Mutable Signal Ratio as a Structural Predictor of Adversarial Vulnerability in Tabular Fraud Detection

Classical machine learning models remain widely deployed for tabular fraud detection, and a fraudster attacking one of them cannot modify feature values at will. Transaction amount and merchant category can be altered before submission; account tenure and aggregated behavioural history cannot. Under this constraint some deployments resist evasion almost completely while others fall on nearly every attempt, and model architecture does not explain the gap. This work introduces the Mutable Signal Ratio (MSR), the share of a trained model's fraud-detection signal carried by features an adversary can control, estimated through mutual information, permutation importance, and SHAP. Computing MSR requires only a trained model and a constraint specification, with no attack executed. Across four datasets spanning two fraud contexts, with five classical model families per dataset attacked by a constrained black-box tri-objective evolutionary method, average attack success ranges from 89.9% on Sparkov to 10.4% on IEEE-CIS, and MSR follows the identical ordering under all three attribution methods. A feature-ablation experiment then manipulates MSR directly, reassigning features between the mutable and immutable sets and retraining every model from scratch. On IEEE-CIS attack success moves from 4.1% to 36.5% as MSR moves from 6.4% to 18.4%, with non-overlapping confidence intervals and a permutation test returning p<0.0001 for all pairwise comparisons; the same design on BAF moves attack success from 7.0% to 73.9%. Adversarial training does not track MSR, which points to mutable feature-space structure as a separate factor in defense effectiveness.