Strong Black-box Adversarial Attacks on Unsupervised Machine Learning Models

TL;DR

This paper introduces a robust black-box adversarial attack method targeting unsupervised clustering algorithms, demonstrating its effectiveness across multiple algorithms and exploring attack transferability between techniques.

Contribution

The paper presents a novel iterative black-box adversarial attack for unsupervised clustering, filling a gap in security analysis of unsupervised ML models.

Findings

Attack successfully fools multiple clustering algorithms

Adversarial samples transfer between different clustering methods

Effective attack demonstrated on real-world dataset

Abstract

Machine Learning (ML) and Deep Learning (DL) models have achieved state-of-the-art performance on multiple learning tasks, from vision to natural language modelling. With the growing adoption of ML and DL to many areas of computer science, recent research has also started focusing on the security properties of these models. There has been a lot of work undertaken to understand if (deep) neural network architectures are resilient to black-box adversarial attacks which craft perturbed input samples that fool the classifier without knowing the architecture used. Recent work has also focused on the transferability of adversarial attacks and found that adversarial attacks are generally easily transferable between models, datasets, and techniques. However, such attacks and their analysis have not been covered from the perspective of unsupervised machine learning algorithms. In this paper, we seek to bridge this gap through multiple contributions. We first provide a strong (iterative) black-box adversarial attack that can craft adversarial samples which will be incorrectly clustered irrespective of the choice of clustering algorithm. We choose 4 prominent clustering algorithms, and a real-world dataset to show the working of the proposed adversarial algorithm. Using these clustering algorithms we also carry out a simple study of cross-technique adversarial attack transferability.