Capx Adversarial Eval

---
name: capx-adversarial-eval
description: Evaluates the robustness of classifiers against universal and individual adversarial perturbations under domain-specific linear constraints. Probes the trade-off between attack success rate and computational efficiency across finance, network security, medical IoT, and cyber-physical systems. Use when the user wants to benchmark on LCLD, IDS, IoMT, SWaT, WADI, or asks about evaluating this task. Reports ASR.
metadata:
  skill_kind: dataset_eval
  source_arxiv: 2510.15699
  bibtex_key: [REDACTED]
  confidence: high
---

# capx-adversarial-eval

> Constrained Adversarial Perturbation — Nishad et al. (2025) (arXiv:2510.15699, 2025)

## What this evaluates

Evaluates the robustness of classifiers against universal and individual adversarial perturbations under domain-specific linear constraints. Probes the trade-off between attack success rate and computational efficiency across finance, network security, medical IoT, and cyber-physical systems.

## Datasets

- **LCLD** — total ?; splits: val (-1), test (-1)
- **IDS** — total ?; splits: val (-1), test (-1)
- **IoMT** — total ?; splits: val (-1), test (-1)
- **SWaT** — total ?; splits: val (-1), test (-1)
- **WADI** — total ?; splits: val (-1), test (-1)

## Metrics

- `ASR` **(primary)** — range: percent
  - Adversarial Success Rate: the percentage of samples whose classification prediction changes from the original (correct) label to an incorrect label after applying the perturbation. Calculated separately on the training set X and the unseen test set.

## Input / output format

**Input**: Structured feature vectors representing normal samples from each dataset, fed into a trained classifier (1D-CNN for LCLD, FFNN for others).

**Output**: Perturbed samples (original input + perturbation vector δ) and the resulting classification prediction from the target model.

## Scoring recipe

```python
def compute_asr(original_preds, perturbed_preds, total_samples):
    misclassified = sum(1 for p_orig, p_pert in zip(original_preds, perturbed_preds) if p_orig != p_pert)
    return (misclassified / total_samples) * 100
```

## Common pitfalls

- Confusing the set X (used to learn the universal perturbation) with the evaluation test set; ASR is reported separately for both.
- Ignoring domain constraints: baselines like UAP generate unconstrained perturbations, while CAPX enforces linear invariants, making direct ASR comparisons without constraint context misleading.
- Assuming fixed perturbation radius: ASR is highly sensitive to the ℓ2-norm budget (ε), which is varied from 0.10 to 0.40 in experiments.

## Evidence (verbatim from paper)

> The set X, used to learn the universal perturbation for each method, consists of correctly classified normal samples randomly selected from the validation set. A separate set of 3,000 correctly classified normal samples is randomly selected from the test set and used as unseen data to test the generalization ability of perturbation. Table[2] summarizes the adversarial efficacy of CAPX and baselines, where CAPX consistently achieves higher ASR while requiring significantly lower computation time.

## Citation

```bibtex
@misc{nishad2025constrained,
  title={Constrained Adversarial Perturbation},
  author={Nishad et al. (2025)},
  year={2025},
  note={arXiv:2510.15699}
}
```

- arXiv: 2510.15699