  Adversarial attacks are a potential threat to machine learning models, as
they can cause the model to make incorrect predictions by introducing
imperceptible perturbations to the input data. While extensively studied in
unstructured data like images, their application to structured data like
tabular data presents unique challenges due to the heterogeneity and intricate
feature interdependencies of tabular data. Imperceptibility in tabular data
involves preserving data integrity while potentially causing misclassification,
underscoring the need for tailored imperceptibility criteria for tabular data.
However, there is currently a lack of standardised metrics for assessing
adversarial attacks specifically targeted at tabular data. To address this gap,
we derive a set of properties for evaluating the imperceptibility of
adversarial attacks on tabular data. These properties are defined to capture
seven perspectives of perturbed data: proximity to original inputs, sparsity of
alterations, deviation to datapoints in the original dataset, sensitivity of
altering sensitive features, immutability of perturbation, feasibility of
perturbed values and intricate feature interdepencies among tabular features.
Furthermore, we conduct both quantitative empirical evaluation and case-based
qualitative examples analysis for seven properties. The evaluation reveals a
trade-off between attack success and imperceptibility, particularly concerning
proximity, sensitivity, and deviation. Although no evaluated attacks can
achieve optimal effectiveness and imperceptibility simultaneously, unbounded
attacks prove to be more promised for tabular data in crafting imperceptible
adversarial examples. The study also highlights the limitation of evaluated
algorithms in controlling sparsity effectively. We suggest incorporating a
sparsity metric in future attack design to regulate the number of perturbed
features.
