Search papers, labs, and topics across Lattice.
This paper introduces FraudBench, a novel benchmarking framework that evaluates adversarial robustness in financial fraud and credit-risk detection by considering the impact of evaluation protocols on robustness conclusions. The authors demonstrate that different methods of enforcing domain-specific constraints and attacker capabilities lead to significantly varied assessments of model robustness, highlighting the protocol sensitivity of these evaluations. Key results reveal that while post-hoc feasibility filtering drastically reduces the number of feasible adversarial examples, integrated attack methods yield a much higher count, underscoring the importance of protocol choice in robustness assessments.
Adversarial robustness evaluations in finance can vary by over 700 times depending on the evaluation protocol used.
Machine learning models are widely used in financial fraud and credit-risk detection, yet their adversarial robustness remains difficult to evaluate because financial tabular data involve domain-specific constraints, severe class imbalance, and asymmetric attacker capability. We argue that, in this setting, robustness is not only an attribute of the model, but also an attribute of the evaluation protocol. Different ways of enforcing constraints and capability can lead to substantially different robustness conclusions. This paper presents FraudBench, a protocol-sensitive benchmark for adversarial robustness evaluation in financial fraud and credit-risk detection. Rather than treating domain constraints as post-hoc validity checks, FraudBench evaluates the same dataset--model--attack--defence setting under three matched protocols: unconstrained attacks, post-hoc feasibility filtering, and deployment-aware constraint-integrated attacks. FraudBench covers four public financial datasets, and evaluates neural, tree-based, and ensemble models using three attack settings. Our results show that robustness conclusions are highly protocol-sensitive. On Lending Club Loan Data under the white-box setting, post-hoc filtering leaves only 3.7 feasible-flipped examples on average, whereas in-attack projection with attacker mutability masking produces 2,832.3 feasible-flipped examples under the same perturbation budget. The results on IEEE-CIS further show that feasibility and attacker capability are separate axes, while black-box evaluation shows that protocol choice can alter model-family rankings. These findings suggest that fraud robustness evaluation should report predictive degradation and attack feasibility jointly, and should incorporate domain constraints into attack generation rather than treating them as post-processing checks.
