# FENCE: Feasible Evasion Attacks on Neural Networks in Constrained Environments

arXiv: https://arxiv.org/abs/1909.10480 · HTML: https://mlsanity.com/paper/1909.10480/

## Key facts

- Cited by 23 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 23 Sep 2019.

## Built on by (most cited first, 23 of 23)

- [A Unified Framework for Adversarial Attack and Defense in Constrained Feature Space](https://mlsanity.com/paper/2112.01156/) (2021)
- [On The Empirical Effectiveness of Unrealistic Adversarial Hardening Against Realistic Adversarial Attacks](https://mlsanity.com/paper/2202.03277/) (2022)
- [A Survey on Deep Learning Approaches for Tabular Data Generation: Utility, Alignment, Fidelity, Privacy, Diversity, and Beyond](https://mlsanity.com/paper/2503.05954/) (2025)
- [Constrained Adaptive Attack: Effective Adversarial Attack Against Deep Neural Networks for Tabular Data](https://mlsanity.com/paper/2406.00775/) (2024)
- [TabularBench: Benchmarking Adversarial Robustness for Tabular Deep Learning in Real-world Use-cases](https://mlsanity.com/paper/2408.07579/) (2024)
- [Constrained Adversarial Learning for Automated Software Testing: a literature review](https://mlsanity.com/paper/2303.07546/) (2023)
- [Deep PackGen: A Deep Reinforcement Learning Framework for Adversarial Network Packet Generation](https://mlsanity.com/paper/2305.11039/) (2023)
- [Investigating Imperceptibility of Adversarial Attacks on Tabular Data: An Empirical Analysis](https://mlsanity.com/paper/2407.11463/) (2024)
- [TabAttackBench: A Benchmark for Adversarial Attacks on Tabular Data](https://mlsanity.com/paper/2505.21027/) (2025)
- [Fixed Points in Cyber Space: Rethinking Optimal Evasion Attacks in the Age of AI-NIDS](https://mlsanity.com/paper/2111.12197/) (2021)
- [Poisoning Network Flow Classifiers](https://mlsanity.com/paper/2306.01655/) (2023)
- [On the Robustness of Tabular Foundation Models: Test-Time Attacks and In-Context Defenses](https://mlsanity.com/paper/2506.02978/) (2025)
- [Level Up with ML Vulnerability Identification: Leveraging Domain Constraints in Feature Space for Robust Android Malware Detection](https://mlsanity.com/paper/2205.15128/) (2022)
- [A Mutation-based Text Generation for Adversarial Machine Learning Applications](https://mlsanity.com/paper/2212.11808/) (2022)
- [Constrained Adaptive Attacks: Realistic Evaluation of Adversarial Examples and Robust Training of Deep Neural Networks for Tabular Data](https://mlsanity.com/paper/2311.04503/) (2023)
- [Crafting Imperceptible On-Manifold Adversarial Attacks for Tabular Data](https://mlsanity.com/paper/2507.10998/) (2025)
- [Learning Location from Shared Elevation Profiles in Fitness Apps: A Privacy Perspective](https://mlsanity.com/paper/2210.15529/) (2022)
- [Problem space structural adversarial attacks for Network Intrusion Detection Systems based on Graph Neural Networks](https://mlsanity.com/paper/2403.11830/) (2024)
- [Model-agnostic clean-label backdoor mitigation in cybersecurity environments](https://mlsanity.com/paper/2407.08159/) (2024)
- [Improving Adversarial Robustness in Android Malware Detection by Reducing the Impact of Spurious Correlations](https://mlsanity.com/paper/2408.16025/) (2024)
- [Insights on Adversarial Attacks for Tabular Machine Learning via a Systematic Literature Review](https://mlsanity.com/paper/2506.15506/) (2025)
- [CITADEL: CSI-Based Jamming Detection and Open-Set Classification for IIoT Networks](https://mlsanity.com/paper/2606.22939/) (2026)
- [FraudBench: Protocol-Sensitive Benchmarking of Adversarial Robustness for Financial Risk Assessment](https://mlsanity.com/paper/2608.24551/) (2026)

## Abstract (arXiv)

As advances in Deep Neural Networks (DNNs) demonstrate unprecedented levels of performance in many critical applications, their vulnerability to attacks is still an open question. We consider evasion attacks at testing time against Deep Learning in constrained environments, in which dependencies between features need to be satisfied. These situations may arise naturally in tabular data or may be the result of feature engineering in specific application domains, such as threat detection in cyber security. We propose a general iterative gradient-based framework called FENCE for crafting evasion attacks that take into consideration the specifics of constrained domains and application requirements. We apply it against Feed-Forward Neural Networks trained for two cyber security applications: network traffic botnet classification and malicious domain classification, to generate feasible adversarial examples. We extensively evaluate the success rate and performance of our attacks, compare their improvement over several baselines, and analyze factors that impact the attack success rate, including the optimization objective and the data imbalance. We show that with minimal effort (e.g., generating 12 additional network connections), an attacker can change the model's prediction from the Malicious class to Benign and evade the classifier. We show that models trained on datasets with higher imbalance are more vulnerable to our FENCE attacks. Finally, we demonstrate the potential of performing adversarial training in constrained domains to increase the model resilience against these evasion attacks.