[Paper Review] T$_k$ML-AP: Adversarial Attacks to Top-$k$ Multi-Label Learning

Shu Hu, Lipeng Ke+2 more|arXiv (Cornell University)|Jul 31, 2021

Adversarial Robustness in Machine Learning24 references4 citations

TL;DR

This paper proposes T$_k$ML-AP, the first white-box adversarial attack framework for top-$k$ multi-label learning (T$k$ML) systems, using continuous, convex loss functions to manipulate label rankings. It achieves high success rates—up to 100% attack success rate on MS COCO—by minimizing perturbations while shifting ground-truth or target labels out of or into the top-$k$ predictions.

ABSTRACT

Top-$k$ multi-label learning, which returns the top-$k$ predicted labels from an input, has many practical applications such as image annotation, document analysis, and web search engine. However, the vulnerabilities of such algorithms with regards to dedicated adversarial perturbation attacks have not been extensively studied previously. In this work, we develop methods to create adversarial perturbations that can be used to attack top-$k$ multi-label learning-based image annotation systems (TkML-AP). Our methods explicitly consider the top-$k$ ranking relation and are based on novel loss functions. Experimental evaluations on large-scale benchmark datasets including PASCAL VOC and MS COCO demonstrate the effectiveness of our methods in reducing the performance of state-of-the-art top-$k$ multi-label learning methods, under both untargeted and targeted attacks.

Motivation & Objective

• To address the lack of systematic adversarial attack methods targeting top-$k$ multi-label learning (T$k$ML) systems, which are widely used in image annotation and web search.
• To develop attack strategies that explicitly model the top-$k$ ranking behavior of T$k$ML classifiers, rather than treating them as standard multi-class problems.
• To design loss functions that are convex in individual prediction scores, enabling efficient optimization and robust adversarial perturbation generation.
• To evaluate the effectiveness of the proposed attacks under both untargeted and targeted settings across large-scale benchmarks like PASCAL VOC and MS COCO.
• To demonstrate that the method can generate effective, low-magnitude perturbations that reliably degrade model performance in real-world T$k$ML applications.

Proposed method

• Reformulate the non-differentiable top-$k$ ranking operation using a continuous approximation to enable gradient-based optimization.
• Design novel, convex loss functions that directly target the ranking shift—either removing ground-truth labels from the top-$k$ or inserting target labels into it.
• Use gradient descent to optimize perturbations that minimize the loss while maintaining imperceptibility, ensuring minimal changes to input features.
• Implement both instance-specific and universal adversarial attack variants (T$_k$ML-AP-Uv) to evaluate robustness across different attack scenarios.
• Calibrate prediction scores using sigmoid-like transformations to ensure outputs lie in [0,1], aligning with standard multi-label learning assumptions.
• Apply the attack framework to state-of-the-art T$k$ML models, using PASCAL VOC 2012 and MS COCO 2014 as benchmark datasets for evaluation.

Experimental results

Research questions

• RQ1 How can adversarial attacks be effectively designed for top-$k$ multi-label learning systems, which differ fundamentally from standard multi-class classification?
• RQ2 Can convex, differentiable loss functions be used to model and optimize top-$k$ ranking shifts in a way that enables efficient and effective adversarial perturbation generation?
• RQ3 How do the proposed attacks perform in both untargeted and targeted settings, especially when the target labels are semantically distant from the ground truth?
• RQ4 What is the trade-off between attack success rate and perturbation magnitude in universal vs. instance-specific adversarial attacks for T$k$ML?
• RQ5 How does the attack performance vary with increasing $k$, and does the semantic distance between target and true labels affect attack difficulty?

Key findings

• T$_k$ML-AP achieved a 100% attack success rate (ASR) on the MS COCO 2014 dataset under targeted attacks with $k=3$, outperforming baseline methods.
• On PASCAL VOC 2012, the method achieved 96.6% ASR for targeted attacks with $k=3$, demonstrating high effectiveness even in challenging settings.
• The universal attack variant (T$_k$ML-AP-Uv) outperformed $k$-UAPs across all $k$ values on MS COCO, with lower perturbation magnitudes required for success.
• Attack success rates decreased with increasing $k$, as more labels needed to be repositioned in the top-$k$ set, confirming increased attack difficulty.
• In the worst-case setting—where target labels were semantically distant from ground truth—T$_k$ML-AP-T still achieved 73.1% ASR at $k=10$, showing resilience to semantic difficulty.
• Visual comparisons confirmed that T$_k$ML-AP-Uv successfully attacked all top-$k$ labels with smaller, more consistent perturbations than $k$-UAPs, which failed on some images.