  While the literature on security attacks and defense of Machine Learning (ML)
systems mostly focuses on unrealistic adversarial examples, recent research has
raised concern about the under-explored field of realistic adversarial attacks
and their implications on the robustness of real-world systems. Our paper paves
the way for a better understanding of adversarial robustness against realistic
attacks and makes two major contributions. First, we conduct a study on three
real-world use cases (text classification, botnet detection, malware
detection)) and five datasets in order to evaluate whether unrealistic
adversarial examples can be used to protect models against realistic examples.
Our results reveal discrepancies across the use cases, where unrealistic
examples can either be as effective as the realistic ones or may offer only
limited improvement. Second, to explain these results, we analyze the latent
representation of the adversarial examples generated with realistic and
unrealistic attacks. We shed light on the patterns that discriminate which
unrealistic examples can be used for effective hardening. We release our code,
datasets and models to support future research in exploring how to reduce the
gap between unrealistic and realistic adversarial attacks.
