On the Adversarial Robustness of Multi-Kernel Clustering
Authors: Hao Yu
Weixuan Liang
KE LIANG
Suyuan Liu
Meng Liu
Xinwang Liu
Venue: ICML 2025 poster (2025)
Keywords: Multi-Kernel Clustering; Adversarial Attacks
Primary area: general_machine_learning->clustering

Abstract: Multi-kernel clustering (MKC) has emerged as a powerful method for capturing diverse data patterns, offering robust and generalized representations of data structures. However, the increasing deployment of MKC in real-world applications raises concerns about its vulnerability to adversarial perturbations. While adversarial robustness has been extensively studied in other domains, its impact on MKC remains largely unexplored. In this paper, we address the challenge of assessing the adversarial robustness of MKC methods in a black-box setting. Specifically, we propose *AdvMKC*, a novel reinforcement-learning-based adversarial attack framework designed to inject imperceptible perturbations into data and mislead MKC methods. AdvMKC leverages proximal policy optimization with an advantage function to overcome the instability of clustering results during optimization. Additionally, it introduces a generator-clusterer framework, where a generator produces adversarial perturbations, and a clusterer approximates MKC behavior, significantly reducing computational overhead. We provide theoretical insights into the impact of adversarial perturbations on MKC and validate these findings through experiments. Evaluations across seven datasets and eleven MKC methods (seven traditional and four robust) demonstrate AdvMKC's effectiveness, robustness, and transferability.

On the Adversarial Robustness of Multi-Kernel Clustering
Hao Yu Weixwan Liang'
Ke Liang'
Suyuan Liu
Meng Liu'
Xinwang Liu'
Abstract
representation of data structures (Zhang al., 2023). This enhanced representation improves clustering robustness and generalization, particularly in heterogeneous scenarios. As result, MKC has been widely applied in domains such as disease diagnosis (Lu et al., 2020; Jiang et al., 2023) and hyperspectral image classification (Jiang et al., 2024; Sima et al., 2022), effectively processing intricate data.
Multi-kernel clustering (MKC) has emerged as powerful method for capturing diverse data pat- terns, offering robust and generalized representa- tions of data structures. However, the increasing deployment of MKC in real-world applications raises concerns about its vulnerability to adver- sarial perturbations. While adversarial robustness has been extensively studied in other domains, its impact on MKC remains largely unexplored. In this paper, we address the challenge of assess- ing the adversarial robustness of MKC methods in a black-box setting. Specifically, we propose AdvMKC, a novel leaarneenmee---aiinnggg.en adversarial attack framework designed to inject imperceptible perturbations into data and mislead MKC methods. AdvMKC leverages proximal policy optimization with an advantage function to overcome the instability of clustering results during optimization. Additionally, it introduces a generator-clusted framework, where a generator produces adversarial perturbations, and a clus- terer approximates MKC behavior, significantly reducing computational overhead. We provide theoretical insights into the impact of adversarial perturhations on MKC and validate these findings through experiments. Evaluations across seven datasets and eleven MKC methods (seven tradi- tional and four robust) demonstrate AdvMKC's effectiveness, robustness, and transferability.
Despite its advantages, the increasing adoption of MKC raises concerns about its robustness against adversarial per- turbations (i.e., small, imperceptible modifications) that can significantly degrade performance (Szegedy et al., 2014; Goodfellow et al., 2015; Sun et al., 2024a). Such vul- nerabilities, demonstrated in domains like image classifi- cation (Shen et al., 2021) and natural language process- ing (Alzantot al., 2018), pose significant risks to security- critical applications. This highlights the urgent need to evaluate the adversarial robustness of MKC methods.
However, this area remains largely underexplored. Existing studies primarily address noise with predefined distribu- tions (e-g., Gaussian noise (Sun al., 2024b; Wang et al., 2023; Yu et al., 2025)) or internal issues such as missing or corrupted data (Liu et al., 2020), while neglecting ad- versarial attacks involving intentional perturbations (Yang et al., 2023). Furthermore, current research on adversarial robustness in multi-view clustering is limited to deep multi- view clustering methods (Huang et al., 2024), which rely on deep representations rather than ity matrices central to MKC. This gap prompts critical question: Can adversarial allacks be effectively designed to evaluate the robustness of MKC methods? Addressing this question introduces two main challenges: 1) Designing learning paradigm that manages the instability of clustering results during adversarial perturbation optimization, espe- cially given the unsupervised nature of clustering and the instability of K-Means-basse methods (Ben-David et al., 2007). 2) Reducing the computational overhead associated with clustering operations, which inherently expensive.
similar-
1. Introduction
Multi-kernel clustering (MKC) leverages multiple kernel functions to capture diverse data patterns (Liang et al., 2024a; Yu et al., 2024; Sun et al., 2024c), By integrating various kernels, MKC addresses the limitations of single- kernel methods, offering more comprehensive and robust
Our Work. In this paper, we address the problem of adver- sarial attacks on MKC by formulating it as a reinforcement learning (RL) task. In this setting, adversarial perturbations are injected into the data, and the degradation in clustering performance serves as a reward guide the optimization process. To tackle these challenges, we propose AdvMKC.
'College of Computer Science and Technology, National Uni- versity of Defence Technology, Changsha, China. Correspondence to: Xinwang Liu <xinwangliue @ nud..
Proceedings of the ndnd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 20255 by the author(s).

---

On the Adversarial Robustness of Multi-Kernel Clustering
novel black-box adversarial attack framework specifically designed for MKC. The framework leverages RL techniques, particularly proximal policy optimization (Schulman al., 2017), to address the inefficiency caused by unstable clus- tering results by employing the advantage function (Pan et al., 2022; Babaeizadeh et al., 2017) during optimization. To further enhance efficiency and reduce computational costs, AdvMKC introduces a gemerator-clustere frame- work. In this setup, the generator produces adversarial per- turbations, while the clusterer approximates the behavior of MKC methods, significantly minimizing the need for re- peated clustering operations during the attack process. Our main contributions are summarized as follows:
et al., 1998) kernels. The quality of the kernel matrix signif- icantly influences clustering performance, making kernel se- lection a key challenge. MKC addresses this by combining multiple kernlls to generate N₂ kernel matrices {K& k=1
Kernel K-Means (MKKM) (Huang et al., 2012), a
powerful MKC method, assigns weights y E R to each kemel and optimizes the following objective:
min Tr (K, HHH)), H S.t. H IK, Y 1== 1, 7 72
(2)
where Ix is a K x K identity matrix, = Th K₁ represents the weighted kernel combination, and H E R-N* is obtained through eigen decomposition of K,,
To the best of our knowledge, this is the first study to evaluate the adversarial robustness of MKC methods in the black-bor setting. We assume an attacker injects im- perceptible, intentional perturbations to mislead unknown MKC methods, leading to erroneous clustering results.
MKC particularly well-suited for multi-view data, where single object is represented by features from diverse sources, For multi-view data X = {XI..... N, ). applying mul- tiple kernel functions to each view yields N₁. = Na x [K]] kernel matrices, where N₂ is the number of views and [AC] is the number of kernel functions.
We propose AdvMKC, novel reinforcememt-leamiing based adversarial attack framework consisting of pertur- bation generator and a clusterer. The generator creates ad- versarial perturbations, while the clusterer mimics MKC behavior to accelerate optimization.
2.2. Adversarial Attacks on Clustering
Research on adversarial attacks against clustering has pre- dominantly focused on traditional methods operating in the original feature space. Early studies demonstrated that ad- versarially positioning samples near cluster boundaries can lead mis-clustering (Dutrisac & Skillicorn, 2008; Skil- licorn, 2009). For example, Biggio al. (2013) attacked hierarchical clustering, while Crussell et al. (2015) dis- rupted DBSCAN by merging clusters. Similarly, Chhabra el al. (2020) highlighted K K-Means' vulnerability to boundary perturbations, and Cinà (2022) proposed a black-bor attack using genetic algorithms to generate perturbations without knowledge of the clustering algorithm.
We provide theoretical insights into the impact of adver- sarial perturbations on MKC performance and validate these findings through empirical evaluations.
We conduct extensive experiments on seven benchmark datasets and eleven MKC methods (seven traditional and four robust methods) to demonstrate the effectiveness, robustness, and transferability of AdvMKC.
2. Background and Related Work
2.1. Multi-Kernel Clustering
Adversarial attacks on MKC, however, remain underex- plored. Huang et al. (2024) introduced adversarial methods for multi-view clustering using generative adversarial net- works (GANs) to disrupt view complementarity and con- sistency. However, their approach is inapplicable to MKC due the absence of feedback mechanisms required to op- timize GAN parameters. This gap underscores the need for novel methods to systematically evaluate the adversarial robustness of MKC methods.
MKC enhances clustering performance by overcoming the limitations of traditional methods such as K K-Means (Mac-
Queen et al., 1967) and spectral clustering (Ng et al., 2001), which rely on single similarity measures and struggle with the complexity of multi-view datasets (Yang et al., 2024; Liang et al.. 2024a; Liu et al., 2022a:b). By integrating multiple kernels, each capturing distinct data characteristics, MKC achieves improved accuracy and robustness.
For single-view data X E Nxd, where N is the number of samples, K is the number of clusters, and d is the fea- ture dimension, a nonlinear mapping s--) projects X into a reproducing kernel Hilbert space. The kernel matrix is:
Due to space constraints, related work on RL for adversarial attacks is discussed in Appendix 3.
3. Reinforcement Learning on Adversarial Attacks
K. << a t (x:))d(a;))
(1)
where sc(-,) :) is a positive as Gaussian (Babaud et al., 1986) or polynomial (Smola
kemnel function, such
Reinforcement learning (RL) has shown success in tackling challenges across various domains, including adversarial ro-
2

---

On the Adversarial Robustness of Multi-Kerne Clustering
bustness. Its strength lies in optimizing sequential decision- making processes. In adversarial contexts, RL has been applied to attack diverse models and datasets. For instance, Sun et al. (2020) injected nodes and adjusted links in graphs to test graph neural networks, while Yang et al. (2020) used RL to generate textured patches disrupting convolutional neural networks. Sarkar el al. (2023) identified sensitive im- age regions for minimal perturbations, and Ju et al. (2023) leveraged RL inject malicious nodes into graphs. Despite these successes, RL has not been applied to adversarial at- tacks on MKC, presenting an open research opportunity to explore assessing MKC robustness.
require iterative representation learning following each per- turbation, significantly increasing computational demands for attackers optimizing perturbations based on previous results. To address these challenges, AdvMKC leverages the PPO algorithm (Schulman et al., 2017; Lee et al., 2024) with an advantage function to mitigate clustering instabil- ity. It employs a generator-clusterer RL framework, where the generator produces adversarial perturbations, and the clusterer approximates the victim MKC algorithm, ensuring reliable feedback while reducing computational complexity.
As shown in Figure 1, AdvMKC operates as follows: Given the original dataset X', the attacker perturbs N, data samples in specific views, acknowledging the practical constraints of multi-view data collection from diverse sources. Section analyzes the impact of varying the number of perturbed sam- ples and views attack performance. In the RL framework, an episode represents complete interaction sequence be- tween the adversarial generator and its environment, starting from an initial state and terminating at a predefined state. During each episode, the generator incrementally injects perturbations into the dataset, evaluates rewards based on clustering performance, and adjusts perturbation directions. The process is limited to T steps, defining the episode length of the adversarial attack.
4. Threat Model
Adversarial attacks require clearly defining the attacker's and defender's knowledge, capabilities, and objectives.
Attacker's Knowledege and bilitiies This study adopts a realistic black-box scenario, where the attacker has no access to the internal workings of the victim MKC method C, including its objective functions and optimization strate- gies (Chhabra et al., 2020; Cinà et al., 2022). The attacker can access subset of the original dataset X, introduce perturbations, and observe the resulting representations.
Defender's Knowledege and Abilities. The defender lacks specific knowledge of the adversarial attack, such as the identities of perturbed samples or modified kernel matrices. However, they can employ robust MKC methods to mitigate the impact of adversarial perturbations.
5.2. Attack Environment
The adversarial attack is modeled as RL process, denoted as (X, 27, Ri, with its components detailed below:
Perturbed Dataset X. The perturbed dataset X, at time step represents the adversarially modified multi-view data.
Attacker's Goals. The attacker aims to introduce minimal perturbations N to the dataset, constrained by a predefined noise threshold e. These perturbations are designed to sig- nificantly degrade clustering performance, as evaluated by external metrics M. The optimization problem is:
Perturbation N. The attacker is constrained to perturbing N, samples. To maximize attack efficacy, the MKC method is first applied to the original dataset to derive latent rep- resentations: H = C(X²), where C(-) represents the MKC algorithm, and H E N denotes the representations. Subsequently, K -Means clustering is performed on H, pro- ducing: centroid matrix M E TR K with rows m, as clus- ter centroids, and cluster indicator matrix I E (0, 1 N where assignments are determined as:
arg argmin min M (C(X NN,YY) Y), s.t. [[ S N
(3)
where Y denotes the ground-truth labels, and + represents the operator that injects adversarial perturbations into spe-
cific views of selected samples.
1,
if arg min je(I...RK
- ||h--m;11
L
(4)
5. Methodology
0,
otherwise,
5.1. Overview
The K-Means algorithm minimizes the clustering error:
Adversarial attacks on MKC pose unique challenges due to the characteristies of MKC algorithms: 1) MKC often relies on the K-Means algorithm to cluster latent represen- tations without supervision. The absence of labeled data impedes the consistent learning of representative features, while random initialization of cluster centers further exac- erbates instability (Lu et al., 2024), complicating the eval- uation of perturbation effectiveness. 2) MKC algorithms
K
min H IM P
S.T.
>
1L==1
(5)
M.I
To identify NP samples for perturbation, the distances be- tween samples and their cluster centroids are computed as:
d v diag ((H IM) IM)T),
(6)
3

---

On the Adversarial Robustness of Multi-Kerne Clustering
Generator
Reward Fy
Clusterer
Lincer
h
h12
hxx,
Concat
Pamurbec
A
Encoder
Encoder
Encoder
Decoder
Decoder
Encoder
Encoder
Encoder
Uill
Image
Audia
Text
Image
Audio
Image
Audio
Text
Perturbed Dataset X:;
Perturbation
Perturbed Dataset Asss
Figure 1. Overview of AdvMKC. Assuming a dataset with three views, ie.. image, audio, and text, the generator is trained to produce adversarial perturbations for the image and audio views. The clusterer evaluates the clustering performance of the perturbed dataset and provides a reward signal to guide the generator's optimization process.
where diag(-) extracts the diagonal elements the resulting matrix. The samples with the largest distances are selected:
The generator produces adversarial perturba- tions based on the current perturbed dataset X4. To ensure the perturbations remain within predefined threshold e, their magnitude is constrained as:
Generator.
Σd dr
arg max IC(L MET
Given practical constraints, the attacker perturbs only Nº views of the selected No samples. time step adversarial perturbations N₁- = (N1,..., NNg) are injected as:
[IG(X; :1
n4 c. 0)
(10)
where represents the generator's parameters. The pertur- bation vector nu is decomposed into per-view components, as shown in Eq. (8).
X X X, + N otherwise.
if if 1I,...,NH):
(8)
The generator 9 adopts an encoder-decoder architecture, as shown Figure The encoder consists of Na encoders, each corresponding to dataset view, minimizing computa- tional complexity. The decoder includes N² decoders, one for each perturbed view. Representations from the encoders are concatenated via the Concat(.) operator, effectively inte- grating multi-view information for generating perturbations.
Here, M₁ Decommn,; (n;; I, N2). where Decom(.) dis- tributes vectorized perturbations across views and samples.
Reward R. The reward function quantifies the effective- ness of adversarial perturbations and facilitates RL con- vergence. Since MKC operates in an unsupervised setting without ground-truth labels, the optimization in Eq. (3) is oheeopitaaaaiii impractical, and gradient-free metrics, such distance mea- sures (Biggio et al., 2013), are inadequate for guiding pertur- bation generation. To address these limitations, clustering performance is assessed using the average cosine similarity of data samples within the same cluster prior to the attack. At time step I, the reward is defined as:
Clusterer. Following the generation of perturbations by g and the creation of the updated dataset X, the clusterer approximates clustering performance to provide feedback for optimizing the generator.
The clusterer is designed to mimic the functionality of the victim MKC method while treating it as a black box. Shar- ing the same encoder architecture as G, the clusterer ex- tracts latent multi niew representations, which are further processed through multi-layer perceptron to produce clus- tering outcomes. The clusterer predicts reward S(Y;; p) for the generated adversarial perturbations using Eq. (9), where represents the clusterer's parameters, and (())) is derived from the clusterer instead of the black-box MKC.
O Cidi
(9)
where H!! represents the i-th row of the learned represen-
tations H at time step 1, C = I {0, NxN is the co-occurrence matrix indicating sample cluster assignments, and @ denotes the Hadamard product.
5.4. Training Procedure
To optimize the adversarial generator and clusterer, we adopt the PPO algorithm (Schulman et al., 2017) with experi- ence replay mechanism utilizing a memory buffer B. During training, decision-man makinn processes are simulated to gen- erate training data, which stored in B with maximum sequence length of Each entry in B represented as
5.3. Generator-Clustere Framework
To reduce queries to the victim MKC and enhance optimiza- tion efficiency, we propose a generator-cluster framework for perturbation generation and approximation of the victim MKC's functionality.

---

On the Adversarial Robustness of Multi-Kerna Clustering
triplet (N, re). encapsulating the perturbed dataset, perturbation, and reward. To address the variability in wards, the advantage function A, is employed to estimate the relative value of rewards compared to a baseline:
6. Theoretical Analysis
This section explores the impact of injected perturbations on clustering performance. with focus on the MKKM (Huang et al., 2012) algorithm as a representative clustering method. For optimization stability, the kernel matrix is normalized as K, N K
T
A.
Σ V=t
x rr S(K:p))
(11)
We reformulate the MKKM objective function and describe its optimization using the reduced gradient method. The objective function is defined as:
where y is the discount factor, and T the total number of time steps per episode.
Generator Loss. The generator aims to maximize the ex- pected advantage while ensuring stable updates through clipped surrogate objective:
f(r)
min Tr (I, (HIIN-HH') HHT).. H-
(17)
Proposition 6.1. The function f(r)) in Eq. (17) is differen- fiable. The gradient's 's p-th component is given by:
(0) = E, [min (0,A,, clip( 7. 1, 7)), (12)
0f(7) = 27p Tr(K (IN HH))),
where 0.- x (8))
=((aaa))))) is the probability ratio of the new generator relative to the old one, and 17 is hyperparameter regulating the allowable deviation. The clipping function clip(.) constrains the ratio to (1-7,, 1+7), mitigating abrupt updates to enhance the robustness and sample efficiency compared to standard gradient methods.
0%
where H min H-Ix Tr(K, - HH
Building on Proposition 6.1, we the reduced gradient method (Rakotomamonjy et al., 2008) to optimize Eq. (17), maintaining the constraints on y. Let u E {1,..., N denote a fixed index. The reduced gradient is calculated as:
The clusterer estimates the expected attack performance for each perturbation by minimizing the error between predicted rewards and actual outcomes:
Clusterer Loss.
[ = 05(7) 0s(7)
Vp
0%p 0%
(p(p) = E, || ((x::))
T
Σ @1(7))
0f(7)
(18)
-
(13)
[V =
8%
O%p
r'ut
prytee
where S(X;; p) denotes the clusterer's s predicted reward for the perturbed dataset Xr given parameters p.
To ensure the positivity of y, the descent direction .d..... dN.]" is defined as:
Entropy Loss. To foster exploration and prevent premature convergence, entropy term is added to the loss:
0.
if 7p 0 and k( > 0;
dp =
Nv ((()),
hp > and p * u;
Centropy (0) = Σ x (9(Xx;)) log क O)). (14)
Ne-1 Eppuno 15(7),
if' u;
(19)
where x(l)
8f(7)
8f(7) 0yp
This term encourages diverse perturbation generation, ducing the risk of suboptimal solutions.
Compared to Rakotomamoniy el al. (2008), the reduced gra- dient here is normalized by NN - to promote convergence within fewer iterations. The update rule is 7 + njd where the step size ensures monotonic convergence of (()) by the reduced gradient method. This algorithm is referred to as MKKM-RG.
Magnitude Loss. To prevent the magnitude of generated perturbations from exceeding specified limit, a regulariza- tion term is introduced to limit the perturbation magnitude:
Emag (0) max (x 0)] 0).
(15)
Assumption 6.2. For any kernel weights 7 E RRN, let òu (r) denote the gap between the k-th and (1+ eigen- values of K,y. We assume for any 7 R No, 5e(r) <0> 0, where is constant.
By optimizing these components together, the training pro- cess achieves balance between exploitation and explo- ration, refining the generator-clustere framework. The over- all loss function is:
This assumption is consistent with standard results in ma- trix theory (Stewart, 1990; Yu et al., 2014) and statistical theory (Von Luxburg et al., 2008; Mitz & Shkolnisky, 2022; Liang et al., 2024a).
L= - Lg( + (p) - (C) (0)+ (0), (16)
where a, B, and y are balancing coefficients.
5

---

On the Adversarial Robustness of Murtel Clustering
Table Effectiveness of AdvMKC against traditional MKC methods (%). Lower metric values indicate better performance. No-attack denotes the scenario where no adversarial attack is applied during clustering.
SMKKM
EROMVC
LSWMKC
LSMKC
Dutaset
Attack
NM1
ARI
ACC
PR
NM1
ARI
ACC
PR
NMI
ARI
ACC
PR
NMI
ARI
ACC
PR
no-attack
59.96
50.54
69.05
69.05
65.76
59.21
76.19
76.19
59.52
47,99
67.62
69.05
59.52
47.99
67.62
69.05
RAMKC
61.89
53.89
72.38
72.38
58.92
47.73
63.81
66.67
55.36
43.06
64.90
65.33
58,13
49.28
69.05
69.05
MSRCvI
EAMKC
60.45
52.43
71.43
71.43
56.65
46.89
64.29
66.
55.10
43.08
64.76
64.76
54.41
43.39
64.76
64.76
AdvMKC
59.44
49.57
68.00
68.00
53.18
43.03
62.86
64.29
54.22
42.42
64.29
64.29
53,90
42.05
63.19
63.19
ne-attack
67.50
66.21
85.11
85.11
62.50
59.39
79.78
79.78
83,12
84.42
93.75
93.75
66,30
64.96
81.07
81.07
RAMKC
67.50
66.21
85.11
85.11
63.21
59.70
79.96
79.96
83.12
84.42
93.75
93.75
66.27
64.92
80.88
80.88
BBCSport
EAMKC
67,50
66.21
85
85.11
62.99
59.29
79.78
79.78
82.47
84.08
93.57
93.57
66.27
64.92
80.88
80.88
AdvMKC
67.23
65,80
84,93
84.93
62.99
59.29
79.78
79.78
82.06
83.57
93.13
93.13
66.03
64.20
79.23
79.23
no-attack
39.97
11.20
29.11
38.90
42.49
12.69
32.71
40.78
39.97
11.20
29.11
38.90
40.58
11.71
30.84
38.18
Protein Fold
RAMKC
31.47
09.07
23.92
29.11
42.41
12.94
33.57
39.34
42.60
13.94
31.70
38.90
39.95
11.27
30.84
37.03
EAMKC
29.42
07.57
21.18
26.80
41.98
13.10
32.85
40.35
43.57
15.32
33.14
39.63
39.97
11.81
31.56
38.62
AdvMKC
28.68
07.06
21.09
26.22
39.15
09.66
28.67
38.33
38,93
10.81
28.27
37.61
39,90
10.99
28.10
36.75
no-attack
34.73
22.41
36.97
80.66
45.82
27.26
36.69
83.65
41.73
25.65
37.04
82.02
45.78
34.68
47.76
81.61
Caltech 101-7
RAMKC
34.73
22.46
37.31
80.66
43.88
29.83
46.00
79.82
41.37
25.65
37.04
82.02
45.77
34.54
47.69
81.61
EAMKC
34.73
22.46
37.31
80.66
45.62
31.46
45.66
81.48
41.37
25.65
37.04
82.02
45.36
34.53
47.96
81.61
AdvMKC
34.52
22.29
36.52
80.46
43.73
26.77
32.40
77.95
41.23
25.34
37.02
81,98
45.28
34.42
47.56
81.52
no-attack
25.96
23.65
51.78
54.50
23.74
18.06
44.75
46.74
41.28
41.67
66.33
69.05
19.33
14.45
41.12
41.88
RAMKC
27.78
25.05
52.57
56.40
22.23
17.13
41.85
44.87
41.18
41.52
66.27
68. 96
16.07
12.54
37.14
38.59
Citeseer
EAMKC
26.75
23.99
51.81
55.10
22.30
16.94
41.58
45.14
40.81
41.14
66.00
68.75
23.32
18.73
43.81
46.35
AdvMKC
25.33
23.54
51.30
54.38
22.02
17.03
40.63
43.08
40.73
41.07
65.06
67.81
14.27
10.39
33.81
34,29
no-anack
08.51
04.26
24.76
32.82
07.66
03.38
21.39
30.53
06.64
02.90
23.83
29.65
08.09
04.22
22.91
31.53
NUS-
RAMKC
08.46
04.21
24.66
32.82
07.41
02.99
20.78
30.40
06.54
02.92
23.66
29.65
08.07
04.14
23.13
31.60
WIDE-
EAMKC
08.47
04.23
24.69
32.77
06.83
03.63
23.71
32.01
06.55
02.86
23 69
29.67
08.01
04.18
22.78
31.50
SCENE
AdvMKC
08.39
04.14
24.51
32.40
06.68
02.62
19.44
30.31
06.50
02.58
23.55
29.51
08.00
04.00
22.53
31.35
Theorem 6.3. Let ry and Fy denote the kernel weights ob- tained from MKKM-RG using the original and perturbed kernel matrices, respectively. Assuming identical initializa- tion and a step size 1) S c, where e > O, we have:
RQ III: Do perturbations generated by AdvMKC for one MKC method transfer effectively to other MKC methods?
RQ IV: Does AdvMKC demonstrate consistent perfor-
mance across different settings and hyperparameters?
l -
max - 71 kE(L,".NN))
|N
7.1. Experimental Setup
where N2 represents the adversarial noise injected into the k-th kernel matrix, and] ||
Comprehensive descriptions of the following datasets, base- lines, and MKC algorithms are provided in Appendix B. The source code is publicly available at https: / //gi thub. com/ http:/cyyhhoo/aaaaaa AAVMKC Official.
is the spectral norm.
From Theorem 6.3, it follows that the impact of adversar- ial perturbations is determined by both the magnitude and number of perturbations. Specifically, increasing either the perturbation magnitude or the proportion of noisy samples leads to decline in clustering performance, as further vali- dated by the experimental results in Subsection 7.5.
Datasets. We assess the attack performance of AdvMKC seven benchmark datasets: MSRCv1 (Winn & Jojic, 2005), BBCSport (Greene & Cunningham, 2006), Protein- Fold (Damoulas & Girolami. 2008), HW-6Views (Huang et al., 2020), Caltech101-7 (Dueck & Frey, 2007), Cite- seer (Giles et al., 1998), and NUS-WIDE-SCENE (Chua et al., 2009).
7. Experimental Evaluation
This section presents a comprehensive evaluation to address the following research questions:
Compared Methods. As there are no existing adversarial at- tack approaches for MKC, we introduce two baseline attack strategies: 1) RAMKC adds random Gaussian noise ad- versarial perturbations. 2) FAMKC optimizes the noise dis- tribution using the Evaluation Strategy (Loshchilov, 2017) and the reward function in Eq. (9).
RQ I: Can AdvMKC effectively generate perturbations
that degrade the performance of MKC methods?
RQ II: Can AdvMKC successfully deceive robust MKC methods designed to handle noisy data?
MKC Methods. We compare AdvMKC with seven tra-
6

---

On the Adversarial Robustness of Multi-Kernd Clustering
Table Robustness of AdvMKC against robust MKC methods (%). Lower metrie values indicate better performance. No-attack refers to clustering without adversarial attacks.
JMKSC
ONMSC
MKCDNM
MKSSC-ERC
Dutaset
Attack
NM1
ARI
ACC
PR
NM1
ARI
ACC
PR
NMI
ARI
ACC
PR
NMI
ARI
ACC
PR
no-attack
04.87
00.11
23.81
24.29
81.64
78.16
90.00
90.00
89.77
88.41
94.76
94.76
58.24
40.12
57.14
63.81
RAMKC
03.42
-0.45
21.90
22.86
80.62
76.99
89.52
89.52
91.74
91.13
96.19
96.19
57.06
39.18
56.19
62.38
MSRCvI
EAMKC
02.84
-1.06
20.00
21.90
80.19
76.19
89.05
89.05
86.17
84,93
93.33
93.33
57.06
39.18
56.19
62.38
AdvMKC
01.63
-1.39
19.38
19.86
80.02
76.09
89.00
89.00
85.70
82.17
90.71
90.71
56.71
38.73
55.71
61.90
no-attack
43.74
23.88
55.70
56.80
80.49
81.69
88.05
88.05
46.31
39.43
59.01
66.91
39.98
32.09
54.78
58.46
RAMKC
53.96
37.51
65.07
65.07
80. 14
81.17
87.87
87.87
46.21
39.17
58.82
66.73
39.70
25.64
47.06
59.74
BBCSport
EAMKC
46.78
25.85
55.70
59.01
80.86
81.68
88.05
88.05
45.85
38.82
58.27
66.73
39.78
25.40
46.14
59.74
AdvMKC
38.74
20.30
52.21
55.51
80.04
81.02
87.35
87.35
45.11
37.86
57.90
65.99
38,77
24.90
45,06
58.19
no-attack
27.41
08.02
23.63
25.36
20.08
07.09
19.31
20.61
18.89
04.46
20.32
21.90
22.06
07.38
22.33
23.34
Protein Fold
RAMKC
25.25
07.91
21.76
23.78
21.23
06.49
18.44
21.04
18.54
05.22
21.33
21.76
22.49
07.33
20.89
21.76
EAMKC
24.80
07.81
22.19
23.63
20.65
07.40
20.03
21.04
19.29
04.19
21.76
21.76
14.48
01.32
17.29
17.44
AdvMKC
23.65
06.90
21.04
22.92
19.48
06.46
18.16
20.46
18.08
04.14
20.03
21.05
14.04
01.19
17.15
17.58
no-attack
00.98
-0.23
38.60
54.21
42.65
26.65
37,99
82,43
50.76
32.93
48.85
85.28
55.31
40.14
51.76
84.40
Caltech 101-7
RAMKC
01.12
00.08
17.84
51.14
42.66
26.69
38.20
82,43
50.32
32.89
45.93
85.01
55.44
40.41
52.10
84.46
EAMKC
00.94
00.86
29.51
54.14
42.66
26.66
38.06
82.43
50.49
32.78
49.19
85.21
55.88
40.18
51.76
83,92
AdvMKC
00.30
-0.30
17.31
50.14
42.52
26.60
36.90
82.40
50.25
32.22
44.71
84.87
55.15
38.78
49.59
83.92
no-attack
01.15
-0.04
21.50
21 66
24.20
21.07
50.09
51.78
21.06
19.57
46.35
48.70
38.54
34.42
61.62
63.22
RAMKC
01.58
00.96
22.95
2.
26.39
24.76
$4.35
56.28
19.70
16.11
43.51
48. 18
39.50
36.57
61.14
65.34
Citeseer
EAMKC
01.59
01.00
23.07
24.18
27.04
25.24
54.71
56.73
07.55
02.49
27.57
31.31
39,96
36.81
62.32
65.31
AdvMKC
01.06
-0.05
21.07
21.21
24.00
20.38
47.19
49.94
06.91
02.47
27.14
30.40
38.01
33.55
60.91
62.46
no-antck
01.11
00.23
21.27
28.47
07.87
03.10
21.03
29.99
07.93
03.39
21.27
30.55
06.32
02.97
21.78
30.84
NUS-
RAMKC
01.11
00:40
17.34
28.47
07.88
03.10
21.15
29.99
07.93
03,40
21.39
30.55
06.38
03.00
21.73
30.92
WIDE-
EAMKC
01.36
-0.44
18.58
28.47
07.95
03.10
21.10
29.96
07.93
03.41
21.20
30.62
06.38
02.97
21.71
30.87
SCENE
AdvMKC
00.40
-0.52
18.01
27.68
07.81
03.06
20.15
29.01
07.87
03.30
21.12
30.31
06.30
02.95
21.70
30.82
ditional MKC methods: MVC-LFA (Wang al., 2019),
are presented in Table 1, with additional findings provided in Table 5. Key observations are summarized as follows:
LSMKKM (Liu et al., 2021), MKKM-SR (Lu et al., 2022),
SMKKM (Liu, 2023), EEOMVC (Wang et al., 2024),
1) Adversarial attacks degrade MKC performance. As demonstrated in the theoretical analysis (Section 6) and experimental results (Table 1), adversarial perturbations sig- nificantly reduce clustering performance. For instance, on the MSRCv1 dataset, attacking EEOMVC reduces NMI from 65.76% to 53.18%. These results confirm that MKC methods, like other machine learning models, are suscepti- ble to adversarial attacks.
LSWMKC (Li et al., 2024), and LSMKC (Liang et al.,
2024b), as well as four robust MKC methods designed for noisy data: JMKSC (Yang et al., 2019), ONMSC (Zhou al., 2020), MKCDNM (Zhang et al., 2022), and MKSSC- ERC (Xu et al., 2024).
To assess clustering performance be- fore and after adversarial attacks, we use four external eval- uation metrics: normalized mutual information (NMI), ad- justed rand index (ARI), accuracy (ACC), and purity (PR).
Evaluation Metries.
2) ACC and PR metries coincide in some cases. Since clustering an unsupervised task, both metries rely on the best possible label assignment. ACC determines the optimal one-to-one mapping between cluster IDs and ground truth labels using the Hungarian algorithm (Kuhn, 2010), whereas PR assigns each cluster to the most frequent ground truth label. When clusters closely align with single ground truth classes (i.e., each cluster predominantly contains data points from one class), both metrics yield identical values.
Implementation Details. To ensure imperceptible adver- sarial perturbations, modify 10% of the dataset samples, with 50% of the views being targeted by default. Following established practices (Chen et al.. 2020), the perturbation magnitude is computed using the &g norm, with a default value of e = 0.1vd. d. Specifically, for a feature vector of size d, an f2 norm perturbation of magnitude e corresponds to an average perturbation of e/ vd per feature.
3) AdvMKC outperforms RAMKC and EAMKC. Ad- vMKC consistently achieves superior performance in gener- ating effective perturbations. For example, on the MSRCv1 dataset, when attacking SMKKM, AdvMKC achieves the most significant impact, demonstrating its ability to opti- mize the perturbation generator through RL.
7.2. RQ I: Effectiveness Evaluation
This section evaluates the adversarial robustness of of the-art MKC methods, targeting seven methods as victims.
Results for SMKKM, EEOMVC, LSWMKC, and LSMKC
7

---

On the Adversarial Robustness of Multi-Kerne Clustering
7.3. RQ II: Robustness Evaluation
Table 3. Transferability of AdvMKC by leveraging surrogate MKC
This section evaluates the effectiveness of AdvMKC against robust MKC algorithms, specifically targeting JMKSC, ON- MSC, MKCDNM, and MKSSC-ERC as victim methods. The experimental results, summarized in Table 2, yield the following key insights:
methods to attack unknown victim MKC methods.
Surrogate
SMKKM
MKSSC-ERC
Dataset
MKC
NM1
ARI
ACC
PR
NMI
ARI
ACC
PR
no-attock
59.96
50.54 69.05 69.05
58.24
40.12
57.14
63.81
EEOMYC
57.65
49.61 68.48
68.48
56.14
38.22
57.02
62.86
MSRCvI
LSMKC
57.35
48.73 68.52 68.52
55.43
39,20
57.10
61.43
1) Robust MKC methods struggle to defend against ad- versarial attacks. For instance, on the MSRCv1 dataset, when attacking the JMKSC algorithm, AdvMKC reduces NMI to 1.6 1.63%. This highlights critical limitation of current robust MKC methods, which often assume perturbations follow Gaussian distributions, rendering them ineffective against more complex adversarial scenarios.
JMKSC
54.39
45.58
64.29
64,29
54.96
37.81
55.71
59.52
ONMSC
56.37
48.67
68.05
68.05
54.19
37.19
56.14
60.48
no-attock
67.50
66.21
85.11
85.11
39,98
32.09
54.78
58.46
EEOMVC
66.25
65.03 84,56
84,56
38.85
30.75
52.12
57.68
BBCSport
LSMKC
66.57
65.50
84.74
84,74
38.22
26.42
47.46
57.29
JMKSC
66.89
65.35 84.74
84, 74
32.67
09.37
71.73
45.40
ONMSC
67.42 66.12
85.00
85.00
39.52
24.94
46.32
58.82
no-attack
39.97
11.20
29.11
38, 90
22.06
07.38
22.33
23.34
EEOMVC
30.15
07.54
21.33
26.80
21.38
01.37
18.59
22.91
Protein
LSMKC
29.57
08.11
20.89
26.37
22.01
00.75
17.29
20.75
2) Robust MKC methods are resilient to Gaussian noise. For example, on the ProteinFold dataset, RAMKC does not significantly degrade the clustering performance of the ONMSC method (NMI: 21.23% under attack vs. 20.08% without attack). This demonstrates that robust MKC meth- ods are well-suited to handle Gaussian noise but remain vulnerable to advanced adversarial attacks.
Foldd
JMKSC
28.93
07.40
20.61
24.64
21.78
02.77
19.88
22.97
ONMSC
29.88
07.75
21.33
27.81
21
02.98
18.30
22.36
100%
100%
75%
50%
50%
25%
25%
7.4. RQ III: Transferability Evaluation
0%
0.56
0.10
0.15
0.50
0.25
0.30
0.05
0.10
0.12
0.00
0.35
0350
This subsection investigates the transferability of adversarial attacks, acknowledging that the defender's specific MKC method is often unknown. It also considers an extreme scenario in which attacking a multi-view clustering model necessitates extensive queries to the target MKC method, leading to substantial resource consumption. To evaluate this, randomly selected MKC method (referred to as the surrogate MKC) is used to train the perturbation generator, and its effectiveness is subsequently tested on a different victim MKC method. The experimental results, summarized in Table 3, yield the following key observation:
(4)LSMKC
(b)
ONMSC
Figure 2. The impact of the proportion of perturbed samples on the MSRCvl dataset.
proportion of perturbed samples is analyzed by vary- ing the ratio of selected samples to the total dataset as {0.05, 0.10, 0.15, 0.20, 0.25, 0.30). Evaluations are con- ducted on the MSRCv1, BBCSport, and ProteinFold datasets. Results for the MSRCv1 dataset are shown in Figure 2, while Figures 5 and 6 present results for BBC- Sport and ProteinFold, respectively. The findings indicate that increasing the proportion of perturbed samples leads to a corresponding decline in clustering performance, as expected, since perturbing more samples exacerbates perfor- mance degradation.
1) Adversarial attacks demonstrate significant transfer- ability across MKC methods. For instance, when JMKSC is used as the surrogate MKC method and SMKKM is the victim method, AdvMKC still achieves 5% reduction in NMI. This transferability likely arises from the common characteristics underlying clustering performance in differ- ent unsupervised learning approaches.
Number of Perturbed Views No. The effect of the num- ber of perturbed views is evaluated on the MSRCv1, HW- 6'View, and Caltech101-7 datasets, with NE varied as 21, 3, 4, 6]. Results for the MSRCvl dataset are pro- vided in Figure 3, while Figures 7 and 8 show results for HW-6Views and Caltech101-7, respectively. The results demonstrate that an increase the number of perturbed views leads to notable decline in clustering performance.
7.5. RQ IV: Sensitivity Evaluation
This subsection investigates the influence of three factors on attack performance: the number of selected samples N2. the number of perturbed views N². and the magnitude of adversarial perturbations c. LSMKC and ONMSC are chosen as the victim MKC methods. Note that in scenarios where PR and ACC are nearly identical, the ACC curve is obscured by the PR curve in the experimental results.
The influ- ence of perturbation magnitude is assessed by varying as {0.01 0.05 the MSRCv1, BBCSport, and ProteinFold datasets. Re- sults for the MSRCv1 dataset are shown in Figure 4, with Figures 9 and 10 displaying results for the other two datasets,
Magnitude of Adversarial Perturbations
vd, d, 0.10 d, 0.15
d, 0.20 d, 0.25 on
Number of Selected Samples N7. The impact of the
8

---

On the Adversarial Robustness of Multi-Kerne Clustering
1M
100%
A02
References
75%
75%
Alzantot, M., Sharma, Y., Elgohary, A., Ho, B., Srivastava, M. B., and Chang, K. Generating natural language adver- sarial examples. In EMNLP, pp. 2890-2896. Association for Computational Linguistics, 2018.
50%
50%
09
0%
Babaeizadeh, M., Frosio, I., Tyree, S., Clemons, J., and Kautz, Reinforcement learning through asynchronous advantage actor-critic on GPU. In ICLR. OpenRe- view.net, 2017.
LSMKC
ONMSC
Figure The impact the number of perturbed views on the MSRCvl dataset.
40C
100%
100%
Babaud, J., Witkin, A. P., Baudin, M., and Duda, R. O. Uniqueness the gaussian kernel for scale-space filter- ing. JEEE Trans. Pattern Anal. Mach. Intell., 8(1):26-33, 1986.
50%
50%
25%
25%
Ben-David, S., Pál, D., and Simon, H. U. Stability of k -means clustering. In Bshouty, N. H. and Gentile, C. (eds.), COLT, volume 4539 of Lecture Notes in Computer Science, pp. 20-34. Springer, 2007.
2.0/77
6.0.7 015677
025-77
ozsi0
100/7
606.7
a30/7 035-7 watid 025/7 (bJONMSC
(0) LSMKC
Figure 4. The impact of adversarial perturbation magnitude the MSRCvl dataset.
Biggio, B., Pillai, I., Bulò, S. R., Ariu, D., Pelillo, M., and Roli, F. Is data clustering in adversarial settings secure? In ACM AlSec' 13, pp. 87-98. ACM, 2013.
respectively. The analysis reveals that higher magnitudes cause more severe degradation in clustering performance.
Chen, J., Jordan, M. I., and Wainwright, M. J. Hop- skipjumpattuck: A query-efficient decision- attack. In SP, pp. 1277-1294. IEEE, 2020.
8. Conclusion
In this paper, we proposed AdvMKC, the first black-box ad- versarial attack method specifically designed for MKC. By formulating adversarial attacks on MKC as an RL problem, we utilized proximal policy optimization with an advan- tage function address the instability of clustering results during optimization. We developed an innovative generator- clusterer framework, where the generator produces adver- sarial perturbations and the clusterer approximates MKC behavior, thereby significantly reducing computational over- head. A theoretical analysis was conducted to clarify the impact of injected perturbations on clustering performance, supported by extensive evaluations. Experimental results validated the effectiveness, robustness, and transferability of the proposed approach.
Chhabra, A., Roy, A., and Mohapatra, P. Suspicion-free adversarial attacks on clustering algorithms. In AAAI, pp. 3625-3632, 2020.
Chua, T., Tang, J., Hong, R., Li, H., Luo, Z., and Zheng, Y. NUS-WIDE: a real-world web image database from national university of singapore. In CIVR. ACM, 2009.
Cinà, A. E., Torcinovich, A., and Pelillo, M. A black- box adversarial attack for poisoning clustering. Pattern Recognit., 122:108306 2022.
Crussell, and Kegelmeyer, W. P. Attacking DBSCAN for fun and profit. In International Conference on Data Mining, pp. 235-243. SIAM, 2015.
Acknowledgement
Damoulas, T. and Girolami, M. A. Probabilistic multi-class multi-kemnll learning: on protein fold recognition and remote homology detection. Bioinform., 24(10): 1264 1270, 2008
This work is supported by the National Science Fund for Distinguished Young Scholars of China (No. 62325604), and the National Natural Science Foundation of China (No. 62441618 and 62276271).
Dueck, D. and Frey, B. J. Non-metric affinity propagation for unsupervised image categorization. In ICCV, pp. 1-8. IEEE Computer Society, 2007.
Impact Statement
This paper presents work whose goal is to advance the field of Machine Learning. There are many potential societal consequences of our work, none of which we feel must be specifically highlighted here.
Dutrisac, J. G. and Skillicom, D. B. Hiding clusters in adversarial settings. In IEEE ISI, pp. 185-187. IEEE, 2008.

---

On the Adversarial Robustness of Multi-Kerne Clustering
Fang, X., Liu, D., Zhou, P., and Hu, Y. Multi-modal cross- domain alignment network for video moment retrieval. IEEE Transactions Multimedia, 25:7517-7532, 2022.
Li, L., Wang, S., Liu, X., Zhu, E., Shen, L., Li, K., and Li, K. Local weephee multiple kernel clustering with consensus discriminative graph. IEEE Trans. Neural Networks Learn. Syst., 35(2):121--1744 2024.
Fang, X., Liu, D., Zhou, P., Xu, Z., and Li, Hierarchical local-global transformer for temporal sentence grounding. IEEE Transactions Multimedia, 2023.
Liang, W., Tang, C., Liu, X., Liu, Y., Liu, J., Zhu, E., and He. K. On the consistency and large-scale extension of multiple kernel clustering. IEEE Trans. Pattern Anal. Mach. Intell,, 46 (6(10):6935-6947, 2024a.
Giles, C. L., Bollacker, K. D., and Lawrence, S. Citeseer: An automatic citation indexing system. In International Conference Digital Libraries, pp. 89-98. ACM, 1998.
Liang, W., Zhu, E., Yu, S., Xu, H., Zhu, X., and Liu, X. Scalable multiple kernel clustering: Learning clustering structure from expectation. In ICML. OpenReview.net, 2024b.
Goodfellow, J., Shlens, J., and Szegedy, C. Explaining and harnessing adversarial examples. In ICLR, 2015.
Greene, D. and Cunningham, P. Practical solutions to the problem diagonal dominance in kernel document clus- tering. In ICML, volume 148 of ACM, pp. 377-384. ACM, 2006.
Liu, J., Zhou, J., Zeng, J., and Tian, J. Difattack: Query- efficient black-box adversarial attack via disentangled feature space. In AAAI, pp. 3666-3674. AAAI Press, 2024.
Huang, A., Zhao, T., and Lin, C. Multi-view data fusion oriented clustering via nuclear norm minimization. IEEE Trans. Image Process., 29:9600-996 -010,99111220 2020.
Liu, W., Zheng, X., Su, J., Hu, M., Tan, Y., and Chen, C. Exploiting variational domain-invariant user embedding for partially overlapped cross domain recommendation. SIGIR, pp. 312-321. ACM, 2022a.
Huang, H., Chuang, Y., and Chen, C. Multiple kernel fuzzy clustering. IEEE Trans. Fuzzy Syst., 20(1):120- 134, 2012.
Liu, W., Zheng, X., Su, J., Hu, M., Tan, Y., and Chen, C. Exploiting variational domain-invarien user embedding for partially overlapped cross domain recommendation. SIGIR, pp. 312-321. ACM, 2022b.
Huang, H., Zhou, G., Zheng, Y., Qiu, Y., Wang. A., and Zhao, Q. Adversarially robust deep multi-view cluster- ing: A novel attack and defense framework. ICML. OpenReview.net, 2024.
Liu, X. Simplemkkm: Simple multiple kernel k-means. IEEE Trans. Pattern Anal. Mach. Intell., 45(4):5174- 5186, 2023.
Jiang, L., Yang. Z. Shi, S., Golyanik, V., Dai, D., and Schiele, B. Self-supervised pre-training with masked shape prediction for 3d scene understanding. In CVPR, pp. 1168-1178. IEEE, 2023.
Liu, X., Zhu, X., Li, M., Wang. L.,, Zhu, E., Liu, T., Kloft, M. Shen, D., Yin, J., and Gao, W. Multiple kernel $KSk- means with incomplete kernels. IEEE Trans. Pattern Anal. Mach. Intell. 42(5):1191-1204, 2020.
Jiang, L., Shi, S., and Schiele, B. Open-vocabulary 3d semantic segmentation with foundation models. In CVPR, pp. 21284 21284-21294, IEEE, 2024.
Liu, X., Zhou, S., Liu, L., Tang, C., Wang, S., Liu, J., and Zhang, Y. Localized simple multiple kernel k k-means. In ICCV, pp. 9273-9281. JEEE, 2021.
Ju, M., Fan, Y., Zhang, C., and Ye, Y. Let graph be the go board: Gradient- node injection attack for graph neural networks via reinforcement learning. In Williams, B., Chen, Y., and Neville, J. (eds.), AAAI, pp. 4383 4390, 2023.
Loshchilov, I. LM-CMA: an alternative to L-BFGS for large-scale black box optimization. Evol. Comput., 25(1): 143-171, 2017.
Kuhn, H. W. The hungarian method for the assignment problem. In 50 Years of Integer Programming 1958-2008, pp. 29-47. Springer, 2010.
Lu, H., Liu, S., Wei, H., and Tu, J. Multi-kernel fuzzy clus- tering based on auto-encoder for fmri functional network. Expert Syst. Appl. 159: 113513, 2020.
Lee, V., Abbeel, P., and Lee, Y. Dreamsmooth: Improving model-based reinforcement learning via reward smooth- ing. In ICLR. OpenReview.net, 2024.
Lu, H., Xu, H., Wang, Q., Gao, Q. Yang, M., and Gao, X. Efficient multi-view k-means for image clustering. IEEE Transactions on Image Processing, 33:273-22 284, 2024.
Li, H., Xu, X., Zhang, X., Yang, S., and Li, B. QEBA: query- efficient boundary- blackbox attack. In CVPR. pp. 1218-1227. IEFF, 2020.
Lu, J., Lu, Y., Wang, R., Nie, F,, and Li, X. Multiple kernel k-means clustering with simultancous spectral rotation. In ICASSP, pp. 4143-41 IEFF, 2022.
10

---

On the Adversarial Robustness of Multi-Kernd Clustering
MacQueen, et al. Some methods for classification and analysis of multivariate observations. In Proceedings of the fifth Berkeley symposium mathematical statistics and probability. volume 1, pp. 281 297- Oakland, CA, USA, 1967.
Sun, Y., Qin, Y., Li, Y., Peng, D., Peng. X., and Hu, P. Robust multi-view clustering with noisy correspon- dence. IEEE Trans. Knowl. Data Eng. 36(12)99150 9162, 2024b.
Sun, Y., Ren, Z., Hu, P., Peng, D., and Wang, X. Hierarchical consensus hashing for cross-modal retrieval. IEEE Trans. Multim., 26:824-836, 2024c.
Mitz, R. and Shkolnisky, Y. A perturbation based kernel ap- proximation framework. In Journal of Machine Learning Research (JMLR), volume 23, pp. 1-26, 2022.
Szegedy, C.. Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, J., and Fergus, R. Intriguing properties of neural networks. In ICLR, 2014.
Ng, A. Y., Jordan, M. I., and Weiss, Y. On spectral cluster- ing: Analysis and an algorithm. In NeurlPS, pp. 849-856. MIT Press, 2001.
Von Luxburg, U., Belkin, M., and Bousquet, O. Consistency of spectral clustering, In The Annals of Statistics, pp. 555-586, 2008
Pan, H., Gürtler, N., Neitz, A., and Schölkopf, B. Direct advantage estimation. In NeurlPS, 2022.
Rakotomamoniy, A., Bach, F., Canu, S., and Grandvalet, Simplemkl. Journal of Machine Learning Research, 9: 2491-25211 2008.
Wang. J., Tang, C., Wan, Z., Zhang, W., Sun, K., and Zomaya, A. Y. Efficient and effective one-step multi- view clustering. IEEE Trans. Neural Networks Learn. Syst, (2214)12222-12220
Sarkar, S., Babu, A. R., Mousavi, S., Ghorbanpour, S., Gun- decha, V., Guillen, A., Gutierrez, R. L., and Naug, A. Robustness with query-efficient adversarial attack using reinforcement learning. In CVPR, pp. 2330-2337. IEEE, 2023.
2024.
Wang, S., Liu, X., Zhu, E., Tang, C., Liu, J., Hu, J., Xia, J., and Yin, J. Multi-view clustering via late fusion align- ment maximization. In IJCAI, pp. 3778-3784. ijcai.org, 2019.
Schulman, J., Wolski, F., Dhariwal, P., Radford, A., and Klimov, O. Proximal policy optimization algorithms. CoRR, Abs/1707.006477 2017.
Wang. S., Chen, Y., Lin, Z.,, Cen, Y., and Cao, Q. Robustness meets low-rankness: Unified entropy and tensor learning for multi-view subspace clustering. IEEE Trans. Circuits Syst. Video Technol., 33(11):6302 -6106 6316, 2023.
Shen, M., Yu, H., Zhu, L., Xu, K., Li, Q., and Hu, Effec- tive and robust physical-world attacks deep learning face recognition systems. IEEE Trans. Inf. Forensics Secur, 16:4063-4077, 2021.
Williams, P. N. and Li, K. Black-box sparse adversarial at- tack via multi-objective optimisation CVPR proceedings. In CVPR, pp. 12291-12301. IEEE, 2023.
Sima, H., Wang. Guo, P., Sun, Liu, H., Xu, M., and Zou, Y. Composite kernel of mutual learning on mid-level features for hyperspectral image classification. IEEE
Winn, J. M. and Jojic, N. LOCUS: learning object classes with unsupervised segmentation. In ICCV, pp. 756-763. IEEE Computer Society, 2005.
Trans. Cybern., 52(1 12:1172221122 2022.
Skillicorn, D. B. Adversarial knowledge discovery. IEEE Intell. Syst., 24(6):54 61, 2009.
Xu, Z., Ding, X., Cui, M., Wang. X., and Shi, P. Multi- kernel subspace stable clustering with exact rank con- straints. Inf. Fusion, 1 110:102488, 2024.
Smola, A. J., Schölkopf, B., and Müller, K. The connec- tion between regularization operators and support vector kernels. Neural Networks, 11()):637-649, 1998.
Yang, C., Ren, Z., Sun, Q. Wu, M., Yin, M., and Sun, Y. Joint correntropy metric weighting and block diagonal regularizer for robust multiple kernel subspace elustering. Inf. Sci., 500:48-66, 2019.
Stewart, G. W. Matrix perturbation theory. Citeseer, 1990.
Sun, Y., Wang, S., Tang, X., Hsieh, T., and Honavar, V. G. Adversarial attacks on graph neural networks via node in- jections: A hicrarchical reinforcement learning approach. In WWW, pp. 673-683, ACM/ / IW3C2, 2020.
Yang. J., Jiang, Y., Huang, X., Ni, B., and Zhao, C. Learning black-box attackers with transferable priors and query feedback. In NeurlPS, 2020.
Sun, Y., Qin, Y., Li, Y., Peng, D., Peng, X., and Hu, P. Robust multi-view clustering with noisy correspon- dence. IEEE Trans. Knowl. Data Eng., 36(12):9150- 9162, 2024a.
Yang, M., Li, Y., Hu, P., Bai, J., Lv, J., and Peng. X. Robust multi-view clustering with incomplete informa- tion. IEEE Trans. Pattern Anal. Mach. Intell., 45(1): 1055-1069, 2023.

---

On the Adversarial Robustness of Multi-Kerne Clustering
Yang, W., Tang, C., Zheng, X., Zhu, X., and Liu, X. Eigen- value ratio inspired partition learning and fusion for mul- tiple kernel clustering. JEEE Trans. Knowl. Data Eng., 36( 36(12):8135-818 2024.
Yang, X., Jing, H., Zhang, Z., Wang, J., Niu, H., Wang, S., Lu, Y., Wang, J., Yin, D., Liu, X., Zhu, E., Lian, D., and Min, E. Darec: A disentangled alignment framework for large language model and recommender system. In ICDE. IEEE, 2025a.
Yang, X., Wang, Y., Chen, J., Fan, W., Zhao, X., Zhu, E., Liu, X., and Lian, D. Dual test-time training for out-of- distribution recommender system. IEEE Trans. Knowl. Data Eng. 3766:3312,-3326, 2025b.
Yu, S., Dong, Z., Wang, S., Wan, X., Liu, Y., Liang W., Zhang, P., Tu, W., and Liu, X. Towards resource- resource-friendly. friendly, extensible and stable incomplete multi-view clustering. In ICML. OeenReview.net, 2024.
Yu, S., Liu, S., Wang, S., Tang, C.,, Luo, Z., Liu, X., and Zhu, E. Sparse low-rank nulti-view subspace clustering with consensus anchors and unified bipartite graph. IEEE Trans. Neural Networks Learn. Syst., 36(1):1438-1452, 2025.
Yu, Y., Wang, T., and Samworth, R. A useful variant of the davis-kahan theorem for statisticians. In Biometrika, pp. 315-323, 2014.
Zhang. J., Li, L.. Wang. S., Liu, J., Liu, Y., Liu, X., and Zhu, E. Multiple kernel clustering with dual noise minimiza- tion. In ACM MM, pp. 3440-3450. ACM, 2022.
Zhang, T., Liu, X., Gong. L.., Wang. S., Niu, X., and Shen, L. Late fusion multiple kernel clustering with local kernel alignment maximization. IEEE Trans. Multim,, 25:993- 1007, 2023.
Zhou, S., Liu, X., Liu, J., Guo, X., Zhao, Y., Zhu, E., Zhai, Y., Yin, J., and Gao, W. Multi-view spectral clustering with optimal neighborhood laplacian matrix. In AAAL, pp. 6965-6972. AAAI Press, 2020.
12

---

On the Adversarial Robustness of Multi-Kernel Clustering
A. Theoritical Analysis
A.1. Proof of Proposition 6.1
Proposition A.1. The function f(r) in Eq. (17) is differentiale.. The p-th component of its gradient is given by:
0f(7)
2np Tr(Kp
HH ));
0%
where H = arg minH H-Ix Tr(K, (IN
HH ))-
Proof. The objective function f()) can be expressed as the of two components:
f(r) = +
where
fi(r) ,r f2(7)
max TrKK, H
1) Differentiability of fi(r). It is straightforward to verify that fi(7) is differentiable, and its gradient is given by:
0f( 27p Tr(K,)-
0%p
2) Differentiability of f2(r). From Theorem I in Liu et al. (2023), f2(r) is differentiable, and its gradient is:
052(7) 27p Tr(K, HH.).
01p
where A arg maxp-H--, H-Ix Tr Tr(K,HHH]]
3) Differentiability of f(y). Since f()) f((7) + f2(7), is differentiable, and its gradient is the sum of the gradients of (i() and f2(r):
0f(7) 0.)(r))
0f2(7)
+
81p
8yp
07p
By substituting the expressions for 0f(()) 8%
and
0fa(7) 09p
we obtain:
0f(r)
27, Tr (K, H)
8%p
Furthermore, H is also the optimal solution of the equivalent minimization problem: Å = arg aiggiinteee H=Ik Tr(K,(IN- H))
A.2. Proof of Thereom 6.3
Before completing the proof of Theorem 6.3, we introduce the following definition, which quantifies the alignment level between base kernel matrix and the consensus clustering indicator matrix.
Definition A.2. Let E N. represent set of kernel weights, and let Ha denote the consensus clustering indicator matrix. The alignment level between the p-th base kernel K, and Ha is defined as:
T(K H - Tr(K,) H.,
To prove Theorem 6.3, we utilize the following three lemmas. Here, we provide the proof of Lemma A.3. Lemma A.3. Ler A, NNN be positive semi-definite matrices. Then,
Tr(AB) < |||| Tr(B),
where |A]] denotes the spectral norm of A.
13

---

On the Adversarial Robustness of Multi-Kernel Clustering
Proof. Let B² be the unique positive semi-definite matrix satisfying B B B. Using this, rewrite the trace term as:
Tr(AB) = Tr B (B
Since (IA| IN) BBAB (by the definition of the spectral norm), we have:
Tr B B - Th B (I -I I:)B:)
Expanding the right-hand side gives:
Tr B [ (|A]) Ix)Bt) = -|||| -T(B,,
which concludes the proof.
The following lemma provides a perturbation bound for eigenvectors of Hermitian matrices, which is useful in our analysis.
Lemma A.4. (Yu et al., 2014) Let A, B E NxN be Hermitian matrices with eigenvalues A1 2 ... 2 AN and X z
2 Ax. respectively. Fix < r < < N, and assume min (2in - >r, Ae+1) > 0, where Ao == 00 and AN+1 == -c. Define d := r L, and let H = [hr hrt1...... h,] E Nxd and H [er, fertt...... h.l E Nxd
be columm-orthogonae matrices satisfying Ah; Xyh3 and Bh, 2yhn for (r....,s). s). Then, the following bound holds:
2 (mmindd/22 /2 - B lop IA -B(F))
sin H. H
minnA X d \o+1)
where 0(H, H) Raxd is diagonal with j-th diagonal entry equal to arccos (h, hT)) Additionally, there exists an orthogonal matrix Ó Redxd such that:
|NA- - 23/2 min Bll BlIF)
min (Ar Xr, Ast1)
where ||-ll represents the Frobenius norm and I1-Ilop denotes the operator norm.
Without loss of generality, assume the attacker injects adversarial perturbations N .N....., NNg] into the first Ng views, while the remaining views {Ng + ,,...,,, N& remain unperturbed. The perturbed kernel matrices are given by K KK,.... ....... Kgg, K Ng--..... Kv, }. and the normalized fused kernel matrix is:
k= K. N
Lemma A.5. For any two sets of kernel weights a and B3 let:
H min Tr(Ka (IN HH )),
H3 = arg min Tr(Ka(I HH
H H-
н H=Ix
Then, for porp& (1...., NE), the difference between T(Kp, Ha) and T T(K,, Hg) satisfies:
T(K, Ha) -T(K, Ha) I ||ox Bll +
||
(E(l....N))
Similarly, for p E (NE + ,,..,,M, Nu the bound is given by:
T(K, p. Ha) - T(K Hg) 3 ||a
Bl1 + max
|N
ge (e.
14

---

On the Adversarial Robustness of Kurni-Kernel Clustering
Proof. For p E (I,... N&). consider the following:
T(K,, Ho) -T(Kp, H3))
Th (K,
H HaH2)) -Tr (K HgH
(20)
1 N IN (r Ha) Tr (r (HH)) Tr(KH
<||N Ir
+ (r,,HHHHH) Tr,
Applying the trace inequality and Lemma A.3, we bound each term:
T(Kp. p. Ha) T(K,. H3))
< N + 1 |F AA AOH + k
HaH. HaHg + +|, KK
Tr (r(
N
(21)
Using Jensen's inequality, we have K 1r I i,.
K
Tr(K3)
S V N2
(Kp) 1
(22)
22
Subsequently, applying the above equation, we have
T(Kp p. Ha) T(K p. Ho) 3 IN
H. H&H
+ H HgH
(23)
For any orthogonal matrix O I x have
H H H
0Q H. HgH. 8
0. H H.
H. OH, HgH
(24)
Ha Oll
A.. H.
H Hp
24
H.
HP
By Lemma A.4 (let r 1,8 = k),, with Assumption 6.2, we have
H. HgH
2
H
O
H
1
2
Ka
N K2
N
F
N₂
a
2
K
(25)
N
P=1
F
N₂
< || Bl
Σ
(ap + Bp)
p=1
X | Bl,00
Similarly, we have
No
NY
HgHg
HoH.
2 Kg
Kg
B2
K, Kp)
I 11
S
max
|
N
9E(1.--
(N.)
p=1
p=1
(26)
15

---

On the Adversarial Robustness of Multi-Kernel Clustering
Substituting Eq. (25) and Eq. (26) into Eq. (24), we can obtain the first bound follows
T(pp. Ha) T(Kp, Hg)) 3 l|a Blo
max
||N
gEf1,-,NNl
For E {NE + 1, ,Nk. we have
T(Kp, p. Ha) (Kp. Ha)
N Tr(K (HgH HaH
=
Tr(K, (HKK(HHHHH - HzH ))
N (H,, - HaAl)))
(27)
+
N
3 a Bl1oo + max |N
Ne)
Finally, we present the proof of Theorem 6.3.
Proof. Assume noiseless kernel matrices lead to the kernel weight sequence {a where a represents the weights at the t-th update. Similarly, let (B(t))T_ denote the kernel weights for the noised kernel matrices. Since the initialization is identical, we have (0) =3())
Fix an index E N.....,,,N).. At the (t 1)-th step, we analyze the change |au ((((+t)) 1/(+111:
(o((+)) -(((+1] - ! - 1
5/a 1] 0g - (8 1) (3(2)1
(t)
1
Σ
(al) Haw) - TKK,, How))
Σ
(K, Hgro) - -B0T Hay
Nu
ptuppE (g)
ptupE (1....))
No Σ
22 (K Haro) T(KT Ha(e))
(KL) Hgo)) - TB, Hgi)))
+
N₂
P=N++ +1
p=N?+
(28)
For term A, we bound it as follows:
=
Σ
( T(,,, T Hgre)) -(NE -1) (a (1) (al'' Ha.))) - ( Hore))
(1.",
S(NE - 1) max
a (TT H - -1((00 (( (8(00T(K, H Harr)
9E(1,--.,))
=(N - 1) max
( (TK, H1 il())) - -1(()) T(K, H1 H.,())) + 9 (((TT(K Ha)))) - (KK,) 11 i1..)))
(E(1,",, NNJ
S(N 1)
max
( - -(t))
TTKK: H Haur)) (NP 1) 1)
max
g(1). T(KK Hawr) - T(KK. H H
qe (1,.. .N1)
ge(1.-,,1 NN!
S(N - 1) (1) g(0) 10 (N - -|(00)))((111
(/(
max
||,||]
qc (E(1.",N77)
(By Lemma A.5.)
2 (t) (t) - 3(() 1100 + max
[N,l)
vE(I,-.Ng)
(29)
where |N || denotes the noise magnitude.
16

---

On the Adversarial Robustness of Kurti-Kernel Clustering
For term B, similar derivation yields:
(K,, -a -8 (B).)))))))) Hgr.)) (N₂ - NN2 (a!" - Hgrs))
P NE H1
(Na NP) (at (Kk Ha( - TKK, Hgm)) + -Na -N2) (o."T(K,,, H,.0)) 314 H30))
max ge( .
(By Lemma A.5.)
3(Nx 2 |aah 1/ +
[Nall]
max
q (1. No.
(30)
Combining Eq. (29), Eq. (30), and Eq. (28), we have
(a 1((+1)) - 1a! - 110 ||ax()) - 11 +
max
[Ny]..
(31)
(E(,,-,N,,
Similarly, for p E {1, ,N + we have
1 (1()1) - 3(1+1)) - |a 1
$ sla a11)) - ( ((0)
(t) T(Ku: Hoce) d (1)
T(K,, Haw)
( T(K,, Hgro)) - - Ha())
(32)
Nx 1 au
+ N₂ -
a) - 1B + max
qE(L,-.,Na No} |N₂
For E (N + +,,... ,,), we have
l (++11_
1(++1) - la -1/11
( T(Ku Ha(o) a T(Kp, Haw))
(( ((K,, Hgco))
T H (g)))
(33)
N4
Nv
(1))
13(00 10 (E(....NNa)
||,
Combining the upper bounds in Eq. (31), Eq. (32) and Eq. (33), we can obtain
((+1)) ((+++111)) 1lo0 2 ((a - |00 + max
|Ngll
(34)
9E(1,.-. .Ne
Based on the above recurrence formula, we have
||
- -g aoo 2 ||a - -g((T-)) + max
||g
ge(1.-,NN NN)
|la -3100 + max
NN g|
max
[Nall-
qe Ne(....N.)
qc (N.
The proof is complete.
B. Details of Experimental Setup
Datasets. We evaluate approach multi-view datasets, described as follows:
MSRCy1 (Winn & Jojic, 2005) contains 210 objects from classes (tree, building, airplane, cow, face, car, bicycle) with
data views.
17

---

On the Adversarial Robustness of Clustering
Table 4. Summary of henchmark datasets.
Dataset
Sample
# View
Cluster
# Feature
Perturbed View Index
MSRCV1
210
5
[24, 576, 256, 254) [3183, 3203]
[1. 4]
BBCSport
544
2
[1]
ProteinFold
694
12
27
[27, 27, ..,, 27, 271
[1, 2, 3, 4]
1011
1474
[48, 254, 1984, 512, 928]
[1,
HW-6Views
2000
6
10
[216, 76, 64, 6, 240, 47]
[3, 4]
Citeseer
3312
2
[3312, 3703]
[1]
NUS-WIDE-SCENE
4095
5
33
[128, 73, 144, 225, 64]
[2.
BBCSport (Greene & Cunningham, 2006) includes 544 sports news articles in 5 categories with views: 3,183- dimensional MTX features and di00-ndimnsiional TERMS features.
ProteinFold (Damoulas Girolami, 2008) comprises 694 instances across classes, each represented by 12 feature sets.
Caltech101-7 (Dueck & Frey, 2007) subset of the Caltech 101 dataset containing 1,474 images across 7 categories (e.g., DollaBill, Faces). Each image is described using six feature types: Gabor (48 dimensions), Wavelet Transform and Moments (40 dimensions), Centered Histogram (254 dimensions), Histogram of Oriented Gradients (1,984 dimensions), Global Image Scene Representation (512 dimensions), and Local Binary Patterns (928 dimensions).
HW-6Views (Huang et al., 2020) contains 2,000 handwritten numerals (0-9) with 6 heterogeneous views labeled into 10 classes.
Citeseer (Giles et al., 1998) is graph dataset of 3,312 scientific publications in 6 categories (e.g., AI, ML). Nodes represent papers with 3,703-dimensiin -i3-dimensiooal keyword vector, and edges indicate citations.
NUS-WIDE-SCENE (Chua al., 2009) features 4,095 images across 33 classes with 5 feature types: Color Histogram (64 dimensions), Color Correlations (144 dimensions), Edge Direction Histogram (73 dimensions). Wavelet Texture (128 dimensions), and Block-Wirs Wise Color Moment (225 dimensions).
The summary of each dataset is presented in Table 4. In evaluations, utilize Gaussian (Babaud et al., 1986) and Polynomial (Smola et al., 1998) kernlls to construct the kernel matrices for each data view.
MKC Methods. We evaluate our method (AdvMKC) against seven traditional MKC approaches:
MVC-LFA (Wang et al., 2019) aligns consensus clustering partitions with weighted base partitions.
LSMKKM (Liu et al., 2021) incorporates local alignment to enhance the fusion of base kernel information.
MKKM-SR (Lu et al., 2022) combines spectral rotation with multiple kernel K-Means clustering for simultaneous optimization of discrete and continuous cluster labels.
SMKKM (Liu, 2023) minimizes kernel weight alignment errors while maximizing clustering assignment accuracy.
EEOMYC (Wang et al., 2024) integrates common latent representation and clustering indicator matrix generation into a unified framework.
LSWMKC (Li et al., 2024) denoises graphs and learns neighborhood kemels to reveal latent local manifold representa- tions.
LSMKC (Liang et al., 2024b) assumes isotropic Gaussian distributions for samples and optimizes cluster assignments of expectation kernel matrices.
Additionally, we compare AdvMKC with four robust MKC methods designed for noisy data:
JJMSC (Yang et al., 2019) learns an optimal consensus kernel from predefined candidates for reliable clustering results.
18

---

On the Adversarial Robustness of Multi-Kernel Clustering
Table Effectiveness of AdvMKC against traditional MKC methods (%). Lower metric values indicate better performance. No-attack refers to clustering without adversarial attacks.
MVC-LFA
LSMKKM
MKKM-SS
Dataset
Attack
NMI
ARI
ACC
PR
NMI
ARI
ACC
PR
NMI
ARI
ACC
PR
no-attack
63.42
56.26
74.76
74.76
53.92
73.81
73.81
58.54
49.99
70.00
72.38
RAMKC
61.75
53.58
71.43
71.90
61.75
54.51
73.81
73.81
53.95
44.29
66.19
66.19
MSRCv1
EAMKC
62.29
54.05
73.33
73.33
60.16
52.48
70.48
70.48
54.54
45.19
66.67
66.67
AdvMKC
59.37
51.15
70.00
70.48
60.02
51.39
69.95
69.95
52.73
42.78
64.76
65.19
no-attack
69.23
71.25
81.88
81.07
54.32
39.72
69.49
69.85
54.67
52.98
67.46
74.08
RAMKC
67.79
60.00
71.32
80.88
52.23
41.49
70.04
70,40
55.15
53.24
67.46
74.08
BBCSport
EAMKC
68.76
60.51
71.32
80.88
54.88
40.21
69.67
70.04
55.12
53.24
67.46
74.08
AdvMKC
68.70
60.31
71.25
51.10
51.84
52.60
51.58
66.42
72.04
no-attack
44.07
17.47
34.01
41.21
22.76
04.72
19.60
24.64
39.97
11.20
29.11
38.90
Protein Fold
RAMKC
44.15
16.78
34.29
42.51
20.73
03.35
19.16
23.05
38.64
10.33
27.95
37.32
EAMKC
43.75
16.56
33.86
42.22
18.79
01.80
16.71
20.46
39.88
11.28
29.39
39.34
AdvMKC
42.34
15.22
32,85
39.77
18.02
01.65
16.14
20.31
37.26
08.16
25.09
35.18
no-aftack
48.34
28.13
37.52
83.79
55.92
39.75
52.10
85.35
43.90
33.74
48.
79.35
Caltech 101-7
RAMKC
45.89
27.93
38.94
82.50
56.05
39.40
52.10
85.35
44.08
33.78
48.03
79.72
EAMKC
45.95
27.64
36.57
82.43
55.93
39.31
52.17
85.28
42.84
29.68
38.94
44.78
AdvMKC
45.78
27.63
36.43
82.29
55.91
39.26
52.04
85.28
39.30
26.22
36.25
45.69
no-aflack
28.70
26.30
54,50
$7.07
07.06
00.08
25.45
25.51
20.73
15.64
44,20
44,96
RAMKC
28.40
25.98
54.26
56.88
07.00
00.07
25.39
25.45
11,20
07.26
31.91
34.21
Citeseer
EAMKC
28.36
26.03
07.18
00.11
25.54
25.60
10.17
06.93
32.37
34.72
AdvMKC
28.08
25.01
54.00
56.10
05.83
00.05
24.43
24.61
10.17
06.90
31.06
32.42
Bo-attack
07.67
03.75
22.98
32.36
06.34
01,28
26.01
31,16
06.56
02.75
22.69
31.79
NUS-
RAMKC
07.90
03.90
23.81
32.63
06.23
01.22
25.59
30,96
06.59
02.88
22.93
31,89
WIDE-
EAMKC
07.53
03.68
22.95
32.45
06.32
01.16
25.64
30.99
06.57
02.81
22.78
31.84
SCENE
AdvMKC
07.50
03.21
23.64
32.41
06.20
01.08
25.54
30.92
06.47
02.70
22.66
31.79
ONMSC (Zhou et al., 2020) enhances the representational capacity of Laplacian matrices by incorporating high-order
connections.
MKCDNM (Zhang et al., 2022) decomposes kernel noise into dual components and minimizes them in a late fusion framework.
MKSSC-ERC (Xu et al., 2024) employs stable clustering framework with automatic initialization of optimal cluster centers.
Compared Methods. As no existing adversarial attack methods are available for MKC, we propose two baseline attack strategies benchmark AdyMKC:
RAMKC generates Gaussian noise n from NN I), normalizes it, and rescales its magnitude to satisfy adversarial constraints: n = é T|]
n2 The noise ń is injected into No samples with Nº views.
FAMKC formulates adversarial perturbations as a black-box optimization problem (Williams & Li, 2023; Fang et al., 2023; 2022). Using the LM-CMA strategy (Loshchilov, 2017), it optimizes the mean and variance of noise distributions with a reward function defined in Eq. (9).
C. Additional Experimental Results
Effectiveness Evaluation. Table 5 presents the experimental results of adversarial attacks on the MVC-LFA, LSMKKM, and MKKM-SR algorithms. The results reveal the susceptibility of MKC methods to adversarial attacks, with AdvMKC demonstrating superior performance compared to other approaches.
Sensitivity Evaluation. We assess the influence of three factors on attack performance: the number of selected samples NP
19

---

On the Adversarial Robustness of Multi-Kernel Clustering
400
100%
HM
100%
ACO
75%
75%
75%
50%
50%
50%
50%
25%
0.20
0.25
8.56
0.10
5.15
0.20
0.25
0.50
0.10
0.35
0.20
0.30
(b) ONMSC
[o] LSMKCC
ONMSC
Figure 5. The impact proportion of perturbed samples on the BBCSport dataset.
Figure 6. The impact of the proportion perturbed samples on the ProteidFold dataset.
423
AM
100%
100%
100%
75%
75%
75%
75%
50%
50%
0%
0%
0%
0%
(8)
LWMMKC
ONMSC
Figure 7. The impact of the number of perturbed views on the HW-6Views dataset.
Figure 8. The impact of the number of perturbed views on the Caltech101-7 dataset.
100%
100%
100%
100%
50%
50%
50%
50%
25%
25%
25%
25%
0%
016
0%
0%
001:2
elavd Eas/7
32007 0asia
satrd
a 01563 nan/2 126/?
00022
4.6/7
0307
620/3 626/2
03545
6.1/2
03563
(SLLMM
(b) ONMSC
IMLS
(S)ONMCC
Figure 9. The impact of adversarial perturbation magnitude on the BBCSport dataset.
Figure 10. The impact of adversarial perturbation magnitude the ProteinFold dataset.
MM-100
Figure 11. Effeect of hyperparameters a, and 7 on the MSRCvl datasel, evaluated using the NMI metric.
Figure 12. Effect of hyperparameters a, B, and & on the MSRCvI dataset, evaluated using the ARI metric.
100-1c-a
1em
100-1c.1
Figure 13. Effect hyperparameters a, and y on the MSRCvl dataset, evaluated using the ACC metric.
Figure Effect of hyperparameters o, 8, and y on the MSRCvI dataset, evaluated using the PR metric.
the number of perturbed views NP. and the magnitude of adversarial perturbations The results, shown in Figures 5-10, indicate that attack performance improves as these factors increase.
Additionally, we perform a sensitivity analysis on the three hyperparameters a, 8, and y in Eq. (16), which regulate the balance among loss terms. To ensure these loss terms have magnitudes comparable the main terms, we select
20

---

On the Adversarial Robustness of Multi-Kerne Clustering
Figure 15. Effect of hyperparameters a, 5, and on the BBCSport dataset, evaluated using the NMI metric.
Figure Effect hyperparameters, a, 3, and ry on the BBCSport dataset, evaluated using the ARI metric.
# T
10d Te
D4 10
Figure 17. Effect of hyperparameters a, 9, and the BBCSport
Figure 18. Effect of hyperparameters B, and yy on the BBCSport dataset, evaluated using PR metric.
dataset, evaluated using the ACC metric.
Table 6. Comparison of time consumption for RAMKC, EAMKC, and AdvMKC on all six datasets (s).
Dataset
Attack
SMKKM
EEOMVC
LSWMKC
LSMKC
MVC-LFA
LSMKKM
MKKM-SR
RAMKC
1125.92
528.48
1476.00
151.00
142.68
169.28
43.00
MSRCvl
EAMKC
1162.00
605.64
1547.68
169.44
156.24
196.40
54.72
AdvMKC
640.28
314.53
960.72
97.35
93.46
116.10
26.63
RAMKC
594.36
306.12
254.12
157.36
125.92
121.60
32.60
BBCSport
EAMKC
626.55
345.18
329.95
188.18
157.55
153.64
AdvMKC
42.26
187.33
185.83
89.77
80.81
75.95
27.87
RAMKC
1158.16
1501.96
2737.96
615.16
397.04
508.36
136.64
Protein Fold
EAMKC
1356.02
1659.16
2830.79 79
729.16
419.07
623.62
168.40
AdvMKC
193.34
915.09
335.79
391.49
252.52
323.06
94.13
RAMKC
5292.00
1033.56
7884.12 12
487.96
579.60
520.00
125.04
Caltech 101-7
EAMKC
5750.15
1149.57
8064.44
522.11
630.46
556.36
148.15
AdvMKC
1092.53
672.34
1044.33
281.26
385.33
341.34
87.57
RAMKC
4161.24
1014.08
19228.40 40
769.22
423.64
1595.28
186.56
Citeseer
FAMKC
4206.61
1048. 15
2180.57
818.58
521.60
1683.57
190.21
AdvMKC
640.36
645.45
1955.01
520.71
299.91
166..52
137.82
NUS-
RAMKC
5396.12
2187.44
36674,16
2651.68
975.56
2060.40
362.72
WIDE-
EAMKC
5594.75
2302.42
39721.68
2721.95
994.56
2201.70
417.25
SCENE
AdvMKC
1068.54
1330.89
4167.51
1607.49
649.42
1588.76
272.86
from (0.1, 0.3, 0.4, 0.5, 0.6), from (le-5, 1e-1,1e-3)) and from 2, 5, 35 -5 -5 -e. The
sensitivity analysis is conducted the MSRCv1 and BBCSport datasets, with results shown in Figure 12-18. These results indicate that as long the magnitudes of the loss terms remain balanced, variations in these parameters have minimal impact on attack performance.
Time Consumption. We evaluate the time consumption of AdvMKC in comparison to two baseline methods, using the same experimental settings as in Table The results, presented in Table demonstrate that AdvMKC requires less time while achieving the highest attack performance among all methods.
Attack Efficiency. Beyond attack performance, efficiency (Li et al., 2020: Liu et al., 2024; Yang et al., 2025a;b) is erucial metric for evaluating adversarial attacks. Since the number of clustering operations directly affects computational cost, we assess the attack efficiency of AdvMKC in comparison to RAMKC and FAMKC.
To fully demonstrate the potential of AdvMKC, we set the number selected samples to = 0.5.N, removing constraints d
on sample selection. Evaluations are conducted using SMKKM and ONMSC as victim MKC methods on the MSRCv1 and BBCSport datasets. The results, presented Figures 19 22, show that AdvMKC consistently achieves optimal attack
21

---

On the Adversarial Robustness of Multi-Kernel Clustering
75%
75%
759
PAPRC
SAMRC
EAPRO
65%
099
8336
0576
4246
49%
45%
48%
3596
109
201
2011
501
101
201
201
400
501
101
201
201
431
Sat
NM
ACC
(c) Purity
Figure 19. Attack efficiency of AdvMKC against the SMKKM algorithm on the MSRCv1 dataset. The horizontal axis represents the number of clustering operations performed.
100%
100%
100%
SAPIC
90%
70%
90%
80%
93%
70%6
50%
70%
70%
60%-
50%
30%
50%
Tat NMI
[b) ARI
AC)
(c) Purity
Figure 20, Attack efficiency of AdvMKC against the ONMSC algorithm on the MSRCvl dataset. The horizontal axis represents the number of clustering operations performed.
556
7556
40%
EAPRC
EAPACC Arr/60
CAREZ
3556
30%
05%
65%
10%
0%
25%
25%
[o) NMI
(b) ARI
ACC
(d) Purity
Figure 21. Attack efficiency of AdvMKC against the SMKKM algorithm the BBCSSort dataset. The horizontal axis represents the number of clustering operations performed.
30%
20%
50%
50%
AS//9C
Ash AM2
20%
10%
40%
-10%
20%
20.
(6) NMI
(b) ARI
ACC
(d) Purity
Figure 22. Attack efficiency of AdvMKC against the ONMSC algorithm on the BBCSport dataset. The horizontal axis represents the number of clustering operations performed.
performance with the fewest clustering operations. This efficiency is attributed to AdvMKC's ability to leverage the clusterer to approximate the behavior of the victim MKC methods.
can be observed that AdvMKC does not attain the best performance during the initial stage of the attack. The performance difference stems from the distinet generation methods used AdvMKC compared to the other two approaches. As shown in Appendix B. RAMKC injects Gaussian noise into the original data, while EAMKC optimizes the mean and variance of noise distributions using the LM-CMA strategy and reward function. In contrast, Adv employs neural network generate perturbations. Due to the initial parameter settings, the perturbation magnitude may be small at the beginning, limiting AdvMKC's performance in the early attack phase. However, once the memory buffer B is filled, the attacker can optimize the generator's parameters, resulting in improved attack performance.
22


Reviews:
[{"review_id": "2y2rzQSBbQ", "reviewer": "Reviewer_yajj", "summary": "The paper investigates the adversarial robustness of MKC in a black-box setting, a largely unexplored area. It introduces AdvMKC, a novel reinforcement-learning-based attack framework that injects imperceptible perturbations to mislead MKC methods. AdvMKC employs proximal policy optimization with an advantage function to handle clustering instability and utilizes a generator-clusterer framework to approximate MKC behavior while reducing computational costs. Theoretical analysis and extensive experiments on seven datasets and eleven MKC methods confirm the effectiveness, robustness, and transferability of AdvMKC.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**We sincerely appreciate Reviewer yajj’s thorough and constructive review. We provide point-by-point responses to the raised weaknesses as follows:**\n\n---\n\n**W1:** This paper assumes the victim MKC method operates as a black box with no direct access. Given this realistic constraint, where frequent queries are not feasible, how does the proposed attack function effectively in such a scenario?\n\n**R1:** We appreciate the reviewer’s insightful comments. Conducting attacks on multi-view clustering requires extensive queries to the victim MKC method, resulting in high resource consumption. To mitigate this, we propose two countermeasures:\n\n1. We design a clusterer that emulates MKC behavior. During attacks, this clusterer provides rewards, eliminating the need to query the victim black-box MKC method. As demonstrated in Appendix D, AdvMKC achieves the highest attack performance with the same number of victim MKC queries.  \n2. When querying the victim MKC method is excessively costly, we propose an alternative approach: querying a surrogate MKC method under the attacker's control. As shown in Table 3, optimizing the generator using the surrogate MKC method enables the crafted perturbations to effectively mislead the victim MKC method.\n\nWe will clarify this issue in the revision. \n\n**W2:** Figures 11–14 show that as the number of clustering operations increases, AdvMKC outperforms the two baseline methods in attack effectiveness. However, in some cases, AdvMKC does not achieve the best performance during the initial attack phase. The authors should provide clarification on these observations.\n\n**R2:** We appreciate the reviewer’s comments. The performance difference stems from the distinct generation methods used in AdvMKC compared to the other two approaches. As shown in Appendix C, RAMKC injects Gaussian noise into the original data, while EAMKC optimizes the mean and variance of noise distributions using the LM-CMA strategy and a reward function. In contrast, AdvMKC employs a neural network to generate perturbations. Due to the initial parameter settings, the perturbation magnitude may be small at the beginning, limiting AdvMKC’s performance in the early attack phase. However, once the memory buffer $\\mathcal{B}$ is filled, the attacker can optimize the generator’s parameters, resulting in improved attack performance. We will address this concern in the revision.", "claims_and_evidence": "The claims are generally supported by theoretical analysis and extensive experiments.", "methods_and_evaluation_criteria": "The proposed methods and evaluation criteria are well-aligned with the problem.", "theoretical_claims": "Yes", "experimental_designs_or_analyses": "Yes, the experiments on seven datasets and eleven MKC methods are reviewed.", "relation_to_broader_scientific_literature": "The paper extends adversarial robustness research to MKC, building on prior work in adversarial attacks and kernel methods.", "essential_references_not_discussed": "No", "other_strengths_and_weaknesses": "Strengths\n\n•\tThis paper introduces AdvMKC, a reinforcement-learning-based attack with a perturbation generator and clusterer for efficient optimization.\n\n•\tThis paper provides insights into the impact of adversarial perturbations on MKC performance.\n\n•\tThis paper validates findings through experiments on seven datasets and eleven MKC methods, demonstrating effectiveness, robustness, and transferability.\n\nWeaknesses\n\n•\tThis paper assumes the victim MKC method operates as a black box with no direct access. Given this realistic constraint, where frequent queries are not feasible, how does the proposed attack function effectively in such a scenario?\n\n•\tFigures 11–14 show that as the number of clustering operations increases, AdvMKC outperforms the two baseline methods in attack effectiveness. However, in some cases, AdvMKC does not achieve the best performance during the initial attack phase. The authors should provide clarification on these observations.", "other_comments_or_suggestions": "NA", "questions_for_authors": "See above “Weakness”.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "zMzzKVl54E", "reviewer": "Reviewer_W7KP", "summary": "This manuscript addresses the underexplored vulnerability of MKC methods to adversarial perturbations. To evaluate the adversarial robustness of MKC in a black-box setting, the authors propose AdvMKC, a novel framework grounded in reinforcement learning. AdvMKC employs proximal policy optimization with an advantage function to ensure stable optimization and mitigate clustering instability. It introduces a generator-clusterer architecture, where the generator produces adversarial perturbations and the clusterer simulates MKC behavior, thereby reducing computational overhead. Experimental results demonstrate that AdvMKC is effective, robust, and transferable across various MKC techniques.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**We sincerely appreciate Reviewer W7KP’s thorough and constructive review. We provide point-by-point weaknesses to the raised questions as follows:**\n\n---\n\n**W1:** The authors do not provide the code. If released, it would enhance reproducibility and be beneficial for the research community.\n\n**R1:** We appreciate the reviewer’s comments and acknowledge the concern. The code will be released upon the paper’s acceptance.\n\n**W2:** When evaluating the transferability of adversarial perturbations generated by the proposed method, the authors should clarify the meaning of the surrogate MKC method referenced in Table 3.\n\n**R2:** Thank you for the reviewer’s insightful comments. In Subsection 6.4, we consider a scenario where frequent queries to the victim MKC method are impractical. To address this, the attacker can utilize an alternative MKC method, referred to as the surrogate MKC method, to approximate the victim MKC method’s functionality. This allows the attacker to optimize the perturbation generator to produce adversarial noise. We will clarify the surrogate MKC method in the revision.  \n\n**W3:** The authors should provide further details on the experimental setup, such as the specific view IDs used in adversarial attacks, given that each dataset comprises multiple data views.\n\n**R3:** We appreciate the reviewer’s comments. The evaluation details, including datasets, MKC methods, and compared methods, are provided in Appendix C. We conduct evaluations across seven datasets: MSRCv1, BBCSport, Caltech101-7, HW-6Views, Citeseer, NUS-WIDE-SCENE, and ProteinFold. To ensure a balanced evaluation, we select data views with low dimensionality and limit the total number of perturbed views to less than 50%. Specifically, for the MSRCv1 dataset, we perturb the first and fourth views, while for BBCSport and Citeseer, only the first view is perturbed. In the ProteinFold dataset, we perturb the first, second, third, and fourth views, whereas, in Caltech101-7, only the first and second views are affected. For HW-6Views, the perturbation is applied to the third and fourth views, and for NUS-WIDE-SCENE, the second and fifth views are perturbed. Additional details can be found in Table 4. We will further clarify this information and provide additional evaluation details in the revision.\n\n**W4:** In figures such as Figure 2 and Figure 3, the ACC metric curve is not clearly presented. However, in certain figures, such as Figure 10, it is clear that the four lines represent four distinct metrics. The authors should address this issue and provide clarification.\n\n**R4:** Thank you for the reviewer’s insightful comments. As shown in Tables 3 and 4, the accuracy and purity metrics coincide in some cases. Since clustering is an unsupervised task, both metrics rely on the best possible label assignment. The accuracy metric determines the optimal one-to-one mapping between cluster IDs and ground truth labels using the Hungarian algorithm [1], whereas the purity metric assigns each cluster to the most frequent ground truth label. When clusters closely align with single ground truth classes (i.e., each cluster predominantly contains data points from one class), both metrics yield identical values. In such cases, the best mapping in Hungarian accuracy and the dominant-class assignment in purity produce the same results. We will include further explanations in the revision. \n\n[1] Kuhn et al. The Hungarian Method for the Assignment Problem. 1955.", "claims_and_evidence": "Yes, all claims presented in the manuscript are substantiated by experimental results and corresponding proofs.", "methods_and_evaluation_criteria": "Yes, adversarial attacks on MKC methods have been insufficiently explored, and the proposed method is the first to address this issue. The datasets used in the evaluations are standard in MKC research.", "theoretical_claims": "I have reviewed the proof in the Appendix and found no issues.", "experimental_designs_or_analyses": "I have reviewed the evaluation design and found that the authors conduct thorough assessments to evaluate the proposed method's effectiveness, robustness, and transferability.", "relation_to_broader_scientific_literature": "This paper examines the adversarial robustness of MKC methods, an area that has not been previously studied.", "essential_references_not_discussed": "No.", "other_strengths_and_weaknesses": "Strengths\n1. This manuscript is the first to investigate the adversarial robustness of MKC methods in a black-box setting, where an attacker introduces imperceptible, targeted perturbations to deceive unknown MKC methods.\n2. The manuscript provides valuable theoretical insights into the effects of adversarial perturbations on MKC methods.\n3. The authors perform comprehensive evaluations across seven benchmark datasets and eleven MKC methods to assess the effectiveness, robustness, and transferability of the proposed method.\n\nWeaknesses\n1. The authors do not provide the code. If released, it would enhance reproducibility and be beneficial for the research community.\n2. When evaluating the transferability of adversarial perturbations generated by the proposed method, the authors should clarify the meaning of the surrogate MKC method referenced in Table 3.\n3. The authors should provide further details on the experimental setup, such as the specific view IDs used in adversarial attacks, given that each dataset comprises multiple data views.\n4. In figures such as Figure 2 and Figure 3, the ACC metric curve is not clearly presented. However, in certain figures, such as Figure 10, it is clear that the four lines represent four distinct metrics. The authors should address this issue and provide clarification.", "other_comments_or_suggestions": "In Figure 1, the font size of some text is too small. I recommend increasing the font size for better clarity.", "questions_for_authors": "Please consider addressing the points raised in the above weaknesses part.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "2sNCVDxSoI", "reviewer": "Reviewer_rAQk", "summary": "AdvMKC proposes a novel black-box adversarial attack for multi-kernel clustering that employs reinforcement learning—specifically, proximal policy optimization with an advantage function—within a generator-clusterer framework. This approach introduces minimal perturbations to mislead multi-kernel clustering while concurrently reducing computational overhead. Comprehensive theoretical analysis and experimental evaluations across several datasets and different MKC variants verify the method's efficacy, robustness, and transferability.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**We sincerely appreciate Reviewer rAQk's thorough and constructive review. We provide point-by-point responses to the raised weaknesses as follows:**\n\n---\n\n**W1:** Although the generator-clusterer framework is claimed to reduce computational costs, prior research has already enhanced multi-view clustering efficiency, and clustering processes typically do not entail significant runtime overhead. It would be beneficial for the authors to report the actual running times of each algorithm to substantiate this claim.\n\n**R1:** We appreciate the reviewer’s insightful comments. We evaluate the time consumption of AdvMKC compared to two baseline methods under the same experimental settings as in Table 1. The results, presented in [the following table](https://anonymous.4open.science/api/repo/AdvMKC-rebuttal-CC14/file/running_time.png?v=12f17fd6), show that AdvMKC requires less time while achieving the highest attack performance among all methods. We conducted a total of **126 evaluations**. Due to the rebuttal's space limitations, we provide the evaluations via the following anonymous GitHub link. For example, when attacking the SMKKM MKC method on the MSRCv1 dataset, AdvMKC completes in 640.28 seconds, which is significantly lower than the 1259.92 seconds and 1162.00 seconds required by RAMKC and EAMKC, respectively. We will include these experimental results in the revision.\n\nExperimental results are presented at https://anonymous.4open.science/r/AdvMKC-rebuttal-CC14/running_time.png.\n\n**W2:** While the effects of parameters such as the selected sample count ($N_d^p$), perturbed view count ($N_k^p$), and perturbation magnitude ($\\epsilon$) on attack performance are examined, the loss function in Equation (16), which comprises four terms and three hyper-parameters, lacks a comprehensive sensitivity analysis.\n\n**R2:** Thank you for the reviewer’s comments. Based on your suggestion, we conduct a sensitivity analysis on the hyperparameters $\\alpha$, $\\beta$, and $\\gamma$ in Eq. (16), which regulate the balance among loss terms. To ensure comparable magnitudes across these terms, we select $\\alpha$ from $\\lbrace 0.1, 0.2, 0.3, 0.4, 0.5, 0.6 \\rbrace$, $\\beta$ from $\\lbrace e^{-5}, e^{-4}, e^{-3} \\rbrace$, and $\\gamma$ from $\\lbrace e^{-5}, 2 e^{-5}, 3 e^{-5}, 4 e^{-5}, 5 e^{-5}, 6 e^{-5} \\rbrace$. The analysis is conducted on the MSRCv1 and BBCSport datasets, with results shown in [the following eight figures](https://anonymous.4open.science/api/repo/AdvMKC-rebuttal-CC14/file/sensitivity_analysis.png?v=0fcf01a5). We conducted a total of **216 evaluations**. Due to the limitations of OpenReview.net, we present the evaluations on the following anonymous GitHub repository. For example, as shown in Figure 13, changes in $\\alpha$, $\\beta$, and $\\gamma$ have no significant effect on the MNI metric for the BBCSport dataset. These results suggest that as long as the loss terms remain balanced in magnitude, variations in these parameters have minimal impact on attack performance.\n\nExperimental results are presented at https://anonymous.4open.science/r/AdvMKC-rebuttal-CC14/sensitivity_analysis.png.\n\n**W3:** The occurrence of negative values in the ARI metric, as illustrated in Table 2, requires clarification on whether these outcomes are expected.\n\n**R3:** We appreciate the reviewer’s comments. The ARI can take negative values because it accounts for randomness in clustering assignments. It adjusts the Rand Index by considering the expected similarity between two random clusterings. If the observed clustering is worse than a random assignment, the ARI can be negative. We will include this clarification in the revision.", "claims_and_evidence": "Yes, the submission’s claims are well-supported by both rigorous theoretical analysis and comprehensive experiments.Yes, the methods and benchmarks are well-suited to the problem.", "methods_and_evaluation_criteria": "Yes, the methods and benchmarks are well-suited to the problem.", "theoretical_claims": "Yes, the proofs for adversarial impact on MKC are verified.", "experimental_designs_or_analyses": "Yes", "relation_to_broader_scientific_literature": "Yes. The paper extends established adversarial and clustering work by integrating reinforcement learning, perturbation strategies, and a generator-clusterer framework to robustify MKC.", "essential_references_not_discussed": "None", "other_strengths_and_weaknesses": "Strengths:\n1. The study introduces the first black-box adversarial evaluation for multi-kernel clustering and presents an innovative reinforcement learning-based attack framework, AdvMKC.\n2. The theoretical insights provided indicate that the impact of adversarial perturbations is governed by both their magnitude and frequency.\n3. The proposed method has been rigorously validated on a diverse range of benchmark datasets.\n\nWeaknesses:\n1. Although the generator-clusterer framework is claimed to reduce computational costs, prior research has already enhanced multi-view clustering efficiency, and clustering processes typically do not entail significant runtime overhead. It would be beneficial for the authors to report the actual running times of each algorithm to substantiate this claim.\n2. While the effects of parameters such as the selected sample count ($N_d^p$), perturbed view count ($N_k^p$), and perturbation magnitude ($\\epsilon$) on attack performance are examined, the loss function in Equation (16), which comprises four terms and three hyper-parameters, lacks a comprehensive sensitivity analysis.\n3. The occurrence of negative values in the ARI metric, as illustrated in Table 2, requires clarification on whether these outcomes are expected.", "other_comments_or_suggestions": "None", "questions_for_authors": "Please refer to the weakness.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "GhZ8umGQVJ", "reviewer": "Reviewer_HijP", "summary": "This paper examines the vulnerability of MKC methods to adversarial perturbations—an area that remains understudied. The authors introduce AdvMKC, a reinforcement learning framework that generates subtle perturbations to deceive MKC methods in black-box settings. Using proximal policy optimization and an innovative generator-clusterer architecture, AdvMKC stabilizes clustering outcomes while reducing computational overhead. Extensive experiments across seven datasets and eleven MKC methods validate the framework's effectiveness, robustness, and transferability.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**We sincerely appreciate Reviewer HijP’s thorough and constructive review. We provide point-by-point responses to the raised weaknesses as follows:**\n\n---\n\n**W1:** In Table I, some cases show improved MKC method performance under adversarial conditions. The authors should clarify why this phenomenon occurs.\n\n**R1:** We appreciate the reviewer’s insightful comments. As noted in Subsection 6.1, to ensure the stealthiness of adversarial attacks, we introduce the hyperparameter $\\epsilon$ to constrain the magnitude of injected noise. To ensure its effectiveness, $\\epsilon$ is set to a very low value. However, these slight perturbations may lead the victim MKC method to learn more robust representations, resulting in a slight improvement in clustering performance. We will clarify this point in the revision. \n\n**W2:** In Eq. (16), the authors introduce two hyperparameters to balance three loss terms. However, they do not conduct sensitivity analysis in the evaluation section to demonstrate how these parameters impact the attack performance.\n\n**R2:** Thank you for the reviewer’s comments. Based on your suggestion, we conduct a sensitivity analysis on the hyperparameters $\\alpha$, $\\beta$, and $\\gamma$ in Eq. (16), which regulate the balance among loss terms. To ensure comparable magnitudes across these terms, we select $\\alpha$ from $\\lbrace 0.1, 0.2, 0.3, 0.4, 0.5, 0.6\\rbrace$, $\\beta$ from $\\lbrace e^{-5}, e^{-4}, e^{-3} \\rbrace$, and $\\gamma$ from $\\lbrace e^{-5}, 2 e^{-5}, 3 e^{-5}, 4 e^{-5}, 5 e^{-5}, 6 e^{-5}\\rbrace$. The analysis is conducted on the MSRCv1 and BBCSport datasets, with results shown in [the following eight figures](https://anonymous.4open.science/api/repo/AdvMKC-rebuttal-CC14/file/sensitivity_analysis.png?v=0fcf01a5). We conducted a total of **216 evaluations**. Due to the limitations of OpenReview.net, we present the evaluations on the following anonymous GitHub repository. For example, as shown in Figure 13, changes in $\\alpha$, $\\beta$, and $\\gamma$ have no significant effect on the MNI metric for the BBCSport dataset. These results suggest that as long as the loss terms remain balanced in magnitude, variations in these parameters have minimal impact on attack performance.\n\nExperimental results are presented at https://anonymous.4open.science/r/AdvMKC-rebuttal-CC14/sensitivity_analysis.png.\n\n**W3:** Considering this is the first work to assess the adversarial robustness of MKC methods, the authors should release their source code to promote further research.\n\n**R3:** We appreciate the reviewer’s comments and acknowledge the concern. The code will be released upon the paper’s acceptance.", "claims_and_evidence": "Yes. The experimental results strongly support the main claims in the submission. The results are presented clearly and thoroughly, with a comprehensive set of datasets demonstrating the method's effectiveness.", "methods_and_evaluation_criteria": "The proposed method leverages reinforcement learning—an approach particularly well-suited for generating adversarial perturbations.", "theoretical_claims": "The proofs are generally well-structured and the key assumptions are clearly stated.", "experimental_designs_or_analyses": "The experimental setup is generally appropriate, with a good selection of benchmarks and adversarial examples used to evaluate robustness.", "relation_to_broader_scientific_literature": "The paper makes significant contributions in the area of adversarial robustness in MKC, proposing a new reinforcement-learning-based adversarial attack framework (AdvMKC).", "essential_references_not_discussed": "There are no essential references missing from the discussion.", "other_strengths_and_weaknesses": "Strengths\n- This paper is pioneering in its examination of MKC methods' adversarial robustness under black-box settings.\n- This paper proposes two additional comparison methods to fully demonstrate the effectiveness of the proposed approach.\n- The motivation is clear and the paper is well-written and easy to follow.\n\nWeaknesses\n- In Table I, some cases show improved MKC method performance under adversarial conditions. The authors should clarify why this phenomenon occurs.\n- In Eq. (16), the authors introduce two hyperparameters to balance three loss terms. However, they do not conduct sensitivity analysis in the evaluation section to demonstrate how these parameters impact the attack performance.\n- Considering this is the first work to assess the adversarial robustness of MKC methods, the authors should release their source code to promote further research.", "other_comments_or_suggestions": "The legends in the experimental results figures are too small and should be enlarged.", "questions_for_authors": "- In Table I, some cases show improved performance of the MKC method under adversarial conditions. Could the authors clarify why this phenomenon occurs?\n- In Eq. (16), the authors introduce two hyperparameters to balance three loss terms. Could the authors provide a sensitivity analysis in the evaluation section to demonstrate how these parameters impact the attack performance?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: Thank you for submitting your work to ICML 2025, and for your efforts in the rebuttal phase to clarify the reviewers' concerns. The authors should provide more comprehensive details about the experimental setup and enhance the quality and clarity of the figures in the camera-ready version. Since all the reviewers affirmed the novelty of the authors' work, I therefore recommend acceptance of the paper.
Decision: Accept (poster)