Research map / Adversarial robustness and security / Certified and empirical robustness

On the Adversarial Robustness of Multi-Kernel Clustering

ICML 2025 · Adversarial robustness and security › Certified and empirical robustness · approach: Adversarial training with feature consistency

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes AdvMKC, a black-box RL-based adversarial attack on multi-kernel clustering using PPO with an advantage function and a generator-clusterer framework, evaluated on seven datasets against eleven MKC methods.

Problem

Adversarial robustness of multi-kernel clustering (MKC) methods is largely unexplored; attacking unsupervised, K-Means-based MKC in a black-box setting is hard due to clustering instability and high clustering cost.

Approach

Formulates the attack as an RL problem: a PPO-trained generator injects bounded perturbations into selected samples/views, rewarded by cosine-similarity-based cluster quality, while a learned clusterer surrogate approximates the victim MKC to cut queries.

Key results

• On MSRCv1, AdvMKC reduces EEOMVC NMI from 65.76% to 53.18%.
• Against robust MKC methods, AdvMKC reduces JMKSC NMI on MSRCv1 to 1.63% (from 4.87% without attack).
• Transfer from JMKSC surrogate to SMKKM victim still yields about a 5% NMI reduction on MSRCv1.

Measured effects reported in the paper

Surprising findings

• Robust MKC methods designed for Gaussian noise are resilient to Gaussian random perturbations (RAMKC) but fail against the RL attack.

Limitations

• Attack assumes access to a data subset and the ability to perturb selected samples and views; threat model is idealized.
• Theoretical analysis is restricted to MKKM with a reduced gradient optimizer and an eigengap assumption.
• No quantitative efficiency or runtime comparison reported to support overhead-reduction claims.

Experimental setup

Datasets: MSRCv1 BBCSport ProteinFold HW-6Views Caltech101-7 Citeseer NUS-WIDE-SCENE

Benchmarks: MSRCv1 BBCSport ProteinFold Caltech101-7 Citeseer NUS-WIDE-SCENE

Metrics: NMI ARI ACC PR

Baselines: RAMKC EAMKC MVC-LFA LSMKKM MKKM-SR SMKKM EEOMVC LSWMKC

Builds on: proximal policy optimization multi-kernel k-means reduced gradient method evolution strategies

Closest papers by meaning

• Clustering Effect of Adversarial Robust Models (NeurIPS 2021 · similarity 0.90)
• Adversarially Robust Deep Multi-View Clustering: A Novel Attack and Defense Framework (ICML 2024 · similarity 0.90)
• On the Robustness of Deep Clustering Models: Adversarial Attacks and Defenses (NeurIPS 2022 · similarity 0.89)
• Kernel Learning with Adversarial Features: Numerical Efficiency and Adaptive Regularization (NeurIPS 2025 · similarity 0.87)
• Efficient Robustness Evaluation via Constraint Relaxation (AAAI 2025 · similarity 0.86)
• Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.85)