An Attacker Cost Functional for Tabular Security: Spectral Geometry, Graph Coherence, and Copula Density Constraints

Adversarial perturbations measured by ℓp norms do not reflect key structural constraints in tabular security data, including anisotropic geometry, feature dependence, and distributional plausibility. We introduce a composite attacker cost functional Catk(x,x′)=τmax{0,m(x′)}+λ1δ⊤G⊥(γ)(x)δ+λ∑jωj|δj|+λ2δ⊤LHδ+λ3logf^1(ϵ)(x)−logf^1(ϵ)(x′)+∑j∈supp(δ)cj+β|M(supp(δ))|ν, which integrates a spectrally truncated geometric term, a graph-based coherence penalty, a smooth copula density barrier, and a superlinear module-spread term. Under spectral degeneracy of the legitimate-class covariance, we establish nonnegativity under density dominance, exact zero self-cost, lower semicontinuity, and λ3κK-weak convexity of the continuous component on compact convex sets, for both affine and ρm-weakly convex scoring functions. These properties yield existence of constrained minimizers. The continuous component is locally Lipschitz, whereas the full functional is not due to the support-counting term. A component feasibility result shows that each term eliminates a distinct class of degenerate perturbations. Limiting regimes and refined evasion cost bounds are derived. An empirical instantiation on PHIUSIIL indicates that perturbations with identical ℓ2 norm can incur costs differing by an order of magnitude.