mlsanityData to 7 Oct 2026

Beyond Gradient-Based Attacks: Adversarial Robustness and Explainability Stability in Cybersecurity Classifiers

arXiv 2607.01679 ↗First posted 2 Jul 2026cs.CR cs.AI cs.LGcited by 0

Not on the map. Why?

Abstract (arXiv)

Adversarial attacks on cybersecurity classifiers pose a dual threat: degrading predictions and destabilising the SHAP-based explanations that security analysts rely on to understand and triage alerts. We extend our prior MLP conference study to Random Forest and XGBoost across four tabular security datasets (phishing URLs, UNSW-NB15, NF-ToN-IoT, HIKARI-2021), evaluating five attacks including three black-box methods applicable to non-differentiable tree models. We introduce the Explainability Stability Index (ESI), a scalar metric computed from TreeSHAP attribution drift under adversarial perturbation, reported on the same [0,1] scale as the Robustness Index (RI). A key finding is that gradient-based black-box attacks (ZOO) produce degenerate results against XGBoost (apparent RI ~0.98) due to piecewise-constant prediction surfaces, while score-based Square Attack reveals genuine vulnerability (RI ~0.36). These degenerate perturbations still drive substantial attribution drift: XGBoost ESI ~0.06-0.16 despite near-perfect ZOO robustness, versus 0.14-0.29 for RF, showing that prediction robustness and explanation stability are distinct axes requiring joint measurement. A two-axis framework (gradient dependence, query efficiency) explains the observed attack ranking and yields practical guidance for tree ensemble evaluation. A step-size ablation explains a counterintuitive PGD anomaly on z-score normalised tabular data.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 22 of its 28 references that are in the map. First posted on arXiv 2 Jul 2026.

Builds on

22 of 28 references.

References · 22

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2017A Unified Approach to Interpreting Model Predictionscited by 6,488
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2016"Why Should I Trust You?": Explaining the Predictions of Any Classifiercited by 5,040
  5. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  6. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  7. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  8. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  9. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  10. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  11. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  12. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
10 more
  1. 2019Fooling LIME and SHAP: Adversarial Attacks on Post hoc Explanation Methodscited by 440
  2. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
  3. 2018On the Robustness of Interpretability Methodscited by 310
  4. 2022OpenXAI: Towards a Transparent Evaluation of Model Explanationscited by 125
  5. 2015Analysis of classifiers' robustness to adversarial perturbationscited by 76
  6. 2020NetFlow Datasets for Machine Learning-based Network Intrusion Detection Systemscited by 45
  7. 2016Adversarial Perturbations Against Deep Neural Networks for Malware Classificationcited by 42
  8. 2021Modeling Realistic Adversarial Attacks against Network Intrusion Detection Systemscited by 39
  9. 2019Evaluating Explanation Methods for Deep Learning in Securitycited by 38
  10. 2026Empirical Analysis of Adversarial Robustness and Explainability Drift in Cybersecurity Classifierscited by 1

Built on by

Not cited yet.