用于评估表格对抗攻击质量的具体指标。CSAD 相对于对抗样本的预测类别分布（而非宽泛的良性分布）来评估它们，确保那些在其他类别中看似连贯的细微对抗扰动能被正确识别为异常。我们整合了 SHAP 可解释性技术来检测模型决策中的不一致性，将 CSAD 扩展为基于 SHAP 的异常检测。我们的评估结合了异常检测率和基于 SHAP 的评估，以更全面地衡量对抗样本的质量。我们评估了多种攻击策略，在四个目标模型上检验了基于黑盒查询的攻击和基于可迁移性的梯度攻击。在基准表格数据集上的实验揭示了攻击者的风险、投入与攻击质量之间的关键差异，为攻击者和防御者面临的优势、局限与权衡提供了洞见。我们的研究结果为表格域对抗攻击与防御开发的未来研究奠定了基础。
英文摘要：
Machine learning models trained on tabular data are vulnerable to adversarial attacks, even in realistic scenarios where attackers only have access to the model's outputs. Since tabular data contains complex interdependencies among features, it presents a unique challenge for adversarial samples which must maintain coherence and respect these interdependencies to remain indistinguishable from benign data. Moreover, existing attack evaluation metrics-such as the success rate, perturbation magnitude, and query count-fail to account for this challenge. To address those gaps, we propose a technique for perturbing dependent features while preserving sample coherence. In addition, we introduce Class-Specific Anomaly Detection (CSAD), an effective novel anomaly detection approach, along with concrete metrics for assessing the quality of tabular adversarial attacks. CSAD evaluates adversarial samples relative to their predicted class distribution, rather than a broad benign distribution. It ensures that subtle adversarial perturbations, which may appear coherent in other classes, are correctly identified as anomalies. We integrate SHAP explainability techniques to detect inconsistencies in model decision-making, extending CSAD for SHAP-based anomaly detection. Our evaluation incorporates both anomaly detection rates with SHAP-based assessments to provide a more comprehensive measure of adversarial sample quality. We evaluate various attack strategies, examining black-box query-based and transferability-based gradient attacks across four target models. Experiments on benchmark tabular datasets reveal key differences in the attacker's risk and effort and attack quality, offering insights into the strengths, limitations, and trade-offs faced by attackers and defenders. Our findings lay the groundwork for future research on adversarial attacks and defense development in the tabular domain.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
