Capx Adversarial Eval

capx-adversarial-eval

Constrained Adversarial Perturbation — Nishad et al. (2025) (arXiv:2510.15699, 2025)

What this evaluates

Evaluates the robustness of classifiers against universal and individual adversarial perturbations under domain-specific linear constraints. Probes the trade-off between attack success rate and computational efficiency across finance, network security, medical IoT, and cyber-physical systems.

Datasets

• LCLD — total ?; splits: val (-1), test (-1)
• IDS — total ?; splits: val (-1), test (-1)
• IoMT — total ?; splits: val (-1), test (-1)
• SWaT — total ?; splits: val (-1), test (-1)
• WADI — total ?; splits: val (-1), test (-1)

Metrics

• ASR (primary) — range: percent
  • Adversarial Success Rate: the percentage of samples whose classification prediction changes from the original (correct) label to an incorrect label after applying the perturbation. Calculated separately on the training set X and the unseen test set.

Input / output format

Input: Structured feature vectors representing normal samples from each dataset, fed into a trained classifier (1D-CNN for LCLD, FFNN for others).

Output: Perturbed samples (original input + perturbation vector δ) and the resulting classification prediction from the target model.

Scoring recipe

def compute_asr(original_preds, perturbed_preds, total_samples):
    misclassified = sum(1 for p_orig, p_pert in zip(original_preds, perturbed_preds) if p_orig != p_pert)
    return (misclassified / total_samples) * 100

Common pitfalls

• Confusing the set X (used to learn the universal perturbation) with the evaluation test set; ASR is reported separately for both.
• Ignoring domain constraints: baselines like UAP generate unconstrained perturbations, while CAPX enforces linear invariants, making direct ASR comparisons without constraint context misleading.
• Assuming fixed perturbation radius: ASR is highly sensitive to the ℓ2-norm budget (ε), which is varied from 0.10 to 0.40 in experiments.

Evidence (verbatim from paper)

The set X, used to learn the universal perturbation for each method, consists of correctly classified normal samples randomly selected from the validation set. A separate set of 3,000 correctly classified normal samples is randomly selected from the test set and used as unseen data to test the generalization ability of perturbation. Table[2] summarizes the adversarial efficacy of CAPX and baselines, where CAPX consistently achieves higher ASR while requiring significantly lower computation time.

Citation

@misc{nishad2025constrained,
  title={Constrained Adversarial Perturbation},
  author={Nishad et al. (2025)},
  year={2025},
  note={arXiv:2510.15699}
}

• arXiv: 2510.15699