Adversarial Robustness on Image Classification with $k$-means

Junae Kim; Paul Montague; Rollin Omari

RECORD

Adversarial Robustness on Image Classification with $k$-means

Rollin Omari, Junae Kim, Paul Montague

Machine Learning · Submitted 15 Dec 2023

abstract compiled · 2026-09-23 · no language-model review

The authors' main claim We additionally introduce and evaluate an adversarial training method that improves testing performance in adversarial scenarios, and we highlight the importance of various parameters in the proposed training method, such as continuous learning, centroid initialisation, and adversarial step-count.

how it is stated · asserted 1.00 read the record →

Comment (0) Read on arXiv ↗

Cite ▾

Claim paper

The compiled record

The paper's own sentences, arranged. Each label is drawn from a closed vocabulary; the number beside it is the probability the classifier gave that label. Numbers in the tables are the authors', checked by code. No sentence in this record was written by a model.

Open the compiled record

Compiled by classifier-1.13.0 via TypeSafe API, question bank abstract-p1-20260923, 2026-09-23: 1 request, 3,675 input tokens.

What the abstract itself states, as probabilities: claims first 0.04 · states limitation 0.22 · human participants 0.03 · controlled comparison 0.17 · randomized assignment 0.02 · states quantitative result 0.04 · compares with prior results 0.17 · mentions code or data availability 0.02.

The abstract, sentence by sentence

arXiv listing abstract v2. Results and the main claim are underlined; show every role.

In this paper we explore the challenges and strategies for enhancing the robustness of $k$-means clustering algorithms against adversarial manipulations. We evaluate the vulnerability of clustering algorithms to adversarial attacks, emphasising the associated security risks. Our study investigates the impact of incremental attack strength on training, introduces the concept of transferability between supervised and unsupervised models, and highlights the sensitivity of unsupervised models to sample distributions. We additionally introduce and evaluate an adversarial training method that improves testing performance in adversarial scenarios, and we highlight the importance of various parameters in the proposed training method, such as continuous learning, centroid initialisation, and adversarial step-count.

background contribution method result interpretation main claim

What the classifier reports for each sentence. The number is the probability it gave the label.
#	sentence	role	the authors' own work	states the main conclusion	strength
s0	In this paper we explore the challenges and strategies for enhancing the robustness of $k$-means clustering algorithms against adversarial manipulations.	contribution 0.82	0.61	0.06	asserted 0.52
s1	We evaluate the vulnerability of clustering algorithms to adversarial attacks, emphasising the associated security risks.	background 0.69	0.59	0.07	asserted 0.94
s2	Our study investigates the impact of incremental attack strength on training, introduces the concept of transferability between supervised and unsupervised models, and highlights the sensitivity of unsupervised models to sample distributions.	contribution 0.93	0.89	0.16	asserted 0.99
s3	We additionally introduce and evaluate an adversarial training method that improves testing performance in adversarial scenarios, and we highlight the importance of various parameters in the proposed training method, such as continuous learning, centroid initialisation, and adversarial step-count.	contribution 0.86	0.95	0.29	asserted 1.00

What kind of paper the classifier reports this is: method or tool 0.90 · evidence from observation or experiment 0.83.

What was examined, and what was not

sources read

arXiv listing abstract v2

not examined

full text
figures and tables
references and citing sentences
relations to other papers

levels run

P abstract

not run

S sections
T body sentences
C citations
R cross-paper relations

Every quoted sentence on this record is the authors'. Every label is from Pith's closed vocabulary, with the probability shown beside it. Every number in the measurements table is the authors', checked by code. Record as JSON

The paper

Original abstract

In this paper we explore the challenges and strategies for enhancing the robustness of $k$-means clustering algorithms against adversarial manipulations. We evaluate the vulnerability of clustering algorithms to adversarial attacks, emphasising the associated security risks. Our study investigates the impact of incremental attack strength on training, introduces the concept of transferability between supervised and unsupervised models, and highlights the sensitivity of unsupervised models to sample distributions. We additionally introduce and evaluate an adversarial training method that improves testing performance in adversarial scenarios, and we highlight the importance of various parameters in the proposed training method, such as continuous learning, centroid initialisation, and adversarial step-count.

Human review

How Pith checks papers → · Full audit of this paper →

How the literature uses it

What this paper does with the arXiv papers it cites

Each citing sentence is taken from the citing paper's LaTeX source and typed by Pith's classifier. A label appears at probability 0.8 or more (0.95 for support), a contest at 0.7 or more; the quoted words are the citing authors'. How each label was checked · JSON

What it cites · 3 sentences without a confident label

Uses the method or tool of 1 paper

For software, we use Python 3.9 and we implement our adversarial attacks with the Adversarial-Robustness-Toolbox [ref] .

Adversarial Robustness Toolbox v1.0.0 · Implementation Details · 1.00

Uses data or values from 1 paper

To evaluate our method, we utilise the MNIST [ref] and Fashion-MNIST [ref] datasets.

Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms · Datasets · 0.99

Cites as background 9 papers

To mitigate the threat of adversarial examples, a large variety of defence methods have been proposed, including adversarial training, which involves incorporating adversarial examples during the training process [ref] ; input transformations, which involve altering the input data via augmentation, smoothing or normalisation to improve model robustness [ref] ; de-noising, which removes or reduces noise from input data with filtering techniques [ref] ; and certified defence, which provides bounds and guarantees for a model's output [ref] .

Countering Adversarial Images using Input Transformations · Introduction · 0.95
To mitigate the threat of adversarial examples, a large variety of defence methods have been proposed, including adversarial training, which involves incorporating adversarial examples during the training process [ref] ; input transformations, which involve altering the input data via augmentation, smoothing or normalisation to improve model robustness [ref] ; de-noising, which removes or reduces noise from input data with filtering techniques [ref] ; and certified defence, which provides bounds and guarantees for a model's output [ref] .

Mitigating Adversarial Effects Through Randomization · Introduction · 0.95
To mitigate the threat of adversarial examples, a large variety of defence methods have been proposed, including adversarial training, which involves incorporating adversarial examples during the training process [ref] ; input transformations, which involve altering the input data via augmentation, smoothing or normalisation to improve model robustness [ref] ; de-noising, which removes or reduces noise from input data with filtering techniques [ref] ; and certified defence, which provides bounds and guarantees for a model's output [ref] .

Certified Defenses against Adversarial Examples · Introduction · 0.95

Discussion

Know something about this paper? Leave a comment, or highlight any passage above to comment on it.