A No-Defense Defense Against Gradient-Based Adversarial Attacks on ML-NIDS: Is Less More? Authors’ draft for soliciting feedback
Mohamed elShehaby, Ashraf Matrawy
I. I NTRODUCTION Deep Neural Network (DNN)-based Network Intrusion Detection Systems (NIDS) are vulnerable to gradient-based adversarial attacks, carefully crafted perturbations that cause the model to misclassify malicious traffic as benign. These attacks serve as the de facto benchmark for robustness evaluations because they represent a theoretical worst-case adversary. By leveraging the network’s loss gradients, they calculate the exact, mathematically optimal path required to cross a decision boundary, rigorously exposing the model’s underlying structural limits. Existing defenses, such as adversarial training, are effective but computationally expensive and reactive. This raises a more fundamental Research Question (RQ): Does the model have to be vulnerable in the first place? This paper argues that it does not. Through thousands of experiments varying network depth, feature dimensionality, activation functions, and dropout against numerous gradientbased attacks, we show that deliberate architectural choices alone can yield an inherently robust NIDS, which we term a “no-defense defense”, requiring no explicit defense mechanism. The main contributions of this paper are: 1 A largescale empirical study of how depth, feature dimensionality, activation functions, and dropout affect adversarial robustness in DNN-based NIDS. 2 Evidence that a shallow, reducedfeature, ReLU-based model constitutes an inherent no-defense defense against NIDS’ gradient-based adversarial attacks. 3 A demonstration that this recipe outperforms adversarially trained deep models on robustness, clean-traffic performance, and training efficiency. 4 An exploration of the practical relevance of gradient-based attacks in the NIDS domain and the implications for real-world deployment.
Loss J
on of ∇ xJ
Abstract—Gradient-based adversarial attacks subtly manipulate inputs of Machine Learning (ML) models to induce incorrect predictions. This paper investigates whether careful architectural choices alone can yield an inherently robust Deep Neural Network (DNN)-based Network Intrusion Detection Systems (NIDS), without any additional explicit defenses. Through thousands of experiments, around 2200, varying network depth, feature dimensionality, activation functions, and dropout across FGSM, PGD, and BIM attacks, we show that shallower networks, reduced feature sets, and ReLU activation consistently and jointly reduce adversarial vulnerability. Moreover, a simple model following this recipe outperforms deeper, fully-featured adversarially trained models, while maintaining near-perfect clean-traffic detection and lower training times. Nevertheless, while less is more, the selection of the right less is what truly matters. Index Terms—Machine Learning, Deep Neural Networks, Adversarial Attacks, Intrusion Detection Systems, Network Security
Directi
arXiv:2605.18666v1 [cs.LG] 18 May 2026
Carleton University, Ottawa, Canada
ϵ = 0.5 ϵ = 0.3 ϵ = 0.1
x
Fig. 1: Visualization of the FGSM attack mechanism on a 3D loss landscape. The figure illustrates the shift of the original input x in the direction of the loss gradient ∇x J(θ, x, y) across varying perturbation magnitudes ϵ.
II. G RADIENT-BASED A DVERSARIAL ATTACKS Gradient-based adversarial attacks against ML models involve adding carefully crafted perturbations to input data that are imperceptible to humans but can cause significant misclassification. These attacks were first systematically studied in the computer vision domain. A. Fast Gradient Sign Method (FGSM) A cornerstone and one of the most widely used evasion adversarial attack methods is the Fast Gradient Sign Method (FGSM) [1]. FGSM generates adversarial examples by adding perturbations in the direction of the gradient of the loss function with respect to the input. The mechanism is visualized in Figure 1, which demonstrates how an attacker climbs the loss landscape J to identify a point that maximizes model error. The adversarial example is computed as: xadv = x + ϵ · sign(∇x J(θ, x, y))
(1)
where x is the original input, xadv is the adversarial example, ϵ is the perturbation magnitude, ∇x J(θ, x, y) is the gradient of the loss function J, θ represents the model parameters, and y is the true label. As illustrated in Figure 2, as the epsilon parameter increases, the input x is pushed along the gradient direction until it crosses the decision boundary into the adversarial class region.
B. Iterative Adversarial Attacks While FGSM is a powerful single-step attack, more sophisticated iterative methods are often used to find more effective adversarial perturbations. • Basic Iterative Method (BIM) [2]: An extension of FGSM that applies the perturbation multiple times with a smaller step size α, clipping the intermediate results after each step to ensure they stay within an ϵ-neighborhood of the original input x. • Projected Gradient Descent (PGD): [3] PGD is essentially a multi-step BIM with a random start point within the ϵ-ball. This randomness allows PGD to explore the local loss landscape more effectively. The relationship between model architecture and these attack trajectories raises a fundamental question: if deeper networks inherently create more convoluted decision boundaries and complex loss landscapes, does this structural complexity provide adversarial algorithms with richer pathways to exploit? A simpler, shallower boundary may prove more resilient by offering fewer gradients for both single-step and iterative algorithms to successfully calculate a label-flipping perturbation. This paper aims to investigate this hypothesis through a largescale empirical study. C. “The Defense” A wide range of defenses against adversarial attacks has been proposed, including input preprocessing [4], defensive distillation [5], and ensemble methods [6]. Nevertheless, adversarial training is widely considered the most well-known and studied defense in the literature [7]. It works by augmenting the training data with adversarial examples, exposing the model to attacks during training so that it learns to correctly classify perturbed inputs. While sometimes effective, adversarial training is computationally expensive, as it requires generating adversarial examples at every training step, and its robustness is often tied to the specific attack used during training. III. R ELATED W ORK DNN Architecture and Adversarial Robustness: Prior work has explored how architectural choices affect adversarial vulnerability, including the roles of activation functions [8], skip connections [9], and model size. Huang et al. [10] showed that increasing model parameters does not necessarily improve robustness, and Simon-Gabriel et al. [11] established theoretically that adversarial vulnerability scales with input dimensionality. However, none of these studies examined DNN depth in the NIDS domain, which presents fundamentally different characteristics, lower-dimensional, structured, protocol-bound features and distinct data distributions compared to computer vision. Depth and Adversarial Robustness in NIDS: ElShehaby et al. [12] established that increasing DNN depth tends to reduce robustness in the NIDS domain, and highlighted the fundamental differences between NIDS and computer vision in the context of adversarial attacks. Our work builds directly on this finding; however, where they isolated layer depth as a single
Feature 2 Original Input Adversarial Example
Adversarial Class (y ′ ) xadv (ϵ = 0.5)
∇x J(θ, x, y)
xadv (ϵ = 0.3) xadv (ϵ = 0.1)
x
Decision Boundary
Benign Class (y) Feature 1
Fig. 2: Conceptual 2D representation of a gradient-based evasion attack. As the perturbation magnitude ϵ increases, the input x is pushed along the gradient direction, eventually crossing the decision boundary into the adversarial class region.
variable, we expand the investigation significantly, testing thousands of configurations across depth, feature dimensionality, activation functions, and dropout, with the goal of deriving a recipe for an inherently robust NIDS without any explicit defense. Hyper-Parameter Tuning for Robustness: Mendes et al. [13] explored hyper-parameter tuning to improve the effectiveness of adversarial training. While related in spirit, their work treats adversarial training as a given and optimizes around it, using computer vision datasets. Our work is positioned differently: we propose architectural design as a substitute for adversarial training, not a companion, and we operate entirely in the NIDS domain, where the problem structure, feature space, and threat model are fundamentally distinct. IV. T HREAT M ODEL We assume a white-box threat model in which the attacker has full knowledge of the target model, including its architecture, parameters, and gradients. The attacker’s goal is to compromise the integrity of the NIDS by crafting adversarial network traffic that evades detection, causing malicious flows to be misclassified as benign. We further assume the attacker has access to the feature space and can manipulate input features to construct adversarial examples. We consider only gradientbased evasion attacks, specifically FGSM, PGD, and BIM, at multiple perturbation budgets ε. We acknowledge that this threat model is intentionally generous to the attacker. In practice, NIDS are internal systems that are neither exposed nor queryable by outsiders, making white-box gradient access highly unrealistic in real-world deployments [14]. Nevertheless, we adopt this strong threat model deliberately: if a no-defense approach proves effective even under these harsh assumptions, its practical value in more realistic settings is only stronger.
Model 5 Model 4 Input (n) Model 3 Input (n) Model 2 Input (n)
Dense 64
Model 1 Input (n) Input (n)
Dense 64 Dense 64
Dense 64 Dense 64
Dense 128 Dense 128
Dense 128 Dense 128
Output (k)
Dense 512 Dense 512
Dense 128 Output (k)
1 hidden
2 hidden
Dense 128 Dense 128
Output (k) 3 hidden
Dense 64 Output (k) 4 hidden
Output (k) 5 hidden
I/O
Dense 64
Fig. 4: Cumulative feature importance across the dataset. The top 12 features account for approximately 95% of total predictive variance.)
Dense 128
Dense 512
Fig. 3: Architectures of the five DNN models. All share the same input (n features) and output (k classes) layers. Hidden layer shading indicates width: light = 64, medium = 128, dark = 512 units.
V. M ETHODOLOGY AND E XPERIMENTAL S YSTEM D ESCRIPTION Methodology: To explore the answer to our fundamental RQ, Does the model have to be vulnerable in the first place?, we adopt a systematic, large-scale experimental approach. If the answer is no, this immediately raises a follow-up RQ: What is the recipe for an inherently robust neural network, a concept we coin the “no-defense defense”, against gradientbased evasion adversarial attacks in the NIDS domain? To answer both, we evaluate approximately 2,200 model configurations, systematically varying network depth, input feature dimensionality, activation functions, and dropout across FGSM, PGD, and BIM attacks at multiple perturbation budgets. This design allows us to isolate the individual contribution of each architectural variable to adversarial robustness and observe how they interact when combined. Finally, we compare the best-performing configuration against adversarially trained deep models to evaluate whether deliberate architectural design can serve as a practical substitute for explicit defenses. Dataset: We use the CSE-CIC-IDS2018 dataset [15], a widely adopted benchmark covering a broad range of attack categories, including Brute Force, DoS, and DDoS, alongside benign traffic. Specifically, we adopt the improved version curated by Liu et al. [16], which addresses known issues in the original release related to erroneous feature generation and incorrect labeling, yielding a more reliable foundation for adversarial robustness research. Pre-Processing: To begin with, non-generalizable columns such as flow IDs and timestamps are removed, and the tar-
get variable is label-encoded. Categorical features are onehot encoded. We also extract the geographic region from the destination IP using the ipapi library [17] and the application layer protocol from the destination port, before onehot encoding them. Following the caution of Arp et al. [18], we never use raw IP addresses as numerical inputs; only derived, semantically meaningful attributes are retained to avoid spurious correlations. Ultimately, this feature engineering and encoding pipeline yields a total of 123 input features. Furthermore, numerical features are standardized to zero mean and unit variance using parameters fitted exclusively on the training set to prevent data leakage. Class imbalance is addressed via random undersampling [19] on the training set. Neural Networks: We evaluate five DNN architectures of increasing depth, ranging from one to five hidden layers. The full architectural details of each model, including layer sizes, are illustrated in Figure 3. Activation functions and dropout are intentionally varied across experiments, as the core objective of this work is to identify the architectural environment most conducive to an inherent, no-defense defense against gradientbased adversarial attacks. Adversarial Attacks: The Adversarial Robustness Toolbox (ART) library [20] was used to generate FGSM [1], Projected Gradient Descent (PGD) [3], and Basic Iterative Method (BIM) [2] adversarial attacks. VI. E XPERIMENTAL R ESULTS AND A NALYSIS A. Baseline Performance and Feature Space Characterization To systematically evaluate the adversarial robustness of MLbased NIDS, we began by analyzing the relative importance of the dataset’s features. To obtain the importance of each feature, we used the “SelectKBest” selector, which utilizes the Analysis of Variance (ANOVA) F-test to compute the ratio of between-group variance to within-group variance for each feature relative to the target classes. Figure 4 plots the resulting cumulative feature importance across the dataset. The curve demonstrates a sharp initial ascent, indicating that a very small subset of features captures the vast majority of the predictive variance. Specifically, the top 12 features account for a highly significant portion of the total importance, rapidly
Fig. 5: Normalized importance scores of the top 20 individual features, showing a steep drop-off after the highest-ranking features.
Fig. 6: Mean ASR across model depths.
TABLE I: Performance of models before the attack across different feature set sizes. Features
Model
Accuracy
Precision
Recall
F1-Score
T. T. (s)
12
Model 1 Model 2 Model 3 Model 4 Model 5
0.9953 0.9966 0.9974 0.9974 0.9974
0.9747 0.9976 0.9988 0.9986 0.9986
0.9465 0.9465 0.9576 0.9582 0.9582
0.9604 0.9714 0.9778 0.9780 0.9780
7.49 10.09 13.20 23.34 31.24
30
Model 1 Model 2 Model 3 Model 4 Model 5
0.9994 0.9995 0.9999 0.9999 1.0000
0.9910 0.9924 0.9989 0.9981 0.9998
0.9991 0.9996 0.9996 0.9998 0.9998
0.9950 0.9960 0.9993 0.9990 0.9998
8.05 10.90 14.04 23.54 31.23
50
Model 1 Model 2 Model 3 Model 4 Model 5
0.9994 0.9996 1.0000 0.9999 1.0000
0.9917 0.9945 0.9998 0.9991 0.9996
0.9983 0.9996 0.9996 0.9996 0.9996
0.9950 0.9970 0.9997 0.9993 0.9996
8.05 11.00 14.24 24.34 32.04
75
Model 1 Model 2 Model 3 Model 4 Model 5
0.9994 0.9995 1.0000 1.0000 1.0000
0.9908 0.9930 0.9996 0.9998 0.9996
0.9996 0.9996 0.9996 0.9996 0.9996
0.9952 0.9963 0.9996 0.9997 0.9996
8.39 11.57 17.26 25.04 32.63
100
Model 1 Model 2 Model 3 Model 4 Model 5
0.9999 0.9999 1.0000 1.0000 1.0000
0.9985 0.9989 0.9994 0.9996 0.9994
0.9996 0.9998 0.9998 0.9998 0.9998
0.9991 0.9993 0.9996 0.9997 0.9996
8.62 13.73 14.99 24.84 32.20
123
Model 1 Model 2 Model 3 Model 4 Model 5
0.9996 0.9999 0.9997 1.0000 0.9998
0.9934 0.9994 0.9956 0.9996 0.9961
0.9998 0.9996 0.9998 0.9996 0.9998
0.9966 0.9995 0.9977 0.9996 0.9980
8.95 13.24 29.79 25.62 37.06
Fig. 7: Effect of ε on ASR across model depths. and training times across all models and feature dimensions. The final column, denoted as T. T. (s), represents the Training Time in seconds, demonstrating the expected computational trade-off where deeper network architectures and larger feature dimensions naturally require more time to train. While the 12feature subset achieves strong baseline accuracy (consistently above 0.995), its F1-scores, ranging from 0.9604 for the shallowest model to 0.9780 for the deepest, do not quite reach the peak performance of models trained on wider feature sets. For instance, once the feature space expands to 30 or more features, the models achieve near-perfect F1-Scores consistently exceeding 0.9950. However, the slightly lower F1-Score at 12 features is an acceptable and expected trade-off for establishing our tightly constrained baseline. B. The Effect of Neural Network Depth on Robustness
approaching the 95% threshold. The disproportionate influence of these specific attributes is further detailed in Figure 5, which illustrates the normalized importance scores of the top 20 individual features. A steep drop-off in relevance is evident immediately after the highest-ranking features. This justifies our decision to establish 12 features as our minimal experimental baseline; it provides a highly constrained, yet mathematically representative, feature space to test how adversarial attacks operate when the attacker’s manipulable input surface is severely limited. Having defined these subsets, we evaluated the baseline performance of all five neural network architectures on clean, unperturbed network traffic prior to any adversarial manipulation. Table I details the Accuracy, Precision, Recall, F1-Score,
With the baseline performance established, we turn to the central hypothesis of this study: whether increasing the depth
Fig. 8: ASR across model depths for FGSM, PGD, and BIM.
Fig. 9: Joint effect of feature dimensionality, model depth, and perturbation budget on ASR.
of a neural network inherently degrades its robustness against gradient-based adversarial evasion attacks in the NIDS domain. To measure how effectively the attacks compromise each architecture, we use the Attack Success Rate (ASR), defined as the proportion of adversarial examples that successfully caused the model to flip its prediction from the correct class to an incorrect one [4]. ASR ranges from 0 to 1, where 0 indicates no successful attacks, and 1 indicates that every crafted adversarial example fooled the model. We evaluated the ASR across the five model architectures, varying the perturbation intensity (ϵ) and attack algorithms. Figure 6 plots the mean ASR across all experimental conditions, aggregated over feature set sizes, perturbation budgets, and attack algorithms, for each model depth. A clear upward trend is observable: as the architecture transitions from a single hidden layer (Model 1) to five hidden layers (Model 5), the mean ASR rises consistently. This indicates that deeper networks are structurally more vulnerable on average, regardless of the specific experimental conditions. The added complexity of deeper models appears to create more convoluted decision boundaries, providing adversarial algorithms with richer gradient pathways to exploit. This trend is also consistent across different perturbation budgets. Figure 7 isolates the effect of ϵ across the different model depths. As expected, a higher ϵ results in a higher ASR across all models, and deeper models remain more vulnerable regardless of the perturbation budget. Finally, we confirm that this architectural behavior is not isolated to a single attack methodology. Figure 8 plots the ASR for FGSM, PGD, and BIM attacks against the varying model depths. While the more sophisticated iterative attacks (PGD and
BIM) generally achieve higher success rates than the singlestep FGSM, all three algorithms exhibit the exact same upward trajectory. C. Impact of Feature Dimensionality on Attack Surface Figure 9 illustrates how expanding the input feature space (from 12 to 123 features) compounds adversarial vulnerability. A clear trend emerges: broader feature dimensionality directly increases the ASR. Interestingly, at the tightly constrained 12-feature baseline, several configurations exhibit a non-zero ASR that initially drops as the feature count increases to 30. This initial success likely occurs because with only 12 heavily weighted features available, successful perturbations inevitably alter core characteristics enough to cross the decision boundary. However, as the feature space expands beyond this initial dip, the ASR climbs dramatically. A wider input vector provides gradient-based algorithms with more degrees of freedom, allowing them to distribute subtle perturbations across dozens of less-critical features without violating the ϵ constraint. D. Influence of Activation Functions on ASR We further investigated how the choice of activation functions affects adversarial vulnerability by evaluating the architectures using ReLU, Tanh, and ELU. Figure 10 illustrates the overall ASR grouped by activation function across the three attack methodologies. The results clearly indicate that ReLU provides the highest robustness, maintaining a significantly lower ASR compared to the alternatives. This dynamic is explored across varying network architectures in Figure 11, which plots ASR scaling with model depth for each activation function. While all three functions demonstrate the established trend of increasing vulnerability as
Fig. 10: Mean ASR grouped by activation function across all attack types.
Fig. 12: Effect of dropout on ASR across model architectures (dropout probability = 0.5)
Fig. 11: ASR scaling with model depth for ReLU, Tanh, and ELU.
Fig. 13: Distribution of confidence drop across model depths.
F. Confidence Drop the network deepens, their baseline vulnerability levels differ drastically. ReLU suppresses the ASR across all depths, exhibiting a much shallower degradation curve. In contrast, Tanh and ELU initiate at significantly higher vulnerability baselines even in shallow configurations and maintain this elevated ASR as depth increases. In Figures 10 and 11, the reported performance metrics represent the mean values aggregated across various experimental conditions, including differing model depths, perturbation budgets (ϵ), and feature dimensions. To rigorously quantify the variance and stability of these models under different hyperparameters, our visualizations incorporate 95% confidence intervals, represented as confidence bars in the bar charts and shaded confidence bands in the line plots.
Analyzing the confidence reduction of the models alongside their ASR reveals a critical duality in how different architectures react to adversarial manipulation. The confidence drop is defined as the decrease in the model’s predicted probability for the correct class between the original and adversarial inputs. Figure 13 shows the overall variance and magnitude of the confidence drop across model depths. The box plot shows that the shallowest network (Model 1) experiences a significant median confidence drop with a wide variance. When paired with its low ASR, this indicates that while the shallow model successfully resists label-flipping, the adversarial perturbations successfully induce a high degree of uncertainty. Conversely, the deepest network (Model 5) displays a tightly bound, minimal drop in confidence. Because deep models also exhibit a high ASR, this
E. Evaluating the Effect of Dropout We further examined the impact of dropout on adversarial robustness by comparing models trained with and without a dropout probability of 0.5. As illustrated in Figure 12, the introduction of dropout does not yield a significant shift in the ASR across the various model architectures. While dropout is traditionally employed to prevent overfitting by reducing co-dependency between neurons, our results indicate that the difference in vulnerability is marginal. In some configurations, such as Model 5, a slight decrease in ASR is noticed when dropout is applied; however, the high degree of overlap in the 95% confidence intervals suggests that dropout is not a determinative factor in the robustness of models against gradient-based adversarial attacks.
Fig. 14: Confidence drop as a function of input feature count across model depths.
Fig. 15: Confidence drop across attack types and model depths.
points to a dangerous failure mode: deeper networks easily fall for adversarial examples and confidently produce incorrect predictions. This behavior is consistent across all input dimensions. As shown in Figure 14, while model depth decreases the confidence drop, the drop is largely unaffected by the input feature count (12 to 123). Moreover, Figure 15 demonstrates that this trend persists regardless of the attack methodology. While iterative methods like PGD and BIM generally inflict a slightly more pronounced confidence reduction compared to the single-step FGSM, all three algorithms produce the exact same downward trajectory in confidence drop as model depth increases. Ultimately, the results confirm that attacks on deep models result in highly confident misclassifications, whereas attacks on shallow models fail to change the prediction but succeed in shaking the model’s certainty. G. No-Defense Defense vs Adversarial Training Based on our preceding experimental results, we propose that an effective “no-defense defense” against adversarial attacks in the NIDS domain consists of designing a model with three fundamental characteristics: a shallow architecture, a constrained feature space (not overly reduced, but around 30 features depending on the dataset), and the ReLU activation function. To rigorously evaluate the robustness of this inherent structural defense, we compare our undefended baseline against the most widely used and robust defense mechanism in the field: adversarial training [21], [22]. Figures 16, 17, and 18 illustrate the Average ASR of our simple baseline (Model 1, trained on 30 features using ReLU) compared to deeper architectures (Models 4 and 5, trained on all features) that have been adversarially trained across ReLU, ELU, and Tanh activation functions, respectively. The data reveal that the structural resilience of the optimal shallow model consistently outperforms the post-hoc defense applied to deeper networks. As demonstrated in Figure 16, at a severe perturbation budget of ϵ = 0.5, the undefended shallow baseline successfully restricts the ASR to below 0.3. Conversely, the deeper models, despite being adversarially trained, suffer ASR spikes exceeding 0.5 and 0.6. This disparity in robustness is even more drastic when examining saturating activation functions. Figures 17 and 18 show that adversarially trained deep models utilizing ELU and Tanh suffer near-total compromise (ASR approaching 1.0)
Fig. 16: Evaluating the Robustness of a No-Defense Baseline Against Adversarially Trained Deep ReLU Networks
Fig. 17: Evaluating the Robustness of a No-Defense Baseline Against Adversarially Trained Deep ELU Networks under high perturbation (ϵ = 0.5). In contrast, our undefended baseline maintains its comparatively low vulnerability. Ultimately, these comparisons demonstrate that architectural simplicity provides a superior, naturally robust foundation. In NIDS applications, strategically limiting model depth and feature dimensions while utilizing ReLU yields better adversarial resistance than applying computationally expensive adversarial training to inherently vulnerable deep networks. VII. D ISCUSSION A. Is less more? The short answer is yes, but not a blind yes. Across experiments, reducing architectural complexity and input dimensionality consistently improves robustness against gradientbased adversarial attacks. However, the relationship is not
Fig. 18: Evaluating the Robustness of a No-Defense Baseline Against Adversarially Trained Deep Tanh Networks
monotonic, and blindly minimizing every design dimension can backfire. For layer depth, the trend is clear. As seen in Figure 8, regardless of the underlying mathematical approach used to craft adversarial examples, whether the single-step FGSM or the iterative PGD and BIM, increasing the number of hidden layers expands the usable attack surface. As the architecture grows from one hidden layer (Model 1) to five (Model 5), the ASR generally rises across almost all feature set sizes, perturbation budgets, and attack types. Deeper networks usually create more convoluted decision boundaries, giving gradientbased algorithms richer pathways to exploit. Consequently, for NIDS applications where the feature space is rigidly structured by network protocol constraints, the deeper is better paradigm is a dangerous misconception; shallow networks provide a strong, natural, no-defense defense against gradient-based manipulations. Using fewer features similarly reduces the attack surface, but the picture is more nuanced. The general trend holds, a wider input vector gives attackers more degrees of freedom to distribute perturbations, but as seen in Fig. 9, at ε = 0.3 and ε = 0.1, the 12-feature models actually show a higher ASR than the 30-feature models, before the expected upward trend resumes. With only 12 heavily weighted features, even a small perturbation inevitably disturbs the most discriminative inputs, making it easier to cross the decision boundary despite the tight surface. Furthermore, as shown in Table I, the 12-feature models carry a clean performance cost, with F1-Scores falling noticeably below those of models trained on 30 or more features. So the minimum is not the optimum. These results highlight that depth, feature count, and activation function are correlated, interconnected design knobs. The evidence strongly favors smaller models, but the sweet spot lies in deliberate, informed reduction, not blind minimization. We should certainly explore less, but always with the full picture in view. B. Do we need all these features? A clear trend is emerging in the NIDS research community: datasets are growing wider with every generation. Before onehot encoding, the UNSW-NB15, 2015, dataset contained features in the 40s, the CSE-CIC-IDS, 2018, dataset expanded into the 80s, and the more recent BCCC-CSE-CIC-IDS2018, 2025, dataset now carries over 300 features. The implicit assumption driving this trend is that more features mean better detection; nevertheless, our results challenge that assumption directly. ElShehaby et al. [4] demonstrated that a carefully selected subset of features is sufficient to build outstanding detection models, and our experimental results strongly agree. As shown in Table I, models trained on as few as 30 features achieve near-perfect F1-Scores, matching or exceeding the performance of models trained on the full feature set, while also being significantly faster to train. This is consistent with the broader observation by Grosse et al. [23], who noted that datasets in AI security research tend to carry far more features than are encountered in real-world deployments. From an adversarial robustness perspective, feature bloat is not merely inefficient;
it is a liability. As demonstrated in Fig. 9, a wider input vector directly expands the attack surface, giving gradient-based algorithms more degrees of freedom to distribute perturbations across features without triggering detection. In short, the additional features slow down training, add no meaningful detection gain, and make the model measurably easier to attack. We do not need all these features. C. Why ReLU? The superior robustness of the ReLU activation function stems fundamentally from its piecewise linear mathematical structure, which naturally induces a defensive phenomenon known as gradient masking. As seen in Figure 19, unlike smooth, saturating functions like Tanh and ELU, which maintain continuous, non-zero derivatives that attack algorithms can easily trace backward to calculate optimal input perturbations, ReLU outputs an exact zero derivative for any negative input. During an attack, these zero-state neurons effectively shatter the backward propagation of the loss gradient, reducing the adversarial algorithm’s ability to identify perturbation pathways. Furthermore, this property creates inherent network sparsity, which severely restricts the manipulable attack surface within the already tightly constrained NIDS feature space, making it significantly harder for attackers to mathematically map and exploit the model’s decision boundaries. f ′ (x) 1 ReLU’ tanh’ ELU’ (α = 1)
0.5
x −4
−3
−2
−1
1
2
3
4
Fig. 19: Derivatives of the ReLU, Tanh, and ELU activation functions. ReLU (blue) outputs exactly zero for any negative input, while Tanh (red, dashed) and ELU (green, dash-dotted) maintain non-zero derivatives throughout.
D. Are these attacks practical in the NIDS domain? Gradient-based attacks are a powerful research tool; however, they are not particularly practical in the real-world NIDS domain. A real attacker does not have white-box access to a deployed model’s gradients, and NIDS systems are not designed to be queried by outsiders. Furthermore, NIDS features are highly correlated and constrained, making these attacks even more infeasible. Apruzzese et al. [24] noted that there is no concrete evidence that any real-world attacker has ever used gradients to conduct an intrusion evasion attack. Moreover, the authors argue that the most practical attacks are simple, gradient-free blind perturbations [25] that require no model
knowledge, no query access, and are trivially easy to generate [14]. This context makes our no-defense defense even more compelling, as most defenses against gradient-based adversarial perturbations are expensive and provide high overhead with low return in the NIDS domain. E. The Win-Win Argument of a No-Defense The findings of this paper converge on a result that is, at first glance, counterintuitive: doing less yields more on every front simultaneously. As demonstrated in Section VI-G, our proposed recipe, a shallow architecture, approximately 30 features (for this dataset), and ReLU activation, consistently outperforms deeper, all-feature models that were adversarially trained, the most popular and effective yet computationally expensive defense in the field, while simultaneously achieving near-perfect F1-Scores on clean traffic and significantly lower training times. There is no defense to implement, no overhead to absorb, and no performance penalty to accept. The architecture itself is the defense, not a perfect one: although it significantly reduces the ASR in most cases, it does not nullify the attacks, though neither do most explicit defenses. It is, however, a strong, practical, and inherently built-in layer of resistance that comes at no additional cost. VIII. C ONCLUSION This paper demonstrated that deliberate architectural choices can serve as an inherent implicit defense against gradientbased adversarial attacks on DNN-based NIDS, without any explicit defense mechanism. Across thousands of experiments, we consistently found that shallower networks, reduced feature dimensionality, and ReLU activation each reduce adversarial vulnerability, and that their effects compound when combined. Dropout, by contrast, had a less drastic impact on robustness. A model following this recipe, one hidden layer, approximately 30 features, and ReLU, not only outperformed adversarially trained deep models in robustness, but also achieved near-perfect clean-traffic detection at a fraction of the training cost. The architecture itself is the defense. Future work should explore the generalizability of these findings across other NIDS datasets and investigate the interaction between this inherent robustness and practical, domain-constrained adversarial perturbations. R EFERENCES [1] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572, 2014. [2] A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” in Artificial intelligence safety and security. Chapman and Hall/CRC, 2018, pp. 99–112. [3] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” arXiv preprint arXiv:1706.06083, 2017. [4] M. ElShehaby and A. Matrawy, “A novel perturb-ability score to mitigate evasion adversarial attacks on flow-based ml-nids,” Journal of Information Security and Applications, vol. 99, p. 104409, 2026. [5] N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami, “Distillation as a defense to adversarial perturbations against deep neural networks,” in 2016 IEEE Symposium on Security and Privacy (SP). IEEE, 2016, pp. 582–597.
[6] M. elShehaby, A. Kotha, and A. Matrawy, “Adaptive continuous adversarial training (acat) to enhance ml-nids robustness,” in ICC 2025 - IEEE International Conference on Communications, 2025, pp. 1091–1096. [7] P. Bountakas, A. Zarras, A. Lekidis, and C. Xenakis, “Defense strategies for adversarial machine learning: A survey,” Computer Science Review, vol. 49, p. 100573, 2023. [8] M. Salimi, M. Loni, and M. Sirjani, “Learning activation functions for adversarial attack resilience in cnns,” in International Conference on Artificial Intelligence and Soft Computing. Springer, 2023, pp. 203– 214. [9] G. Cazenavette, C. Murdock, and S. Lucey, “Architectural adversarial robustness: The case for deep pursuit,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 7150– 7158. [10] H. Huang, Y. Wang, S. Erfani, Q. Gu, J. Bailey, and X. Ma, “Exploring architectural ingredients of adversarially robust deep neural networks,” Advances in neural information processing systems, vol. 34, pp. 5545– 5559, 2021. [11] C.-J. Simon-Gabriel, Y. Ollivier, L. Bottou, B. Schölkopf, and D. LopezPaz, “First-order adversarial vulnerability of neural networks and input dimension,” in International conference on machine learning. PMLR, 2019, pp. 5809–5817. [12] M. ElShehaby and A. Matrawy, “Exploring the effect of dnn depth on adversarial attacks in network intrusion detection systems,” arXiv preprint arXiv:2510.19761, 2025. [13] P. Mendes, P. Romano, and D. Garlan, “Hyper-parameter tuning for adversarially robust models,” arXiv preprint arXiv:2304.02497, 2023. [14] M. elShehaby and A. Matrawy, “Evasion adversarial attacks remain impractical against ml-based network intrusion detection systems, especially dynamic ones,” 2026. [Online]. Available: https://arxiv.org/ abs/2306.05494 [15] I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, “Toward generating a new intrusion detection dataset and intrusion traffic characterization.” ICISSp, vol. 1, pp. 108–116, 2018. [16] L. Liu, G. Engelen, T. Lynar, D. Essam, and W. Joosen, “Error prevalence in nids datasets: A case study on cic-ids-2017 and cse-cic-ids-2018,” in 2022 IEEE Conference on Communications and Network Security (CNS). IEEE, 2022, pp. 254–262. [17] “ipapi,” https://pypi.org/project/ipapi/, 2024, accessed: 2024-10-10. [18] D. Arp, E. Quiring, F. Pendlebury, A. Warnecke, F. Pierazzi, C. Wressnegger, L. Cavallaro, and K. Rieck, “Dos and don’ts of machine learning in computer security,” in 31st USENIX Security Symposium (USENIX Security 22), 2022, pp. 3971–3988. [19] B. Liu and G. Tsoumakas, “Dealing with class imbalance in classifier chains via random undersampling,” Knowledge-Based Systems, vol. 192, p. 105292, 2020. [20] M.-I. Nicolae, M. Sinn, M. N. Tran, B. Buesser, A. Rawat, M. Wistuba, V. Zantedeschi, N. Baracaldo, B. Chen, H. Ludwig et al., “Adversarial robustness toolbox v1. 0.0,” arXiv preprint arXiv:1807.01069, 2018. [21] R. Abou Khamis and A. Matrawy, “Evaluation of adversarial training on different types of neural networks in deep learning-based idss,” in 2020 international symposium on networks, computers and communications (ISNCC). IEEE, 2020, pp. 1–6. [22] R. Abou Khamis, M. O. Shafiq, and A. Matrawy, “Investigating resistance of deep learning-based ids against adversaries using min-max optimization,” in ICC 2020-2020 IEEE International Conference on Communications (ICC). IEEE, 2020, pp. 1–7. [23] K. Grosse, L. Bieringer, T. R. Besold, and A. M. Alahi, “Towards more practical threat models in artificial intelligence security,” in 33rd USENIX Security Symposium (USENIX Security 24), 2024, pp. 4891–4908. [24] G. Apruzzese, H. Anderson, S. Dambra, D. Freeman, F. Pierazzi, and K. Roundy, “Position:“real attackers don’t compute gradients”: Bridging the gap between adversarial ml research and practice,” in IEEE Conference on Secure and Trustworthy Machine Learning. IEEE, 2022. [25] G. Apruzzese, A. Fass, and F. Pierazzi, “When adversarial perturbations meet concept drift: an exploratory analysis on ml-nids,” in Proceedings of the 2024 Workshop on Artificial Intelligence and Security, 2024, pp. 149–160.