Generating Realistic Adversarial Examples for Business Processes using Variational Autoencoders

TL;DR

This paper presents novel latent space attack methods for generating realistic adversarial examples in predictive business process monitoring, ensuring the adversaries respect process constraints and data distributions.

Contribution

Introduction of two domain-agnostic latent space attack techniques that generate realistic adversarial examples for business processes without relying on process-specific knowledge.

Findings

Latent space attacks outperform traditional methods in realism and effectiveness.

Adversarial examples generated within data distributions improve model robustness.

Evaluation on real-life logs demonstrates practical applicability.

Abstract

In predictive process monitoring, predictive models are vulnerable to adversarial attacks, where input perturbations can lead to incorrect predictions. Unlike in computer vision, where these perturbations are designed to be imperceptible to the human eye, the generation of adversarial examples in predictive process monitoring poses unique challenges. Minor changes to the activity sequences can create improbable or even impossible scenarios to occur due to underlying constraints such as regulatory rules or process constraints. To address this, we focus on generating realistic adversarial examples tailored to the business process context, in contrast to the imperceptible, pixel-level changes commonly seen in computer vision adversarial attacks. This paper introduces two novel latent space attacks, which generate adversaries by adding noise to the latent space representation of the input data, rather than directly modifying the input attributes. These latent space methods are domain-agnostic and do not rely on process-specific knowledge, as we restrict the generation of adversarial examples to the learned class-specific data distributions by directly perturbing the latent space representation of the business process executions. We evaluate these two latent space methods with six other adversarial attacking methods on eleven real-life event logs and four predictive models. The first three attacking methods directly permute the activities of the historically observed business process executions. The fourth method constrains the adversarial examples to lie within the same data distribution as the original instances, by projecting the adversarial examples to the original data distribution.