Investigating Imperceptibility of Adversarial Attacks on Tabular Data: An Empirical Analysis

Abstract

Adversarial attacks are a potential threat to machine learning models by causing incorrect predictions through imperceptible perturbations to the input data. While these attacks have been extensively studied in unstructured data like images, applying them to tabular data, poses new challenges. These challenges arise from the inherent heterogeneity and complex feature interdependencies in tabular data, which differ from the image data. To account for this distinction, it is necessary to establish tailored imperceptibility criteria specific to tabular data. However, there is currently a lack of standardised metrics for assessing the imperceptibility of adversarial attacks on tabular data. To address this gap, we propose a set of key properties and corresponding metrics designed to comprehensively characterise imperceptible adversarial attacks on tabular data. These are: proximity to the original input, sparsity of altered features, deviation from the original data distribution, sensitivity in perturbing features with narrow distribution, immutability of certain features that should remain unchanged, feasibility of specific feature values that should not go beyond valid practical ranges, and feature interdependencies capturing complex relationships between data attributes. We evaluate the imperceptibility of five adversarial attacks, including both bounded attacks and unbounded attacks, on tabular data using the proposed imperceptibility metrics. The results reveal a trade-off between the imperceptibility and effectiveness of these attacks. The study also identifies limitations in current attack algorithms, offering insights that can guide future research in the area. The findings gained from this empirical analysis provide valuable direction for enhancing the design of adversarial attack algorithms, thereby advancing adversarial machine learning on tabular data.

What this paper studies

A small numerical change is not necessarily a plausible change to a tabular record. Features have different scales, meanings and relationships: an attack can stay close to the original input while changing an immutable attribute or producing an invalid combination of values.

This paper asks how to characterise imperceptibility for tabular adversarial attacks and how existing attacks behave when assessed through that broader lens.

The contribution

We organise imperceptibility around seven properties:

The empirical study evaluates five attacks, combining quantitative measurement with qualitative analysis of domain-dependent properties. It examines the trade-off between causing misclassification and retaining plausible records.

How to use this work

Use the properties to make an evaluation’s assumptions explicit. Report attack effectiveness alongside the relevant imperceptibility measures, and identify which constraints require domain knowledge. A single distance threshold cannot stand in for all seven properties.

Scope and limitations

The properties provide an evaluation framework. The experiments do not establish that every domain has the same valid ranges, immutable attributes or dependencies. Those must be specified for the application. The paper also discusses the effects of one-hot encoding, proximity-focused attacks and assumptions about feature importance.

Place in my research

This study establishes the evaluation questions explored further in TabAttackBench. My on-manifold attack work then investigates generation methods that better preserve statistical consistency.

Related research

• Crafting Imperceptible On-Manifold Adversarial Attacks for Tabular Data
• TabAttackBench: A Benchmark for Adversarial Attacks on Tabular Data

Citation

Cite the published version using 10.1016/j.iswa.2024.200461.

@article{ISWA2025,
  author = {He, Zhipeng and Ouyang, Chun and Alzubaidi, Laith and Barros, Alistair and Moreira, Catarina},
  title = {Investigating Imperceptibility of Adversarial Attacks on Tabular Data: An Empirical Analysis},
  journal = {Intelligent Systems with Applications},
  year = {2025},
  volume = {25},
  eid = {200461},
  doi = {10.1016/j.iswa.2024.200461}
}