Conformance/compliance-Constrained Gradient Attacks for Predictive Process Monitoring

Provided and advised by: Henryk Mustroph

Introduction:
Machine learning models trained on event log data predict what happens next in a running case. These predictive process monitoring (PPM) models increasingly support real operational decisions, and as they do, their reliability under unexpected or adversarial input becomes critical. Article 15 of the EU AI Act makes this concrete: high-risk AI systems must be robust against inputs designed to manipulate their outputs, throughout their entire lifecycle.
The standard tool for measuring this robustness is a gradient-based adversarial attack. Rather than testing random noise, a gradient attack uses the model's own internal signals to find the worst-case input change, the smallest modification that causes the largest prediction error. This makes gradient attacks the most principled and efficient robustness probe available, and the benchmark the research community uses to compare defenses.
Applying this to PPM, however, reveals a problem. A prefix, the sequence of events recorded so far in a running case (i.e., a PPM model input), is not arbitrary data. It must follow the rules of the underlying business process: control-flow constraints encoded in a process model, and compliance rules such as "a credit check must precede a loan decision," expressible in constraint languages like DECLARE, etc. A gradient step applied freely to a prefix will almost always produce a sequence the process could never generate, which is just unrealistic. Attacking a model with such inputs does not measure real-world robustness, it tests behavior on scenarios that cannot occur.
This thesis asks: how can someone build a gradient attack that only produces valid, process-conformant prefixes, with conformance enforced inside the attack mechanism, not as an afterthought? It determines whether robustness evaluations in PPM are meaningful at all.
Task:
• Perform a systematic literature review on robustness in PPM, neuro-symbolic PPM and related gradient attack mechanisms in other domains.
• Based on the resulting knowledge design a theoretical solution artefact, e.g., new algorithm
• Implement and evaluate the effect of the new designed gradient attack method.

Recommended Readings:
PPM & Robustness (SOTA)
• Stevens et al. (2022). Assessing the Robustness in PPM through Adversarial Attacks. ICPM.
• Stevens et al. (2023). Manifold Learning for Adversarial Robustness in PPM. ICPM.
Gradient Attacks
• Goodfellow et al. (2015). Explaining and Harnessing Adversarial Examples. ICLR.
• Madry et al. (2018). Towards Deep Learning Models Resistant to Adversarial Attacks. ICLR

Topics: Process Mining, Artificial Intelligence.

The application must contain:
• Application Form (check the requirements on the website).
• Current Transcript of Records.
• CV.
Please send the application to bachelor.i17(at)in.tum.de OR master.i17(at)in.tum.de
(depending on your study) AND (in cc) henryk.mustroph(at)tum.de.