On the Adversarial Robustness of Subspace Learning

Abstract

In this paper, we study the adversarial robustness of subspace learning problems. Different from the assumptions made in existing work on robust subspace learning where data samples are contaminated by gross sparse outliers or small dense noises, we consider a more powerful adversary who can first observe the data matrix and then intentionally modify the whole data matrix. We first characterize the optimal rank-one attack strategy that maximizes the subspace distance between the subspace learned from the original data matrix and that learned from the modified data matrix. We then generalize the study to the scenario without the rank constraint and characterize the corresponding optimal attack strategy. Our analysis shows that the optimal strategies depend on the singular values of the original data matrix and the adversary's energy budget. Finally, we provide numerical experiments and practical applications to demonstrate the efficiency of the attack strategies.

References in corpus (8)

• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• Robust Physical-World Attacks on Deep Learning Models
• An Online Algorithm for Separating Sparse and Low-dimensional Signal Sequences from their Sum
• Dynamic Anomalography: Tracking Network Anomalies via Sparsity and Low Rank
• Online Categorical Subspace Learning for Sketching Big Data with Misses
• The Role of Principal Angles in Subspace Classification
• A geometric note on subspace updates and orthogonal matrix decompositions under rank-one modifications
• On the Adversarial Robustness of Multivariate Robust Estimation

Cited by in corpus (5)

• On the Adversarial Robustness of LASSO Based Feature Selection
• Dimensionality reduction, regularization, and generalization in overparameterized regressions
• Optimal Feature Manipulation Attacks Against Linear Regression
• Generalized Likelihood Ratio Test for Adversarially Robust Hypothesis Testing
• Do Deep Minds Think Alike? Selective Adversarial Attacks for Fine-Grained Manipulation of Multiple Deep Neural Networks