# Adversarial Robustness of Traffic Classification under Resource Constraints: Input Structure Matters

arXiv: https://arxiv.org/abs/2512.02276 · HTML: https://mlsanity.com/paper/2512.02276/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 10 of its 30 references that are in the map.
- First posted on arXiv 1 Dec 2025.

## Builds on (most cited first, 10 of 10)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Adversarial Robustness Toolbox v1.0.0](https://mlsanity.com/paper/1807.01069/) (2018)
- [Neural Architecture Search: Insights from 1000 Papers](https://mlsanity.com/paper/2301.08727/) (2023)
- [Adversarial Network Traffic: Towards Evaluating the Robustness of Deep Learning-Based Network Traffic Classification](https://mlsanity.com/paper/2003.01261/) (2020)
- [Untargeted White-box Adversarial Attack with Heuristic Defence Methods in Real-time Deep Learning based Network Intrusion Detection System](https://mlsanity.com/paper/2310.03334/) (2023)
- [Tiny Neural Networks for Session-Level Traffic Classification](https://mlsanity.com/paper/2504.04008/) (2025)
- [Evaluating Resilience of Encrypted Traffic Classification Against Adversarial Evasion Attacks](https://mlsanity.com/paper/2105.14564/) (2021)
- [Energy-Efficient Deep Learning for Traffic Classification on Microcontrollers](https://mlsanity.com/paper/2506.10851/) (2025)
- [Hardware-Aware Neural Architecture Search for Encrypted Traffic Classification on Resource-Constrained Devices](https://mlsanity.com/paper/2506.11319/) (2025)

## Abstract (arXiv)

Traffic classification (TC) plays a critical role in cybersecurity, particularly in IoT and embedded contexts, where inspection must often occur locally under tight hardware constraints. We use hardware-aware neural architecture search (HW-NAS) to derive lightweight TC models that are accurate, efficient, and deployable on edge platforms. Two input formats are considered: a flattened byte sequence and a 2D packet-wise time series; we examine how input structure affects adversarial vulnerability when using resource-constrained models. Robustness is assessed against white-box attacks, specifically Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD). On USTC-TFC2016, both HW-NAS models achieve over 99% clean-data accuracy while remaining within 65k parameters and 2M FLOPs. Yet under perturbations of strength 0.1, their robustness diverges: the flat model retains over 85% accuracy, while the time-series variant drops below 35%. Adversarial fine-tuning delivers robust gains, with flat-input accuracy exceeding 96% and the time-series variant recovering over 60 percentage points in robustness, all without compromising efficiency. The results underscore how input structure influences adversarial vulnerability, and show that even compact, resource-efficient models can attain strong robustness, supporting their practical deployment in secure edge-based TC.