Pith. sign in

REVIEW 5 major objections 5 minor 61 references

Evaluating the Vulnerability of ML-Based Ethereum Phishing Detectors to Single-Feature Adversarial Perturbations

T0 review · 5 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Single-feature edits break Ethereum phishing detectors trained on Random Forest, Decision Tree, and KNN.

desk verdict A real problem and a sensible attack taxonomy, but as submitted the experiments do not support the claims: the split is contradicted by the table counts, FGSM is used on non-differentiable models without a surrogate, and the discussion contradicts the results. read the letter →

arxiv 2504.17684 v1 pith:BUXP5Y5J submitted 2025-04-24 cs.CR

Ahod Alghuried , Ali Alkinoon , Abdulaziz Alghamdi , Soohyeon Choi , Manar Mohaisen , David Mohaisen This is my paper · ORCID
classification cs.CR
keywords Ethereumphishingdetectionadversarialperturbationssingle-featureattacksFastGradientSignMethodRandomForestDecisionTreeK-NearestNeighborstraining
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that Ethereum phishing and scam detection built on Random Forest, Decision Tree, and K-Nearest Neighbors can be evaded by changing one transaction feature at a time, such as shifting the timestamp, altering the value, or swapping the sender or receiver address. Under these simple manipulations, phishing and scamming recall collapses for all three classifiers in several scenarios, with Decision Tree and KNN often becoming almost useless. The paper also claims that retraining on adversarially modified examples restores most of the lost accuracy, and that combining temporal features with address or financial features makes models harder to fool. If true, this matters because a real attacker can often edit only one field of a transaction, so detectors that rely on these standard classifiers need explicit defenses rather than assuming clean data.

What carries the argument

The paper's core instrument is a set of single-feature perturbation operators applied to two Ethereum transaction datasets, together with the Fast Gradient Sign Method (FGSM), a one-step attack that perturbs features in the direction that most increases the loss. FGSM computes $x' = x + \epsilon \cdot \text{sign}(\nabla_x J(\theta, x, y))$ and is applied to transaction value, gas, gas_price, and block_timestamp. The perturbation operators are timestamp shifts, uniform and proportional value changes, and sender or receiver address replacement; these define the attack surface being tested. The same operators double as the adversarial training recipe: retraining on the modified examples is the defense whose accuracy restoration is measured. The machinery carries the argument because every result is a before-and-after comparison of accuracy, precision, recall, and F1 under one of these operators.

What would settle it

Run the gradient-based attack on the same three classifiers using the models' own loss gradient rather than an external surrogate. For piecewise-constant classifiers like RF, DT, and KNN, $\nabla_x J(\theta,x,y)$ is zero almost everywhere, so the FGSM update $x' = x + \epsilon \cdot \text{sign}(\nabla_x J(\theta,x,y))$ would leave inputs unchanged and accuracy should stay at baseline. If the reported accuracy collapses are reproduced only when a surrogate gradient supplies nonzero directions, then the single-feature FGSM claim depends on an attack the paper does not specify.

Watch

Extended reading notes

Core claim

The central discovery is that the evaluated ML detectors are not robust to single-feature perturbations that stay within realistic transaction ranges. On the first dataset, a one-day timestamp shift drops KNN accuracy from 0.94 to 0.83, a 1% uniform value change drops RF and DT accuracy from about 0.99 and 0.98 to 0.69, and replacing the recipient address in all transactions drops RF phishing recall from 1.00 to 0.51. On the second dataset, targeted rule-based changes push phishing detection accuracy for RF and DT from 0.96 to 0.01 and scamming accuracy from roughly 0.98 to 0.14, while gradient-based FGSM attacks reduce DT overall accuracy to about 0.09 and KNN's phishing and scamming metrics to zero. The paper further claims that adversarial training on timestamp- and value-perturbed samples returns RF, DT, and KNN to roughly their original accuracy. The authors interpret the inconsistency across algorithms as an opportunity: model choice and feature composition can be tuned for resilience.

Load-bearing premise

That the Fast Gradient Sign Method can be meaningfully applied to Random Forest, Decision Tree, and K-Nearest Neighbors, even though those models do not provide the gradient of the error with respect to input features that the method assumes.

Editorial extensions

If this is right

  • A phishing detector that relies on transaction value and timestamp alone can be evaded by an attacker who edits a single field, so production detectors should monitor feature consistency.
  • Overall accuracy can stay high while phishing recall collapses, so reporting class-level precision and recall is necessary to see whether a detector is still safe.
  • KNN's phishing and scamming metrics drop to zero under FGSM in the paper's experiments, suggesting KNN should not be the sole classifier in adversarial settings unless retrained.
  • Adversarial training on timestamp and value perturbations returns RF and DT to near-baseline accuracy, giving a concrete defense that does not require changing the model family.
  • Combining temporal features with address or financial features reduces vulnerability, making feature selection a defense lever independent of training.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper does not test whether an attacker needs a surrogate gradient to run FGSM on tree-based or nearest-neighbor classifiers; if one is required, the gradient-based results overstate how easily a real attacker can produce those perturbations.
  • A testable extension is to apply the same timestamp, value, and address perturbations to graph-based phishing detectors, since the paper's address results suggest those models may be even more sensitive to identity changes.
  • The uniform value perturbation's catastrophic effect on RF and DT may be partly an artifact of how categorical or scaled features are encoded; re-running with standardized feature encoders would isolate whether the vulnerability is in the model or the representation.
  • The paper's adversarial training used only timestamp and value perturbations, so an immediate extension is to include address replacement in the training mix and measure whether the restored accuracy generalizes to other single-feature edits.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper evaluates the robustness of Random Forest, Decision Tree, and K-Nearest Neighbors classifiers for Ethereum phishing detection against simple single-feature manipulations (timestamp, value, sender/receiver address) and against FGSM-style gradient-based attacks. Using two Ethereum transaction datasets, it reports accuracy, precision, recall, and F1 degradations under these perturbations, then proposes adversarial training and feature-selection guidance as mitigation strategies. The central claims are that simple manipulations substantially degrade detection performance, that model vulnerability varies across algorithms, and that adversarial training restores most lost performance.

Significance. If the empirical claims were sound, the paper would offer a useful cautionary result for practitioners building Ethereum phishing detectors, showing that even single-feature changes can bypass non-neural classifiers, and that adversarial training can partially mitigate this. The simple perturbation model is realistic and the comparison across three classic classifiers is informative. The paper also openly builds on a prior WISA workshop version and uses public datasets, which supports reproducibility in principle. However, as submitted, the experimental reporting has multiple serious internal inconsistencies that undermine the validity of the headline numbers, so the significance currently rests on claims that are not adequately supported.

major comments (5)
  1. [Section 4.2 and Tables 2–5, 10, 11] The paper states an 80/20 train/test split, but every Dataset-1 table reports class counts that sum to 23,472, the full dataset size. For example, Table 2's baseline row gives 15,989 benign + 7,483 phishing = 23,472, and Table 10 repeats these exact counts. An 80/20 split would yield about 4,694 test instances, so these tables cannot be reporting metrics on a held-out test fold. If the reported accuracy and degradation numbers are computed on the training set or on the full dataset, the headline vulnerability and recovery results do not demonstrate generalization to unseen transactions. This is load-bearing because the paper's central claim rests on these measurements.
  2. [Section 4.2 (FGSM) and Section 5.3] FGSM is defined for models whose loss is differentiable with respect to the input, but the paper applies it to Random Forest, Decision Tree, and K-Nearest Neighbors, which are piecewise-constant functions with gradients that are zero or undefined almost everywhere. The manuscript presents the standard FGSM formula in Section 4.2 but never specifies a surrogate gradient, a smoothing procedure, or a gradient-estimation method. Without such a mechanism, the FGSM-based attack results (Section 5.3, Figures 2–4) and the adversarial-training claims that rely on FGSM (Section 6.1 and Table 12) are not supported. The paper must either describe and justify an approximate-gradient approach or replace FGSM with a well-defined gradient-free attack.
  3. [Section 5.4 versus Section 8] Section 5.4 reports that manipulating address features (from_address and to_address) caused phishing and scamming precision and recall to drop to zero for all models (Table 7), and the same section states that temporal feature manipulation nearly nullified phishing detection (Table 9). Section 8, however, claims that address features are 'less affected' and are the 'most resistant' to adversarial attacks, and that temporal features are 'resistant' and have smaller impact than value manipulations. These statements directly contradict the reported results. This internal contradiction means the discussion and the feature-selection recommendations at the end of Section 8 are not grounded in the paper's own experimental findings.
  4. [Sections 6–7 and Table 12] The adversarial-training evaluation is circular in design: the training augmentation is generated with the same perturbation families (timestamp shifts, value changes, FGSM) that are then used for the attack evaluation, and the post-retraining results in Table 12 are measured on those same perturbation types. The near-total recovery of accuracy to 0.98–0.99 under this protocol may reflect the model having been trained on the exact test distribution rather than genuine robustness to unseen manipulations. To support the claimed robustness benefit, the authors need to evaluate on attack types, magnitudes, or feature subsets that were not included in the adversarial training augmentation.
  5. [Tables 3 and 6] There are internal reporting inconsistencies that make several metrics unreliable. In Table 3, the 'Uniform' row for RF reports accuracy 0.69 with counts of 23,353 benign and 119 phishing; the per-class precision and recall shown (benign precision 0.96, phishing precision 0.68, phishing recall 0.02) are not consistent with the confusion-matrix sizes implied by those counts. In Table 6, the 'Instance Counts Before and After Attacks' row for KNN shows 'Fake ICO' as 2,189, equal to the Scamming count, whereas Section 4.1.1 states that the second dataset contains only one Fake ICO transaction; Table 12 also lists Fake ICO count as 2,189. Such inconsistencies indicate that the tabulated numbers cannot be taken at face value without clarification.
minor comments (5)
  1. [Throughout] The paper contains numerous typos and duplicated phrases, e.g., 'Despite advancements in machine learning and Despite significant progress' in Section 2.4, and 'probability' / 'propability' inconsistencies. A careful copyedit is needed before resubmission.
  2. [Figure 7] Figure 7 is described only as 'Combined model accuracy across 2-6 figures' and appears to be a collage of bar charts; the reader cannot discern which subpanel corresponds to which attack or metric. Each subpanel needs a clear caption and consistent axis labeling.
  3. [Table 12] Table 12 has merged cells that obscure which values are shared across models; for instance, the row 'Accuracy Before and After Adversarial Training' shows 0.99/0.98 once but is meant to apply to all three models. The table should be restructured so that each model's pre/post accuracy and misclassification rates are explicit.
  4. [Section 5.1] The text says 'DT's recall for phishing was especially affected, falling to just 0.01%.' The corresponding Table 3 does not clearly show a 0.01% value; the reported recall for phishing under uniform value manipulation is 0.02. The numerical discrepancy between the text and the table should be reconciled.
  5. [References] A few references are cited inconsistently: [47] is listed as Szegedy et al. in the reference list but is also attributed to Goodfellow et al. in the introduction when discussing FGSM. The authors should verify that citation numbers match the intended works.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the vulnerability and adversarial-training results are empirical measurements, not derivations that reduce to their own inputs.

full rationale

The paper's claims are experimental measurements of classifier accuracy under hand-defined single-feature perturbations, followed by accuracy measurements after retraining on augmented data. There is no derivation chain in which an output quantity is defined in terms of the claimed result or in which a fitted parameter is renamed as a prediction. The adversarial-training recovery is an empirical outcome, not a construction: training on perturbed examples does not by itself force the post-retraining accuracy values reported, and evaluating on the same perturbation family is a standard robustness protocol rather than a circular reduction. The acknowledgement of an earlier version of this work is a self-citation, but it is not load-bearing: no uniqueness theorem, ansatz, or central premise is justified by it. The suspicious full-dataset counts in Tables 2-5 and the application of FGSM to non-differentiable classifiers are correctness and methodological risks, but they are not circularity; the reported numbers are measurements, however flawed, rather than quantities that equal their inputs by construction. The paper is therefore not circular, though its empirical validation has serious reproducibility concerns.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

The paper's vulnerability and defense claims depend on several hand-chosen perturbation magnitudes (timestamp intervals, 1% value change, address replacement counts, unstated FGSM epsilon), on the representativeness of two external datasets, and on an unjustified application of FGSM to non-differentiable models. The defense evaluation also assumes that testing on the same attack families used in training augmentation is a valid measure of robustness, which is a circularity risk.

free parameters (4)
  • FGSM epsilon = not specified
    The magnitude of the FGSM perturbation, epsilon, is introduced in Section 4.2 but its value and calibration are never reported; the vulnerability results are sensitive to this choice.
  • Timestamp shift increments = +5 to +24 hours
    Hand-selected shift intervals in Section 5.1 (Table 2). These values determine the reported accuracy drops.
  • Uniform value change percentage = 1%
    In Section 5.1 and Table 3, uniform value manipulation is labeled '1%' but the text describes adding a fixed percentage uniformly; the exact transformation is not defined precisely, and it drives the 0.69 accuracy result.
  • Address manipulation counts = 5000, 10000, 23472
    The numbers of transactions with replaced From/To addresses are hand-picked in Section 5.1 (Tables 4 and 5).
assumptions (3)
  • domain assumption The two datasets are representative and correctly labeled for Ethereum phishing and fraud detection.
    Section 4.1.1 relies on external datasets from Kabla et al. and Al-Emari et al. without verifying label quality or class priors.
  • ad hoc to paper FGSM can be applied to non-differentiable classifiers (RF, DT, KNN) without a surrogate gradient approximation.
    Section 4.2 states FGSM is used with the gradient formula, but RF/DT/KNN do not have well-defined input gradients; no approximation is described.
  • domain assumption The 80/20 train/test split is used for reporting all metrics.
    Section 4.2 states an 80/20 split, but result tables report class counts equal to the full dataset, implying evaluation on the combined train/test data.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Evaluating the Vulnerability of ML-Based Ethereum Phishing Detectors to Single-Feature Adversarial Perturbations." pith.science (2026). https://pith.science/paper/BUXP5Y5J

@misc{pith2026250417684,
  author       = {Pith},
  title        = {Pith review of: Evaluating the Vulnerability of ML-Based Ethereum Phishing Detectors to Single-Feature Adversarial Perturbations},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BUXP5Y5J}},
  note         = {Machine review of arXiv:2504.17684}
}
read the original abstract

This paper explores the vulnerability of machine learning models to simple single-feature adversarial attacks in the context of Ethereum fraudulent transaction detection. Through comprehensive experimentation, we investigate the impact of various adversarial attack strategies on model performance metrics. Our findings, highlighting how prone those techniques are to simple attacks, are alarming, and the inconsistency in the attacks' effect on different algorithms promises ways for attack mitigation. We examine the effectiveness of different mitigation strategies, including adversarial training and enhanced feature selection, in enhancing model robustness and show their effectiveness.

Figures

Figures reproduced from arXiv: 2504.17684 by the authors.

Figure 1
Figure 1. Pipeline in Ethereum transactions and adversarial testing. [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Performance comparison of RF, DT, and KNN under baseline and adversarial conditions using the [PITH_FULL_IMAGE:figures/full_fig_p012_2.png] view at source ↗
Figure 3
Figure 3. Evaluation of RF, DT, and KNN performance with [PITH_FULL_IMAGE:figures/full_fig_p013_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Assessment of RF, DT, and KNN performance with [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]
Figure 5
Figure 5. Figure 5: Performance comparison of RF, DT, and KNN models under baseline and untargeted adversarial [PITH_FULL_IMAGE:figures/full_fig_p014_5.png]
Figure 6
Figure 6. Figure 6: RF, DT, and KNN performance with address feature manipulation. Metrics: accuracy, precision, recall, [PITH_FULL_IMAGE:figures/full_fig_p014_6.png]
Figure 7
Figure 7. Figure 7: Combined model accuracy across 2-6 figures. [PITH_FULL_IMAGE:figures/full_fig_p015_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

61 extracted references · 26 canonical work pages

  1. [1]

    Ahmed Abusnaina, Mohammed Abuhamad, Hisham Alasmary, Afsah Anwar, Rhongho Jang, Saeed Salem, DaeHun Nyang, and David Mohaisen. 2022. DL-FHMC: Deep Learning-Based Fine-Grained Hierarchical Learning Approach for Robust Malware Classification. IEEE Trans. Dependable Secur. Comput. 19, 5 (2022), 3432–3447. https://doi.org/10. 1109/TDSC.2021.3097296

    arXiv 2022

  2. [2]

    Ahmed Abusnaina, Afsah Anwar, Sultan Alshamrani, Abdulrahman Alabduljabbar, RhongHo Jang, DaeHun Nyang, and David Mohaisen. 2022. Systematically Evaluating the Robustness of ML-based IoT Malware Detection Systems. In 25th International Symposium on Research in Attacks, Intrusions and Defenses, RAID . ACM, 308–320. https://doi.org/10. 1145/3545948.3545960

    arXiv 2022

  3. [3]

    Ahmed Abusnaina, Rhongho Jang, Aminollah Khormali, DaeHun Nyang, and David Mohaisen. 2020. DFD: Adver- sarial Learning-based Approach to Defend Against Website Fingerprinting. In 39th IEEE Conference on Computer Communications, INFOCOM. IEEE, 2459–2468. https://doi.org/10.1109/INFOCOM41043.2020.9155465

    arXiv 2020

  4. [4]

    Ahmed Abusnaina, Aminollah Khormali, Hisham Alasmary, Jeman Park, Afsah Anwar, and Aziz Mohaisen. 2019. Adversarial Learning Attacks on Graph-based IoT Malware Detection Systems. In 39th IEEE International Conference on Distributed Computing Systems, ICDCS . IEEE, 1296–1305. https://doi.org/10.1109/ICDCS.2019.00130

    arXiv 2019

  5. [5]

    Arora, Yizhen Wang, Fei Wang, Hao Yang, and David Mohaisen

    Ahmed Abusnaina, Yuhang Wu, Sunpreet S. Arora, Yizhen Wang, Fei Wang, Hao Yang, and David Mohaisen. 2021. Adversarial Example Detection Using Latent Neighborhood Graph. In 2021 IEEE/CVF International Conference on Computer Vision, ICCV. IEEE, 7667–7676. https://doi.org/10.1109/ICCV48922.2021.00759

    arXiv 2021

  6. [6]

    Ayodeji Adeniran, Mohammed Alkinoon, and David Mohaisen. 2023. Understanding the Utilization of Cryptocurrency in the Metaverse and Security Implications. In Computational Data and Social Networks - 12th International Conference, CSoNet (Lecture Notes in Computer Science, Vol. 14479). Springer, 268–281. https://doi.org/10.1007/978-981-97-0669-3_25

    work page doi:10.1007/978-981-97-0669-3_25 2023

  7. [7]

    Ayodeji Adeniran, Kieran Human, and David Mohaisen. 2024. Dissecting the Infrastructure Used in Web-based Cryptojacking: A Measurement Perspective. In International Conference Information Security Applications, WISA . https://doi.org/10.48550/arXiv.2408.03426

    arXiv doi:10.48550/arxiv.2408.03426 2024

  8. [8]

    Rachit Agarwal, Tanmay Thapliyal, and Sandeep K. Shukla. 2022. Analyzing Malicious Activities and Detecting Adversarial Behavior in Cryptocurrency based Permissionless Blockchains: An Ethereum Usecase. Distributed Ledger Technol. Res. Pract. 1, 2 (2022), 1–21. https://doi.org/10.1145/3549527 , Vol. 1, No. 1, Article . Publication date: April 2025. 22 Ahod...

    work page doi:10.1145/3549527 2022

Show all 61 references
  1. [9]

    Sanjalawe, and Selvakumar Manickam

    Salam Al-Emari, Mohammed Anbar, Yousef K. Sanjalawe, and Selvakumar Manickam. 2020. A Labeled Transactions- Based Dataset on the Ethereum Network. In Advances in Cyber Security - Second International Conference, ACeS (Communications in Computer and Information Science, Vol. 13...

    2020 doi

  2. [10]

    Hisham Alasmary, Ahmed Abusnaina, Rhongho Jang, Mohammed Abuhamad, Afsah Anwar, DaeHun Nyang, and David Mohaisen. 2020. Soteria: Detecting Adversarial Examples in Control Flow Graph-based Malware Classifiers. In 40th IEEE International Conference on Distributed Computing Syste...

    2020

  3. [11]

    Ahod Alghuried and David Mohaisen. 2024. Simple Perturbations Subvert Ethereum Phishing Transactions Detection: An Empirical Analysis. CoRR abs/2408.03441 (2024). https://doi.org/10.48550/ARXIV.2408.03441

    2024 doi arXiv

  4. [12]

    Hung Ba. 2019. Improving Detection of Credit Card Fraudulent Transactions using Generative Adversarial Networks. CoRR abs/1907.03355 (2019). http://arxiv.org/abs/1907.03355

    2019 arXiv

  5. [13]

    Arjun Nitin Bhagoji, Warren He, Bo Li, and Dawn Song. 2018. Practical Black-Box Attacks on Deep Neural Networks Using Efficient Query Mechanisms. In Computer Vision - ECCV (Lecture Notes in Computer Science, Vol. 11216) . Springer, 158–174. https://doi.org/10.1007/978-3-030-01258-8_10

    2018 doi

  6. [14]

    Duchi, and Percy Liang

    Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C. Duchi, and Percy Liang. 2019. Unlabeled Data Improves Adversarial Robustness. In Advances in Neural Information Processing Systems 32: Annual Confer- ence on Neural Information Processing Systems . 11190–11201. https://pr...

    2019

  7. [15]

    Francesco Cartella, Orlando Anunciação, Yuki Funabiki, Daisuke Yamaguchi, Toru Akishita, and Olivier Elshocht

  8. [16]

    Yuanyuan Chen, Jing Qiu, Xiaojiang Du, Lihua Yin, and Zhihong Tian. 2020. Security of Mobile Multimedia Data: The Adversarial Examples for Spatio-temporal Data. Comput. Networks 181 (2020), 107432. https://doi.org/10.1016/J. COMNET.2020.107432

    2020

  9. [17]

    Zhen Chen, Sheng-Zheng Liu, Jia Huang, Yu-Han Xiu, Hao Zhang, and Haixia Long. 2024. Ethereum Phishing Scam Detection Based on Data Augmentation Method and Hybrid Graph Neural Network Model. Sensors 24, 12 (2024), 4022. https://doi.org/10.3390/S24124022

    2024 doi

  10. [18]

    Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. 2021. RobustBench: a standardized adversarial robustness benchmark. InProceedings of the Neural Information Processing Systems Track ...

    2021 arXiv

  11. [19]

    Pablo de Juan Fidalgo, Carmen Camara, and Pedro Peris-Lopez. 2022. Generation and Classification of Illicit Bitcoin Transactions. In Proceedings of the International Conference on Ubiquitous Computing & Ambient Intelligence, UCAmI (Lecture Notes in Networks and Systems, Vol. 5...

    2022 doi

  12. [20]

    Yifan Ding, Liqiang Wang, Huan Zhang, Jinfeng Yi, Deliang Fan, and Boqing Gong. 2019. Defending Against Adversarial Attacks Using Random Forest. In IEEE Conference on Computer Vision and Pattern Recognition Workshops, CVPR . Computer Vision Foundation / IEEE, 105–114. https://...

    2019

  13. [21]

    Ivan Fursov, Matvey Morozov, Nina Kaploukhaya, Elizaveta Kovtun, Rodrigo Rivera-Castro, Gleb Gusev, Dmitry Babaev, Ivan Kireev, Alexey Zaytsev, and Evgeny Burnaev. 2021. Adversarial Attacks on Deep Models for Financial Transaction Records. In KDD ’21: The 27th ACM SIGKDD Confe...

    2021

  14. [22]

    Daniel Gibert, Luca Demetrio, Giulio Zizzo, Quan Le, Jordi Planes, and Battista Biggio. 2024. Certified Adversarial Robustness of Machine Learning-based Malware Detectors via (De)Randomized Smoothing. CoRR abs/2405.00392. https://doi.org/10.48550/ARXIV.2405.00392

    2024 doi arXiv

  15. [23]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and Harnessing Adversarial Examples. In 3rd International Conference on Learning Representations, ICLR , Yoshua Bengio and Yann LeCun (Eds.). http: //arxiv.org/abs/1412.6572

    2015 arXiv

  16. [24]

    Qingyu Guo, Zhao Li, Bo An, Pengrui Hui, Jiaming Huang, Long Zhang, and Mengchen Zhao. 2019. Securing the Deep Fraud Detector in Large-Scale E-Commerce Platform via Adversarial Machine Learning Approach. In The World Wide Web Conference, WWW. ACM, 616–626. https://doi.org/10.1...

    2019

  17. [25]

    Al-Ani, and Shankar Karuppayah

    Arkan Hammoodi Hasan Kabla, Mohammed Anbar, Selvakumar Manickam, Taief Alaa Alamiedy, Peterson Bernabe Cruspe, Ahmed K. Al-Ani, and Shankar Karuppayah. 2022. Applicability of Intrusion Detection System on Ethereum Attacks: A Comprehensive Review. IEEE Access 10 (2022), 71632–7...

    2022

  18. [26]

    Arkan Hammoodi Hasan Kabla, Mohammed Anbar, Selvakumar Manickam, and Shankar Karuppayah. 2022. Eth-PSD: A Machine Learning-Based Phishing Scam Detection Approach in Ethereum. IEEE Access 10 (2022), 118043–118057. , Vol. 1, No. 1, Article . Publication date: April 2025. Evaluat...

    2022

  19. [27]

    Dan Li, Dacheng Chen, Jonathan Goh, and See-Kiong Ng. 2018. Anomaly Detection with Generative Adversarial Networks for Multivariate Time Series. CoRR abs/1809.04758 (2018). http://arxiv.org/abs/1809.04758

    2018 arXiv

  20. [28]

    Jie Li, Tianqing Zhu, Wei Ren, and Kim-Kwang Raymond Choo. 2023. Improve individual fairness in federated learning via adversarial training. Comput. Secur. 132 (2023), 103336. https://doi.org/10.1016/J.COSE.2023.103336

    2023

  21. [29]

    Xiaodan Li, Yuefeng Chen, Yuan He, and Hui Xue. 2019. AdvKnn: Adversarial Attacks On K-Nearest Neighbor Classifiers With Approximate Gradients. CoRR abs/1911.06591 (2019). http://arxiv.org/abs/1911.06591

    2019 arXiv

  22. [30]

    Jintao Luo, Jiwei Qin, Ruijin Wang, and Lu Li. 2024. A Phishing Account Detection Model via Network Embedding for Ethereum. IEEE Trans. Circuits Syst. II Express Briefs 71, 2 (2024), 622–626. https://doi.org/10.1109/TCSII.2023.3267822

    2024

  23. [31]

    Haifeng Lv and Yong Ding. 2023. Phishing detection on Ethereum via transaction subgraphs embedding.IET Blockchain 3, 4 (2023), 194–203. https://doi.org/10.1049/BLC2.12034

    2023 doi

  24. [32]

    Alberto Mozo, Ángel González-Prieto, Antonio Pastor Perales, Sandra Gómez Canaval, and Edgar Talavera. 2021. Synthetic flow-based cryptomining attack generation through Generative Adversarial Networks. CoRR abs/2107.14776 (2021). https://arxiv.org/abs/2107.14776

    2021 arXiv

  25. [33]

    Nina Narodytska and Shiva Prasad Kasiviswanathan. 2017. Simple Black-Box Adversarial Attacks on Deep Neural Networks. In 2017 IEEE Conference on Computer Vision and Pattern Recognition Workshops, CVPR . IEEE Computer Society, 1310–1318. https://doi.org/10.1109/CVPRW.2017.172

    2017 doi

  26. [34]

    Cuong Phuc Ngo, Amadeus Aristo Winarto, Connie Khor Li Kou, Sojeong Park, Farhan Akram, and Hwee Kuan Lee

  27. [35]

    Oliveira, Júlia Almeida Valadares, José Eduardo de Azevedo Sousa, Alex Borges Vieira, Heder Soares Bernardino, Saulo Moraes Villela, and Glauber Dias Gonçalves

    Vinicius C. Oliveira, Júlia Almeida Valadares, José Eduardo de Azevedo Sousa, Alex Borges Vieira, Heder Soares Bernardino, Saulo Moraes Villela, and Glauber Dias Gonçalves. 2021. Analyzing Transaction Confirmation in Ethereum Using Machine Learning Techniques. SIGMETRICS Perfo...

    2021

  28. [36]

    McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami

    Nicolas Papernot, Patrick D. McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. 2016. Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks. In IEEE Symposium on Security and Privacy, SP . IEEE Computer Society, 582–597. https://doi.org/10.1109/SP.2016.41

    2016 doi

  29. [37]

    Parizi, and Ali Dehghantanha

    Elnaz Rabieinejad, Abbas Yazdinejad, Reza M. Parizi, and Ali Dehghantanha. 2023. Generative Adversarial Networks for Cyber Threat Hunting in Ethereum Blockchain. Distributed Ledger Technol. Res. Pract. 2, 2 (2023), 1–19. https: //doi.org/10.1145/3584666

    2023 doi

  30. [38]

    Vaishali Ravindranath, M. K. Nallakaruppan, M. Lawanya Shri, Balamurugan Balusamy, and Siddhartha Bhattacharyya

  31. [39]

    Muhammad Saad and David Mohaisen. 2023. Analyzing In-browser Cryptojacking. CoRR abs/2304.13253 (2023). https://doi.org/10.48550/ARXIV.2304.13253

    2023 doi arXiv

  32. [40]

    Kamhoua, Joongheon Kim, DaeHun Nyang, and Aziz Mohaisen

    Muhammad Saad, Laurent Njilla, Charles A. Kamhoua, Joongheon Kim, DaeHun Nyang, and Aziz Mohaisen. 2019. Mempool optimization for Defending Against DDoS Attacks in PoW-based Blockchain Systems. In IEEE International Conference on Blockchain and Cryptocurrency, ICBC . IEEE, 285...

    2019

  33. [41]

    Kamhoua, Sachin Shetty, DaeHun Nyang, and David Mohaisen

    Muhammad Saad, Jeffrey Spaulding, Laurent Njilla, Charles A. Kamhoua, Sachin Shetty, DaeHun Nyang, and David Mohaisen. 2020. Exploring the Attack Surface of Blockchain: A Comprehensive Survey. IEEE Commun. Surv. Tutorials 22, 3 (2020), 1977–2008. https://doi.org/10.1109/COMST....

    2020

  34. [42]

    Sanjalawe and Salam Al-Emari

    Yousef K. Sanjalawe and Salam Al-Emari. 2023. Abnormal Transactions Detection in the Ethereum Network Using Semi-Supervised Generative Adversarial Networks. IEEE Access 11 (2023), 98516–98531. https://doi.org/10.1109/ ACCESS.2023.3313630

    2023

  35. [43]

    Leslie, Charles A

    Dule Shu, Nandi O. Leslie, Charles A. Kamhoua, and Conrad S. Tucker. 2020. Generative adversarial attacks against intrusion detection systems using active learning. In Proceedings of the 2nd ACM Workshop on Wireless Security and Machine Learning, WiseML@WiSec . ACM, 1–6. https...

    2020

  36. [44]

    Samuel Henrique Silva and Peyman Najafirad. 2020. Opportunities and Challenges in Deep Learning Adversarial Robustness: A Survey. CoRR abs/2007.00753 (2020). https://arxiv.org/abs/2007.00753

    2020 arXiv

  37. [45]

    Harsh Jot Singh and Abdelhakim Senhaji Hafid. 2019. Prediction of Transaction Confirmation Time in Ethereum Blockchain Using Machine Learning. In Blockchain and Applications - International Congress, BLOCKCHAIN (Advances in Intelligent Systems and Computing, Vol. 1010) . Sprin...

    2019 doi

  38. [46]

    David Stutz, Matthias Hein, and Bernt Schiele. 2019. Disentangling Adversarial Robustness and Generalization. In IEEE Conference on Computer Vision and Pattern Recognition, CVPR . Computer Vision Foundation / IEEE. https: //doi.org/10.1109/CVPR.2019.00714

    2019

  39. [47]

    Goodfellow, and Rob Fergus

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus

  40. [48]

    Runnan Tan, Qingfeng Tan, Qin Zhang, Peng Zhang, Yushun Xie, and Zhao Li. 2023. Ethereum fraud behavior detection based on graph neural networks. Computing 105, 10 (2023), 2143–2170. https://doi.org/10.1007/S00607-023-01177-7

    2023 doi

  41. [49]

    Daniël Vos and Sicco Verwer. 2021. Efficient Training of Robust Decision Trees Against Adversarial Examples. In Proceedings of the 38th International Conference on Machine Learning, ICML (Proceedings of Machine Learning Research, Vol. 139). PMLR, 10586–10595. http://proceeding...

    2021

  42. [50]

    Jiajing Wu, Qi Yuan, Dan Lin, Wei You, Weili Chen, Chuan Chen, and Zibin Zheng. 2022. Who Are the Phishers? Phishing Scam Detection on Ethereum via Network Embedding. IEEE Trans. Syst. Man Cybern. Syst. 52, 2 (2022), 1156–1166. https://doi.org/10.1109/TSMC.2020.3016821

    2022

  43. [51]

    Yuille, and Kaiming He

    Cihang Xie, Yuxin Wu, Laurens van der Maaten, Alan L. Yuille, and Kaiming He. 2019. Feature Denoising for Improving Adversarial Robustness. In IEEE Conference on Computer Vision and Pattern Recognition, CVPR . Computer Vision Foundation / IEEE, 501–509. https://doi.org/10.1109...

    2019

  44. [52]

    Jin Yang, Tao Li, Gang Liang, Yunpeng Wang, Tianyu Gao, and Fangdong Zhu. 2020. Spam transaction attack detection model based on GRU and WGAN-div. Comput. Commun. 161 (2020), 172–182. https://doi.org/10.1016/J.COMCOM. 2020.07.031

    2020 doi

  45. [53]

    Xikang Yang, Biyu Zhou, Xuehai Tang, Xiaodan Zhang, Jizhong Han, and Songlin Hu. 2023. Translets: Toward Explainable Phishing Fraud Detection in Ethereum. In IEEE International Conference on High Performance Computing & Communications, Data Science & Systems, Smart City & Depe...

    2023

  46. [54]

    Keting Yin and Binglong Ye. 2023. Phishing Scam Detection for Ethereum Based on Community Enhanced Graph Convolutional Networks. In Neural Information Processing - 30th International Conference, ICONIP (Communications in Computer and Information Science, Vol. 1965) . Springer,...

    2023 doi

  47. [55]

    Liangheng Zhang, Congmei Jiang, Zhaosen Chai, and Yu He. 2024. Adversarial attack and training for deep neural network based power quality disturbance classification. Eng. Appl. Artif. Intell. 127, Part A (2024), 107245. https: //doi.org/10.1016/J.ENGAPPAI.2023.107245

    2024

  48. [56]

    Francesco Zola, Jan Lukas Bruse, Xabier Etxeberria Barrio, Mikel Galar, and Raul Orduna Urrutia. 2020. Generative Adversarial Networks for Bitcoin Data Augmentation. In 2nd Conference on Blockchain Research & Applications for Innovative Networks and Services . IEEE, 136–143. h...

    2020

  49. [57]

    Bruse, Mikel Galar, and Raul Orduna Urrutia

    Francesco Zola, Lander Segurola-Gil, Jan L. Bruse, Mikel Galar, and Raul Orduna Urrutia. 2022. Attacking Bitcoin anonymity: generative adversarial networks for improving Bitcoin entity classification. Appl. Intell. 52, 15 (2022), 17289–17314. https://doi.org/10.1007/S10489-022...

    2022 doi

  50. [2014]

    In 2nd International Conference on Learning Representations, ICLR

    Intriguing properties of neural networks. In 2nd International Conference on Learning Representations, ICLR . , Vol. 1, No. 1, Article . Publication date: April 2025. 24 Ahod Alghuried, Ali Alkinoon, Abdulaziz Alghamdi, Soohyeon Choi, Manar Mohaisen, and David Mohaisen http://...

    2025 arXiv

  51. [2019]

    In 31st IEEE International Conference on Tools with Artificial Intelligence, ICTAI

    Fence GAN: Towards Better Anomaly Detection. In 31st IEEE International Conference on Tools with Artificial Intelligence, ICTAI. IEEE, 141–148. https://doi.org/10.1109/ICTAI.2019.00028

    2019

  52. [2021]

    In Proceedings of the Workshop on Artificial Intelligence Safety 2021 (SafeAI 2021) co-located with the Thirty-Fifth AAAI Conference on Artificial Intelligence (AAAI, Vol

    Adversarial Attacks for Tabular Data: Application to Fraud Detection and Imbalanced Data. In Proceedings of the Workshop on Artificial Intelligence Safety 2021 (SafeAI 2021) co-located with the Thirty-Fifth AAAI Conference on Artificial Intelligence (AAAI, Vol. 2808. CEUR-WS.o...

    2021

  53. [2024]

    Evaluation of performance enhancement in Ethereum fraud detection using oversampling techniques. Appl. Soft Comput. 161 (2024), 111698. https://doi.org/10.1016/J.ASOC.2024.111698

    2024

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.