Crafting Imperceptible On-Manifold Adversarial Attacks for Tabular Data

Abstract

Adversarial attacks on tabular data present unique challenges due to the heterogeneous nature of mixed categorical and numerical features. Unlike images where pixel perturbations maintain visual similarity, tabular data lacks intuitive similarity metrics, making it difficult to define imperceptible modifications. Additionally, traditional gradient-based methods prioritise $\ell_p$-norm constraints, often producing adversarial examples that deviate from the original data distributions, making them detectable. To address this, we propose a latent-space perturbation framework using a mixed-input Variational Autoencoder (VAE) to generate statistically consistent adversarial examples. The proposed VAE integrates categorical embeddings and numerical features into a unified latent manifold, enabling perturbations that preserve statistical consistency. We introduce In-Distribution Success Rate (IDSR) to jointly evaluate attack effectiveness and distributional alignment. Evaluation across six publicly available datasets and three model architectures demonstrates that our method achieves substantially lower outlier rates and more consistent performance compared to traditional input-space attacks and other VAE-based methods adapted from image domain approaches, achieving substantially lower outlier rates and higher IDSR across six datasets and three model architectures. Our comprehensive analyses of hyperparameter sensitivity, sparsity control, and generative architecture demonstrate that the effectiveness of VAE-based attacks depends strongly on reconstruction quality and the availability of sufficient training data. When these conditions are met, the proposed framework achieves superior practical utility and stability compared with input-space methods. This work underscores the importance of maintaining on-manifold perturbations for generating realistic and robust adversarial examples in tabular domains.

What this paper studies

Tabular records combine numerical and categorical features with dependencies that input-space perturbations can disrupt. This paper investigates generating adversarial examples through a learned latent representation, with the aim of preserving statistical consistency while changing a model’s prediction.

How the approach works

1. A mixed-input variational autoencoder combines categorical embeddings and numerical features in a latent representation.
2. Attack optimisation perturbs that representation and decodes it back into a tabular record.
3. Evaluation considers both attack effectiveness and alignment with the data distribution, including In-Distribution Success Rate (IDSR).

The evaluation spans six public datasets and three predictive model architectures, with comparisons against input-space attacks and other VAE-based methods.

What the results show

The study reports lower outlier rates and strong IDSR performance under the evaluated conditions. It also examines hyperparameter sensitivity, sparsity control and generative architecture, rather than treating successful misclassification alone as sufficient evidence of a useful attack.

Where the method needs care

Reconstruction quality and sufficient training data are important to the method’s effectiveness. A learned latent representation is an approximation to the data structure, and distributional alignment should be interpreted within the evaluation used in the paper.

Sparsity remains a challenge: a small latent change can alter several reconstructed features. The paper investigates sparsity penalties and feature selection, but does not establish a general solution for changing only a few attributes. These limits matter when deciding whether the method fits an application’s attack model.

Place in my research

The imperceptibility study defines the evaluation concerns; TabAttackBench examines existing attacks against quantitative measures. This work moves from evaluation toward attack generation that better respects statistical structure.

Related research

• Investigating Imperceptibility of Adversarial Attacks on Tabular Data: An Empirical Analysis
• TabAttackBench: A Benchmark for Adversarial Attacks on Tabular Data

Citation

Cite the published version using 10.1016/j.asoc.2025.114286.

@article{ASOC2026,
  author = {He, Zhipeng and Stevens, Alexander and Ouyang, Chun and De Smedt, Johannes and Barros, Alistair and Moreira, Catarina},
  title = {Crafting Imperceptible On-Manifold Adversarial Attacks for Tabular Data},
  journal = {Applied Soft Computing},
  year = {2026},
  volume = {186, Part D},
  eid = {114286},
  doi = {10.1016/j.asoc.2025.114286}
}