# Evasion Attacks on Cost-Utility-Based Adversarial Training for Online AutoML in IoT Networks

arXiv: https://arxiv.org/abs/2609.31981 · HTML: https://mlsanity.com/paper/2609.31981/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 9 of its 19 references that are in the map.
- First posted on arXiv 25 Sep 2026.

## Builds on (most cited first, 9 of 9)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Adversarial Examples Are Not Bugs, They Are Features](https://mlsanity.com/paper/1905.02175/) (2019)
- [IoT Data Analytics in Dynamic Environments: From An Automated Machine Learning Perspective](https://mlsanity.com/paper/2209.08018/) (2022)
- [Adversarial Robustness for Tabular Data through Cost and Utility Awareness](https://mlsanity.com/paper/2208.13058/) (2022)
- [Enabling AutoML for Zero-Touch Network Security: Use-Case Driven Analysis](https://mlsanity.com/paper/2502.21286/) (2025)
- [Making targeted black-box evasion attacks effective and efficient](https://mlsanity.com/paper/1906.03397/) (2019)
- [Amoeba: Circumventing ML-supported Network Censorship via Adversarial Reinforcement Learning](https://mlsanity.com/paper/2310.20469/) (2023)
- [Online Evasion Attacks on Recurrent Models:The Power of Hallucinating the Future](https://mlsanity.com/paper/2207.09912/) (2022)

## Abstract (arXiv)

As Internet of Things (IoT) networks increasingly depend on machine learning for anomaly, malware, intrusion detection, and network monitoring, such systems have become attractive targets for evasion attacks. Evasion attacks pose a major security risk because an adversary intentionally modifies input data to mislead a trained model into producing incorrect predictions while evading detection. This study evaluates the impact of black-box evasion attacks on a cost-utility-based adversarial training defense strategy in an Online AutoML context for IoT networks. Specifically, evasion attacks were applied to online learners, including Hoeffding Tree (HT), Leveraging Bagging (LB), Streaming Random Patches (SRP), Hoeffding Adaptive Tree (HAT), and Adaptive Random Forest (ARF). By developing naive and adversarially trained (AT) versions of these online learners, we generated clean and adversarial accuracies for each model. The results show that the AT versions of LB and SRP performed best, achieving the highest adversarial accuracy (0.985) and high clean accuracy (0.993) at the highest cost budget of 1.00, with a maximum accuracy reduction of only 0.8%. Finally, drift detection was conducted using the Early Drift Detection Method (EDDM).