Adversarial Robustness of Machine Learning-based Fraud Detection Systems: An Empirical Evaluation of Attack Impact and Mitigation in Fintech Environments

Abstract

This study evaluated the adversarial robustness of machine learning-based fraud detection systems by comparing classifier vulnerability profiles and assessing adversarial training as a mitigation strategy. Using the IEEE-CIS Fraud Detection dataset, comprising 590,540 transactions with a fraud incidence of 3.5%, four classifiers—logistic regression, random forest, gradient boosting, and a feed-forward neural network—were trained under identical preprocessing and class-weighting conditions and then subjected to Fast Gradient Sign Method and Projected Gradient Descent attacks at a perturbation budget of 0.02. Adversarial examples were constructed directly using closed-form and backpropagated gradients for the differentiable classifiers and using a logistic regression surrogate for the non-differentiable ensembles, before adversarial training was applied as a post-attack mitigation stage. Logistic regression proved the most adversarially vulnerable architecture, sustaining a 31.12-percentage-point recall loss under Projected Gradient Descent, while adversarial training subsequently restored its recall from 0.39 to 0.999 at an accuracy cost of 0.10 percentage points. Random forest and gradient boosting were not degraded by the surrogate-based attack, indicating that comparative robustness claims for tree-based ensembles require attack methods suited to their non-differentiable structure rather than transfer-based evaluation alone. Within the scope of this single-dataset evaluation, the findings support the adoption of adversarial training for gradient-based fraud detection models and suggest that robustness claims should be accompanied by disclosure of the attack methodology used to establish them.