# Adversarial Attacks on Deep Models for Financial Transaction Records

arXiv: https://arxiv.org/abs/2106.08361 · HTML: https://mlsanity.com/paper/2106.08361/

## Key facts

- Cited by 24 papers in the map (data through 14 Oct 2026).
- Builds on 22 of its 30 references that are in the map.
- First posted on arXiv 15 Jun 2021.

## Builds on (most cited first, 22 of 22)

- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [BERTScore: Evaluating Text Generation with BERT](https://mlsanity.com/paper/1904.09675/) (2019)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Adversarial examples in the physical world](https://mlsanity.com/paper/1607.02533/) (2016)
- [BERT-ATTACK: Adversarial Attack Against BERT Using BERT](https://mlsanity.com/paper/2004.09984/) (2020)
- [Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey](https://mlsanity.com/paper/1801.00553/) (2018)
- [Adversarial Examples: Attacks and Defenses for Deep Learning](https://mlsanity.com/paper/1712.07107/) (2017)
- [Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifiers](https://mlsanity.com/paper/1801.04354/) (2018)
- [Adversarial Attacks and Defences: A Survey](https://mlsanity.com/paper/1810.00069/) (2018)
- [Detecting Adversarial Samples from Artifacts](https://mlsanity.com/paper/1703.00410/) (2017)
- [Adversarial Attacks and Defenses in Images, Graphs and Text: A Review](https://mlsanity.com/paper/1909.08072/) (2019)
- [On Detecting Adversarial Perturbations](https://mlsanity.com/paper/1702.04267/) (2017)
- [Adversarial Attack and Defense on Graph Data: A Survey](https://mlsanity.com/paper/1812.10528/) (2018)
- [Deep Text Classification Can be Fooled](https://mlsanity.com/paper/1704.08006/) (2017)
- [Crafting Adversarial Input Sequences for Recurrent Neural Networks](https://mlsanity.com/paper/1604.08275/) (2016)
- [Learning with a Strong Adversary](https://mlsanity.com/paper/1511.03034/) (2015)
- [Art of singular vectors and universal adversarial perturbations](https://mlsanity.com/paper/1709.03582/) (2017)
- [E.T.-RNN: Applying Deep Learning to Credit Loan Applications](https://mlsanity.com/paper/1911.02496/) (2019)
- [Gradient-based adversarial attacks on categorical sequence models via traversing an embedded world](https://mlsanity.com/paper/2003.04173/) (2020)
- [Differentiable Language Model Adversarial Attacks on Categorical Sequence Classifiers](https://mlsanity.com/paper/2006.11078/) (2020)

## Built on by (most cited first, 24 of 24)

- [How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defenses](https://mlsanity.com/paper/2305.10862/) (2023)
- [One Transformer for All Time Series: Representing and Training with Time-Dependent Heterogeneous Tabular Data](https://mlsanity.com/paper/2302.06375/) (2023)
- [When and How to Fool Explainable Models (and Humans) with Adversarial Examples](https://mlsanity.com/paper/2107.01943/) (2021)
- [Spear and Shield: Adversarial Attacks and Defense Methods for Model-Based Link Prediction on Continuous-Time Dynamic Graphs](https://mlsanity.com/paper/2308.10779/) (2023)
- [Assessing Robustness via Score-Based Adversarial Image Generation](https://mlsanity.com/paper/2310.04285/) (2023)
- [MLEM: Generative and Contrastive Learning as Distinct Modalities for Event Sequences](https://mlsanity.com/paper/2401.15935/) (2024)
- [Out-of-Distribution Data: An Acquaintance of Adversarial Examples -- A Survey](https://mlsanity.com/paper/2404.05219/) (2024)
- [Adversarial Attacks and Defenses in Machine Learning-Powered Networks: A Contemporary Survey](https://mlsanity.com/paper/2303.06302/) (2023)
- [Diffusion Transformers for Tabular Data Time Series Generation](https://mlsanity.com/paper/2504.07566/) (2025)
- [Robust Graph Neural Networks using Weighted Graph Laplacian](https://mlsanity.com/paper/2208.01853/) (2022)
- [No Query, No Access](https://mlsanity.com/paper/2505.07258/) (2025)
- [Bank transactions embeddings help to uncover current macroeconomics](https://mlsanity.com/paper/2110.12000/) (2021)
- [Adversarial Attacks and Defenses in Multivariate Time-Series Forecasting for Smart and Connected Infrastructures](https://mlsanity.com/paper/2408.14875/) (2024)
- [Evaluation of Neural Networks Defenses and Attacks using NDCG and Reciprocal Rank Metrics](https://mlsanity.com/paper/2201.05071/) (2022)
- [Enhancing Adversarial Attacks via Parameter Adaptive Adversarial Attack](https://mlsanity.com/paper/2408.07733/) (2024)
- [Uniting contrastive and generative learning for event sequences models](https://mlsanity.com/paper/2408.09995/) (2024)
- [Hiding Backdoors within Event Sequence Data via Poisoning Attacks](https://mlsanity.com/paper/2308.10201/) (2023)
- [Simple Perturbations Subvert Ethereum Phishing Transactions Detection: An Empirical Analysis](https://mlsanity.com/paper/2408.03441/) (2024)
- [Catastrophic Overfitting, Entropy Gap and Participation Ratio: A Noiseless lp Norm Solution for Fast Adversarial Training](https://mlsanity.com/paper/2505.02360/) (2025)
- [Designing an attack-defense game: how to increase robustness of financial transaction models via a competition](https://mlsanity.com/paper/2308.11406/) (2023)
- [Self-Attention Mechanism in Multimodal Context for Banking Transaction Flow](https://mlsanity.com/paper/2410.08243/) (2024)
- [Looking around you: external information enhances representations for event sequences](https://mlsanity.com/paper/2502.10205/) (2025)
- [Creating a Causally Grounded Rating Method for Assessing the Robustness of AI Models for Time-Series Forecasting](https://mlsanity.com/paper/2502.12226/) (2025)
- [Leveraging Vulnerabilities in Temporal Graph Neural Networks via Strategic High-Impact Assaults](https://mlsanity.com/paper/2509.25418/) (2025)

## Abstract (arXiv)

Machine learning models using transaction records as inputs are popular among financial institutions. The most efficient models use deep-learning architectures similar to those in the NLP community, posing a challenge due to their tremendous number of parameters and limited robustness. In particular, deep-learning models are vulnerable to adversarial attacks: a little change in the input harms the model's output. In this work, we examine adversarial attacks on transaction records data and defences from these attacks. The transaction records data have a different structure than the canonical NLP or time series data, as neighbouring records are less connected than words in sentences, and each record consists of both discrete merchant code and continuous transaction amount. We consider a black-box attack scenario, where the attack doesn't know the true decision model, and pay special attention to adding transaction tokens to the end of a sequence. These limitations provide more realistic scenario, previously unexplored in NLP world. The proposed adversarial attacks and the respective defences demonstrate remarkable performance using relevant datasets from the financial industry. Our results show that a couple of generated transactions are sufficient to fool a deep-learning model. Further, we improve model robustness via adversarial training or separate adversarial examples detection. This work shows that embedding protection from adversarial attacks improves model robustness, allowing a wider adoption of deep models for transaction records in banking and finance.