Adversarial Robustness on Image Classification With <italic>k</italic>-Means

Abstract

Attacks and defences in adversarial machine learning literature have primarily focused on supervised learning. However, it remains an open question whether existing methods and strategies can be adapted to unsupervised learning approaches. In this paper we explore the challenges and strategies in attacking a $k$ -means clustering algorithm and in enhancing its robustness against adversarial manipulations. We evaluate the vulnerability of clustering algorithms to adversarial attacks on two datasets (MNIST and Fashion-MNIST), emphasising the associated security risks. Our study investigates the impact of incremental attack strength on training, introduces the concept of transferability between supervised and unsupervised models, and highlights the sensitivity of unsupervised models to sample distributions. We additionally introduce and evaluate an adversarial training method that improves testing performance in adversarial scenarios, and we highlight the importance of various parameters in the proposed training method, such as continuous learning, centroid initialisation, and adversarial step-count. Overall, our study emphasises the vulnerability of unsupervised learning and clustering algorithms to adversarial attacks and provides insights into potential defence mechanisms.

Keywords

• Adversarial examples
• adversarial machine learning
• adversarial robustness
• adversarial training
• k-means clustering
• unsupervised learning