# Softmax-based Classification is k-means Clustering: Formal Proof, Consequences for Adversarial Attacks, and Improvement through Centroid Based Tailoring

arXiv: https://arxiv.org/abs/2001.01987 · HTML: https://mlsanity.com/paper/2001.01987/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 7 Jan 2020.

## Built on by (most cited first, 8 of 8)

- [Using Deep Convolutional Neural Networks to Detect Rendered Glitches in Video Games](https://mlsanity.com/paper/2406.08231/) (2024)
- [ScaleFace: Uncertainty-aware Deep Metric Learning](https://mlsanity.com/paper/2209.01880/) (2022)
- [Deep Clustering With Consensus Representations](https://mlsanity.com/paper/2210.07063/) (2022)
- [Deep Repulsive Prototypes for Adversarial Robustness](https://mlsanity.com/paper/2105.12427/) (2021)
- [Incorporating Pre-training Data Matters in Unsupervised Domain Adaptation](https://mlsanity.com/paper/2308.03097/) (2023)
- [Enhancing Classifier Conservativeness and Robustness by Polynomiality](https://mlsanity.com/paper/2203.12693/) (2022)
- [Clustering Aware Classification for Risk Prediction and Subtyping in Clinical Data](https://mlsanity.com/paper/2102.11872/) (2021)
- [Pre-trained Language Models as Re-Annotators](https://mlsanity.com/paper/2205.05368/) (2022)

## Abstract (arXiv)

We formally prove the connection between k-means clustering and the predictions of neural networks based on the softmax activation layer. In existing work, this connection has been analyzed empirically, but it has never before been mathematically derived. The softmax function partitions the transformed input space into cones, each of which encompasses a class. This is equivalent to putting a number of centroids in this transformed space at equal distance from the origin, and k-means clustering the data points by proximity to these centroids. Softmax only cares in which cone a data point falls, and not how far from the centroid it is within that cone. We formally prove that networks with a small Lipschitz modulus (which corresponds to a low susceptibility to adversarial attacks) map data points closer to the cluster centroids, which results in a mapping to a k-means-friendly space. To leverage this knowledge, we propose Centroid Based Tailoring as an alternative to the softmax function in the last layer of a neural network. The resulting Gauss network has similar predictive accuracy as traditional networks, but is less susceptible to one-pixel attacks; while the main contribution of this paper is theoretical in nature, the Gauss network contributes empirical auxiliary benefits.