Ripple Perturbations Through Structure: Likelihood-Constrained Adversarial Attacks on Heterogeneous Tabular Data

Generating realistic adversarial examples for tabular data remains challenging due to heterogeneous feature types and asymmetric inter-feature dependencies. Existing approaches typically rely on handcrafted constraints or undirected similarity criteria to delimit the feasible attack region, which often fail to capture the structural dependency governing tabular generation. Consequently, standard attacks typically produce perturbations that are statistically likely yet semantically inconsistent and prone to optimization stagnation via gradient masking. To address this, we propose LCSA, a white-box framework that formulates adversarial generation as optimization over structurally admissible perturbations. LCSA leverages an ensemble of heterogeneous neural Structural Causal Models to infer dependencies and introduces a structure-aware ripple mechanism. Unlike attacks that perturb features in isolation, this mechanism propagates updates downstream, acting as a structural preconditioner that conditions gradient flow to mitigate masking effects. Extensive experiments demonstrate that LCSA outperforms state-of-the-art baselines in 45 of 50 evaluated configurations, yielding adversarial examples with superior structural consistency and transferability.

Artificial intelligence models are vulnerable to small, malicious modifications to their input, a phenomenon known as adversarial attacks. While this vulnerability is extensively studied in the image domain, generating attacks against tabular data, such as datasets commonly used in finance and healthcare, presents unique challenges. Tabular records must adhere to strict logical constraints, such as ensuring alignment between the age of an individual and the employment history of that person. Existing attack methods often ignore these constraints, generating invalid samples that security systems easily detect and reject. To address this limitation, we introduce a new attack framework called LCSA. The framework models the underlying causal relationships within the data. When modifying a specific feature to mislead the target model, the framework triggers a cascading update across the feature space. Changing a single variable automatically adjusts all dependent variables, ensuring that the manipulated sample remains structurally consistent and realistic. Experimental results demonstrate that these structurally sound attacks effectively evade modern anomaly detectors designed to identify baseline methods. By highlighting this vulnerability, our work provides a crucial tool to test and develop more robust artificial intelligence systems for high-stakes applications, including credit scoring and medical diagnosis.