Slice-Aware Adversarial Vulnerability Analysis of TabNet-Based Intrusion Detection in 5G Network Slicing

1. Introduction

The security of 5G network slicing cannot be reliably characterised using aggregate intrusion detection metrics alone. Although a NIDS may achieve high overall accuracy, its protection can be highly uneven across heterogeneous slices. This issue is particularly critical in 5G environments because Enhanced Mobile Broadband (eMBB), Ultra-Reliable Low-Latency Communication (URLLC), and Massive Machine-Type Communication (mMTC) serve fundamentally different operational requirements [1,2]. Consequently, a security evaluation that aggregates all traffic classes into a single global score may conceal severe vulnerabilities affecting a specific slice. The rapid proliferation of Internet of Things (IoT) devices and the deployment of 5G networks have further expanded the attack surface of modern communication infrastructures, making the problem of slice-level security evaluation both timely and practically significant. Machine learning (ML)-based Network Intrusion Detection Systems (NIDS) have become a central component for securing such heterogeneous environments, owing to their ability to detect complex and evolving attack patterns that signature-based systems cannot capture.

However, ML-based NIDS are themselves vulnerable to adversarial evasion attacks, in which an attacker introduces carefully crafted perturbations to malicious traffic features so that the classifier misclassifies the traffic as benign [3]. This vulnerability is particularly concerning in security-critical infrastructures such as 5G, where a successful evasion attack could allow malicious traffic to bypass detection within a specific slice, undermining the isolation guarantees that slicing is meant to provide.

The adversarial robustness of NIDS has been investigated along several complementary lines of research: strengthening detection through attention-based ensemble architectures, generating evasion attacks that target a small subset of highly influential features rather than perturbing the entire feature space, and empirically assessing the practical feasibility of evasion attacks under realistic, feature-space-constrained threat models [4,5,6,7,8]. In parallel, TabNet [11], a deep learning architecture designed for tabular data, has attracted growing interest in the NIDS literature due to its built-in, sequential attention mechanism, which offers instance-wise interpretability while achieving competitive classification performance [12,13]. The broader idea of using model explanations to guide adversarial attacks is not unprecedented in the wider machine learning literature: explainability outputs such as SHAP values have been used to localize perturbations against malware detectors [15], and the interplay between post-hoc explanations and adversarial manipulation has recently been systematized [16]. However, to the best of our knowledge, no existing study leverages the native, architecture-embedded attention mechanism of an interpretable tabular classifier such as TabNet to guide evasion attack design within the network intrusion detection domain, and no existing study evaluates adversarial robustness at the granularity of individual 5G network slices. A closely related, contemporaneous study proposes security-aware evaluation guidelines for adversarially-robust anomaly detection in the 5G Core network [17]; however, it targets protocol-level (PFCP) control-plane attacks rather than service-level network slicing, and does not employ an interpretable, attention-based classifier.

This limitation is not merely theoretical. As shown later in this study, a TabNet-based NIDS trained on the CICIoT2023 dataset [18] achieves a global weighted F1-score of 0.928, suggesting strong overall performance; yet the same model attains an F1-score of only 0.483 on the mMTC slice under clean, non-adversarial conditions. Under adversarial perturbation, the picture inverts further: URLLC, the slice with the highest clean accuracy, proves to be the most vulnerable to evasion, while mMTC, the weakest slice under clean conditions, is comparatively robust. Such asymmetries are entirely obscured by global accuracy and weighted F1-score, motivating the need for evaluation metrics that are explicitly aware of slice structure.

Motivated by this gap, this paper makes the following contributions:

• A slice-aware adversarial evaluation framework is developed to investigate the vulnerability of ML-based NIDSs across heterogeneous 5G service slices, rather than relying solely on aggregate performance metrics.
• Attention-Guided Evasion (AGE) is introduced as an attention-guided, transfer-based adversarial attack that exploits TabNet’s attention mechanism to concentrate perturbations on the most influential features, improving attack effectiveness while maintaining a low perturbation footprint.
• Two slice-aware evaluation metrics, PSRI and SW-F1, are proposed to quantify adversarial robustness and balanced detection performance across eMBB, URLLC, and mMTC slices.
• The experiments reveal a previously hidden slice-level vulnerability pattern in which URLLC experiences severe degradation under adversarial attacks despite strong global NIDS performance, while mMTC remains comparatively robust.
• The study demonstrates the limitations of aggregate security metrics in heterogeneous 5G environments, showing that a global weighted F1 score of 0.928 can coexist with a substantially lower slice-balanced score of 0.807.

The remainder of this paper is organized as follows. Section 2 reviews related work. Section 3 describes the dataset, threat model, and experimental setup. Section 4 formalizes the proposed slice-aware evaluation metrics. Section 5 presents results and discussion. Section 6 concludes the paper.

2. Related Work

Although there is no study in the literature that exactly matches our work, there are valuable studies that show strong similarities in certain respects. The existing literature addresses adversarial NIDS research along three axes: the use of attention mechanisms to strengthen defenses [4], targeted evasion attacks aimed at a small number of features [5], and the analysis of evasion feasibility under realistic attack constraints [6,7,8]. However, none of these studies have directly integrated the attention mask output into attack design or performed slice-based robustness evaluation in the context of 5G slicing.

Reference [4] developed an attention and dilated convolution-based ensemble model (ADCEN), achieving 95% accuracy against adversarial evasion attacks. However, as this study is defense-oriented, it does not utilize the features the model focuses on in attack design. Furthermore, class imbalance and slice-based evaluation were not addressed.

Reference [5] demonstrated that targeting only a small number of features is more effective than applying perturbations to all features, using the Jacobian Saliency Map for feature selection. This finding constitutes one of the primary motivations behind AGE’s approach of targeting only five critical features using the attention mask output. However, model-specific attention information is not integrated into the attack design, and the 5G slicing environment and slice-based robustness evaluation are outside the scope of that study.

Reference [6] generated realistic adversarial botnet traffic in a black-box scenario, demonstrating the practical feasibility of evasion attacks under feature-space constraints. Although this study supports our threat model, the white-box scenario and slice-based robustness evaluation distinguish our work from theirs.

Reference [7] aimed to detect evasion attacks by designing a multi-adversarial detector based on transfer learning. This defense approach proved effective in attack detection. However, the attention mechanism specific to TabNet and 5G slice-based evaluation were not addressed.

Reference [8] studied the practical feasibility of evasion attacks against ML-based NIDS and demonstrated that factors such as Boolean and discrete features, feature correlations, and model access constraints significantly limit the effectiveness of such attacks. This finding contextually supports our white-box assumption and preference for feature-space perturbations.

In a related study, Baldini [9] investigated the mitigation of adversarial attacks in 5G networks using Extremely Randomized Trees (ERT) combined with Infinite Feature Selection, demonstrating robustness against label flipping and feature-based attacks on a 5G-specific dataset. However, that study relies on global classification metrics without slice-level analysis, and does not address feature-space evasion attacks or interpretable attention-based models.

The TabNet architecture proposed for tabular data [11] has also begun to be used in the IDS field in recent years [12,13]. However, current TabNet-based IDS studies focus solely on detection accuracy. Adversarial robustness and slice-based performance evaluation have not yet been addressed.

Reference [12] adapted the TabNet architecture to classify MQTT protocol traffic in IoT environments. This study demonstrates the success of TabNet’s attention mechanism in selecting network traffic features. However, the model was evaluated only under clean conditions, and adversarial robustness and slice-based analysis were not investigated.

In the TabNet-IDS study [13], TabNet wasevaluated on the UNSW-NB15 [14], CIC-IDS2018, and CICIoT2023 [18] datasets [13]. The use of CICIoT2023 enables direct comparison with our study. However, no adversarial robustness analysis was conducted, and the 5G slicing context was not considered.

Recently, Reference [10] proposed a DeepSHAP-based adversarial attack that selectively alters only the most influential features of network flows to evade ML-based NIDS. While conceptually similar to AGE in its feature-selective perturbation strategy, their approach relies on post-hoc SHAP explanations applied to arbitrary classifiers, rather than exploiting the native, architecture-embedded attention mechanism of an interpretable model such as TabNet. Furthermore, slice-aware evaluation across 5G service categories is not addressed.

A detailed comparison of all studies is provided in Table 1.

3. Dataset, Threat Model, and Experimental Setup

3.1. Dataset

In this study, we used the CICIoT2023 dataset published by the Canadian Institute for Cyber Security (CIC) in 2023 [18]. The dataset contains network traffic collected from real IoT devices and includes both normal and attack traffic. There are 34 classes in total: 33 represent different attack types such as DDoS, DoS, Mirai botnet, reconnaissance, and injection attacks, while the remaining one represents normal (benign) traffic [19]. The dataset is provided in three pre-defined partitions—training, test, and validation—which we used as-is without additional splitting.

TabNet baseline classification performance was evaluated on the full test set (1,176,851 samples) to ensure a comprehensive performance report. Subsequent adversarial and slice-based analyses were conducted on a stratified subsample of 50,000 test samples for computational efficiency, preserving the original class distribution [20]. Each sample contains 46 numerical features including flow-level network statistics such as packet count, byte count, inter-arrival time (IAT), TCP flag counts, and protocol type. Dataset statistics are presented in Table 2.

3.2. 5G Network Slice Mapping

We grouped the 34 classes according to the three core 5G service categories: eMBB, URLLC, and mMTC [1,2]. High-volume DDoS attacks were assigned to the eMBB slice due to their high bandwidth consumption. DoS, MITM, and DNS spoofing attacks were assigned to URLLC due to their critical effects on latency and reliability [21]. Mirai botnet, reconnaissance, and injection attacks were assigned to mMTC, as they target low-power IoT devices [22]. The resulting distribution is shown in Table 3 and Figure 1. The slice assignment follows the service-level traffic characterisation guidelines of 3GPP TR 22.261 [1,2] and is consistent with prior slice-aware security studies [22]. To assess the sensitivity of our results to this mapping, we verified that reassigning borderline attack types (e.g., DNS_Spoofing between URLLC and mMTC) does not qualitatively alter the slice-level PSRI ranking: URLLC remains the most vulnerable slice and mMTC the most robust under all tested perturbation budgets.

3.3. Threat Model

We adopt a white-box attack scenario in which the adversary has full knowledge of the model architecture, weights, and test data [23]. The attacker’s goal is to perturb malicious traffic so that the model classifies it as benign—an evasion attack [3]. A key constraint is that the attacker can only modify network flow statistics (e.g., IAT, packet count, flag values), not the packet payload [11,24].

Two standard baselines are employed:

FGSM [25]:

$$x^{\prime }=x+\epsilon ·\mathrm{sign}\left({\nabla }_{x}J(\theta ,x,y)\right)$$

(1)

PGD [26]:

$$x^{t+1}={\Pi }_{x+S}\left(x^t+\alpha ·\mathrm{sign}\left({\nabla }_{x}J(\theta ,x^t,y)\right)\right)$$

(2)

For both attacks, $\epsilon \in \{0.01,0.05,0.10,0.20,0.30,0.50\}$ was tested and results were evaluated per slice [24].

3.4. Data Preprocessing

No missing or infinite values were present, so no imputation was required. All numerical features were standardized using StandardScaler (zero mean, unit variance) [27], fitted on the training set only and applied separately to the test and validation sets to prevent data leakage. The class imbalance (up to 3,000:1 ratio) was left intact intentionally: real network traffic exhibits such imbalance naturally, and demonstrating how it misleads global metrics is a central motivation of this work [28]. To separate the effect of class imbalance from adversarial vulnerability, PSRI is computed at the slice level using aggregate accuracy rather than per-class F1.

3.5. TabNet Configuration

We selected TabNet [11] as the classifier due to its sequential attention mechanism, which enables both competitive detection accuracy and instance-wise feature importance analysis. Although Random Forest and MLP achieve comparable global accuracy, TabNet was selected for its instance-wise sequential attention mechanism, which enables the proposed AGE attack by providing a dynamic, per-sample feature importance signal that neither tree-based nor standard neural network architectures offer natively. Hyperparameters are listed in Table 4.

3.6. Adversarial Attack Configuration

Attacks were applied in the feature space [24]. Feature importance ranking via TabNet’s attention mask was computed using only the validation set to avoid any overlap with the test set used for attack evaluation. The top five features by attention weight are: syn_count, IAT, SMTP, UDP, and TCP (Table 5). The attack configuration is summarised in Table 6 and the experimental workflow is shown in Figure 2.

3.7. Proposed Evasion Attack: Attention-Guided Evasion (AGE)

This study proposes two original contributions. The first is AGE (Attention-Guided Evasion). Since TabNet’s sparse attention mechanism interrupts gradient flow—a phenomenon known as gradient masking [8]—AGE is implemented via a transfer-based approach in which the gradient direction is obtained from a surrogate MLP $f_s$, while the perturbation magnitude and feature selection are governed by the TabNet attention mask. The perturbation vector for feature j is:

$${\delta }_j=\left\{\begin{array}{cc}\epsilon ·{\displaystyle \frac{a_j^{\mathrm{TabNet}}}{{\displaystyle \sum _{k\in \mathcal{A}}{a}_k^{\mathrm{TabNet}}}}}·\mathrm{sign}\left({\nabla }_{x_j}J(f_s,x,y)\right)\hfill & \mathrm{if}j\in \mathcal{A}\hfill \\ 0\hfill & \mathrm{otherwise}\hfill \end{array}\right.$$

(3)

where $a_j^{\mathrm{TabNet}}$ is the attention weight of feature j, $\mathcal{A}$ is the top-5 attention feature set, $\epsilon$ is the perturbation budget, $f_s$ is the surrogate MLP (three hidden layers: 256–128–64 neurons, ReLU), and J is the cross-entropy loss. The adversarial examples $x^{\prime }=x+\delta$ are transferred to TabNet for evaluation [29,30].

The second contribution consists of PSRI and SW-F1, whose formal definitions are provided in Section 4.

3.8. Evaluation Metrics

Standard metrics (Accuracy, Precision, Recall, weighted F1, macro F1) are reported alongside the proposed slice-aware metrics [31,32,33]. All metrics are computed separately under clean conditions and under each adversarial attack for every tested $\epsilon$ value, and reported per slice in Section 5.

4. Proposed Slice-Aware Evaluation Metrics

Standard metrics assume a homogeneous operational environment where all classes contribute proportionally to the overall score. In 5G slicing architectures this assumption fails: each slice serves a distinct application domain, and a model that performs well on the dominant slice may catastrophically fail on a minority slice without any indication from global metrics [31,32,33].

4.1. Motivation

Table 7 shows the discrepancy between global and per-slice F1-scores under clean conditions. The global weighted F1 of 0.928 suggests strong overall performance, yet the mMTC slice achieves only 0.483. This 0.445-point gap is entirely masked by eMBB’s 0.981 F1 and 70.5% sample weight.

4.2. Per-Slice Robustness Index (PSRI)

Let $S=\{\mathrm{eMBB},\mathrm{URLLC},\mathrm{mMTC}\}$. For adversarial attack a with perturbation budget $\epsilon$:

$${\mathrm{PSRI}}_s(a,\epsilon )={\displaystyle \frac{{\mathrm{Acc}}_s^{\mathrm{adv}}(a,\epsilon )}{{\mathrm{Acc}}_s^{\mathrm{clean}}}}$$

(4)

${\mathrm{PSRI}}_s=1.0$ indicates perfect robustness; ${\mathrm{PSRI}}_s\to 0$ indicates complete collapse. It should be noted that classes with F1 = 0.00 under clean conditions are excluded from PSRI computation at the class level, as their clean accuracy baseline is already zero, making the ratio undefined. PSRI is therefore computed over the aggregate accuracy of all samples within each slice.

The aggregate PSRI across all slices is:

$$\overline{\mathrm{PSRI}}(a,\epsilon )={\displaystyle \frac{1}{\left|S\right|}}\sum _{s\in S}{\mathrm{PSRI}}_s(a,\epsilon )$$

(5)

4.3. Slice-Weighted F1 (SW-F1)

$$\mathrm{SW}-\mathrm{F}1={\displaystyle \frac{1}{\left|S\right|}}\sum _{s\in S}F{1}_s^{\mathrm{weighted}}$$

(6)

Unlike $F{1}_{\mathrm{weighted}}$, SW-F1 assigns equal weight to each slice regardless of sample size. In our experiments:

$$F{1}_{\mathrm{weighted}}=0.928,\mathrm{SW}-\mathrm{F}1={\displaystyle \frac{0.981+0.956+0.483}{3}}=0.807$$

The 0.121-point gap quantifies the degree to which global metrics overestimate protection for minority slices.

4.4. Stealthiness Metrics

$$\begin{array}{cc}\hfill L_2(a,\epsilon )& ={\displaystyle \frac{1}{n}}{\displaystyle \sum _{i=1}^n}{\parallel x_i^{\mathrm{adv}}-x_i\parallel }_2\hfill \end{array}$$

(7)

$$\begin{array}{cc}\hfill FC(a,\epsilon )& ={\displaystyle \frac{1}{n}}{\displaystyle \sum _{i=1}^n}{\displaystyle \sum _{j=1}^d}\mathbf{1}\left[|x_{ij}^{\mathrm{adv}}-x_{ij}|>\delta \right]\hfill \end{array}$$

(8)

where $\delta ={10}^{-6}$ and $d=46$.

5. Results and Discussion

5.1. TabNet Baseline Performance

An accuracy of 97.07% was achieved on the test set. The weighted F1 is 0.97, but the macro F1 is only 0.56 [31], indicating highly unbalanced per-class performance. Selected class results are in Table 9 and the confusion matrix in Figure 3. The full classification report is in Appendix A.

Table 8. TabNet Baseline Summary Performance Metrics (Test Set).

Metric	Value
Test Accuracy	0.9707
Weighted F1	0.97
Macro F1	0.56
Macro Precision	0.59

Table 8. TabNet Baseline Summary Performance Metrics (Test Set).

Metric	Value
Test Accuracy	0.9707
Weighted F1	0.97
Macro F1	0.56
Macro Precision	0.59

Table 9. Classification Report for Selected Classes (Test Set).

Class	Precision	Recall	F1	Support	Slice
DDoS-ICMP_Flood	1.00	1.00	1.00	180,447	eMBB
DoS-UDP_Flood	1.00	1.00	1.00	83,627	URLLC
Mirai-udpplain	0.99	0.99	0.99	22,536	mMTC
DNS_Spoofing	0.00	0.00	0.00	4,570	URLLC
Backdoor_Malware	0.00	0.00	0.00	89	mMTC
XSS	0.00	0.00	0.00	103	mMTC
DictionaryBruteForce	0.00	0.00	0.00	319	mMTC
Macro Avg	0.59	0.56	0.56	1,176,851	All
Weighted Avg	0.97	0.97	0.97	1,176,851	eMBB-weighted

Table 9. Classification Report for Selected Classes (Test Set).

Class	Precision	Recall	F1	Support	Slice
DDoS-ICMP_Flood	1.00	1.00	1.00	180,447	eMBB
DoS-UDP_Flood	1.00	1.00	1.00	83,627	URLLC
Mirai-udpplain	0.99	0.99	0.99	22,536	mMTC
DNS_Spoofing	0.00	0.00	0.00	4,570	URLLC
Backdoor_Malware	0.00	0.00	0.00	89	mMTC
XSS	0.00	0.00	0.00	103	mMTC
DictionaryBruteForce	0.00	0.00	0.00	319	mMTC
Macro Avg	0.59	0.56	0.56	1,176,851	All
Weighted Avg	0.97	0.97	0.97	1,176,851	eMBB-weighted

5.2. Attention Mask Analysis

Feature importance ranking was computed over 2,000 validation examples to avoid test set leakage. The top five features are: syn_count (5.09), IAT (4.34), SMTP (4.25), UDP (3.73), and TCP (3.25). The full ranking is in Table 5 and visualised in Figure 4.

5.3. Adversarial Attack Comparison

Table 10 and Table 11 summarise the epsilon-sweep results. At $\epsilon =0.10$, AGE-Transfer achieves a 50.2% accuracy drop while modifying only 3.9 features and using an $L_2$ norm of 0.037. FGSM modifies all 46 features with $L_2=0.632$, using $17\times$ more perturbation for a comparable effect [29,30].

To further validate that AGE’s effectiveness stems specifically from TabNet’s native attention mechanism rather than generic feature-selective perturbation, we implemented a DeepSHAP-guided baseline (AGE-SHAP) following the approach of [10]. In AGE-SHAP, the top-5 features are selected using SHAP values computed on the surrogate MLP rather than TabNet’s attention mask. Despite sharing 3 of 5 features with AGE-Attention (TCP, Protocol Type, syn_count), AGE-SHAP achieves a negligible accuracy drop of 0.1% compared to AGE-Attention’s 54.0%. This result demonstrates that the effectiveness of AGE is not attributable to feature-selective perturbation alone, but specifically to the exploitation of TabNet’s native, architecture-embedded attention mechanism. Post-hoc SHAP explanations computed on a surrogate model fail to capture the decision-relevant feature structure of TabNet, confirming the necessity of using the model’s own interpretability signal for attack design.

Figure 5. Accuracy and accuracy drop comparison of AGE-Transfer, FGSM, and PGD attacks across epsilon values.

Figure 5. Accuracy and accuracy drop comparison of AGE-Transfer, FGSM, and PGD attacks across epsilon values.

To assess statistical significance, a bootstrap confidence interval (1,000 resamples) was computed for the difference in accuracy drop between AGE-Attention and FGSM. The observed difference is $+0.044$ (AGE achieves 4.4 percentage points higher accuracy drop), with a 95% bootstrap CI of $[0.036,0.052]$. Since the interval lies entirely above zero, the superiority of AGE-Attention over FGSM in terms of attack effectiveness is statistically significant at the 5% level.

5.4. Per-Slice Robustness Analysis (PSRI)

It is important to distinguish between two sources of low per-slice performance: (i) pre-existing misclassification of rare classes under clean conditions, and (ii) adversarial degradation caused by attack perturbations. PSRI isolates the second effect by normalising post-attack accuracy against the clean baseline within each slice.

Table 12 presents per-slice results under FGSM and AGE-Transfer at $\epsilon =0.10$. URLLC is the most vulnerable slice: ${\mathrm{PSRI}}_{\mathrm{URLLC}}\left(\mathrm{AGE}\right)=0.023$. The SW-F1 gap further underscores this: $F{1}_{\mathrm{weighted}}=0.928$ versus $\mathrm{SW}-\mathrm{F}1=0.807$, a difference of 0.121.

Figure 6. Per-slice PSRI, accuracy, and F1-drop comparison under FGSM and AGE-Transfer ($\epsilon =0.10$).

Figure 6. Per-slice PSRI, accuracy, and F1-drop comparison under FGSM and AGE-Transfer ($\epsilon =0.10$).

5.5. Baseline Model Comparison

All baseline models and TabNet were trained on the same training partition (200,000 samples). TabNet baseline classification performance (Table 8 and Table 9) was evaluated on the full test set ($n=1,176,851$) to provide a comprehensive per-class report. Subsequent adversarial and slice-based analyses (Table 12, Table 13 and Table 14) were conducted on a stratified subsample of 50,000 test samples ($N=8,000$ after slice assignment) for computational efficiency, preserving the original class distribution. Baseline models (Table 13) were evaluated on the same 50,000-sample test set with five random seeds. Table 13 compares clean performance across models. All three models achieve comparable global accuracy (0.972–0.982), confirming that TabNet does not sacrifice detection performance for interpretability.

While Random Forest and MLP exhibit broadly similar PSRI profiles across slices (URLLC: 0.482 and 0.512 respectively; mMTC: 0.750 and 0.839), TabNet demonstrates a pronounced cross-slice asymmetry: the URLLC slice collapses under adversarial perturbation (PSRI = 0.022), while the mMTC slice remains highly robust (PSRI = 0.983). This asymmetry is directly attributable to TabNet’s attention mechanism and validates both the AGE attack design and the necessity of PSRI.

Figure 7. Clean performance comparison of Random Forest, MLP, and TabNet (mean ± std over 5 seeds).

Figure 7. Clean performance comparison of Random Forest, MLP, and TabNet (mean ± std over 5 seeds).

5.6. Discussion

Three key findings emerge. First, adversarial attacks cause markedly asymmetric slice-level damage: URLLC is the most vulnerable (PSRI≈0.02 under both attacks), while mMTC is relatively robust to transfer-based AGE (PSRI=0.983) but highly susceptible to FGSM (PSRI=0.453). This cross-attack, cross-slice asymmetry is a novel empirical finding with direct operational implications for 5G network operators.

Second, global metrics hide this asymmetry: a global weighted F1 of 0.928 masks an mMTC F1 of only 0.483 under clean conditions, and a global PSRI of 0.444 (AGE) obscures the near-total collapse of URLLC (PSRI=0.023). The proposed PSRI and SW-F1 make these disparities visible and quantifiable.

Third, AGE-Transfer achieves a comparable or higher accuracy drop than FGSM at $\epsilon =0.10$ (50.2% vs. 48.4%) while modifying only 8.5% of features and using $17\times$ less $L_2$ perturbation. This stealthiness advantage is directly relevant for evading anomaly-based defenses [29,30].

Feature-Space vs. Problem-Space Limitations.

A fundamental limitation shared by this study and most adversarial NIDS research is that perturbations are applied in the feature space rather than the problem space (i.e., raw network packets). Feature-space attacks modify pre-computed flow statistics which may not be directly realizable in live network traffic due to protocol constraints and feature dependencies [8]. For example, modifying syn_count without a corresponding change in TCP flag counts would produce a statistically inconsistent flow. Future work should incorporate constraint-aware perturbation generation to bridge this gap [5,6].

Static Dataset Limitations.

This study evaluates adversarial robustness on a static benchmark dataset. The 5G slice mapping is based on traffic-level characteristics rather than actual 5G protocol-layer information. Validation against a testbed environment—such as Open5GS with srsRAN or ns-3 with the 5G NR module—is planned as a primary direction for future work.

Future Directions.

Future work will focus on: (i) extending evaluation to a second benchmark dataset (UNSW-NB15 [11]) to assess the generalisability of PSRI and SW-F1 across different traffic distributions and attack taxonomies — a necessary step to confirm that the observed slice-level asymmetries are not artefacts of CICIoT2023’s specific class distribution; (ii) implementing constraint-aware adversarial examples valid in the problem space; and (iii) deploying the proposed framework in an Open5GS/srsRAN testbed. Additionally, adversarial training augmented with attention regularisation will be explored as a defence mechanism.

Operational Impact for 5G Network Operators.

The near-total adversarial collapse of the URLLC slice (PSRI = 0.023) carries direct operational consequences for 5G network operators. URLLC is the service category that underpins mission-critical applications such as remote surgery, autonomous vehicle coordination, industrial automation, and smart grid control—all of which operate under strict latency and reliability Service Level Agreements (SLAs), typically requiring end-to-end latency below 1 ms and availability of 99.999%. A PSRI of 0.023 implies that under adversarial conditions, the NIDS correctly identifies only 2.3% of URLLC-slice attack traffic that it would detect under clean conditions, effectively rendering the intrusion detection mechanism inoperative for this slice. In practical terms, an attacker aware of this vulnerability could craft low-perturbation evasion traffic—consuming as few as 3.9 modified flow features—to conduct DoS, MITM, or DNS spoofing attacks against URLLC infrastructure while evading detection entirely. This finding suggests that 5G network operators relying on global NIDS metrics may be operating under a false sense of security, and that slice-aware robustness evaluation frameworks such as the one proposed in this study should be incorporated into 5G security auditing standards.

6. Conclusions

In this study, we presented a comprehensive, slice-aware adversarial vulnerability analysis of a TabNet-based NIDS operating within a 5G network slicing context. The proposed Attention-Guided Evasion (AGE) attack leverages TabNet’s native attention mask to perturb only the top five influential features, achieving a 50.2% accuracy drop at $\epsilon =0.10$ while requiring $17\times$ less $L_2$ perturbation than FGSM, thereby demonstrating remarkable stealthiness. Crucially, our introduced metrics—Per-Slice Robustness Index (PSRI) and Slice-Weighted F1 (SW-F1)—exposed critical security blind spots masked by conventional global metrics, revealing an asymmetric collapse in URLLC (PSRI = 0.023) and quantifying a 0.121-point overestimation gap in overall protection. These findings highlight the absolute necessity of slice-aware evaluation frameworks for heterogeneous 5G environments. Future research will focus on developing slice-aware adversarial defense strategies and validating the proposed framework within real-time 5G network simulators (e.g., ns-3).