Pith. sign in

REVIEW 4 major objections 6 minor 59 references

Addressing Key Challenges of Adversarial Attacks and Defenses in the Tabular Domain: A Methodological Framework for Coherence and Consistency

T0 review · 4 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper argues that adversarial sample quality in tabular data should be judged by class-specific anomaly detection and SHAP-based interpretation stability, and that this framework exposes transferability-based attacks as far harder to…

desk verdict A solid empirical framework for tabular adversarial evaluation, but the SHAP anomaly metric is uncalibrated and the headline CSAD claim overstates what Table 6 actually shows. read the letter →

arxiv 2412.07326 v3 pith:7TEOFSBT submitted 2024-12-10 cs.LG

Yael Itzhakev , Amit Giloni , Yuval Elovici , Asaf Shabtai This is my paper · ORCID
classification cs.LG
keywords tabulardataadversarialattacksdefensesclass-specificanomalydetectionSHAPblack-boxtransferabilityfeaturecoherence
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Tabular machine-learning models face a distinct adversarial problem: a perturbed record must not only fool the model but also keep its feature relationships coherent, and standard success and perturbation metrics do not measure that. This paper proposes a framework with three parts: a regression-based technique for adjusting dependent features during an attack, a class-specific anomaly detection approach called CSAD that scores samples against benign data of their predicted class, and SHAP-based evaluation of whether a sample changes the model's internal feature-importance reasoning. The paper evaluates two query-based and five transferability-based attacks on three tabular datasets with four tree models. Its central empirical claim is that query-based attacks succeed near-perfectly but produce large, detectable distortions, whereas transferability-based attacks have lower success but are often nearly undetectable by both feature-space and SHAP-based criteria. If this is right, defenders should monitor interpretation stability as well as input coherency, and should not treat query-based attacks alone as representative of real-world risk.

What carries the argument

The load-bearing object is Class-Specific Anomaly Detection (CSAD), defined as training one anomaly detector per class and scoring an adversarial sample against the detector of its predicted class, rather than against a global benign distribution. CSAD is applied to two evaluation criteria: Feature Space Coherency, measured by isolation forest and autoencoder anomaly rates, and Model Interpretation Stability, measured by the class-specific range of each feature's SHAP values over benign training samples, flagging any sample whose SHAP value for at least one feature falls outside that range. A second mechanism is the regression-based dependent-feature perturbation, which trains a regression model per dependent feature and uses it to correct the feature after each attack step so the crafted sample stays coherent with the rest of the record. These mechanisms carry the argument because they turn 'coherence' into an operational quantity.

What would settle it

Run the paper's CSAD SHAP anomaly test on benign test samples and record the fraction with at least one out-of-range feature-importance value; if that benign false-positive rate is comparable to the adversarial detection rates reported in Table 6, the claimed CSAD advantage would be an artifact of threshold choice rather than a detection improvement.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that adversarial sample quality in the tabular domain is better measured by class-conditional anomaly assessment than by global anomaly thresholds or by perturbation magnitude. The central instrument is CSAD, which trains a separate detector for each predicted class and evaluates each adversarial sample only against the benign distribution of the class the model assigns to it; combined with SHAP importance ranges, this consistently identifies adversarial samples that a global detector misses, with the paper reporting p < 0.001 and effect sizes near Cohen's g = 1.0 for the CSAD advantage. The paper further reports that small L2 distance is not a reliable sign of invisibility, since some low-distortion transferability-based samples are still flagged as anomalous, and that feature-space and SHAP-based anomaly rates respond independently to different attacks. The authors would summarize their result as: class-specific evaluation plus interpretation stability gives a concrete, scalable way to quantify whether an adversarial tabular sample would actually evade detection.

Load-bearing premise

The load-bearing premise is that benign samples rarely produce a feature-importance value outside the per-class range of benign training samples, so an out-of-range value can be treated as a sign of attack.

Editorial extensions

If this is right

  • Query-based attacks (boundary and HopSkipJump) achieve near-perfect success but at the cost of many changed features, large L2 distortions, and query counts up to roughly 120,000, making them expensive and detectable.
  • Transferability-based attacks need only one query but succeed less often; the samples that do transfer are mostly invisible to both autoencoder and isolation-forest detectors and usually leave SHAP importance stable.
  • Feature-importance-based feature selection in transfer attacks raises transfer success and keeps perturbations smaller than random selection does.
  • Under the paper's CSAD metric, class-specific anomaly scoring detects adversarial samples at rates several times higher than global scoring across datasets, including cases where global scoring finds none.
  • Small L2 distance does not by itself mean a tabular sample is undetectable, so perturbation norms should not be the sole quality criterion.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: the class-conditional principle of CSAD could extend to non-tabular modalities, but its benefit will depend on whether per-class benign subsamples are large enough to estimate reliable reference distributions.
  • Beyond the paper: before CSAD is used as a defense, its benign false-positive rate should be measured on the exact task; the per-feature min/max range on a 115-feature dataset would likely need percentile-based calibration.
  • Beyond the paper: the reported invisibility of successful transfer attacks suggests a defense that monitors interpretation stability rather than raw feature values alone, since input-space detectors miss these samples.
  • Beyond the paper: the regression-based dependent-feature correction was tested only on the ICU dataset; a direct test on datasets with known nonlinear or mutually dependent features would show how far the coherence guarantee generalizes.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes a methodological framework for adversarial attacks and defenses on tabular data, with three main contributions: (i) a regression-based technique for perturbing dependent features while preserving sample coherence; (ii) a class-specific anomaly detection approach (CSAD) applied to both feature-space anomaly detectors (autoencoder and isolation forest) and SHAP-based model-interpretation metrics; and (iii) a large comparative empirical study of two query-based attacks and five transferability-based attacks across four tree-based models on three datasets. The evaluation assesses attacker risk, effort, and adversarial sample quality via anomaly detection rates and SHAP-based stability metrics. The main reported findings are that query-based attacks achieve near-perfect success but produce large, detectable distortions and require many queries, whereas transferability-based attacks are less successful but produce more coherent, harder-to-detect samples, and that CSAD substantially outperforms a global threshold approach for detecting adversarial samples.

Significance. If the proposed framework is valid, it would fill a real gap in the tabular adversarial robustness literature by providing objective, scalable metrics for adversarial sample coherence and by systematically comparing attack strategies. The paper's methodological ambition is substantial, and the authors make their artifacts publicly available, which supports reproducibility. The feature-space anomaly detection evaluation is carefully calibrated (FPR reported for AE/IF), and the comparative attack study is broad. However, the central claim that CSAD and the SHAP-based dual criteria reliably measure adversarial sample quality is weakened by an uncalibrated SHAP threshold rule and by an internally inconsistent claim of uniform superiority. The significance of the work thus depends on the extent to which these issues can be resolved in revision.

major comments (4)
  1. [Section 3.3] The definition of the normal SHAP range as [min(SHAP_f,c), max(SHAP_f,c)] over benign training samples makes the Importance-Based Anomaly Detection Rate an uncalibrated out-of-sample min/max envelope rule. For the Hate dataset with 115 features, a benign test sample will very likely fall outside at least one training min/max interval, yet the paper reports no false-positive rate for any of the SHAP-based metrics; Section 5.4 reports FPR only for the AE/IF feature-space detectors. As a result, the absolute anomaly rates in Table 5 and the CSAD-vs-standard comparison in Table 6 are uninterpretable: the higher CSAD rates may simply reflect a higher uncalibrated FPR of the per-class reference rather than a genuine detection advantage. The manuscript should either calibrate the SHAP criterion (e.g., per-feature quantiles, with FPR measured on a benign validation split) or explicitly report and adjust for the FPR.
  2. [Section 5.5 / Table 6] Section 5.5 states that 'CSAD consistently and significantly outperforms the standard approach across all datasets (p<0.001)' with 'uniformly large Cohen's g=1.0.' This is contradicted by Table 6, where the standard approach yields higher detection rates than CSAD in multiple cells: VideoTQ RF random 13.8% vs 0.0%, VideoTQ RF GB imp. 17.0% vs 0.0%, VideoTQ LGB GB imp. 10.6% vs 3.4%, VideoTQ XGB boundary 47.0% vs 38.9%, and Hate GB LGB imp. 100.0% vs 81.2%. Moreover, a Cohen's g of 1.0 for a paired McNemar test is impossible when the marginal rates differ in both directions; Appendix C itself lists non-significant random-transferability cases (e.g., Table 16, Hate random: p=1.00). The claim of uniform superiority must be removed or replaced with an analysis that accounts for significance per attack–model combination and for the direction of each difference.
  3. [Section 3.3 / Section 5.5] The reported CSAD advantage over the standard approach is partly constructed by the experimental setup. In a binary problem, a successful adversarial sample sits near the decision boundary while retaining traits of its true class; comparing it only with benign samples of the predicted class will almost mechanically produce a higher anomaly rate than comparing it with the pooled benign distribution. The paper does not control for this by reporting the SHAP-based false-positive rates for benign samples under the class-specific versus global references. Without such a control, the conclusion that class-specific evaluation is 'essential' (Section 5.5) is not supported by the data; the observed gap may be an artifact of differing reference-set sizes and spreads. The authors should test whether CSAD improves the ROC or precision-recall trade-off at matched FPR values, rather than comparing raw flag rates.
  4. [Section 3.2 / Section 4.5] The regression-based technique for dependent features (Section 3.2) is a central claimed contribution, but its effectiveness is never directly evaluated. It is applied only to the ICU dataset (Section 4.5), and the paper does not compare attack outcomes, anomaly detection rates, or coherence metrics with and without the regression correction. The claim that this technique 'ensures' coherence and 'maintains feature consistency' (Section 3.2) is therefore unsupported by the experiments. An ablation study, at least on the ICU dataset, is needed to substantiate this component of the framework.
minor comments (6)
  1. [Section 3.3] There are typos in the text: 'extened' should be 'extended', and 'to to' should be 'to'.
  2. [Equation (1) / Section 4.2] The threshold in Eq. (1) uses '2 * std' but the text later refers to 'k=2' without defining a general k; the notation should be made consistent.
  3. [Section 4.2] The Hate preprocessing description states that 'top-40 most important features' were selected 'based on the Pearson correlation coefficient' but does not specify the target variable or whether the correlation is with the class label; please clarify.
  4. [Section 5.3 / Equations (4)-(5)] The definitions of alpha, beta, and t in the time equations are confusing, and the numeric result '~243.5673 seconds' contains a stray tilde and ambiguous units; the presentation should be cleaned up.
  5. [Appendix C] Some effect-size entries are reported as 'L' even when the accompanying p-value is not significant (e.g., Table 16, Hate random: p=1.00, effect size L); the reporting convention for effect size on non-significant tests should be explained or revised.
  6. [Table 6] The caption states that the better detection rate is highlighted in bold, but the table as displayed does not show bold formatting; please ensure the formatting is visible in the final version.

Circularity Check

1 steps flagged · score 8.0 of 10

CSAD's reported superiority over the standard approach is guaranteed by its own interval definition: class-conditional min/max SHAP ranges are subsets of global ranges, so CSAD flags a superset of samples by construction.

  1. self definitional [Section 3.3 (Model Interpretation Stability) and Section 5.5 (Effectiveness of the CSAD Approach), Table 6]
    "for each class c and feature f, we define the normal range as [min(SHAP_f,c), max(SHAP_f,c)] based on the SHAP values observed in benign training samples assigned to class c. An adversarial sample predicted as class c is considered to exhibit an anomalous SHAP value for feature f if its value falls outside this class-specific range. ... The results demonstrate that the CSAD approach substantially improves the detection of adversarial samples in most cases, often achieving a detection rate that is over twice that of the standard approach. ..."

    For every feature f, the class-conditional interval [min(SHAP_f,c), max(SHAP_f,c)] is a subset of the global interval [min(SHAP_f,all), max(SHAP_f,all)] because class c's benign samples are a subset of all benign samples. Consequently, any sample whose SHAP value lies outside the global interval is automatically outside the class interval, and samples inside the global interval can still be outside the narrower class interval. Therefore the event 'at least one anomalous SHAP feature' under CSAD contains the corresponding event under the standard approach, making CSAD's importance-based anomaly rate and average anomalous-feature count greater than or equal to the standard values for every sample, by construction.

full rationale

The paper contains one clear instance of self-definitional circularity: the central claim that CSAD 'substantially improves' detection over the standard approach is forced by the way the two approaches define their SHAP normal ranges. Since the class-specific min/max range is always contained in the global min/max range, CSAD's anomaly flags are a superset of the standard approach's flags; the reported statistical superiority is therefore an artifact of the definition rather than a discovered property. The rest of the paper's empirical content—query counts, L0/L2 distortions, attack success rates, and the AE/IF feature-space comparisons—is independent and not circular. The AE threshold in Eq. (1) is calibrated on a benign validation set and the IF contamination is matched to the AE FPR, which is standard threshold calibration rather than circularity. The use of prior work by overlapping authors for the transferability-based attack architecture and preprocessing ([8], [9]) is self-citation, but it is not load-bearing for the paper's main evaluation framework and does not constitute circular reasoning. The internal contradiction in Table 6, where CSAD is sometimes lower than the standard approach despite the claimed consistent superiority, is a correctness concern rather than additional circularity. Overall, because a headline contribution of the paper is a prediction that reduces by definition, the circularity score is high, though the paper retains substantial independent empirical content.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central claims rest on six hand-chosen or fitted parameters (AE threshold, IF contamination, attack regularization, learning rates, regression model configurations, feature selection counts), none of which is derived or given a sensitivity analysis. Five background assumptions are load-bearing, most importantly the unmeasured benign false-positive rate of the SHAP-based detector and the acyclicity of feature dependencies. The paper introduces no new entities (particles, forces, dimensions): all components are named methods (CSAD, regression adjustment) built from existing tools.

free parameters (6)
  • AE anomaly threshold multiplier k = 2
    Eq. (1) sets threshold = mean + 2*std of benign validation reconstruction error; Section 3.3 states k=2 was chosen by empirical tuning to balance sensitivity and false positives, so every AE-based detection rate depends on this fitted constant. No sensitivity analysis is reported.
  • IF contamination parameter = matched to AE FPR per dataset and class
    Section 3.3 and Section 5.4: the isolation forest's contamination parameter was set to match the AE's false-positive rate derived from Eq. (1), making the IF results dependent on the AE threshold choice.
  • Embedding regularization weight alpha in transfer attacks = 1
    Eq. (2): L_adv = -BCE(M'(x_adv), y) + alpha * ||phi(x_adv) - phi(x)||_2 with alpha = 1. This weight sets the attack's coherence and effectiveness trade-off and thereby shapes the transferability attack results reported in Tables 3 to 5.
  • Transfer attack optimizer learning rate = 1.0 (Hate, VideoTQ); 20.0 (ICU)
    Section 4.4: manually tuned learning rates for solving Eq. (3), with no sensitivity analysis; the ICU value of 20.0 is unusually large and could materially change the perturbation path.
  • Regression model learning rates for dependent features = 0.1 (apache_3j_bodysystem, apache_3j_diagnosis); 0.01 (d1_mbp_invasive_max, d1_mbp_invasive_min)
    Section 4.5: 'determined through manual tuning to optimize model performance.' The quality of these regression fits is not reported (no R2 or error metric), yet they implement the paper's headline coherence-preservation technique.
  • Feature selection counts k (importance features) and n (correlated features) = k=2, n=1
    Section 4.4 and Algorithm 4: each perturbation iteration selects 2 features plus 1 Pearson-correlated feature; all transferability attack results are conditional on this choice, with no variation tested.
assumptions (5)
  • domain assumption Adversarial samples lacking coherence with benign data will exhibit anomalous patterns detectable by AE/IF and SHAP range checks.
    Section 2.2: 'The underlying assumption is that adversarial samples lacking structural coherence or consistency with benign data distributions are more likely to exhibit anomalous patterns.' This premise justifies using anomaly detection rates as the quality metric.
  • domain assumption Benign samples rarely fall outside the per-class [min, max] SHAP range computed from training data.
    Section 3.3, Model Interpretation Stability: the normal range is [min(SHAP_f,c), max(SHAP_f,c)] over benign training samples; a sample is anomalous if any feature exceeds it. The associated benign false-positive rate is never measured; with 115 features the union-bound flag rate is likely nontrivial.
  • ad hoc to paper Feature dependencies are acyclic and identifiable in advance.
    Section 3.2: the perturbation technique 'assumes that the features with dependencies are not directly interdependent among themselves'; Section 6 concedes mutual or latent dependencies require an unimplemented discovery stage. The technique therefore only covers the subset of datasets where dependencies are known and non-circular.
  • domain assumption Threat model: attacker obtains confidence scores, unlimited queries (query-based) or a single query (transferability), plus a surrogate dataset from the same distribution as the target training data.
    Section 4.6: all reported risk, effort, and quality results are conditional on this access model; label-only attacks or out-of-distribution surrogate data are not covered.
  • standard math Jensen's inequality and the stated non-parametric tests (Mann-Whitney U, proportions z-tests, McNemar, Wilcoxon) are applied correctly in Appendices B and C.
    Appendix B.3 uses convexity of x^alpha and Jensen's inequality for the CSAD complexity claims; Appendix C applies Holm-corrected tests. These background results are standard and not derived in the paper.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Addressing Key Challenges of Adversarial Attacks and Defenses in the Tabular Domain: A Methodological Framework for Coherence and Consistency." pith.science (2026). https://pith.science/paper/7TEOFSBT

@misc{pith2026241207326,
  author       = {Pith},
  title        = {Pith review of: Addressing Key Challenges of Adversarial Attacks and Defenses in the Tabular Domain: A Methodological Framework for Coherence and Consistency},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7TEOFSBT}},
  note         = {Machine review of arXiv:2412.07326}
}
read the original abstract

Machine learning models trained on tabular data are vulnerable to adversarial attacks, even in realistic scenarios where attackers only have access to the model's outputs. Since tabular data contains complex interdependencies among features, it presents a unique challenge for adversarial samples which must maintain coherence and respect these interdependencies to remain indistinguishable from benign data. Moreover, existing attack evaluation metrics-such as the success rate, perturbation magnitude, and query count-fail to account for this challenge. To address those gaps, we propose a technique for perturbing dependent features while preserving sample coherence. In addition, we introduce Class-Specific Anomaly Detection (CSAD), an effective novel anomaly detection approach, along with concrete metrics for assessing the quality of tabular adversarial attacks. CSAD evaluates adversarial samples relative to their predicted class distribution, rather than a broad benign distribution. It ensures that subtle adversarial perturbations, which may appear coherent in other classes, are correctly identified as anomalies. We integrate SHAP explainability techniques to detect inconsistencies in model decision-making, extending CSAD for SHAP-based anomaly detection. Our evaluation incorporates both anomaly detection rates with SHAP-based assessments to provide a more comprehensive measure of adversarial sample quality. We evaluate various attack strategies, examining black-box query-based and transferability-based gradient attacks across four target models. Experiments on benchmark tabular datasets reveal key differences in the attacker's risk and effort and attack quality, offering insights into the strengths, limitations, and trade-offs faced by attackers and defenders. Our findings lay the groundwork for future research on adversarial attacks and defense development in the tabular domain.

Figures

Figures reproduced from arXiv: 2412.07326 by the authors.

Figure 1
Figure 1. An overview of the paper’s methodological framework. 26]) and five transferability-based gradient attacks with varying feature selection techniques [8, 9]. The process illustrated in [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Attacker’s risk: number of changed features (𝐿0 distance) and distortion size (𝐿2 distance), across query- and transferability-based attacks. significantly larger perturbations than transferability-based attacks (𝑝 < 0.05), consistent with the visual trends in [PITH_FULL_IMAGE:figures/full_fig_p014_2.png] view at source ↗
Figure 3
Figure 3. Attack quality evaluated based on the feature space anomaly detection. Bars show the percentage of adversarial samples flagged as anomalies (TPR; higher is better) by an AE and an IF for each attack and target model, across datasets. Thresholds are fixed per dataset and class on a benign validation split; the resulting benign FPR is less than 5% across all datasets and classes. and 1.45% on the VideoTQ dataset. For … view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Attack quality evaluated based on the impact on the target model’s decision-making process; SHAP value distribution for benign (blue) and adversarial samples (on the Hate dataset), across the top-four most important features selected based on their average SHAP values …
Figure 5
Figure 5. Figure 5: Attack quality evaluated based on the impact on the target model’s decision-making process; SHAP value distribution for benign (blue) and adversarial samples (on the ICU dataset), across the top-four most important features selected based on their average SHAP values c…
Figure 6
Figure 6. Figure 6: Attack quality evaluated based on the impact on the target model’s decision-making process; SHAP value distribution for benign (blue) and adversarial samples (on the VideoTQ dataset), across the top-four most important features selected based on their average SHAP valu…
Figure 7
Figure 7. Figure 7: Training complexity comparison between CSAD and the traditional approach for balanced classes. The curves show the theoretical relative training cost as a function of the number of classes 𝑘, under the assumption that all classes contain the same number of samples. For…
Figure 8
Figure 8. Figure 8: Training complexity comparison between CSAD and traditional approaches for unbalanced classes. The curves illustrate the worst case where a dominant class contains most of the samples (99% in this example). For 𝛼 < 1, CSAD incurs higher cost as the number of classes in…
Figure 9
Figure 9. Figure 9: The impact of class imbalance on the relative benefit of CSAD over the traditional approach, for 𝛼 > 1 and a fixed number of classes 𝑘. When classes are nearly balanced, CSAD achieves substantial computational savings over the traditional method. As the imbalance ratio…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

59 extracted references · 47 canonical work pages

  1. [1]

    Crouhy, D

    M. Crouhy, D. Galai, R. Mark, A comparative analysis of current credit risk models, Journal of Banking & Finance 24 (1-2) (2000) 59–117

    work page 2000

  2. [2]

    S. Moro, R. Laureano, P. Cortez, Using data mining for bank direct marketing: An application of the crisp-dm methodology (2011)

    work page 2011

  3. [3]

    M. D. Danese, M. Halperin, J. Duryea, R. Duryea, The generalized data model for clinical research, BMC medical informatics and deci- sion making 19 (1) (2019) 1–13

    work page 2019

  4. [4]

    J. C. Lam, K. K. Wan, K. Cheung, L. Yang, Principal component analysis of electricity use in office buildings, Energy and buildings 40 (5) (2008) 828–836

    work page 2008

  5. [5]

    Ramesh, R

    T. Ramesh, R. Prakash, K. Shukla, Life cycle energy analysis of buildings: An overview, Energy and buildings 42 (10) (2010) 1592– 1600

    work page 2010

  6. [6]

    V.Ballet,X.Renard,J.Aigrain,T.Laugel,P.Frossard,M.Detyniecki, Imperceptible adversarial attacks on tabular data, arXiv preprint arXiv:1911.03274 (2019)

    arXiv 2019

  7. [7]

    Cartella, O

    F. Cartella, O. Anunciacao, Y. Funabiki, D. Yamaguchi, T. Akishita, O.Elshocht,Adversarialattacksfortabulardata:Applicationtofraud detection and imbalanced data, arXiv preprint arXiv:2101.08030 (2021)

    arXiv 2021

  8. [8]

    Y.Mathov,E.Levy,Z.Katzir,A.Shabtai,Y.Elovici,Notalldatasets are born equal: On heterogeneous tabular data and adversarial exam- ples, Knowledge-Based Systems 242 (2022) 108377

    work page 2022

Show all 59 references
  1. [9]

    Grolman, H

    E. Grolman, H. Binyamini, A. Shabtai, Y. Elovici, I. Morikawa, T. Shimizu, Hateversarial: Adversarial attack against hate speech detection algorithms on twitter, in: Proceedings of the 30th ACM ConferenceonUserModeling,AdaptationandPersonalization,2022, pp. 143–152

    2022

  2. [10]

    H. Xu, Y. Ma, H.-C. Liu, D. Deb, H. Liu, J.-L. Tang, A. K. Jain, Adversarialattacksanddefensesinimages,graphsandtext:Areview, International Journal of Automation and Computing 17 (2020) 151– 178

    2020

  3. [11]

    G.Zizzo,C.Hankin,S.Maffeis,K.Jones,Adversarialmachinelearn- ing beyond the image domain, in: Proceedings of the 56th Annual Design Automation Conference 2019, 2019, pp. 1–4

    2019

  4. [12]

    Kaviani, K

    S. Kaviani, K. J. Han, I. Sohn, Adversarial attacks and defenses on ai in medical imaging informatics: A survey, Expert Systems with Applications 198 (2022) 116815

    2022

  5. [13]

    M. K. Puttagunta, S. Ravi, C. Nelson Kennedy Babu, Adversarial examples: attacks and defences on medical deep learning systems, Multimedia Tools and Applications (2023) 1–37

    2023

  6. [14]

    J. Lan, R. Zhang, Z. Yan, J. Wang, Y. Chen, R. Hou, Adversarial attacksanddefensesinspeakerrecognitionsystems:Asurvey,Journal of Systems Architecture 127 (2022) 102526

    2022

  7. [15]

    F.Marulli,L.Verde,L.Campanile,Exploringdataandmodelpoison- ing attacks to deep learning-based nlp systems, Procedia Computer Science 192 (2021) 3570–3579

    2021

  8. [16]

    Goyal, S

    S. Goyal, S. Doddapaneni, M. M. Khapra, B. Ravindran, A survey of adversarialdefensesandrobustnessinnlp,ACMComputingSurveys 55 (14s) (2023) 1–39

    2023

  9. [17]

    L. Sun, Y. Dou, C. Yang, K. Zhang, J. Wang, S. Y. Philip, L. He, B. Li, Adversarial attack and defense on graph data: A survey, IEEE Transactions on Knowledge and Data Engineering (2022)

    2022

  10. [18]

    A.Keys,F.Fidanza,M.J.Karvonen,N.Kimura,H.L.Taylor,Indices of relative weight and obesity, International journal of epidemiology 43 (3) (2014) 655–665

    2014

  11. [19]

    X. Chen, C. Liu, Y. Zhao, Z. Jia, G. Jin, Improving adversarial robustness of bayesian neural networks via multi-task adversarial training, Information Sciences 592 (2022) 156–173

    2022

  12. [20]

    M. S. Haroon, H. M. Ali, Adversarial training against adversar- ial attacks for machine learning-based intrusion detection systems., Computers, Materials & Continua 73 (2) (2022)

    2022

  13. [21]

    S. M. Lundberg, S.-I. Lee, A unified approach to interpreting model predictions, Advances in neural information processing systems 30 (2017)

    2017

  14. [22]

    V.Belle,I.Papantonis,Principlesandpracticeofexplainablemachine learning, Frontiers in big Data (2021) 39

    2021

  15. [23]

    Ribeiro, P

    M. Ribeiro, P. Calais, Y. Santos, V. Almeida, W. Meira Jr, Charac- terizing and detecting hateful users on twitter, in: Proceedings of the International AAAI Conference on Web and Social Media, Vol. 12, 2018

    2018

  16. [24]

    Hanberger, D

    H. Hanberger, D. L. Monnet, L. E. Nilsson, Intensive care unit, in: Antibioticpolicies:theoryandpractice,Springer,2005,pp.261–279

    2005

  17. [25]

    W.Brendel,J.Rauber,M.Bethge,Decision-basedadversarialattacks: Reliable attacks against black-box machine learning models, arXiv preprint arXiv:1712.04248 (2017)

    2017 arXiv

  18. [26]

    1277–1294

    J.Chen,M.I.Jordan,M.J.Wainwright,Hopskipjumpattack:Aquery- efficient decision-based attack, in: 2020 ieee symposium on security and privacy (sp), IEEE, 2020, pp. 1277–1294

    2020

  19. [27]

    Szegedy, W

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Good- fellow, R. Fergus, Intriguing properties of neural networks, arXiv preprint arXiv:1312.6199 (2013)

    2013 arXiv

  20. [28]

    Deldjoo, T

    Y. Deldjoo, T. D. Noia, F. A. Merra, A survey on adversarial rec- ommender systems: from attack/defense strategies to generative ad- versarial networks, ACM Computing Surveys (CSUR) 54 (2) (2021) 1–38

    2021

  21. [29]

    K.Mahmood,R.Mahmood,E.Rathbun,M.vanDijk,Backinblack: Acomparativeevaluationofrecentstate-of-the-artblack-boxattacks, IEEE Access 10 (2021) 998–1019

    2021

  22. [30]

    Papernot, P

    N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, A. Swami, Practical black-box attacks against machine learning, in: Proceedings of the 2017 ACM on Asia conference on computer and communications security, 2017, pp. 506–519

    2017

  23. [31]

    L.Ju,R.Cui,J.Sun,Z.Li,Arobustapproachtoadversarialattackon tabular data for classification algorithm testing, in: 2022 8th Interna- tional Conference on Big Data and Information Analytics (BigDIA), IEEE, 2022, pp. 371–376

    2022

  24. [32]

    I. J. Goodfellow, J. Shlens, C. Szegedy, Explaining and harnessing adversarial examples, arXiv preprint arXiv:1412.6572 (2014)

    2014 arXiv

  25. [33]

    Ilyas, L

    A. Ilyas, L. Engstrom, A. Athalye, J. Lin, Black-box adversarial attacks with limited queries and information, in: International con- ference on machine learning, PMLR, 2018, pp. 2137–2146

    2018

  26. [34]

    Q. Wang, B. Zheng, Q. Li, C. Shen, Z. Ba, Towards query-efficient adversarial attacks against automatic speech recognition systems, IEEE Transactions on Information Forensics and Security 16 (2020) 896–908

    2020

  27. [35]

    Alecci, M

    M. Alecci, M. Conti, F. Marchiori, L. Martinelli, L. Pajola, Your attack is too dumb: Formalizing attacker scenarios for adversarial transferability, in: Proceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses, 2023, pp. 315–329

    2023

  28. [36]

    Kurakin, I

    A. Kurakin, I. J. Goodfellow, S. Bengio, Adversarial examples in the physical world, in: Artificial intelligence safety and security, Chapman and Hall/CRC, 2018, pp. 99–112

    2018

  29. [37]

    S. A. Fezza, Y. Bakhti, W. Hamidouche, O. Déforges, Perceptual evaluation of adversarial attacks for cnn-based image classification, in:2019EleventhInternationalConferenceonQualityofMultimedia Experience (QoMEX), IEEE, 2019, pp. 1–6

    2019

  30. [38]

    A. L. P. Gómez, L. F. Maimó, A. H. Celdrán, F. J. G. Clemente, Vaasi: Crafting valid and abnormal adversarial samples for anomaly detection systems in industrial scenarios, Journal of Information Security and Applications 79 (2023) 103647

    2023

  31. [39]

    Papernot, P

    N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, A.Swami,Thelimitationsofdeeplearninginadversarialsettings,in: 2016IEEEEuropeansymposiumonsecurityandprivacy(EuroS&P), IEEE, 2016, pp. 372–387

    2016

  32. [40]

    Borisov, T

    V. Borisov, T. Leemann, K. Seßler, J. Haug, M. Pawelczyk, G. Kas- neci,Deepneuralnetworksandtabulardata:Asurvey,IEEEtransac- tions on neural networks and learning systems (2022)

    2022

  33. [41]

    R.A.Fisher,R.A.Fisher,Thedesignofexperiments,Springer,1971

    1971

  34. [42]

    Sakurada, T

    M. Sakurada, T. Yairi, Anomaly detection using autoencoders with nonlinear dimensionality reduction, in: Proceedings of the MLSDA 2014 2nd workshop on machine learning for sensory data analysis, 2014, pp. 4–11. Y. Itzhakev et al.:Preprint submitted to Elsevier Page 37 of 38 Ad...

    2014

  35. [43]

    H.Xu,G.Pang,Y.Wang,Y.Wang,Deepisolationforestforanomaly detection, IEEE Transactions on Knowledge and Data Engineering 35 (12) (2023) 12591–12604

    2023

  36. [44]

    Schölkopf, J

    B. Schölkopf, J. C. Platt, J. Shawe-Taylor, A. J. Smola, R. C. Williamson, Estimating the support of a high-dimensional distribu- tion, Neural computation 13 (7) (2001) 1443–1471

    2001

  37. [45]

    F.T.Liu,K.M.Ting,Z.-H.Zhou,Isolationforest,in:2008eighthieee international conference on data mining, IEEE, 2008, pp. 413–422

    2008

  38. [46]

    L. S. Nelson, The shewhart control chart—tests for special causes, Journal of quality technology 16 (4) (1984) 237–239

    1984

  39. [47]

    W. A. Shewhart, Economic control of quality of manufactured prod- uct. (1931)

    1931

  40. [48]

    L. Shan, Y. Li, H. Jiang, P. Zhou, J. Niu, R. Liu, Y. Wei, J. Peng, H.Yu,X.Sha,etal.,Abnormalecgdetectionbasedonanadversarial autoencoder, Frontiers in Physiology 13 (2022) 961724

    2022

  41. [49]

    Torabi, S

    H. Torabi, S. L. Mirtaheri, S. Greco, Practical autoencoder based anomalydetectionbyusingvectorreconstructionerror,Cybersecurity 6 (1) (2023) 1

    2023

  42. [50]

    Pennington, R

    J. Pennington, R. Socher, C. D. Manning, Glove: Global vectors for word representation, in: Proceedings of the 2014 conference on empirical methods in natural language processing (EMNLP), 2014, pp. 1532–1543

    2014

  43. [51]

    T. Chen, C. Guestrin, Xgboost: A scalable tree boosting system, in: Proceedings of the 22nd acm sigkdd international conference on knowledge discovery and data mining, 2016, pp. 785–794

    2016

  44. [52]

    J. H. Friedman, Greedy function approximation: a gradient boosting machine, Annals of statistics (2001) 1189–1232

    2001

  45. [53]

    G. Ke, Q. Meng, T. Finley, T. Wang, W. Chen, W. Ma, Q. Ye, T.- Y. Liu, Lightgbm: A highly efficient gradient boosting decision tree, Advances in neural information processing systems 30 (2017)

    2017

  46. [54]

    Breiman, Random forests, Machine learning 45 (2001) 5–32

    L. Breiman, Random forests, Machine learning 45 (2001) 5–32

    2001

  47. [55]

    1251–1258

    L.Liu,H.Qi,Learningeffectivebinarydescriptorsviacrossentropy, in: 2017 IEEE winter conference on applications of computer vision (WACV), IEEE, 2017, pp. 1251–1258

    2017

  48. [56]

    D. P. Kingma, J. Ba, Adam: A method for stochastic optimization, arXiv preprint arXiv:1412.6980 (2014)

    2014 arXiv

  49. [57]

    E. W. Weisstein, Correlation coefficient, https://mathworld. wolfram. com/ (2006)

    2006

  50. [58]

    Nicolae, M

    M.-I. Nicolae, M. Sinn, M. N. Tran, B. Buesser, A. Rawat, M. Wis- tuba, V. Zantedeschi, N. Baracaldo, B. Chen, H. Ludwig, et al., Ad- versarialrobustnesstoolboxv1.0.0,arXivpreprintarXiv:1807.01069 (2018)

    2018 arXiv

  51. [59]

    Cover, J

    T. Cover, J. Thomas, Elements of Information Theory, A Wiley- Interscience publication, Wiley, 2006. URL https://books.google.co.il/books?id=0QuawYmc2pIC Y. Itzhakev et al.:Preprint submitted to Elsevier Page 38 of 38

    2006

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.