# Multi-Label Adversarial Perturbations

arXiv: https://arxiv.org/abs/1901.00546 · HTML: https://mlsanity.com/paper/1901.00546/

## Key facts

- Cited by 18 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 2 Jan 2019.

## Built on by (most cited first, 18 of 18)

- [TkML-AP: Adversarial Attacks to Top-k Multi-Label Learning](https://mlsanity.com/paper/2108.00146/) (2021)
- [Rank-based Decomposable Losses in Machine Learning: A Survey](https://mlsanity.com/paper/2207.08768/) (2022)
- [A Unified Framework for Adversarial Attack and Defense in Constrained Feature Space](https://mlsanity.com/paper/2112.01156/) (2021)
- [Towards Evaluating the Robustness of Deep Diagnostic Models by Adversarial Attack](https://mlsanity.com/paper/2103.03438/) (2021)
- [GAMA: Generative Adversarial Multi-Object Scene Attacks](https://mlsanity.com/paper/2209.09502/) (2022)
- [MultiGuard: Provably Robust Multi-label Classification against Adversarial Examples](https://mlsanity.com/paper/2210.01111/) (2022)
- [Data Optimization in Deep Learning: A Survey](https://mlsanity.com/paper/2310.16499/) (2023)
- [XFL: Naming Functions in Binaries with Extreme Multi-label Learning](https://mlsanity.com/paper/2107.13404/) (2021)
- [Leveraging Local Patch Differences in Multi-Object Scenes for Generative Adversarial Attacks](https://mlsanity.com/paper/2209.09883/) (2022)
- [On Evaluating Adversarial Robustness of Chest X-ray Classification: Pitfalls and Best Practices](https://mlsanity.com/paper/2212.08130/) (2022)
- [JMA: a General Algorithm to Craft Nearly Optimal Targeted Adversarial Example](https://mlsanity.com/paper/2401.01199/) (2024)
- [Attack Transferability Characterization for Adversarially Robust Multi-label Classification](https://mlsanity.com/paper/2106.15360/) (2021)
- [Adversarial Examples for Extreme Multilabel Text Classification](https://mlsanity.com/paper/2112.07512/) (2021)
- [Superclass Adversarial Attack](https://mlsanity.com/paper/2205.14629/) (2022)
- [Towards Effective Multi-Label Recognition Attacks via Knowledge Graph Consistency](https://mlsanity.com/paper/2207.05137/) (2022)
- [When Measures are Unreliable: Imperceptible Adversarial Perturbations toward Top-k Multi-Label Learning](https://mlsanity.com/paper/2309.00007/) (2023)
- [Performance Evaluation of Knowledge Graph Embedding Approaches under Non-adversarial Attacks](https://mlsanity.com/paper/2407.06855/) (2024)
- [Showing Many Labels in Multi-label Classification Models: An Empirical Study of Adversarial Examples](https://mlsanity.com/paper/2409.17568/) (2024)

## Abstract (arXiv)

Adversarial examples are delicately perturbed inputs, which aim to mislead machine learning models towards incorrect outputs. While most of the existing work focuses on generating adversarial perturbations in multi-class classification problems, many real-world applications fall into the multi-label setting in which one instance could be associated with more than one label. For example, a spammer may generate adversarial spams with malicious advertising while maintaining the other labels such as topic labels unchanged. To analyze the vulnerability and robustness of multi-label learning models, we investigate the generation of multi-label adversarial perturbations. This is a challenging task due to the uncertain number of positive labels associated with one instance, as well as the fact that multiple labels are usually not mutually exclusive with each other. To bridge this gap, in this paper, we propose a general attacking framework targeting on multi-label classification problem and conduct a premier analysis on the perturbations for deep neural networks. Leveraging the ranking relationships among labels, we further design a ranking-based framework to attack multi-label ranking algorithms. We specify the connection between the two proposed frameworks and separately design two specific methods grounded on each of them to generate targeted multi-label perturbations. Experiments on real-world multi-label image classification and ranking problems demonstrate the effectiveness of our proposed frameworks and provide insights of the vulnerability of multi-label deep learning models under diverse targeted attacking strategies. Several interesting findings including an unpolished defensive strategy, which could potentially enhance the interpretability and robustness of multi-label deep learning models, are further presented and discussed at the end.