Suspicion-Free Adversarial Attacks on Clustering Algorithms

Abstract

Clustering algorithms are used in a large number of applications and play an important role in modern machine learning– yet, adversarial attacks on clustering algorithms seem to be broadly overlooked unlike supervised learning. In this paper, we seek to bridge this gap by proposing a black-box adversarial attack for clustering models for linearly separable clusters. Our attack works by perturbing a single sample close to the decision boundary, which leads to the misclustering of multiple unperturbed samples, named spill-over adversarial samples. We theoretically show the existence of such adversarial samples for the K-Means clustering. Our attack is especially strong as (1) we ensure the perturbed sample is not an outlier, hence not detectable, and (2) the exact metric used for clustering is not known to the attacker. We theoretically justify that the attack can indeed be successful without the knowledge of the true metric. We conclude by providing empirical results on a number of datasets, and clustering algorithms. To the best of our knowledge, this is the first work that generates spill-over adversarial samples without the knowledge of the true metric ensuring that the perturbed sample is not an outlier, and theoretically proves the above.

Resilient Machine Learning for Networked Cyber Physical Systems: A Survey for Machine Learning Security to Securing Machine Learning for CPS

“…Moreover, they studied the issue of adversarial attacks transferability in unsupervised ML models. Furthermore, the same authors in [145] proposed a definition for adversarial examples in clustering algorithms. Consequently, they presented a powerful black-box adversarial attack algorithm against clustering algorithms for linearly separable clusters.…”

An Overview of Fairness in Clustering

“…Malicious entities can seek to disrupt fairness for their personal gains and agendas. As a starting point for investigating this, it would be useful to leverage work on data poisoning for clustering in a blackbox setting [181], [182]. Without changing the attack objective, the attack first proposed in [32] is especially powerful because it can be carried out without knowing the original clustering algorithm.…”

“…We can delineate a first approach for degrading fairness using the attack algorithm of [181] and for the fairness notion of bounded representation [86]. Let the clustering algorithm be k-means where k = 2.…”

“…Here, for ensuring fairness each protected group's members in a cluster need to be within some minimum and maximum pre-specified proportion. In [181] details adversarial attacks where the target of the adversary is to lead to spill-over of as many points from one cluster to another. Thus, in the 2-way clustering setting, This work is licensed under a Creative Commons Attribution 4.0 License.…”

“…since this attack algorithm can change the proportion of points that belong to each cluster, we can effectively skew the chosen fairness metric for the outputted clustering. We defer interested readers to [181] for more details on the attack algorithm and threat model. Subsequent to this, there are many possible directions along which fairness degrading adversarial attacks can be extended:…”