# Feature Importance Guided Attack: A Model Agnostic Adversarial Attack

arXiv: https://arxiv.org/abs/2106.14815 · HTML: https://mlsanity.com/paper/2106.14815/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- Builds on 16 of its 48 references that are in the map.
- First posted on arXiv 28 Jun 2021.

## Builds on (most cited first, 16 of 16)

- [XGBoost: A Scalable Tree Boosting System](https://mlsanity.com/paper/1603.02754/) (2016)
- [Evasion Attacks against Machine Learning at Test Time](https://mlsanity.com/paper/1708.06131/) (2017)
- [Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning](https://mlsanity.com/paper/1712.03141/) (2017)
- [Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning](https://mlsanity.com/paper/1702.07464/) (2017)
- [Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation](https://mlsanity.com/paper/1806.01156/) (2018)
- [Adversarial Attacks for Tabular Data: Application to Fraud Detection and Imbalanced Data](https://mlsanity.com/paper/2101.08030/) (2021)
- [Imperceptible Adversarial Attacks on Tabular Data](https://mlsanity.com/paper/1911.03274/) (2019)
- [Deep Neural Rejection against Adversarial Examples](https://mlsanity.com/paper/1910.00470/) (2019)
- [Adversarial Robustness with Non-uniform Perturbations](https://mlsanity.com/paper/2102.12002/) (2021)
- [Advanced Evasion Attacks and Mitigations on Practical ML-Based Phishing Website Classifiers](https://mlsanity.com/paper/2004.06954/) (2020)
- [PermuteAttack: Counterfactual Explanation of Machine Learning Credit Scorecards](https://mlsanity.com/paper/2008.10138/) (2020)
- [Not All Datasets Are Born Equal: On Heterogeneous Data and Adversarial Examples](https://mlsanity.com/paper/2010.03180/) (2020)
- [Robust Classification of Financial Risk](https://mlsanity.com/paper/1811.11079/) (2018)
- [High Accuracy Phishing Detection Based on Convolutional Neural Networks](https://mlsanity.com/paper/2004.03960/) (2020)
- [Know Your Phish: Novel Techniques for Detecting Phishing Sites and their Targets](https://mlsanity.com/paper/1510.06501/) (2015)
- [Potential adversarial samples for white-box attacks](https://mlsanity.com/paper/1912.06409/) (2019)

## Built on by (most cited first, 10 of 10)

- [Constrained Adaptive Attack: Effective Adversarial Attack Against Deep Neural Networks for Tabular Data](https://mlsanity.com/paper/2406.00775/) (2024)
- [Multi-SpacePhish: Extending the Evasion-space of Adversarial Attacks against Phishing Website Detectors using Machine Learning](https://mlsanity.com/paper/2210.13660/) (2022)
- [FitCF: A Framework for Automatic Feature Importance-guided Counterfactual Example Generation](https://mlsanity.com/paper/2501.00777/) (2025)
- [An Adversarial Attack Analysis on Malicious Advertisement URL Detection Framework](https://mlsanity.com/paper/2204.13172/) (2022)
- [Raze to the Ground: Query-Efficient Adversarial HTML Attacks on Machine-Learning Phishing Webpage Detectors](https://mlsanity.com/paper/2310.03166/) (2023)
- [Biathlon: Harnessing Model Resilience for Accelerating ML Inference Pipelines](https://mlsanity.com/paper/2405.11191/) (2024)
- [MISLEAD: Manipulating Importance of Selected features for Learning Epsilon in Evasion Attack Deception](https://mlsanity.com/paper/2404.15656/) (2024)
- [Crafting Imperceptible On-Manifold Adversarial Attacks for Tabular Data](https://mlsanity.com/paper/2507.10998/) (2025)
- [Backdoor Attacks on Transformers for Tabular Data: An Empirical Study](https://mlsanity.com/paper/2311.07550/) (2023)
- [Insights on Adversarial Attacks for Tabular Machine Learning via a Systematic Literature Review](https://mlsanity.com/paper/2506.15506/) (2025)

## Abstract (arXiv)

Research in adversarial learning has primarily focused on homogeneous unstructured datasets, which often map into the problem space naturally. Inverting a feature space attack on heterogeneous datasets into the problem space is much more challenging, particularly the task of finding the perturbation to perform. This work presents a formal search strategy: the `Feature Importance Guided Attack' (FIGA), which finds perturbations in the feature space of heterogeneous tabular datasets to produce evasion attacks. We first demonstrate FIGA in the feature space and then in the problem space. FIGA assumes no prior knowledge of the defending model's learning algorithm and does not require any gradient information. FIGA assumes knowledge of the feature representation and the mean feature values of defending model's dataset. FIGA leverages feature importance rankings by perturbing the most important features of the input in the direction of the target class. While FIGA is conceptually similar to other work which uses feature selection processes (e.g., mimicry attacks), we formalize an attack algorithm with three tunable parameters and investigate the strength of FIGA on tabular datasets. We demonstrate the effectiveness of FIGA by evading phishing detection models trained on four different tabular phishing datasets and one financial dataset with an average success rate of 94%. We extend FIGA to the phishing problem space by limiting the possible perturbations to be valid and feasible in the phishing domain. We generate valid adversarial phishing sites that are visually identical to their unperturbed counterpart and use them to attack six tabular ML models achieving a 13.05% average success rate.