Pith. sign in

REVIEW 4 major objections 4 minor 50 references

Generating Realistic Adversarial Examples for Business Processes using Variational Autoencoders

T0 review · 4 major / 4 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read By sampling nearby points in a class-specific variational autoencoder's latent space and decoding them back to activity sequences, this paper generates realistic adversarial examples that flip outcome predictions of business-process…

desk verdict Useful PPM benchmark, but the 'realistic' claim for latent-space attacks is unverified and the success margin over projected attacks is negligible. read the letter →

arxiv 2411.14263 v1 pith:ESITWMJE submitted 2024-11-21 cs.LG cs.AI

Alexander Stevens , Jari Peeperkorn , Johannes De Smedt , Jochen De Weerdt This is my paper · ORCID
classification cs.LGcs.AI
keywords adversarialmachinelearningpredictiveprocessmonitoringvariationalautoencoderlatentspaceattacksexamplesminingoutcome-orientedmanifold
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that realistic adversarial examples for business-process outcome predictions can be generated by perturbing the latent space of a class-specific variational autoencoder, rather than by directly editing the activity sequence. The authors introduce two latent-space attacks—a black-box latent sampling attack and a white-box gradient steps attack—and benchmark them against six input-space methods on eleven real-life event logs and four classifiers. The latent sampling attack achieves the highest average success rate (50.17%), narrowly edging out the best projected input-space attack (50.08%) and far surpassing regular edits (12–38%). If this holds, OOPPM models are vulnerable to realistic, domain-agnostic attacks that produce plausible-looking traces, which matters for high-stakes decisions such as loan approvals or hospital discharge.

What carries the argument

The central object is a class-wise Long Short-Term Memory variational autoencoder that learns a low-dimensional Gaussian latent manifold for each outcome class from trace prefixes. The reparameterization trick $z = \mu + \epsilon \cdot \sigma$ generates stochastic latent samples from the same mean and variance as the original trace, and the decoder maps them back to activity sequences. The pipeline then encodes the original and all candidate decoded traces, and selects the one with smallest Euclidean distance in latent space as the adversarial example, an additional heuristic intended to keep the perturbation close to the original while staying on the learned manifold.

What would settle it

For a fixed event log, take the latent sampling attack's generated adversarial traces and check each one against a process model discovered from the training log (e.g., a directly-follows graph or a declarative model); if a substantial fraction of successful adversarial traces violate the model's allowed behavior, or if domain experts judge them impossible, the realism claim is refuted. A second check is to re-run the attack while measuring whether the true outcome label stays invariant under the perturbation; if it does not, the reported success rates overstate vulnerability.

Watch

Extended reading notes

Core claim

The paper establishes that adversarial examples for discrete business-process sequences can be generated in a continuous latent space: encode a trace prefix into the class-specific LSTM VAE, sample a nearby latent code via the reparameterization trick, decode, and select the adversarial candidate closest to the original in latent space. This latent sampling attack is reported to be the most effective across all four OOPPM classifiers, with a 50.17% average success rate, and produces examples with low-to-moderate distributional and sequence distance, falling into the 'Others' profile that is subtle enough to avoid easy detection yet highly successful. The white-box gradient steps attack, adapted from a counterfactual-generation method, is included mainly as a benchmark and reaches only 33.17% average success, underscoring that strong attacks on these models do not require gradient access.

Load-bearing premise

The attack's realism and label invariance rest on the assumption that decoding a perturbed latent code from the class-specific VAE always yields a valid, executable process trace whose true outcome is unchanged, but the paper never verifies this against process models or domain knowledge.

Editorial extensions

If this is right

  • OOPPM classifiers (logistic regression, XGBoost, random forest, LSTM) can be fooled by realistic-looking, domain-agnostic attacks at roughly 50% success, so deployments in loan approval or healthcare should include adversarial robustness testing.
  • The latent sampling attack is black-box and model-agnostic, so the generated examples can be stored as a robustness test set and reused to compare any classifier.
  • Attack success increases with prefix length for latent-space and projected attacks, meaning longer-running cases are more vulnerable than early predictions.
  • The white-box gradient steps attack (33% average success) underperforms the black-box latent sampling attack, suggesting that gradient information is not necessary for strong attacks on these models.
  • The 'Others' cluster profile, occupied by latent sampling and projected attacks, shows that modest hard-to-detect changes can be highly effective, pointing to a need for defenses that target distributional shifts.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: the gap between latent sampling (50.17%) and the best projected attack (50.08%) is small enough that the 'most effective' claim should be read cautiously unless paired significance tests over event logs confirm it.
  • Beyond the paper: because the paper never validates that decoded traces obey real process constraints, some successful adversarial examples may be impossible sequences; a defender who can discover the underlying process model could filter them, lowering the true vulnerability.
  • Beyond the paper: the latent sampling recipe should transfer to other discrete sequence classifiers (clinical pathways, software logs, user journeys), and a testable extension is to measure attack success plus human-expert realism in those domains.
  • Beyond the paper: since latent sampling only uses the VAE's mean and variance and never queries the classifier's gradients, combining its candidates with a query-efficient black-box search over the latent code could push success rates higher while remaining domain-agnostic.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper studies adversarial attacks on outcome-oriented predictive process monitoring (OOPPM). It introduces two latent-space attacks, Latent Sampling and Gradient Steps, built on class-specific LSTM variational autoencoders, and benchmarks them against six input-space attacks (three regular permutation attacks and three projected variants) across eleven real-life event logs and four classifiers. The headline result is that Latent Sampling achieves the highest average attack success rate (50.17%), slightly ahead of projected 3-event attacks (50.08%), and the authors claim it produces realistic, domain-agnostic adversarial examples without process-specific knowledge. The paper also proposes a cluster-profile analysis of attack types and releases code based on CARLA.

Significance. The paper addresses a relevant and under-studied problem, and the benchmark is broad: eleven logs, four classifiers, eight attack methods, with a public code repository. If the realism and label-invariance claims were validated, domain-agnostic latent-space attacks would be a useful contribution to robustness evaluation in PPM, especially as they avoid hand-crafted process constraints. However, the current manuscript does not provide independent evidence that decoded latent-space examples are feasible process traces or preserve true labels, and the success-rate advantage over projected attacks is not statistically established. These gaps directly affect the central claim, so the contribution is interesting but not yet fully supported.

major comments (4)
  1. [Section III-C, Eq. (1)] The label invariance assumption is defined in Eq. (1) but never verified for any generated adversarial example. Section III-C defines attack success solely as a change in the classifier's prediction, and Section V-A reports success rates using that definition. For the latent space attacks, the true label of the decoded example is never compared with the original label, and decoded traces are not checked against the LTL rules used to define the labels in Section IV-A or against any process-model constraint. This matters because Section III-A states that projected and latent attacks can change the prefix length after decoding; a length or control-flow change can alter the true outcome. The claim in Section V-A that latent sampling produces realistic attacks is therefore not supported by the presented evidence. The authors should report, at minimum, the fraction of generated examples that appear in the event log or that satisfy a directly-follows or process-model conformance check, and restrict success-rate comparisons to examples whose true label is verified unchanged.
  2. [Section V-A] The average success rate of Latent Sampling is 50.17%, while 3 Event (Projected) achieves 50.08%, a difference of 0.09 percentage points. The paper states that Latent Sampling 'remains the most effective across all the four OOPPM methods' without reporting any significance test, confidence interval, or per-log variance. Since the averages are aggregated over eleven event logs and four classifiers, a paired test across logs or a per-classifier Wilcoxon signed-rank test is needed before claiming superiority; on the reported aggregate numbers, the difference is not statistically distinguishable from noise.
  3. [Section V-A, Figure 7] The Gradient Steps attack is described as applicable only to the LSTM classifier, yet its reported 33.17% success rate is included in the global ranking and in Figure 7's box plots along with the other classifiers. This mixes different support sets: Gradient Steps is evaluated on a single classifier, while the other methods are averaged over four classifiers. The ranking of methods is therefore not directly comparable. The authors should report results separately for the common support, or present per-classifier tables, so that the ranking is not confounded by the classifier subset.
  4. [Sections V-B and V-C] The realism evaluation operationalizes 'realistic' through Euclidean distance in latent space, EMD, and DL Edit distance to the original prefix. These are similarity measures, not validity measures. The fact that Latent Sampling falls into the 'Others' cluster, with low-to-moderate EMD and DL Edit values, does not establish that the decoded sequences are feasible process executions. For sparse logs such as BPIC2015, the class-specific VAE may decode sequences that never occur in the log; no generative validation is reported, such as decoding random class-specific latent codes and checking them against a discovered process model or the original event log. The conclusion in Section V-B that latent attacks 'conform to the original data distribution' is therefore an assumption inherited from the VAE training objective, not a demonstrated property of the generated adversarial examples.
minor comments (4)
  1. [Abstract and Section I] The text says the paper evaluates 'these two latent space methods with six other adversarial attacking methods', but then describes only 'the first three attacking methods' and 'the fourth method'. The counting should be clarified: the projected strategy yields three attacks, so there are six non-latent methods in total.
  2. [Algorithm 1, line 24] The assignment 'mu, ←encodeonlatentspace(prefixes)' is syntactically incomplete; it should be 'mu, _ ← encodeonlatentspace(prefixes)' or 'mu ← encodeonlatentspace(prefixes)'.
  3. [Table III] The column 'LCP' is not defined in the table caption or the surrounding text; it should be defined explicitly, for example as the longest common prefix length between original and adversarial trace.
  4. [Section V-C] The cluster-profile thresholds are described verbally as 'third quartile', 'first quartile', and 'below the median' after normalization, but the exact normalization and threshold computation are not stated; please provide the precise formulas and quartile values for reproducibility.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the central benchmark is empirical and self-contained; realism and label-invariance concerns are validation gaps, not circular reductions.

full rationale

The paper's load-bearing result is an empirical comparison of attack success rates against four independently trained classifiers on eleven event logs. The success metric (prediction flip, Section III-C, Eq. 1) is computed after attacks are generated, and no attack parameter is fitted to that metric; the latent sampling attack generates candidates via the VAE reparameterization trick and selects the closest in latent space to the original prefix, which is a selection rule independent of the classifier output. The paper's self-citations ([30], [31], [32]) are prior attack baselines, the class-specific manifold setup, and an implementation reference; they are not invoked as an external theorem that forces the current result. The main weakness is that 'realistic' is asserted from the VAE's own learned latent distribution and label invariance is never independently checked, so the claim that decoded traces are executable or label-preserving is unverified; this is a correctness/evaluation gap rather than a circular derivation. No equation in the paper reduces to its input by construction, and no fitted parameter is renamed as a prediction. Hence no circularity is established.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

The central claims rest on two unvalidated domain assumptions: label invariance of generated examples and the VAE manifold as a faithful model of valid process traces. The attack methods carry hand-chosen hyperparameters such as candidate count, k events, gradient iterations, and latent dimension, none of which are sensitivity-analyzed. No invented physical or conceptual entities are introduced beyond the new methods themselves.

free parameters (4)
  • number of adversarial examples per prefix (nradv) = 100 (from figure captions; algorithm parameter)
    Success rate and the minimal-distance selection depend on how many latent or permuted candidates are generated per prefix. No sensitivity analysis is reported.
  • number of events permuted in k-event attack = 3 (the '3 Event' attacks)
    The k-event attack uses k=3 as the default; results may change with k.
  • gradient steps optimization iterations = 1500 (default)
    The paper notes that increasing iterations beyond the default 1500 could further enhance success rates (Section V-A).
  • VAE latent dimension r = not reported in text
    Latent dimensionality is a free architecture choice that affects reconstruction quality and attack success, but no value is given.
assumptions (3)
  • domain assumption Label invariance assumption: perturbing a trace does not change its true class label.
    Equation (1) states this assumption, but the paper never validates it for generated examples; if it fails, a successful attack may be a relabeled example rather than an adversarial example.
  • domain assumption The class-specific LSTM VAE learns a manifold that coincides with the distribution of realistic, process-valid traces.
    Section III-A and Section IV-C3 assume decoded latent samples are realistic; no process-model or domain-expert validation is provided.
  • standard math Standard variational autoencoder theory (ELBO, reparameterization) and the manifold hypothesis.
    Background in Section II-C is used to justify treating latent distance as similarity and latent perturbations as on-manifold. This is standard but not formalized in this paper.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Generating Realistic Adversarial Examples for Business Processes using Variational Autoencoders." pith.science (2026). https://pith.science/paper/ESITWMJE

@misc{pith2026241114263,
  author       = {Pith},
  title        = {Pith review of: Generating Realistic Adversarial Examples for Business Processes using Variational Autoencoders},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ESITWMJE}},
  note         = {Machine review of arXiv:2411.14263}
}
read the original abstract

In predictive process monitoring, predictive models are vulnerable to adversarial attacks, where input perturbations can lead to incorrect predictions. Unlike in computer vision, where these perturbations are designed to be imperceptible to the human eye, the generation of adversarial examples in predictive process monitoring poses unique challenges. Minor changes to the activity sequences can create improbable or even impossible scenarios to occur due to underlying constraints such as regulatory rules or process constraints. To address this, we focus on generating realistic adversarial examples tailored to the business process context, in contrast to the imperceptible, pixel-level changes commonly seen in computer vision adversarial attacks. This paper introduces two novel latent space attacks, which generate adversaries by adding noise to the latent space representation of the input data, rather than directly modifying the input attributes. These latent space methods are domain-agnostic and do not rely on process-specific knowledge, as we restrict the generation of adversarial examples to the learned class-specific data distributions by directly perturbing the latent space representation of the business process executions. We evaluate these two latent space methods with six other adversarial attacking methods on eleven real-life event logs and four predictive models. The first three attacking methods directly permute the activities of the historically observed business process executions. The fourth method constrains the adversarial examples to lie within the same data distribution as the original instances, by projecting the adversarial examples to the original data distribution.

Figures

Figures reproduced from arXiv: 2411.14263 by the authors.

Figure 1
Figure 1. An illustrative example of adversarial examples in latent space. This [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. A taxonomy of adversarial attacks and adversarial defenses in AML. [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Illustration of (1.A) the regular adversarial attack introduced by [30], and (1.B) the manifold-projected adversarial attack as described by [32]. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Illustration of (1.C) the latent sampling attack, which uses the stochasticity of the reparameterization trick to generate adversarial examples, and (1.D) [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: An illustrative example of adversarial examples in latent space. Note [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Illustration of (2) which is the minimization in the latent space as an additional requirement to adhere to the label invariance assumption. [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Average success rate for the different attack strategy combinations and the different classifiers, averaged over all the 11 event logs. [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 8
Figure 8. Figure 8: The normalized frequency of the successful adversarial examples (y-axis) per prefix length (x-axis), averaged over the event logs. TABLE III OVERVIEW OF THE RESULTS Event Log |σ| Attack Type and Strategy Success Rate (%) Eucl. Dist. (lat. space) L1 L2 EMD DL Edit LCP 3…
Figure 9
Figure 9. Figure 9: The success rate percentage and absolute number of traces per cluster category (left), and the number of traces per cluster category and attack method. [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

50 extracted references · 36 canonical work pages

  1. [1]

    In: Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing

    Alzantot, M., Sharma, Y ., Elgohary, A., Ho, B.J., Srivastava, M., Chang, K.W.: Generating natural language adversarial examples. In: Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing. Association for Computational Linguistics (2018)

    work page 2018

  2. [2]

    In: Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining

    Babaev, D., Savchenko, M., Tuzhilin, A., Umerenkov, D.: Et-rnn: Applying deep learning to credit loan applications. In: Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining. pp. 2183–2190 (2019)

    work page 2019

  3. [3]

    In: Wallach, H.M., Larochelle, H., Beygelzimer, A., d’Alch ´e-Buc, F., Fox, E.B., Gar- nett, R

    Chen, H., Zhang, H., Si, S., Li, Y ., Boning, D.S., Hsieh, C.: Robustness verification of tree-based models. In: Wallach, H.M., Larochelle, H., Beygelzimer, A., d’Alch ´e-Buc, F., Fox, E.B., Gar- nett, R. (eds.) Advances in Neural Information Processing Sys- tems 32: Annual Conference on Neural Information Processing Sys- tems 2019, NeurIPS 2019, December...

    work page 2019

  4. [4]

    In: International Conference on Machine Learning

    Chen, N., Klushyn, A., Ferroni, F., Bayer, J., Van Der Smagt, P.: Learning flat latent manifolds with vaes. In: International Conference on Machine Learning. pp. 1587–1596. PMLR (2020)

    work page 2020

  5. [5]

    In: International conference on artificial intelligence and statistics

    Connor, M., Canal, G., Rozell, C.: Variational autoencoder with learned latent structure. In: International conference on artificial intelligence and statistics. pp. 2359–2367. PMLR (2021)

    work page 2021

  6. [6]

    Information Systems 56, 235–257 (2016)

    De Leoni, M., van der Aalst, W.M., Dees, M.: A general process mining framework for correlating, predicting and clustering dynamic behavior based on event logs. Information Systems 56, 235–257 (2016)

    work page 2016

  7. [7]

    In: Bengio, S., Wal- lach, H.M., Larochelle, H., Grauman, K., Cesa-Bianchi, N., Gar- nett, R

    Dhurandhar, A., Chen, P., Luss, R., Tu, C., Ting, P., Shanmugam, K., Das, P.: Explanations based on the missing: Towards con- trastive explanations with pertinent negatives. In: Bengio, S., Wal- lach, H.M., Larochelle, H., Grauman, K., Cesa-Bianchi, N., Gar- nett, R. (eds.) Advances in Neural Information Processing Sys- tems 31: Annual Conference on Neura...

    work page 2018

  8. [8]

    van Dongen, B.F., Crooy, R.A., van der Aalst, W.M.: Cycle time prediction: When will this case finally be finished? In: On the Move to Meaningful Internet Systems: OTM 2008: OTM 2008 Confederated International Conferences, CoopIS, DOA, GADA, IS, and ODBASE 2008, Monterrey, Mexico, November 9-14, 2008, Proceedings, Part I. pp. 319–336. Springer (2008)

    work page 2008

Show all 50 references
  1. [9]

    In: 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Workshop Track Proceedings

    Gilmer, J., Metz, L., Faghri, F., Schoenholz, S.S., Raghu, M., Watten- berg, M., Goodfellow, I.J.: Adversarial spheres. In: 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Workshop Track Proceedings. pp. 1–13....

    2018

  2. [10]

    In: Bengio, Y ., LeCun, Y

    Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. In: Bengio, Y ., LeCun, Y . (eds.) 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings (2015)

    2015

  3. [11]

    Harl, M., Weinzierl, S., Stierle, M., Matzner, M.: Explainable predictive business process monitoring using gated graph neural networks. J. Decis. Syst. 29(Supplement), 312– 327 (2020). https://doi.org/10.1080/12460125.2020.1780780, https://doi.org/10.1080/12460125.2020.1780780

    2020

  4. [12]

    In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Hendrycks, D., Zhao, K., Basart, S., Steinhardt, J., Song, D.: Natural adversarial examples. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 15262–15271 (2021)

    2021

  5. [13]

    IEEE transactions on neural networks and learning systems 27(6), 1333–1344 (2015)

    Ho, S.S., Dai, P., Rudzicz, F.: Manifold learning for multivariate variable-length sequences with an application to similarity search. IEEE transactions on neural networks and learning systems 27(6), 1333–1344 (2015)

    2015

  6. [14]

    CoRR abs/1907.09615 (2019), http://arxiv

    Joshi, S., Koyejo, O., Vijitbenjaronk, W., Kim, B., Ghosh, J.: Towards realistic individual recourse and actionable explanations in black-box decision making systems. CoRR abs/1907.09615 (2019), http://arxiv. org/abs/1907.09615

    2019 arXiv

  7. [15]

    In: Indulska, M., Reinhartz-Berger, I., Cetina, C., Pastor, O

    K ¨appel, M., Jablonski, S.: Model-agnostic event log augmentation for predictive process monitoring. In: Indulska, M., Reinhartz-Berger, I., Cetina, C., Pastor, O. (eds.) Advanced Information Systems Engineering - 35th International Conference, CAiSE 2023, Zaragoza, Spain, Ju...

    2023 doi

  8. [16]

    arXiv preprint arXiv:1312.6114 (2013)

    Kingma, D.P., Welling, M.: Auto-encoding variational bayes. arXiv preprint arXiv:1312.6114 (2013)

    2013 arXiv

  9. [17]

    Kratsch, W., Manderscheid, J., R ¨oglinger, M., Seyfried, J.: Machine learning in business process monitoring: A comparison of deep learning and classical approaches used for outcome prediction. Bus. Inf. Syst. Eng. 63(3), 261–276 (2021). https://doi.org/10.1007/S12599-020-006...

    2021 doi

  10. [18]

    Business & Information Systems Engineering 63, 261–276 (2021)

    Kratsch, W., Manderscheid, J., R ¨oglinger, M., Seyfried, J.: Machine learning in business process monitoring: a comparison of deep learning and classical approaches used for outcome prediction. Business & Information Systems Engineering 63, 261–276 (2021)

    2021

  11. [19]

    Interpretable Artificial Intelligence: A Perspective of Granular Computing pp

    Mehdiyev, N., Fettke, P.: Explainable artificial intelligence for process mining: A general overview and application of a novel local explana- tion approach for predictive process monitoring. Interpretable Artificial Intelligence: A Perspective of Granular Computing pp. 1–28 (2021)

    2021

  12. [20]

    Artificial Intelligence Review 55(2), 801–827 (2022)

    Neu, D.A., Lahann, J., Fettke, P.: A systematic literature review on state-of-the-art deep learning methods for process prediction. Artificial Intelligence Review 55(2), 801–827 (2022)

    2022

  13. [21]

    In: Van- schoren, J., Yeung, S

    Pawelczyk, M., Bielawski, S., van den Heuvel, J., Richter, T., Kasneci, G.: CARLA: A python library to benchmark algorith- mic recourse and counterfactual explanation algorithms. In: Van- schoren, J., Yeung, S. (eds.) Proceedings of the Neural Informa- tion Processing Systems ...

    2021

  14. [22]

    In: Huang, Y ., King, I., Liu, T., van Steen, M

    Pawelczyk, M., Broelemann, K., Kasneci, G.: Learning model-agnostic counterfactual explanations for tabular data. In: Huang, Y ., King, I., Liu, T., van Steen, M. (eds.) WWW ’20: The Web Confer- ence 2020, Taipei, Taiwan, April 20-24, 2020. pp. 3126–3132. ACM / IW3C2 (2020). h...

    2020

  15. [23]

    Peeperkorn, J., vanden Broucke, S., Weerdt, J.D.: Can recurrent neural networks learn process model structure? J. Intell. Inf. Syst. 61(1), 27–51 (2023). https://doi.org/10.1007/S10844-022-00765-X, https://doi.org/10. 1007/s10844-022-00765-x

    2023 doi

  16. [24]

    CoRR abs/2109.03501 (2021), https://arxiv.org/abs/ 2109.03501

    Rizzi, W., Francescomarino, C.D., Ghidini, C., Maggi, F.M.: How do I update my model? on the resilience of predictive process monitoring models to change. CoRR abs/2109.03501 (2021), https://arxiv.org/abs/ 2109.03501

    2021 arXiv

  17. [25]

    Rudin, C.: Stop explaining black box machine learning models for high stakes decisions and use interpretable models instead. Nat. Mach. Intell. 1(5), 206–215 (2019). https://doi.org/10.1038/S42256-019-0048- X, https://doi.org/10.1038/s42256-019-0048-x IEEE TRANSACTIONS ON KNOW...

    2019 doi

  18. [26]

    Harvard Data Science Review 2(1), 1 (2020)

    Rudin, C., Wang, C., Coker, B.: The age of secrecy and unfairness in recidivism prediction. Harvard Data Science Review 2(1), 1 (2020)

    2020

  19. [27]

    In: Seventh International Conference on Learning Representations (ICLR 2019)

    Schott, L., Rauber, J., Bethge, M., Brendel, W.: Towards the first adver- sarially robust neural network model on mnist. In: Seventh International Conference on Learning Representations (ICLR 2019). pp. 1–16 (2019)

    2019

  20. [28]

    In: Proceedings of the 37th International Conference on Machine Learning, ICML 2020, 13-18 July 2020, Virtual Event

    Srivastava, M., Hashimoto, T.B., Liang, P.: Robustness to spurious corre- lations via human annotations. In: Proceedings of the 37th International Conference on Machine Learning, ICML 2020, 13-18 July 2020, Virtual Event. Proceedings of Machine Learning Research, vol. 119, pp. 9109–

    2020

  21. [29]

    European Journal of Operational Research 317(2), 317–329 (2024)

    Stevens, A., De Smedt, J.: Explainability in process outcome prediction: Guidelines to obtain interpretable and faithful models. European Journal of Operational Research 317(2), 317–329 (2024)

    2024

  22. [30]

    In: 2022 4th International Conference on Process Mining (ICPM)

    Stevens, A., De Smedt, J., Peeperkorn, J., De Weerdt, J.: Assessing the robustness in predictive process monitoring through adversarial attacks. In: 2022 4th International Conference on Process Mining (ICPM). pp. 56–63. IEEE (2022)

    2022

  23. [31]

    arXiv preprint arXiv:2403.09232 (2024)

    Stevens, A., Ouyang, C., De Smedt, J., Moreira, C.: Generating feasible and plausible counterfactual explanations for outcome prediction of business processes. arXiv preprint arXiv:2403.09232 (2024)

    2024 arXiv

  24. [32]

    In: 2023 5th International Conference on Process Mining (ICPM)

    Stevens, A., Peeperkorn, J., De Smedt, J., De Weerdt, J.: Manifold learning for adversarial robustness in predictive process monitoring. In: 2023 5th International Conference on Process Mining (ICPM). pp. 17–

    2023

  25. [33]

    In: IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2019, Long Beach, CA, USA, June 16-20,

    Stutz, D., Hein, M., Schiele, B.: Disentangling adversarial robustness and generalization. In: IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2019, Long Beach, CA, USA, June 16-20,

    2019

  26. [34]

    In: Bengio, Y ., LeCun, Y

    Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Good- fellow, I.J., Fergus, R.: Intriguing properties of neural networks. In: Bengio, Y ., LeCun, Y . (eds.) 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014...

    2014

  27. [35]

    In: Advanced Information Systems Engineering: 29th International Conference, CAiSE 2017, Es- sen, Germany, June 12-16, 2017, Proceedings 29

    Tax, N., Verenich, I., La Rosa, M., Dumas, M.: Predictive business process monitoring with lstm neural networks. In: Advanced Information Systems Engineering: 29th International Conference, CAiSE 2017, Es- sen, Germany, June 12-16, 2017, Proceedings 29. pp. 477–492. Springer (2017)

    2017

  28. [36]

    In: Demeniconi, C., Davidson, I

    Taymouri, F., Rosa, M.L., Erfani, S.M.: A deep adversarial model for suffix and remaining time prediction of event sequences. In: Demeniconi, C., Davidson, I. (eds.) Proceedings of the 2021 SIAM International Conference on Data Mining, SDM 2021, Vir- tual Event, April 29 - May...

    2021 doi

  29. [37]

    In: Fahland, D., Ghidini, C., Becker, J., Dumas, M

    Taymouri, F., Rosa, M.L., Erfani, S.M., Bozorgi, Z.D., Verenich, I.: Predictive business process monitoring via generative adversarial nets: The case of next event prediction. In: Fahland, D., Ghidini, C., Becker, J., Dumas, M. (eds.) Business Process Management - 18th Interna...

    2020 doi

  30. [38]

    ACM Trans

    Teinemaa, I., Dumas, M., Rosa, M.L., Maggi, F.M.: Outcome- oriented predictive process monitoring: Review and benchmark. ACM Trans. Knowl. Discov. Data 13(2), 17:1–17:57 (2019). https://doi.org/10.1145/3301300, https://doi.org/10.1145/3301300

    2019 doi

  31. [39]

    Usama, M., Qadir, J., Al-Fuqaha, A., Hamdi, M.: The adversarial machine learning conundrum: can the insecurity of ml become the achilles’ heel of cognitive networks? IEEE Network 34(1), 196–203 (2019)

    2019

  32. [40]

    In: Joint European Conference on Machine Learning and Knowledge Discovery in Databases

    Van Looveren, A., Klaise, J.: Interpretable counterfactual explanations guided by prototypes. In: Joint European Conference on Machine Learning and Knowledge Discovery in Databases. pp. 650–665. Springer (2021)

    2021

  33. [41]

    arXiv preprint arXiv:2101.10123 (2021)

    Van Looveren, A., Klaise, J., Vacanti, G., Cobb, O.: Conditional generative models for counterfactual explanations. arXiv preprint arXiv:2101.10123 (2021)

    2021 arXiv

  34. [42]

    In: Polyvyanyy, A., Wynn, M.T., Looy, A.V ., Reichert, M

    Venkateswaran, P., Muthusamy, V ., Isahagian, V ., Venkatasubrama- nian, N.: Robust and generalizable predictive models for business processes. In: Polyvyanyy, A., Wynn, M.T., Looy, A.V ., Reichert, M. (eds.) Business Process Management - 19th International Conference, BPM 202...

    2021 doi

  35. [43]

    In: Bertino, E., Chang, C.K., Chen, P., Damiani, E., Goul, M., Oyama, K

    Wang, J., Yu, D., Liu, C., Sun, X.: Outcome-oriented predictive pro- cess monitoring with attention-based bidirectional LSTM neural net- works. In: Bertino, E., Chang, C.K., Chen, P., Damiani, E., Goul, M., Oyama, K. (eds.) 2019 IEEE International Conference on Web Services, I...

    2019

  36. [44]

    lstm (with attention)

    Weytjens, H., De Weerdt, J.: Process outcome prediction: Cnn vs. lstm (with attention). In: Business Process Management Workshops: BPM 2020 International Workshops, Seville, Spain, September 13–18, 2020, Revised Selected Papers 18. pp. 321–333. Springer (2020)

    2020

  37. [45]

    Information Sciences 587, 794–812 (2022)

    Wu, T., Wang, X., Qiao, S., Xian, X., Liu, Y ., Zhang, L.: Small perturbations are enough: Adversarial attacks on time series prediction. Information Sciences 587, 794–812 (2022)

    2022

  38. [46]

    arXiv preprint arXiv:1801.02610 (2018)

    Xiao, C., Li, B., Zhu, J.Y ., He, W., Liu, M., Song, D.: Generat- ing adversarial examples with adversarial networks. arXiv preprint arXiv:1801.02610 (2018)

    2018 arXiv

  39. [47]

    IEEE Trans

    Yuan, X., He, P., Zhu, Q., Li, X.: Adversarial examples: Attacks and defenses for deep learning. IEEE Trans. Neural Networks Learn. Syst. 30(9), 2805–2824 (2019). https://doi.org/10.1109/TNNLS.2018.2886017, https://doi.org/10. 1109/TNNLS.2018.2886017

    2019

  40. [48]

    In: International Conference on Learning Representations (2018)

    Zhao, Z., Dua, D., Singh, S.: Generating natural adversarial examples. In: International Conference on Learning Representations (2018)

    2018

  41. [2019]

    6976–6987

    pp. 6976–6987. Computer Vision Foundation / IEEE (2019). https://doi.org/10.1109/CVPR.2019.00714, http://openaccess.thecvf. com/content CVPR 2019/html/Stutz Disentangling Adversarial Robustness and Generalization CVPR 2019 paper.html

    2019

  42. [9119]

    PMLR (2020), http://proceedings.mlr.press/v119/srivastava20a. html

    2020

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.