为表格数据构建不可察觉的在流形上的对抗攻击
Crafting Imperceptible On-Manifold Adversarial Attacks for Tabular Data
AI总结：
本文提出了一种基于混合输入VAE的对抗攻击方法，通过在潜在空间中生成统计一致的对抗示例，提升了表格数据中攻击的隐蔽性和有效性。
摘要：
针对表格数据中混合的分类和数值特征的异质性，对抗攻击面临独特挑战。与图像不同，像素扰动保持视觉相似性，而表格数据缺乏直观的相似性度量，难以定义不可察觉的修改。此外，传统基于梯度的方法优先考虑ℓp范数约束，常产生偏离原始数据分布的对抗示例。为此，我们提出了一种使用混合输入变分自编码器（VAE）的潜在空间扰动框架，以生成统计上一致的对抗示例。所提出的VAE将分类嵌入和数值特征整合到统一的潜在流形中，使扰动保持统计一致性。我们引入了在分布成功率（IDSR）来联合评估攻击效果和分布对齐。在六个公开可用的数据集和三种模型架构上的评估表明，我们的方法在异常率和性能一致性方面显著优于传统输入空间攻击和其他从图像领域适应的VAE方法。我们的超参数敏感性分析、稀疏性控制和生成架构分析表明，VAE基于的攻击效果在很大程度上依赖于重建质量和足够的训练数据。当这些条件得到满足时，所提出的框架在实用性和稳定性方面优于输入空间方法。本工作强调了在表格领域生成真实和稳健的对抗示例中保持在流形扰动的重要性。
英文摘要：
Adversarial attacks on tabular data present unique challenges due to the heterogeneous nature of mixed categorical and numerical features. Unlike images where pixel perturbations maintain visual similarity, tabular data lacks intuitive similarity metrics, making it difficult to define imperceptible modifications. Additionally, traditional gradient-based methods prioritise $\ell_p$-norm constraints, often producing adversarial examples that deviate from the original data distributions. To address this, we propose a latent-space perturbation framework using a mixed-input Variational Autoencoder (VAE) to generate statistically consistent adversarial examples. The proposed VAE integrates categorical embeddings and numerical features into a unified latent manifold, enabling perturbations that preserve statistical consistency. We introduce In-Distribution Success Rate (IDSR) to jointly evaluate attack effectiveness and distributional alignment. Evaluation across six publicly available datasets and three model architectures demonstrates that our method achieves substantially lower outlier rates and more consistent performance compared to traditional input-space attacks and other VAE-based methods adapted from image domain approaches, achieving substantially lower outlier rates and higher IDSR across six datasets and three model architectures. Our comprehensive analyses of hyperparameter sensitivity, sparsity control, and generative architecture demonstrate that the effectiveness of VAE-based attacks depends strongly on reconstruction quality and the availability of sufficient training data. When these conditions are met, the proposed framework achieves superior practical utility and stability compared with input-space methods. This work underscores the importance of maintaining on-manifold perturbations for generating realistic and robust adversarial examples in tabular domains.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
