Generating Realistic Adversarial Examples for Business Processes using Variational Autoencoders
This work addresses adversarial vulnerability in business process monitoring, offering a domain-agnostic approach to enhance security, though it is incremental as it adapts existing adversarial attack concepts to a specific domain.
The paper tackles the problem of generating realistic adversarial examples for predictive process monitoring, where minor input perturbations can cause incorrect predictions, by introducing two novel latent space attacks that add noise to latent representations, and evaluates them against other methods on real-life event logs and predictive models, showing improved performance in generating plausible adversaries.
In predictive process monitoring, predictive models are vulnerable to adversarial attacks, where input perturbations can lead to incorrect predictions. Unlike in computer vision, where these perturbations are designed to be imperceptible to the human eye, the generation of adversarial examples in predictive process monitoring poses unique challenges. Minor changes to the activity sequences can create improbable or even impossible scenarios to occur due to underlying constraints such as regulatory rules or process constraints. To address this, we focus on generating realistic adversarial examples tailored to the business process context, in contrast to the imperceptible, pixel-level changes commonly seen in computer vision adversarial attacks. This paper introduces two novel latent space attacks, which generate adversaries by adding noise to the latent space representation of the input data, rather than directly modifying the input attributes. These latent space methods are domain-agnostic and do not rely on process-specific knowledge, as we restrict the generation of adversarial examples to the learned class-specific data distributions by directly perturbing the latent space representation of the business process executions. We evaluate these two latent space methods with six other adversarial attacking methods on eleven real-life event logs and four predictive models. The first three attacking methods directly permute the activities of the historically observed business process executions. The fourth method constrains the adversarial examples to lie within the same data distribution as the original instances, by projecting the adversarial examples to the original data distribution.