Research map / Adversarial robustness and security / Certified and empirical robustness

Adversarially Robust Deep Multi-View Clustering: A Novel Attack and Defense Framework

ICML 2024 · Adversarial robustness and security › Certified and empirical robustness · approach: Adversarial training with feature consistency

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes the first GAN-based adversarial attack on deep multi-view clustering (DMVC) models targeting view complementarity and consistency, and an adversarially robust DMVC defense (AR-DMVC) with an information-theoretic Attack Mitigator regularizer.

Problem

Deep multi-view clustering models are unexplored with respect to adversarial attacks, and no defense exists for them; the paper asks how to attack DMVC models and how to make them robust.

Approach

Attack objectives that jointly perturb view-specific representations (complementarity) and the fused consensus representation (consistency) via a GAN generator; defense by contrastive adversarial training over multi-view PGD examples plus a KL-based Attack Mitigator term motivated by bounding conditional mutual information between adversarial input and cluster assignments.

Key results

• On NoisyMNIST, AECoDDC accuracy drops from 0.99 pre-attack to 0.24 post-attack, while AR-DMVC-AM retains 0.93 post-attack.
• On RegDB, the attack reduces EAMC ACC from 0.64 to 0.33 and AR-DMVC-AM retains ACC 0.52 post-attack versus 0.54 pre-attack.
• Table 3 at epsilon 0.3 on NoisyMNIST: AR-DMVC-AM ACC 0.94 versus 0.23-0.47 for baselines.

Measured effects reported in the paper

Surprising findings

• Adversarial training with a consistency-aligned multi-view PGD objective (AR-DMVC) does not always beat AR-DMVC-AM; the Attack Mitigator term yields most of the robustness gains under larger epsilon.
• Attacks substantially degrade all evaluated DMVC models, including recent SOTA methods such as SEM and InfoDDC.

Limitations

• Attack requires indexing per-view representations, so may be less effective for methods that learn only unified representations.
• AR-DMVC-AM needs multiple backward passes over all training data to generate adversarial variants, which is computationally expensive for large-scale sets.
• Evaluated only on four relatively small multi-view image benchmarks.

Experimental setup

Datasets: RegDB NoisyFashion NoisyMNIST PatchedMNIST

Benchmarks: RegDB NoisyFashion NoisyMNIST PatchedMNIST

Metrics: ACC NMI ARI

Baselines: EAMC SiMVC CoMVC Multi-VAE AECoDDC InfoDDC SEM

Builds on: Chhabra et al. 2022 GAN black-box clustering attack projected gradient descent adversarial training contrastive learning (SimCLR-style NT-Xent) Deep Divergence-Based Clustering (DDC)

Closest papers by meaning

• On the Robustness of Deep Clustering Models: Adversarial Attacks and Defenses (NeurIPS 2022 · similarity 0.93)
• On the Adversarial Robustness of Multi-Kernel Clustering (ICML 2025 · similarity 0.90)
• Automatically Identify and Rectify: Robust Deep Contrastive Multi-view Clustering in Noisy Scenarios (ICML 2025 · similarity 0.85)
• Investigating and Mitigating the Side Effects of Noisy Views for Self-Supervised Clustering Algorithms in Practical Multi-View Scenarios (CVPR 2024 · similarity 0.84)
• Deep Fair Multi-View Clustering with Attention KAN (CVPR 2025 · similarity 0.84)
• EASEMVC:Efficient Dual Selection Mechanism for Deep Multi-View Clustering (CVPR 2025 · similarity 0.84)