Constrained Adversarial Perturbation
This work addresses the limitation of unrealistic adversarial examples in constrained feature spaces, which is crucial for real-world applications in domains like finance and cyber-physical systems, though it is incremental by extending UAP methods to incorporate constraints.
The paper tackles the problem of generating universal adversarial perturbations (UAPs) that respect domain-specific constraints, such as debt-to-income ratios in finance, to make attacks more plausible and applicable. It introduces Constrained Adversarial Perturbation (CAP), an algorithm that achieves higher attack success rates and significantly reduces runtime compared to existing baselines across domains like finance and IT networks.
Deep neural networks have achieved remarkable success in a wide range of classification tasks. However, they remain highly susceptible to adversarial examples - inputs that are subtly perturbed to induce misclassification while appearing unchanged to humans. Among various attack strategies, Universal Adversarial Perturbations (UAPs) have emerged as a powerful tool for both stress testing model robustness and facilitating scalable adversarial training. Despite their effectiveness, most existing UAP methods neglect domain specific constraints that govern feature relationships. Violating such constraints, such as debt to income ratios in credit scoring or packet flow invariants in network communication, can render adversarial examples implausible or easily detectable, thereby limiting their real world applicability. In this work, we advance universal adversarial attacks to constrained feature spaces by formulating an augmented Lagrangian based min max optimization problem that enforces multiple, potentially complex constraints of varying importance. We propose Constrained Adversarial Perturbation (CAP), an efficient algorithm that solves this problem using a gradient based alternating optimization strategy. We evaluate CAP across diverse domains including finance, IT networks, and cyber physical systems, and demonstrate that it achieves higher attack success rates while significantly reducing runtime compared to existing baselines. Our approach also generalizes seamlessly to individual adversarial perturbations, where we observe similar strong performance gains. Finally, we introduce a principled procedure for learning feature constraints directly from data, enabling broad applicability across domains with structured input spaces.