Adversarial Detection

Detects adversarial examples by measuring distributional shifts between incoming samples and the clean training manifold. Techniques compare activation statistics, kernel density estimates, or Maximum Mean Discrepancy (MMD) scores against baseline distributions.

• Flags inputs that fall in low-probability regions of the data manifold
• Effective against gradient-based perturbations that push samples off the natural data distribution
• Computationally lightweight, suitable for real-time transaction scoring pipelines

Reduces the degrees of freedom available to an adversary by squeezing or compressing input features before classification. Compares model predictions on original versus squeezed inputs; significant divergence indicates an adversarial sample.

• Common squeezers: bit-depth reduction, spatial smoothing, non-local means filtering
• Exploits the fact that adversarial perturbations are fragile to information compression
• Minimal impact on legitimate transaction feature vectors while exposing crafted noise

Attaches a dedicated binary classifier head to intermediate layers of the main fraud model, trained specifically to discriminate clean inputs from adversarial examples. This detector operates in the model's internal representation space.

• Trained jointly or post-hoc using layer-wise activation signatures
• Captures subtle anomalies in feature hierarchies that perturbations introduce
• Can be optimized independently without degrading primary fraud classification accuracy

Measures the Local Intrinsic Dimensionality (LID) of input representations to identify adversarial samples. Adversarial examples typically reside in higher-dimensional subspaces than natural data points within the same local neighborhood.

• Computes the rate of growth in the number of neighbors as distance increases
• Leverages the observation that adversarial subspaces have expanded dimensionality
• Robust across diverse attack algorithms without requiring attack-specific training

Evaluates the stability of model outputs under controlled input transformations. A legitimate transaction yields consistent predictions across augmented views, while adversarial examples exhibit brittle, inconsistent responses.

• Applies stochastic transformations: randomized cropping, Gaussian noise injection, dropout at inference
• Flags samples where prediction variance exceeds calibrated thresholds
• Aligns with randomized smoothing principles for certified detection guarantees

Uses an autoencoder or variational autoencoder trained exclusively on clean transaction data. Adversarial inputs produce anomalously high reconstruction errors because the decoder has never learned to represent perturbation patterns.

• Computes Mean Squared Error (MSE) between input and reconstructed output
• Effective against both white-box and black-box evasion attacks
• Can be deployed as a lightweight pre-screening layer before the main fraud classifier

A carefully crafted, often imperceptible modification to an input sample designed to cause a machine learning model to misclassify it. In financial fraud contexts, perturbations might involve subtly altering transaction amounts, timestamps, or merchant categories to evade detection while preserving the fraudulent transaction's functionality. Perturbation budgets are typically constrained by Lp-norms (e.g., L∞ ≤ 8/255 for image data), but for tabular transaction data, constraints are domain-specific.

• L0 attacks modify few features but with large magnitude
• L2 attacks spread small changes across many features
• L∞ attacks bound the maximum per-feature change
• Financial models face feature-space constraints unique to each data schema

An attack type where an adversary modifies a malicious sample at inference time to bypass a detection model without altering the model's internal parameters. In fraud detection, this manifests as criminals iteratively testing transaction patterns against a live scoring API to discover blind spots. Unlike poisoning attacks, evasion leaves the model intact but exploits its decision boundaries.

• Query-based evasion: Attacker probes the model with modified transactions
• Gradient-based evasion: Attacker uses white-box access to craft optimal perturbations
• Hard-label attacks: Attacker only sees binary accept/reject decisions
• Real-world example: Fraudsters adjusting transaction velocity patterns to stay below risk thresholds

A defensive technique that augments the training dataset with adversarial examples to improve a model's robustness against evasion attacks. During each training iteration, the model generates worst-case perturbations against itself and learns to classify them correctly. This creates smoother decision boundaries that are harder to exploit.

• Madry et al. formulation: Min-max optimization over perturbation ball
• Free adversarial training: Reuses gradients from backward pass to reduce compute cost
• TRADES loss: Balances natural accuracy with robustness via KL divergence regularization
• Trade-off: Typically reduces clean-data accuracy by 2-5% while dramatically improving robustness

A defensive phenomenon where a model's gradients are useless for generating attacks, often providing a false sense of security against adaptive adversaries. This occurs when defenses introduce non-differentiable operations, randomized transformations, or numerical instability that obscure true gradients. Critically, gradient masking does not indicate genuine robustness.

• Shattered gradients: Non-differentiable preprocessing causes gradient breakage
• Stochastic gradients: Randomization prevents reliable gradient estimation
• Exploding/vanishing gradients: Numerical instability from deep architectures
• Adaptive attacks that circumvent gradient masking remain the gold standard for evaluation

A white-box attack methodology specifically designed with full knowledge of a defense mechanism to circumvent it, serving as the gold standard for robustness evaluation. If a defense relies on obfuscated gradients, an adaptive attack replaces non-differentiable components with differentiable approximations. No defense can be considered validated until it withstands a properly designed adaptive attack.

• Backward pass differentiable approximation (BPDA): Replaces non-differentiable layers
• Expectation over Transformation (EOT): Averages gradients over randomized defenses
• AutoAttack: Standardized ensemble of parameter-free adaptive attacks
• Carlini & Wagner: Foundational adaptive attack methodology for L0, L2, L∞ norms

A formal, mathematical guarantee that a model's prediction will remain constant for any input perturbation within a defined radius. Unlike empirical defenses that can be broken by stronger attacks, certified methods provide provable lower bounds on robustness. Randomized smoothing is the most scalable approach, constructing a smoothed classifier by adding Gaussian noise and using statistical hypothesis testing.

• Deterministic certification: Bound propagation through network layers (e.g., CROWN, IBP)
• Probabilistic certification: Randomized smoothing with Monte Carlo sampling
• Certified radius: Maximum perturbation size guaranteed to not change prediction
• Limitation: Certification radii are typically smaller than what empirical methods achieve