White-Box and Transfer-Based Black-Box Adversarial Attacks on Neural Network Models for Credit Card Fraud Detection

Abstract

Machine learning models deployed for credit card fraud detection operate in adversarial, security-critical settings, and their robustness against evasion attacks directly affects financial and operational risk. However, despite extensive work on models for credit card fraud detection, comparatively fewer studies have examined their adversarial vulnerability. This study proposes a targeted Projected Gradient Descent-based attack on feedforward neural network models for credit card fraud detection. The attack is evaluated in white-box and black-box settings, illustrating the extent to which adversarial vectors generated on a surrogate attack model may be transferred to a set of victim models. The experimental settings are designed to ensure a fair, mixed-feature attack, including introduction of perturbation bound constraints, preservation of the class imbalance, specification of attack success criteria, selection of victim models, and avoiding bias. The obtained adversarial transaction vectors are evaluated in terms of their effect on model predictions and their mathematical proximity to the corresponding original fraudulent vectors. Finally, the evaluation results and limitations of the scope of the study are discussed.

1. Introduction

Deep neural networks are increasingly being applied in financial systems for tasks such as credit card fraud detection, transaction risk assessment, and anomaly detection. Their ability to model nonlinear relationships in high-dimensional transactional data has led to improved predictive performance compared to traditional approaches [1]. At the same time, the use of such models in security-sensitive financial environments necessitates careful consideration of their robustness to adversarial attacks.

In the context of neural networks, evasion adversarial attacks are typically designed to introduce small, structured perturbations to input data with the goal of maliclously influencing model predictions while preserving similarity to the original inputs. Among the existing methods, the Projected Gradient Descent (PGD) algorithm is widely acknowledged as a strong first-order adversarial attack [2]. While PGD-based attacks have been extensively analyzed in domains such as image classification, their application to models for financial data analysis has received comparatively less attention.

Financial transaction datasets differ from commonly studied benchmarks in several important aspects. Such data are typically tabular, constrained by semantic and operational rules, and characterized by strong class imbalance. Consequently, adversarial perturbations in this domain must be evaluated not only in terms of their impact on model predictions, but also with respect to their proximity to other legitimate and fraudulent transactions.

This study makes the following contributions:

• It proposes a targeted PGD-based attack on a feedforward neural network model for credit card fraud detection.
• It evaluates the proposed attack in white-box settings.
• It evaluates the proposed attack in black-box settings and illustrates the extent to which adversarial vectors generated on a surrogate attack model may be transferred to a set of victim models.

In both white-box and black-box settings, the adversarial vectors are evaluated in terms of their effect on model predictions and their mathematical proximity to the corresponding original fraudulent vectors.

The remainder of this paper is organized as follows. Section 2 gives a brief overview of background and related work on adversarial attacks against neural networks in financial applications. Section 3 describes the underlying datasets, the baseline neural network model for credit card fraud detection, and the PGD-based evasion attack. Section 4 and Section 5 report on the evaluation of the proposed attack in white-box and black-box settings, respectively. Section 6 discusses the obtained results, the experimental settings, and the limitations of the scope of the study. Section 7 concludes the paper.

2. Related Work

Adversarial attacks on neural networks were first introduced in the context of high-dimensional image processing tasks by applying small gradient-based perturbations to input samples to cause misclassification [3]. In line with that, first-order adversaries such as Projected Gradient Descent were proposed in [2], and a generator network-based approach to synthesizing adversarial samples was reported in [4].

In recent years, an increasing number of studies have examined the influence of adversarial attacks on neural network-based classification models [5,6,7,8,9,10].

Computer vision and image classification are among the most comprehensively studied domains in the context of adversarial attacks and corresponding defence mechanisms [11,12,13,14]. Within these areas, numerous application-specific studies have demonstrated vulnerabilities to such attacks, including medical image analysis [15] and object detection systems [16].

Beyond computer vision and image classification, adversarial attack research has been expanding to a variety of different data types. Studies have investigated vulnerabilities in models trained on textual data [17], as well as in neural network architectures designed for audio processing [18]. Furthermore, adversarial threats have also been examined in the context of IoT and cyber–physical systems, where neural network-based solutions are widely employed [19,20,21,22].

In the domain of tabular machine learning models, systematic benchmarks have been proposed to evaluate adversarial attacks across multiple tabular datasets and model types, demonstrating the sensitivity of structured data models to carefully crafted perturbations [23,24,25,26]. Model-agnostic attack approaches that leverage feature importance to generate perturbations in tabular classification tasks without requiring gradient access were introduced in [27] and evaluated on several tabular benchmarks, including phishing and financial datasets.

Classical machine learning and deep learning approaches have attracted research attention for the credit card fraud detection task [28,29,30,31,32,33,34,35,36]. Recent studies explored more advanced deep learning techniques for transaction fraud detection. In [37], a continuous-coupled neural network architecture tailored for credit card fraud detection was employed. In [33], deep learning techniques such as convolutional neural networks and recurrent neural networks, including the LSTM and GRU variants, were reviewed in the context of credit card fraud detection tasks, highlighting their ability to capture complex patterns and temporal dependencies in large transactional datasets.

However, despite extensive work on models for credit card fraud detection, comparatively fewer studies have examined their adversarial vulnerability; e.g., transferable adversarial attacks on machine learning models for credit card fraud detection were investigated in [38], including gradient-based attacks in both white-box and black-box scenarios. Adversarial manipulations have also been considered in the context of algorithmic trading systems, where input perturbations are shown to mislead automated trading models under real-world conditions [39].

Adversarial attacks in black-box settings represent a particularly relevant threat model for machine learning systems implemented under real-world conditions, since the attacker does not have direct access to the architecture, parameters, or gradients of the target model. These attacks are most often divided into query-based approaches, which use outputs obtained by repeatedly sending queries to the target model, and portability-based approaches, which generate adversarial samples using one or more surrogate models and rely on the possibility of their transfer to previously unknown target models. A comprehensive benchmark covering both these categories is presented in [40], where a unified evaluation of 29 query-based methods and 30 portability-based methods is performed on different datasets, model architectures, attack settings, and defense mechanisms. To improve the efficiency of query-based attacks, the approach proposed in [41] combines the information obtained by querying a target model with transferability-based prior knowledge derived from the gradient of a surrogate model. It has been shown that the obtained algorithms, without direct access to gradients and guided by prior knowledge, reduce the number of required queries, while maintaining a high attack success rate.

Portability-based attacks are particularly significant under restrictive black-box conditions, as they can be executed without directly querying a target model. In [42], the portability of ensemble-based adversarial attacks is analyzed through the flatness of the loss function surface and the proximity of a generated adversarial sample to the local optima of multiple surrogate models. Based on these properties, the Common Weakness Attack method is proposed, which aims to generate adversarial samples with improved transferability between models for image classification and object detection. More recent research has extended transfer-based black-box attacks to large base and multimodal models. The Chain of Attack method, presented in [43], uses a series of intermediate steps based on multimodal semantic changes to improve the target transferability of adversarial samples to models that combine visual and linguistic information, without the need for knowledge of the target model. Similarly, the UMI-GRAT method presented in [44] demonstrated that adversarial samples generated solely by the publicly available Segment Anything Model can be transferred to its subsequently fine-tuned models, even when the target task and the training dataset remain unknown. These results show that portability between models can enable effective attacks even under conditions of very limited access and highlight the importance of evaluating the robustness of neural networks in realistic black-box scenarios.

All those studies considering the adversarial vulnerability of different machine learning models primarily focus on attack success rates, robustness degradation, or cross-model generalization under adversarial conditions. In contrast to them, this work adopts a somewhat complementary perspective by focusing on a statistical characterization of successful evasive perturbations within a given feature space. Rather than prioritizing transferability of adversarial samples or large-scale robustness benchmarking, the reported analysis investigates the local proximity between adversarial and original transaction vectors within the underlying dataset distribution.

3. Materials and Methods

This section describes datasets underlying this study (cf. Section 3.1), a baseline neural network model for credit card fraud detection (cf. Section 3.2), and a PGD-based evasion adversarial attack (cf. Section 3.3). The following core Python (v3.9) software stack was used: NumPy (v2.2.6), Pandas (v2.3.3), Scikit-Learn (v1.7.2), and TensorFlow (v2.20.0). Feature standardization was performed using StandardScaler, while Glorot initialization was applied to the neural network weights (biases were initialized to zero).

3.1. Datasets

In this study, we resort to the Credit Card Fraud Detection Dataset [45]. It consists of 284,807 anonymized transactions (of which 492 are labeled as fraudulent) made by European cardholders over a period of several days. Each record corresponds to a single transaction and is represented by 30 explanatory features and one binary class feature indicating whether a given transaction is legitimate or fraudulent. The first 28 explanatory features (V1 through V28) are obtained by principal component analysis applied to the original transaction attributes in order to protect confidentiality. In the original dataset, those features were normalized with a zero mean. The two remaining explanatory features, Amount and Time, represent the transaction amount and the elapsed time in seconds from the first recorded transaction in the dataset, respectively. For the purpose of this contribution, the Amount feature, which spans a wide numerical range, was also normalized to a zero mean after the dataset division explained below, while the Time feature was omitted.

From the original dataset, we derived two non-overlapping datasets: $\mathcal{D}$ and ${\mathcal{D}}^{\prime }$. Both datasets were selected to preserve a highly imbalanced class distribution. Specifically, $\mathcal{D}$ contains 246 randomly sampled fraudulent transactions, corresponding to one half of all fraudulent transactions available in the original dataset, together with 24,354 randomly sampled legitimate transactions. Similarly, the second dataset ${\mathcal{D}}^{\prime }$ contains the remaining 246 fraudulent transactions and 24,354 randomly sampled legitimate transactions which do not overlap with transactions in dataset $\mathcal{D}$. Thus, each of the derived datasets consists of 24,600 transactions, with fraudulent transactions accounting for approximately 1% of the samples and legitimate transactions accounting for the remaining 99%. It can be observed that the prevalence of fraudulent transactions in the original Credit Card Fraud Detection dataset is lower, accounting for only 0.17% of the samples. However, this dataset is outdated (dating from 2013), whereas more recent estimates suggest that over 4% of all digital transactions worldwide are potentially fraudulent [46]. Thus, the adopted prevalence of 1% may be considered acceptable.

In addition, these datasets underwent random stratified splitting at an 80:20 ratio. Dataset $\mathcal{D}$ was divided into training set ${\mathcal{D}}_1$ and test set ${\mathcal{D}}_2$, while dataset ${\mathcal{D}}^{\prime }$ was divided into training set ${\mathcal{D}}_1^{\prime }$ and test set ${\mathcal{D}}_2^{\prime }$. These sets, summarized in

Table 1. Summary of datasets.

Dataset	# Transactions	# Legitimate Transactions	# Fraudulent Transactions
$\mathcal{D}$	24,600	24,354	246
${\mathcal{D}}_1$	19,680	19,483	197
${\mathcal{D}}_2$	4920	4871	49
${\mathcal{D}}^{\prime }$	24,600	24,354	246
${\mathcal{D}}_1^{\prime }$	19,680	19,483	197
${\mathcal{D}}_2^{\prime }$	4920	4871	49

The symbol # is an abbreviation for “number”.

, were used to support separate stages of the experimental evaluation:

• Set ${\mathcal{D}}_1$ served as the training set to optimize parameters of a baseline neural network model for credit card fraud detection, set ${\mathcal{D}}_2$ as the validation set to monitor performance after each epoch, and set ${\mathcal{D}}_2^{\prime }$ as the testing set to assess the quality of the fully trained baseline model.
• In white-box settings, the proposed PGD attack was applied to all fraudulent transaction vectors in set ${\mathcal{D}}_1^{\prime }$ within the context of the baseline model. The generated adversarial vectors were evaluated in terms of their effect on the baseline model prediction (see Section 4).
• In black-box settings, set ${\mathcal{D}}_1^{\prime }$ served as the training set to optimize parameters of victim neural network models, set ${\mathcal{D}}_2^{\prime }$ as the validation set to monitor performance after each epoch, and set ${\mathcal{D}}_2$ as the testing set to assess the quality of the fully trained models. Then, the PGD attack was applied to all fraudulent transaction vectors in dataset ${\mathcal{D}}_1$ within the context of the baseline model. The transferability of the generated adversarial vectors was examined across the set of victim models (see Section 5).

Such utilization of the sets ensured that the adversarial vectors were always derived from a previously unseen set, i.e., their corresponding source fraudulent vectors were excluded from the model training or evaluation.

To evaluate result stability, we ran each PDG-based experiment two times under both white-box and black-box settings (cf. Section 4 and Section 5). For each run, we used different random seed settings

$$\mathcal{S}=(s_1,s_2,s_3,s_4,s_5,s_6,s_7),$$

(1)

while keeping all other parameters constant, where

• $s_1$—the random seed for selecting 24,354 legitimate samples to be included in set $\mathcal{D}$,
• $s_2$—the random seed for selecting 24,354 legitimate samples to be included in set ${\mathcal{D}}^{\prime }$,
• $s_3$—the random seed for a $50:50$ split of all available (492) fraudulent samples into two subsets, which are included in sets $\mathcal{D}$ and ${\mathcal{D}}^{\prime }$, respectively,
• $s_4$—the random seed for shuffling legitimate and fraudulent samples in set $\mathcal{D}$,
• $s_5$—the random seed for shuffling legitimate and fraudulent samples in set ${\mathcal{D}}^{\prime }$,
• $s_6$—the random seed for an $80:20$ split of set $\mathcal{D}$ into sets ${\mathcal{D}}_1$ and ${\mathcal{D}}_2$,
• $s_7$—the random seed for an $80:20$ split of set ${\mathcal{D}}^{\prime }$ into sets ${\mathcal{D}}_1^{\prime }$ and ${\mathcal{D}}_2^{\prime }$.

This involved completely separate dataset derivation, model training, and testing. The two specific random seed settings used in this study are listed in

Table 2. Random seed settings used in this study.

Random Seed Settings	Random Seeds
	${\mathit{s}}_{\mathbf{1}}$	${\mathit{s}}_{\mathbf{2}}$	${\mathit{s}}_{\mathbf{3}}$	${\mathit{s}}_{\mathbf{4}}$	${\mathit{s}}_{\mathbf{5}}$	${\mathit{s}}_{\mathbf{6}}$	${\mathit{s}}_{\mathbf{7}}$
${\mathcal{S}}_1$	22	25	27	48	94	34	67
${\mathcal{S}}_2$	35	17	47	90	84	44	55

. As an illustration and for the subsequent selection of the perturbation bound in Section 4 and Section 5,

Table 3. The mean and standard deviation of each explanatory feature in set ${\mathcal{D}}_1$ across different random seed settings.

Feature	Random State Setting ${\mathcal{S}}_1$		Random State Setting ${\mathcal{S}}_2$
	Mean	St. dev.	Mean	St. dev.
V1	−0.056556	2.107529	−0.031175	2.106691
V2	0.044264	1.734943	0.036573	1.70532
V3	−0.058572	1.767076	−0.06045	1.761784
V4	0.042265	1.495353	0.044719	1.496718
V5	−0.033183	1.48878	−0.022844	1.445343
V6	−0.003214	1.336646	−0.027691	1.321971
V7	−0.050426	1.526953	−0.058233	1.446825
V8	−0.005203	1.440624	−0.007139	1.390874
V9	−0.027951	1.141118	−0.021106	1.155883
V10	−0.040541	1.270388	−0.044758	1.309484
V11	0.028661	1.087749	0.03356	1.112917
V12	−0.04977	1.194306	−0.050513	1.235508
V13	−0.001926	0.996708	−0.002554	0.991663
V14	−0.052291	1.19384	−0.067699	1.241511
V15	−0.009785	0.916255	−0.003821	0.918569
V16	−0.021106	0.990014	−0.024733	1.017455
V17	−0.051635	1.16142	−0.048258	1.241866
V18	−0.01063	0.888276	−0.022296	0.899131
V19	0.008796	0.825528	0.009602	0.819501
V20	0.00749	0.785778	−0.001234	0.766585
V21	0.006433	0.889487	0.001114	0.824828
V22	−0.008954	0.751143	0.004259	0.741246
V23	0.001063	0.67686	−0.005112	0.666892
V24	−0.004902	0.603337	0.000322	0.606508
V25	−0.001722	0.523075	−0.000418	0.523436
V26	−0.000718	0.482874	−0.005888	0.477928
V27	0.002322	0.417625	0.004963	0.413537
V28	0.002496	0.322224	0.001257	0.340038
Amount	88.126	243.210	87.561	225.313
Amount (after normalization)	0.002975	1.022533	−0.010587	0.871823

presents the mean and standard deviation of each explanatory feature in set ${\mathcal{D}}_1$ across different random seed settings.

3.2. Baseline Model

For the purpose of evaluating the adversarial attack presented in this contribution, we developed a baseline model for credit card fraud detection, based on a feedforward neural network. The model was designed to be relatively simple, reflecting common practice in tabular financial data analysis and enabling a clear assessment of adversarial vulnerability without architectural complexity.

The baseline model consists of an input layer matching the dimensionality of the feature space, followed by two fully connected hidden layers, comprising 32 and 16 neurons with the Rectified Linear Unit (ReLU) activation function, respectively. Both hidden layers are followed by a dropout layer with a dropout rate of 0.3 to reduce overfitting. The output layer consists of a single neuron with the sigmoid activation function, producing a probabilistic estimate of the likelihood that a transaction is fraudulent, with a fixed classification threshold of 0.5. Binary cross-entropy was applied as the loss function, and the model optimization was performed using the Adaptive Moment Estimation optimizer with a learning rate of ${10}^{-3}$.

The baseline model was trained on set ${\mathcal{D}}_1$ (see Section 3.1). Training was conducted for 30 epochs, with a batch size of 32 samples. Validation was conducted at the end of each training epoch using set ${\mathcal{D}}_2$, to monitor the model’s generalization behavior. No early stopping criterion was applied, and the model’s internal parameters obtained after the final epoch were retained for subsequent evaluation and adversarial analysis.

The fully trained baseline model was assessed on set ${\mathcal{D}}_2^{\prime }$. Its performance is reported in

Table 4. Evaluation of the baseline model.

Metric	Random State Setting ${\mathcal{S}}_1$	Random State Setting ${\mathcal{S}}_1$
Accuracy	0.9973	0.9983
ROC AUC	0.9629	0.9909
Precision (Class 0)	0.9981	0.9987
Recall (Class 0)	0.9991	0.9995
F1-score (Class 0)	0.9986	0.9991
Precision (Class 1)	0.9090	0.9555
Recall (Class 1)	0.8163	0.8775
F1-score (Class 1)	0.8602	0.9148
Macroaverage F1-score	0.9294	0.9570
Confusion matrix (TN, FP, FN, TP)	(4867, 4, 9, 40)	(4869, 2, 6, 43)

. In two experimental runs, the model achieves an accuracy of 0.9973 and 0.9983, a macroaverage F₁-score of 0.9294 and 0.9570, and an ROC AUC of 0.9629 and 0.9909, respectively. However, it should be noted that the reported performance serves solely as a reference point prior to adversarial manipulation and is not intended to reflect the model robustness in general.

3.3. Projected Gradient Descent Optimization

In order to explicitly steer the model predictions toward a predefined target class, a targeted binary cross-entropy loss function was employed. Given an input transaction vector $\mathbf{x}$ and a target label $y^{*}\in \{0,1\}$, the loss function was defined so as to increase the model’s confidence in the target class, irrespective of the original class label.

Let $f\left(\mathbf{x}\right)$ denote the output of the neural network, representing the predicted probability of a transaction being fraudulent. The targeted loss for an adversarial sample ${\mathbf{x}}_{\mathrm{adv}}$ is defined as

$${\mathcal{L}}_{\mathrm{target}}=\mathrm{BCE}(y^{*},f\left({\mathbf{x}}_{\mathrm{adv}}\right)),$$

(2)

where BCE denotes the binary cross-entropy loss function. In our experiments, the target label was set to the legitimate transaction class (i.e., $y^{*}=0$), thereby modeling an evasion attack in which fraudulent transactions are modified to be misclassified as non-fraudulent. More precisely, the gradient updates on input transaction vector $\mathbf{x}$ are computed in a direction that explicitly minimizes the discrepancy between the model output and the target label $y^{*}$.

Adversarial samples were generated using a targeted PGD algorithm under an $L_{\infty }$ norm constraint. The optimization process aims to iteratively modify a given input fraudulent transaction vector while enforcing a strict bound on the maximum allowable perturbation applied to each feature. It starts from a random point within the $ϵ$-bounded neighborhood of fraudulent transaction vector $\mathbf{x}$:

$${\mathbf{x}}_{\mathrm{adv}}^{\left(0\right)}=\mathbf{x}+\mathit{\xi },\mathit{\xi }\sim \mathcal{U}(-ϵ,ϵ),$$

(3)

where ${\mathbf{x}}_{\mathrm{adv}}^{\left(0\right)}$ denotes the initial adversarial vector, and $\mathcal{U}$ denotes a uniform distribution.

At each iteration, the gradient of the targeted loss function with respect to the input vector is computed by back-propagation through the target neural network. The adversarial vector is first updated according to

$${\mathbf{x}}_{\mathrm{adv}}^{(t+1)}={\mathbf{x}}_{\mathrm{adv}}^{\left(t\right)}-\alpha ·\mathrm{sign}\left({\nabla }_{\mathbf{x}}{\mathcal{L}}_{\mathrm{target}}\left({\mathbf{x}}_{\mathrm{adv}}^{\left(t\right)}\right)\right),$$

(4)

where ${\mathbf{x}}_{\mathrm{adv}}^{\left(t\right)}$ denotes the adversarial vector at iteration t, and $\alpha$ denotes the step size. The negative gradient direction reflects the targeted nature of the attack, as the optimization is aimed at reducing the loss with respect to the chosen target label. Immediately following this update, the adversarial perturbation is projected back onto the $L_{\infty }$ ball of radius $ϵ$ centered at the original input:

$${\mathbf{x}}_{\mathrm{adv}}^{(t+1)}=\mathbf{x}+\mathrm{clip}\left({\mathbf{x}}_{\mathrm{adv}}^{(t+1)}-\mathbf{x},-ϵ,ϵ\right).$$

(5)

The projection step guarantees that the resulting adversarial sample remains within the predefined perturbation bounds. After a given number of iterations, the final adversarial transaction vector is obtained. The described procedure is formally represented by the pseudocode in Algorithm 1.

Algorithm 1 Targeted PGD attack under an $L_{\infty }$ constraint.

1: Input: trained model $f(·)$, original inputs $\mathbf{X}$, target label $y^{*}$, iterations T, step size $\alpha$, perturbation bounds $ϵ$   2: Output: adversarial inputs ${\mathbf{X}}_{\mathrm{adv}}$   3: ${\mathbf{X}}_0\leftarrow \mathbf{X}$   4: Sample $\mathrm{\Xi }\sim \mathcal{U}(-ϵ,ϵ)$ with shape $\left|\mathbf{X}\right|$   5: ${\mathbf{X}}_{\mathrm{adv}}^{\left(0\right)}\leftarrow {\mathbf{X}}_0+\mathrm{\Xi }$   6: ${\mathbf{y}}^{*}\leftarrow y^{*}·{\mathbf{1}}_{\left|\mathbf{X}\right|}$   7: for  $t=0$ to T  do   8:    Compute predictions $\widehat{\mathbf{y}}\leftarrow f\left({\mathbf{X}}_{\mathrm{adv}}^{\left(t\right)}\right)$   9:    Compute targeted loss ${\mathcal{L}}_{\mathrm{target}}\leftarrow \mathrm{BCE}({\mathbf{y}}^{*},\widehat{\mathbf{y}})$ 10:    Compute gradient $\mathbf{g}\leftarrow {\nabla }_{\mathbf{X}}{\mathcal{L}}_{\mathrm{target}}\left({\mathbf{X}}_{\mathrm{adv}}^{\left(t\right)}\right)$ 11:    Targeted update: ${\mathbf{X}}_{\mathrm{adv}}^{(t+1)}\leftarrow {\mathbf{X}}_{\mathrm{adv}}^{\left(t\right)}-\alpha ·\mathrm{sign}\left(\mathbf{g}\right)$ 12:    Project onto $L_{\infty }$-ball: 13:       $\mathbf{\Delta }\leftarrow \mathrm{clip}\left({\mathbf{X}}_{\mathrm{adv}}^{(t+1)}-{\mathbf{X}}_0,-ϵ,ϵ\right)$ 14:       ${\mathbf{X}}_{\mathrm{adv}}^{(t+1)}\leftarrow {\mathbf{X}}_0+\mathbf{\Delta }$ 15: end for 16: Return  ${\mathbf{X}}_{\mathrm{adv}}^{\left(T\right)}$

4. White-Box Attack

(i) Parameter settings: The underlying datasets contain mixed features, i.e., the standard deviations of the normalized explanatory features, given in Table 3, take values in the ranges $(0.322224,2.107529)$ and $(0.340038,2.10669)$, respectively. On the other hand, the proposed attack applies a single perturbation bound ($ϵ$) for a set of mixed values. When dealing with mixed-feature tabular data, adopting a high perturbation bound relative to the feature standard deviations would negatively affect the real-world validity of the data. Thus, to ensure a fair mixed-feature PGD attack, we adopted the following relatively strict perturbation bound constraint:

$$ϵ\le 0.33·{\sigma }_{min},$$

(6)

i.e., the perturbation bound $ϵ$ must be less than 33% of the minimum standard deviation across the normalized explanatory features (which is in line with the common practice in the field [2]). Subject to this constraint, and with ${\sigma }_{min}$ being equal to 0.322224 and 0.340038, respectively, across two experimental runs (derived from Table 3), we consider the following values of the perturbation bound:

$$ϵ\in \{0.05,0.1\}.$$

(7)

Table 5. The maximum change in the Amount feature at the original monetary scale for perturbation bounds $ϵ\in \{0.05,0.1\}$.

Amount Feature	Random State Setting ${\mathcal{S}}_1$	Random State Setting ${\mathcal{S}}_2$
Minimum	0.0	0.0
Maximum	7429.150	8182.7
Mean	88.126	87.561
Standard deviation	243.210	225.313
Maximum change ($ϵ=0.05$)	12.160	11.265
Maximum change ($ϵ=0.1$)	24.321	22.531

illustrates how the adopted perturbation bounds affect the Amount feature at the original monetary scale. It can be observed that the maximum change in this feature represents a relatively mild shift.

The other attack parameters are set as follows: $L_{\infty }$ constraint, step size $\alpha =0.0001$, number of iterations $T=5000$.

(ii) Selection of input transactional vectors: We considered all fraudulent transaction vectors from dataset ${\mathcal{D}}_1^{\prime }$. This vector subset was then restricted to retain only the fraudulent transaction vectors that were correctly classified by the baseline model introduced in Section 3.2:

$$\mathbf{X}=\left\{\mathbf{x}\right|\mathbf{x}\in {\mathcal{D}}_1^{\prime }\wedge \mathrm{label}\left(\mathbf{x}\right)=\mathrm{fraudulent}\wedge \mathrm{class}\left(\mathbf{x}\right)=\mathrm{fraudulent}\}.$$

(8)

The proposed PGD attack was independently applied to each fraudulent transaction vector in set $\mathbf{X}$.

(iii) Evaluation: For each of the selected samples $\mathbf{x}\in \mathbf{X}$, an adversarial counterpart ${\mathbf{x}}_{\mathrm{adv}}^{\left(T\right)}\in {\mathbf{X}}_{\mathrm{adv}}^{\left(T\right)}$ was generated. After applying the PGD optimization, the obtained adversarial vectors were submitted to the baseline model. Only those adversarial vectors that successfully induced a malicious change in the model prediction from fraudulent to legitimate were retained for further analysis, i.e.,

$${\mathbf{X}}_{\mathrm{adv}}=\left\{{\mathbf{x}}_{\mathrm{adv}}\right|{\mathbf{x}}_{\mathrm{adv}}\in {\mathbf{X}}_{\mathrm{adv}}^{\left(T\right)}\wedge \mathrm{class}\left({\mathbf{x}}_{\mathrm{adv}}\right)=\mathrm{legitimate}\}.$$

(9)

In the first experimental run (i.e., random seed setting ${\mathcal{S}}_1$), for $ϵ=0.05$, the attack resulted in one successful adversarial vector (i.e., $|{\mathbf{X}}_{\mathrm{adv}}|=1$), which gave a 0.60% attack success rate. For $ϵ=0.1$, four successful adversarial vectors were generated (i.e., $|{\mathbf{X}}_{\mathrm{adv}}|=4$), which gave a 2.42% attack success rate. In the second experimental run (i.e., random seed setting ${\mathcal{S}}_2$), one successful adversarial vector was obtained for both perturbation bounds $ϵ\in \{0.05,,0.01\}$ (i.e., $|{\mathbf{X}}_{\mathrm{adv}}|=1$), resulting in a 0.61% attack success rate. These results are summarized in

Table 6. Evaluation of the white-box PGD attack on the baseline model (step size $\alpha =0.0001$, number of iterations $T=5000$).

Random Seed	Perturbation	# Adv. Vectors	# Successful Adv. Vectors	Attack Success
Setting	Bound $\mathbf{ϵ}$	$|{\mathbf{X}}_{\mathbf{adv}}^{\left(\mathbf{T}\right)}|$	$|{\mathbf{X}}_{\mathbf{adv}}|$	Rate
${\mathcal{S}}_1$	0.05	165	1	$0.60\%\left({\displaystyle \frac{1}{165}}\right)$
	0.1	165	4	$2.42\%\left({\displaystyle \frac{4}{165}}\right)$
${\mathcal{S}}_2$	0.05	164	1	$0.61\%\left({\displaystyle \frac{1}{164}}\right)$
	0.1	164	1	$0.61\%\left({\displaystyle \frac{1}{164}}\right)$

The symbol # is an abbreviation for “number”.

.

However, to evaluate a given adversarial vector ${\mathbf{x}}_{i,\mathrm{adv}}$, it is not sufficient only to demonstrate that it is classified as a legitimate sample by the baseline model. It is also necessary to show that it is most similar to the fraudulent transaction vector ${\mathbf{x}}_i$ from which it has been derived and substantially different from other transaction vectors in dataset $\mathcal{D}$. To estimate the similarity between two vectors, we resort to the cosine similarity measure [47]. For each successful adversarial transaction vector ${\mathbf{x}}_{i,\mathrm{adv}}\in {\mathbf{X}}_{\mathrm{adv}}$, we calculate its cosine similarity with each transaction vector ${\mathbf{x}}_j$ contained in dataset $\mathcal{D}$:  

$$s_{i,j}=\cos \left({\mathbf{x}}_{i,\mathrm{adv}},{\mathbf{x}}_j\right)={\displaystyle \frac{{\mathbf{x}}_{i,\mathrm{adv}}·{\mathbf{x}}_j}{\parallel {\mathbf{x}}_{i,\mathrm{adv}}{\parallel }_2{\parallel {\mathbf{x}}_j\parallel }_2}}.$$

(10)

This computation yields an empirical distribution of similarity values between the given adversarial vector ${\mathbf{x}}_{i,\mathrm{adv}}$ and the dataset. The resulting reference similarity set is given by

$${\mathcal{S}}_{i,\mathrm{ref}}=\cos \left({\mathbf{x}}_{i,\mathrm{adv}},{\mathbf{x}}_j\right),\mathrm{where}{\mathbf{x}}_j\in \mathcal{D}.$$

(11)

In addition, let $s_{i,\mathrm{orig}}$ be the cosine similarity between adversarial vector ${\mathbf{x}}_{i,\mathrm{adv}}$ and vector ${\mathbf{x}}_i\in \mathcal{D}$ from which it has been derived:

$$s_{i,\mathrm{orig}}=\cos \left({\mathbf{x}}_{i,\mathrm{adv}},{\mathbf{x}}_i\right).$$

(12)

In the given context, to evaluate adversarial vector ${\mathbf{x}}_{i,adv}$, it is necessary to show that $s_{i,\mathrm{orig}}$ represents an extreme outlier within distribution ${\mathcal{S}}_{i,\mathrm{ref}}$. Thus, the value $s_{i,\mathrm{orig}}$ was standardized using z-score normalization relative to the reference similarity distribution [48]:

$$z_{i,\mathrm{orig}}={\displaystyle \frac{s_{i,\mathrm{orig}}-{\mu }_{i,\mathrm{ref}}}{{\sigma }_{i,\mathrm{ref}}}},$$

(13)

where ${\mu }_{i,\mathrm{ref}}$ and ${\sigma }_{i,\mathrm{ref}}$ denote the mean and standard deviation of the reference distribution, respectively:

$${\mu }_{i,\mathrm{ref}}=\mathbb{E}\left[{\mathcal{S}}_{i,\mathrm{ref}}\right],{\sigma }_{i,\mathrm{ref}}=\sqrt{\mathbb{V}\left[{\mathcal{S}}_{i,\mathrm{ref}}\right]}.$$

(14)

The standardized score $z_{i,\mathrm{orig}}$ quantifies the extent to which the original transaction vector represents an extreme nearest neighbor of the adversarial vector when compared to all other transactions in dataset $\mathcal{D}$.

The values of $s_{i,\mathrm{orig}}$, ${\mu }_{i,\mathrm{ref}}$, ${\sigma }_{i,\mathrm{ref}}$ and $z_{i,\mathrm{orig}}$ obtained for the considered perturbation bounds $ϵ=0.05$ and $ϵ=0.1$ are reported in

Table 7. Alignment of adversarial transaction vectors with the corresponding original fraudulent vectors in the context of the white-box PGD attack with a perturbation bound of $ϵ=0.05$: the results of the z-score analysis within dataset ${\mathcal{D}}_1^{\prime }$.

Random Seed Setting	i	${\mathit{s}}_{\mathit{i},\mathbf{orig}}=\cos \left({\mathit{x}}_{\mathit{i},\mathbf{adv}},{\mathit{x}}_{\mathit{i}}\right)$	${\mathit{\mu }}_{\mathit{i},\mathbf{ref}}$	${\mathit{\sigma }}_{\mathit{i},\mathbf{ref}}$	${\mathit{z}}_{\mathit{i},\mathbf{orig}}$
${\mathcal{S}}_1$	1	0.99981611	−0.00506206	0.21159025	4.74917050
${\mathcal{S}}_2$	1	0.99968608	00722135	0.23358401	4.24885547

and

Table 8. Alignment of adversarial transaction vectors with the corresponding original fraudulent vectors in the context of the white-box PGD attack with a perturbation bound of $ϵ=0.1$: the results of the z-score analysis within dataset ${\mathcal{D}}_1^{\prime }$.

Random Seed Setting	i	${\mathit{s}}_{\mathit{i},\mathbf{orig}}=\cos \left({\mathit{x}}_{\mathit{i},\mathbf{adv}},{\mathit{x}}_{\mathit{i}}\right)$	${\mathit{\mu }}_{\mathit{i},\mathbf{ref}}$	${\mathit{\sigma }}_{\mathit{i},\mathbf{ref}}$	${\mathit{z}}_{\mathit{i},\mathbf{orig}}$
${\mathcal{S}}_1$	1	0.99927033	−0.00531050	0.21189997	4.74082566
	2	0.99917149	−0.00749639	0.16270481	6.18708116
	3	0.99917149	0.01107455	0.20399358	4.83679768
	4	0.99917149	−0.00726121	0.20351066	4.94489495
${\mathcal{S}}_2$	1	0.99873237	0.00772406	0.23390539	4.23679112

, respectively. In both cases, for each adversarial sample ${\mathbf{x}}_{i,\mathrm{adv}}\in {\mathbf{X}}_{\mathrm{adv}}$, it can be observed not only that $s_{i,\mathrm{orig}}$ represents the maximum value within the reference distribution ${\mathcal{S}}_{i,\mathrm{ref}}$,

$$s_{i,\mathrm{orig}}=\underset{\mathbf{x}\in \mathcal{D}}{\max }\cos \left({\mathbf{x}}_{i,\mathrm{adv}},\mathbf{x}\right),$$

(15)

i.e.,

$${\mathbf{x}}_i=\underset{\mathbf{x}\in \mathcal{D}}{\mathrm{argmax}}\cos \left({\mathbf{x}}_{i,\mathrm{adv}},\mathbf{x}\right),$$

(16)

but also that the obtained z-score $z_{i,\mathrm{orig}}$ belongs to the range $(4.23679112,6.18708116)$. Such a high z-score indicates that $s_{i,\mathrm{orig}}$ represents an outlier within distribution ${\mathcal{S}}_{i,\mathrm{ref}}$, i.e., the original transaction vector ${\mathbf{x}}_i$ represents the extreme nearest neighbour of the adversarial vector ${\mathbf{x}}_{i,\mathrm{adv}}$ within the global similarity distribution. Thus, we showed that the considered adversarial vectors were not only classified as legitimate transactions by the baseline model, but are also highly similar (in terms of mathematical proximity) to their corresponding original fraudulent transaction vectors and substantially different from other transaction vectors (fraudulent or legitimate) contained in dataset $\mathcal{D}$.

5. Black-Box Attack

(i) Parameter settings: In black-box settings, we adopt a perturbation boundary constraint that is slightly relaxed compared to the white-box constraint defined in Equation (6):

$$ϵ\le 0.3·{\sigma }_{avg},$$

(17)

i.e., the perturbation bound $ϵ$ must be less than 30% of the mean standard deviation across the normalized explanatory features. Subject to this constraint, and with ${\sigma }_{avg}$ being equal to 1.0703 and 1.0639, respectively, across two experimental runs (derived from Table 3), we consider the following values of the perturbation bound:

$$ϵ\in \{0.05,0.1,0.2,0.3\}.$$

(18)

It should be noted that all adopted perturbation boundaries are still less than the minimum standard deviation across the normalized explanatory features (cf. Table 3). The maximum change in the Amount feature at the original monetary scale for the considered perturbation bounds is given in Table 5 and

Table 9. The maximum change in the Amount feature at the original monetary scale for perturbation bounds $ϵ\in \{0.2,0.3\}$.

Amount Feature	Random State Setting ${\mathcal{S}}_1$	Random State Setting ${\mathcal{S}}_2$
Maximum change ($ϵ=0.2$)	48.642	45.063
Maximum change ($ϵ=0.3$)	72.963	67.594

. It represents a mild shift for $ϵ\in \{0.05,0.1\}$ and a moderate-to-severe shift for $ϵ\in \{0.2,0.3\}$.

The other attack parameters remain unchanged: $L_{\infty }$ constraint, step size $\alpha =0.0001$, and number of iterations $T=5000$.

(ii) Selection of adversarial vectors for the transferability analysis: We considered all fraudulent transaction vectors from dataset ${\mathcal{D}}_1$. This vector subset was then restricted to retain only the fraudulent transaction vectors that were correctly classified by the baseline model introduced in Section 3.2. Then, for a given perturbation bound $ϵ$, for each of the retained fraudulent transaction vectors, its adversarial counterpart was derived using the proposed white-box PGD-based attack. Finally, the obtained adversarial vectors were submitted to the baseline model. Only those adversarial vectors that successfully induced a misclassification from fraudulent to legitimate were retained for the transferability analysis.

The numbers of the retained adversarial vectors obtained for the considered perturbation bounds are given in

Table 10. Summary of the alignment of adversarial transaction vectors selected for the transferability analysis with the corresponding original fraudulent vectors in the context of the black-box PGD attack: the results of the z-score analysis within dataset ${\mathcal{D}}_1$.

Random Seed	Perturbation Bound	# Adv. Vectors	Average z-Score
Setting	$\mathbf{ϵ}$		(st. dev)
${\mathcal{S}}_1$	0.3	20	4.961 (±0.794)
	0.2	15	4.632 (±0.325)
	0.1	10	4.602 (±0.288)
	0.05	6	4.519 (±0.346)
${\mathcal{S}}_2$	0.3	21	5.552 (±1.690)
	0.2	17	4.853 (±0.544)
	0.1	15	4.815 (±0.524)
	0.05	9	0.323 (±0.318)

The symbol # is an abbreviation for “number”.

, together with their average z-score values indicating the alignment of the retained adversarial vectors with the corresponding original fraudulent vectors.

(iii) Attack transferability evaluation: For the purpose of evaluating the transferability of the generated adversarial transaction vectors, we developed 4092 victim models for credit card fraud. The victim models were also neural-network based, and they differed from the baseline model in terms of architecture. Their architectures were specified over the following hyperparameter space $(l,n,r)$, where

• $l\in L$—the number of hidden layers, where $L=\{1,2,3,4,5\}$,
• $n\in N$—the number of neurons in a hidden layer, where $N=\{16,32,64,128\}$,
• $r\in R$—the dropout rate, where $R=\{0.0,0.2,0.3\}$.

All other hyperparameters (i.e., the activation functions, loss function, classification threshold, optimizer, number of epochs, batch size, and underlying datasets) were the same as in the baseline model (cf. Section 3.2). The adopted hyperparameter space resulted in $\left|R\right|·{\displaystyle \sum _{k=1}^{\left|L\right|}}{4}^{\left|N\right|}=4092$ victim model architectures. The victim models were trained on dataset ${\mathcal{D}}_1^{\prime }$. The validation was conducted at the end of each training epoch using set ${\mathcal{D}}_2^{\prime }$ (see Section 3.1).

The fully trained victim models were assessed on set ${\mathcal{D}}_2$. The clean-test performance of the victim models was evaluated using ROC-AUC and macroaveraged $F_1$-score. The summary of this evaluation is given in

Table 11. Summary of the clean-test performance of 4092 victim models.

Macroaverage ${\mathit{F}}_1$-Score	Random Seed Setting ${\mathcal{S}}_1$	Random Seed Setting ${\mathcal{S}}_2$
Average (${\tau }_{avg}$)	0.9091	0.9532
Standard deviation	0.0117	0.0098
Minimum	0.8441	0.8650
Maximum	0.9402	0.9785
Q1	0.9014	0.9489
Q2	0.9102	0.9551
Q3	0.9168	0.9611
Q4	0.9402	0.9785
Selection threshold ($\tau$)	0.9067	0.9517

. In addition, the performance of the victim models is summarized according to network depth (i.e., number of hidden layers), width (i.e., the maximum number of neurons in any single layer), and dropout rate (see

Table 12. Summary of the clean-test performance of 4092 victim models according to network depth (i.e., number of hidden layers).

Random Seed Setting	Depth	# Models	ROC-AUC	Macro ${\mathit{F}}_1$
${\mathcal{S}}_1$	1	12	0.9521 ± 0.0059	0.9096 ± 0.0107
	2	48	0.9478 ± 0.0063	0.9113 ± 0.0102
	3	192	0.9471 ± 0.0070	0.9087 ± 0.0110
	4	768	0.9479 ± 0.0072	0.9087 ± 0.0114
	5	3072	0.9483 ± 0.0071	0.9092 ± 0.0118
${\mathcal{S}}_2$	1	12	0.9943 ± 0.0022	0.9584 ± 0.0052
	2	48	0.9923 ± 0.0029	0.9562 ± 0.0067
	3	192	0.9918 ± 0.0043	0.9546 ± 0.0092
	4	768	0.9922 ± 0.0037	0.9538 ± 0.0102
	5	3072	0.9920 ± 0.0044	0.9530 ± 0.0099

The symbol # is an abbreviation for “number”.

,

Table 13. Summary of the clean-test performance of 4092 victim models according to network width (i.e., the maximum number of neurons in any single layer).

Random Seed Setting	Width	# Models	ROC-AUC	Macro ${\mathit{F}}_1$
${\mathcal{S}}_1$	16	15	0.9452 ± 0.0111	0.9091 ± 0.0091
	32	171	0.9486 ± 0.0081	0.9079 ± 0.0120
	64	903	0.9480 ± 0.0078	0.9089 ± 0.0123
	128	3003	0.9482 ± 0.0068	0.9092 ± 0.0115
${\mathcal{S}}_2$	16	15	0.9921 ± 0.0029	0.9514 ± 0.0076
	32	171	0.9909 ± 0.0053	0.9508 ± 0.0103
	64	903	0.9916 ± 0.0044	0.9529 ± 0.0099
	128	3003	0.9922 ± 0.0041	0.9535 ± 0.0098

The symbol # is an abbreviation for “number”.

and

Table 14. Summary of the clean-test performance of 4092 victim models according to dropout rate.

Random Seed Setting	Dropout Rate	# Models	ROC-AUC	Macro ${\mathit{F}}_1$
${\mathcal{S}}_1$	0.0	1.364	0.9460 ± 0.0092	0.9028 ± 0.0129
	0.2	1.364	0.9490 ± 0.0059	0.9121 ± 0.0098
	0.3	1.364	0.9496 ± 0.0051	0.9125 ± 0.0094
${\mathcal{S}}_2$	0.0	1364	0.9899 ± 0.0057	0.9491 ± 0.0125
	0.2	1364	0.9929 ± 0.0030	0.9558 ± 0.0076
	0.3	1364	0.9932 ± 0.0026	0.9548 ± 0.0072

The symbol # is an abbreviation for “number”.

, respectively).

To ensure the fairness of the experiment, the black-box attack was applied only to those victim models that are considered adequately trained, i.e., whose macroaverage $F_1$-scores were greater than a given threshold. To adaptively calculate the threshold, we applied the IsoData algorithm, which iteratively divides the observations into two groups and updates the threshold as the midpoint between their respective means until convergence [49]. Originally introduced for automatic image thresholding, the same iterative principle was applied to the one-dimensional distribution of the obtained macroaverage $F_1$-scores. The tolerance parameter for the IsoData algorithm was set to 0.00001. We further tightened the model selection criterion as follows:

$$\tau =\max ({\tau }_{iso},{\tau }_{avg}),$$

(19)

where $\tau$, ${\tau }_{iso}$ and ${\tau }_{avg}$ respectively represent a final threshold value, a threshold value obtained by the IsoData algorithm, and an average macro-averaged $F_1$-score across the victim models (cf. Table 11).

Thus, across two experimental runs, 2271 and 2334 (out of 4092) victim models respectively achieved macro-averaged F1-scores greater than the adopted threshold value and were retained for the subsequent adversarial transferability analysis, whereas the remaining models were omitted.

Let ${\mathbf{x}}_{i,\mathrm{adv}}$ be an adversarial transaction vector derived from original fraudulent vector ${\mathbf{x}}_i\in \mathcal{D}$, and let $m_j$ be a victim model. The attack on victim model $m_j$ was considered successful if the model correctly classified the original transaction vector ${\mathbf{x}}_i$ as fraudulent but misclassified its adversarial counterpart ${\mathbf{x}}_{i,\mathrm{adv}}$ as legitimate. The results of the attack transferability evaluation are summarized in

Table 15. Summary of the results of the PGD attack transferability evaluation across the selected victim models for different $ϵ$-values.

Random	Pert.	# Adv.	Avg. # Succ.	Margin of Error	Max. # Succ.	Attack
Seed	Bound	Vectors	Attacks per	(95% Conf.	Attacks	Success
Setting	$\mathbf{ϵ}$		Vector (st. dev.)	Interval)	per Vector	Rate
${\mathcal{S}}_1$	0.3	20	556.550 (629.969)	±294.83	1884	$65.24\%\left({\displaystyle \frac{10,466}{16,042}}\right)$
	0.2	15	466.266 (505.734)	±280.10	1516	$58.01\%\left({\displaystyle \frac{6817}{11,750}}\right)$
	0.1	10	176.000 (198.246)	±141.81	488	$35.36\%\left({\displaystyle \frac{1760}{4977}}\right)$
	0.05	6	71.666 (84.554)	±88,71	220	$28.64\%\left({\displaystyle \frac{430}{1501}}\right)$
${\mathcal{S}}_2$	0.3	21	180.333 (313.806)	±142.85	1021	$34.26\%\left({\displaystyle \frac{3787}{11,051}}\right)$
	0.2	17	145.647 (224.780)	±115.58	665	$61.07\%\left({\displaystyle \frac{2476}{4054}}\right)$
	0.1	15	112.066 (161.940)	±89.69	479	$41.61\%\left({\displaystyle \frac{1681}{4039}}\right)$
	0.05	9	34.000 (68.585)	±52.72	209	$32.34\%\left({\displaystyle \frac{306}{946}}\right)$

The symbol # is an abbreviation for “number”.

. For each considered perturbation bound $ϵ$, this table provides the average number of successful attacks per adversarial vector (with standard deviation), the margin of error for a 95% confidence interval, the maximum number of successful attacks for an adversarial vector, and the attack success rate, defined as the proportion of eligible model-sample pairs, i.e.,

$$\mathrm{ASR}={\displaystyle \frac{\left|\left\{(m,\mathbf{x})\right|m\left(\mathbf{x}\right)=\mathrm{fraudulent}\wedge m\left({\mathbf{x}}_{\mathrm{adv}}\right)=\mathrm{legitimate}\}\right|}{\left|\left\{\right(m,\mathbf{x}\left)\right|m\left(\mathbf{x}\right)=\mathrm{fraudulent}\}\right|}}.$$

(20)

6. Discussion

This section discusses the experimental settings, obtained results, and limitations of the scope of the study.

(i) Experimental settings: We recall that the underlying datasets contain mixed features, i.e., the standard deviations of the normalized explanatory features differ significantly (cf. Table 3). Thus, the experimental settings were designed to ensure a fair, mixed-feature attack, as follows:

• Constrained perturbation bound: The perturbation bounds were constrained (cf. Equations (6), (7), (17) and (18)) to ensure that calculated adversarial vectors remain mathematically close to their original vectors.
• Fine-grained optimization: To allow for fine-grained optimization inside the $L_{\infty }$$ϵ$-ball, we adopted a step size that is relatively small compared to the perturbation bound ($\alpha =0.0001$). On the other hand, a relatively large iteration budget (i.e., $T=5000$ optimization steps) was adopted to ensure that the perturbation reaches the boundary of the $L_{\infty }$$ϵ$-ball.
• Class imbalance: The underlying datasets are selected to preserve a highly imbalanced class distribution of legitimate and fraudulent transactions, which is often present in financial data. Thus, in each of the considered datasets, fraudulent transactions account for approximately 1% of the samples, while legitimate transactions account for the remaining 99%.
• Attack success criterion: The attack on a model m by submitting an adversarial sample ${\mathbf{x}}_{i,\mathrm{adv}}$, derived from original fraudulent vector ${\mathbf{x}}_i$, was considered successful only if the model correctly classified vector ${\mathbf{x}}_i$ as fraudulent and misclassified its adversarial counterpart ${\mathbf{x}}_{i,\mathrm{adv}}$ as legitimate.
• Avoiding bias: In general, adversarial vector ${\mathbf{x}}_{i,\mathrm{adv}}$ was submitted to a target model m only if the model was not trained on its original counterpart ${\mathbf{x}}_i$. In black-box settings, the derivation of adversarial vectors was agnostic of the architectures of the victim models, and the adversarial vectors were derived only from the fraudulent transaction vectors which were correctly classified by the baseline (i.e., surrogate) model.

(ii) Summary of results: The results of the white-box evaluation suggest that feedforward neural network models for credit card fraud detection are susceptible to the proposed PGD-based attack even for relatively strictly constrained perturbation bounds $ϵ\in \{0.05,0.1\}$ (cf. Equations (6) and (7)). For $ϵ=0.1$, the success rate of the white-box attack across two experimental runs was 2.42% and 0.61%, respectively. For $ϵ=0.05$, the obtained success rate was (approximately) 0.6% (cf. Table 6). The small number of adversarial vectors may be explained by the fact that they were derived from set ${\mathcal{D}}_1^{\prime }$, which was agnostic to the baseline model (cf. Section 3.1).

The black-box evaluation illustrated the extent to which adversarial vectors generated on a baseline (i.e., a surrogate attack) model may be transferred to a set of victim models (see Table 15). The adversarial vectors were derived from set ${\mathcal{D}}_1$, on which the baseline model was trained, and therefore the number of derived adversarial vectors was greater than in the white-box experiments. However, this is still in line with the black-box settings: the attacker has access to set ${\mathcal{D}}_1$, while the victim models are agnostic of this set. The attack success rate ranges from 28.64% for $ϵ=0.05$ to 65.24% for $ϵ=0.3$. In addition, for all perturbation values in each experimental run, Table 15 provides the margins of error for a 95% confidence interval. The confidence intervals are calculated using the t-distribution because the number of samples was less than 30 in each case. The margins of error are high (i.e., the confidence intervals are wide), indicating strong heterogeneous transfer behavior. However, even with a small number of samples, for $ϵ\in \{0.1,0.2,0.3\}$, the entire confidence intervals are positive, which may indicate that the effect is likely positive. For the smallest pertubation bound (i.e., $ϵ=0.05$), a statistically significant positive effect cannot be claimed.

In both white-box and black-box settings, the results of the standardized z-score analysis (cf. Table 7, Table 8 and Table 10) show that adversarial transaction vectors remain closely aligned with their corresponding original vectors in the feature space, i.e., the cosine similarity between an adversarial vector and its original counterpart consistently appears as an extreme value when compared to the reference distribution derived from similarities with all other dataset samples.

(iii) A consistency check: To evaluate the consistency of the reported results, we compared the findings against another constrained evasion attack—the targeted Basic Iterative Method (BIM). It was evaluated under the same conditions as the PGD attack, i.e., using random seed setting ${\mathcal{S}}_1$ and the same underlying training and test sets, baseline model, perturbation boundary constraints, parameter settings, vector selection criterion, and attack success criterion.

• The white-box BIM attack generated the same number of successful adversarial vectors as the PGD white-box attack, resulting in identical success rates to those reported in the PGD evaluation (cf. Table 6). The alignment of adversarial transaction vectors with the corresponding original fraudulent vectors was evaluated in

  Table 16. Alignment of adversarial transaction vector with the corresponding original fraudulent vector in the context of the white-box BIM attack with a perturbation bound of $ϵ=0.05$: the results of the z-score analysis within dataset ${\mathcal{D}}_1^{\prime }$.

  i	${\mathit{s}}_{\mathit{i},\mathbf{orig}}=\cos \left({\mathit{x}}_{\mathit{i},\mathbf{adv}},{\mathit{x}}_{\mathit{i}}\right)$	${\mathit{\mu }}_{\mathit{i},\mathbf{ref}}$	${\mathit{\sigma }}_{\mathit{i},\mathbf{ref}}$	${\mathit{z}}_{\mathit{i},\mathbf{orig}}$
  1	0.99981611	−0.00506206	0.21159025	4.74917050

  and

  Table 17. Alignment of adversarial transaction vector with the corresponding original fraudulent vector in the context of the white-box BIM attack with a perturbation bound of $ϵ=0.1$: the results of the z-score analysis within dataset ${\mathcal{D}}_1^{\prime }$.

  i	${\mathit{s}}_{\mathit{i},\mathbf{orig}}=\cos \left({\mathit{x}}_{\mathit{i},\mathbf{adv}},{\mathit{x}}_{\mathit{i}}\right)$	${\mathit{\mu }}_{\mathit{i},\mathbf{ref}}$	${\mathit{\sigma }}_{\mathit{i},\mathbf{ref}}$	${\mathit{z}}_{\mathit{i},\mathbf{orig}}$
  1	0.99927033	−0.0053105	0.21189997	4.74082566
  2	0.99917149	−0.00749639	0.16270481	6.18708116
  3	0.99775022	0.01107455	0.20399358	4.83679768
  4	0.99907762	−0.00726121	0.20351066	4.94489495

  .
• The adversarial vectors selected for the BIM black-box attack transferability analysis are summarized in

  Table 18. Summary of the alignment of adversarial transaction vectors selected for the transferability analysis with the corresponding original fraudulent vectors in the context of the black-box BIM attack: the results of the z-score analysis within dataset ${\mathcal{D}}_1$.

  Perturbation Bound $\mathit{ϵ}$	# Adv. Vectors	Average z-Score (st. dev)
  0.3	20	5.031 (±0.952)
  0.2	15	4.632 (±0.326)
  0.1	10	4.589 (±0.301)
  0.05	6	4.518 (±0.351)

  The symbol # is an abbreviation for “number”.

  . The results of the attack transferability evaluation are given in

  Table 19. Summary of the results of the BIM attack transferability evaluation across the selected victim models for different $ϵ$-values.

  Pert.	# Adv.	Avg. # Succ.	Margin of Error	Max. # Succ.	Attack
  Bound	Vectors	Attacks per	(95% Conf.	Attacks	Success
  $\mathbf{ϵ}$		Vector (st. dev.)	Interval)	per Vector	Rate
  0.3	20	582.950 (655.280)	±306.68	1940	$51.67\%\left({\displaystyle \frac{11,659}{22,564}}\right)$
  0.2	15	488.466 (566.749)	±313.89	1523	$62.35\%\left({\displaystyle \frac{7327}{11,750}}\right)$
  0.1	10	175.900 (198.105)	±141.71	488	$35.28\%\left({\displaystyle \frac{1759}{4985}}\right)$
  0.05	6	71.666 (84.554)	±88.71	220	$28.64\%\left({\displaystyle \frac{430}{1501}}\right)$

  The symbol # is an abbreviation for “number”.

  .

It can be observed that the BIM evaluation results obtained in both white-box and black-box settings are highly comparable to the results reported in the PGD evaluation. However, since BIM and PGD are closely related iterative gradient attacks, the reported BIM experiment should be interpreted as a consistency check rather than as broad validation of adversarial robustness.

(iv) Limitations of the scope of the study: There are some scope limitations which may affect the interpretation, reproducibility, or generalizability of the reported results. They are the following:

• Although the perturbation bounds were constrained to ensure a fair attack, the original meanings and dependencies of features V1–V28 are unavailable. Thus, we do not claim that high cosine similarity represents evidence of semantic or operational validity of the generated adversarial vectors. Instead, the reported results established only close mathematical proximity of adversarial transaction vectors to their original counterpart vectors.
• The underlying dataset is aged, collected over a period of several days, and no temporal or concept-drift evaluation was conducted; i.e., the study did not account for how data changes over time.
• This study was focused on feedforward neural network architectures. The applicability of the proposed attack to an extended set of model families was not considered.
• Although two runs were conducted for each PGD-based experiment in black-box settings, it should be noted that different perturbation bounds generate different sets of successful surrogate attacks. Consequently, attack success and transferability across perturbation bound values may still be influenced by changes in sample composition.
• Extending this approach so that each explanatory feature is assigned its own adaptively calculated perturbation boundary is part of future work.

7. Conclusions

This study proposed a targeted Projected Gradient Descent-based attack on feedforward neural network models for credit card fraud detection. The attack was evaluated in white-box and black-box settings, illustrating the extent to which adversarial vectors generated on a surrogate attack model may be transferred to a set of victim models. The experimental settings are designed to ensure a fair, mixed-feature attack, including introduction of perturbation bound constraints, preservation of the class imbalance, specification of attack success criteria, selection of victim models, and avoiding bias. The obtained adversarial transaction vectors are evaluated in terms of their effect on model predictions and their mathematical proximity to the corresponding original fraudulent vectors. Finally, the evaluation results and limitations of the scope of this study are discussed.

The reported findings highlighted the vulnerability of neural network-based fraud detection systems to both direct white-box attacks and transfer-based black-box attacks. They also emphasized the need for defence mechanisms adapted to tabular financial data, including adversarial training procedures that can improve the robustness of fraud detection models against adversarial samples.