# CaFA: Cost-aware, Feasible Attacks With Database Constraints Against Neural Tabular Classifiers

arXiv: https://arxiv.org/abs/2501.10013 · HTML: https://mlsanity.com/paper/2501.10013/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 17 Jan 2025.

## Built on by (most cited first, 5 of 5)

- [On the Robustness of Tabular Foundation Models: Test-Time Attacks and In-Context Defenses](https://mlsanity.com/paper/2506.02978/) (2025)
- [Making Logic a First-Class Citizen in Generative ML for Networking](https://mlsanity.com/paper/2506.23964/) (2025)
- [Insights on Adversarial Attacks for Tabular Machine Learning via a Systematic Literature Review](https://mlsanity.com/paper/2506.15506/) (2025)
- [UTOPIA: Unlearnable Tabular Data via Decoupled Shortcut Embedding](https://mlsanity.com/paper/2602.07358/) (2026)
- [Worst-Case Discovery and Runtime Protection for RL-Based Network Controllers](https://mlsanity.com/paper/2605.04373/) (2026)

## Abstract (arXiv)

This work presents CaFA, a system for Cost-aware Feasible Attacks for assessing the robustness of neural tabular classifiers against adversarial examples realizable in the problem space, while minimizing adversaries' effort. To this end, CaFA leverages TabPGD-an algorithm we set forth to generate adversarial perturbations suitable for tabular data- and incorporates integrity constraints automatically mined by state-of-the-art database methods. After producing adversarial examples in the feature space via TabPGD, CaFA projects them on the mined constraints, leading, in turn, to better attack realizability. We tested CaFA with three datasets and two architectures and found, among others, that the constraints we use are of higher quality (measured via soundness and completeness) than ones employed in prior work. Moreover, CaFA achieves higher feasible success rates-i.e., it generates adversarial examples that are often misclassified while satisfying constraints-than prior attacks while simultaneously perturbing few features with lower magnitudes, thus saving effort and improving inconspicuousness. We open-source CaFA, hoping it will serve as a generic system enabling machine-learning engineers to assess their models' robustness against realizable attacks, thus advancing deployed models' trustworthiness.