The scale of the screening effort underscores how fragmented the field has been. The authors began with a systematic search across the literature and applied structured filtration criteria to arrive at their final corpus of 93 papers. That ratio, fewer than half a percent of the initially identified publications, reflects both the explosive growth of machine learning research and the relative scarcity of work dedicated specifically to the security of models that learn without labels. The reviewed studies spanned clustering algorithms, super-resolution models, autoencoders, generative adversarial networks, diffusion models, and transformers, giving the researchers a panoramic view of where the technology stands and where it is exposed.

Why does unsupervised learning deserve its own security analysis? The answer lies in how these models differ fundamentally from supervised ones. A supervised classifier learns a mapping from inputs to known labels, and adversarial research in that domain has produced well-known attack families, such as small perturbations to images that flip a classifier’s decision. Unsupervised models, by contrast, extract structure from raw data: they group similar items, compress and reconstruct signals, or learn to generate new samples that mimic a training distribution. An adversary attacking such a system does not need to fool a label; instead, the attacker might corrupt the learned clusters, poison the data so that a generative model produces manipulated outputs, or degrade reconstruction quality in ways that are harder to detect because there is no ground-truth label to compare against.

The review’s synthesis identified eight distinct types of attacks and nine distinct types of defences across the six model categories. This taxonomy is one of the paper’s central contributions. By providing top-level descriptions of each attack and defence family and then comparing how they manifest across different unsupervised architectures, the authors offer researchers a common vocabulary for a field that has often studied each model type in isolation. An attack that works against a generative adversarial network, for example, may exploit very different mechanisms than one targeting a clustering algorithm, yet the literature had lacked a unified framework for seeing those similarities and differences side by side.

Generative models receive particular attention in the analysis, and for good reason. Generative adversarial networks and diffusion models now power image synthesis, data augmentation, and creative tools used by hundreds of millions of people. Because these models learn the underlying distribution of their training data, an adversary who can influence that data, or the training process itself, can potentially shape what the model generates. The review highlights how poisoning attacks, in which malicious samples are injected into training data, pose a distinct threat in unsupervised settings, where there are no labels to act as a sanity check on the data. A poisoned generative model may look perfectly normal on the surface while harbouring hidden behaviours that only emerge under specific conditions.

Autoencoders and super-resolution models present a different attack surface. These systems compress inputs into lower-dimensional representations and then reconstruct them, a process that can be destabilised by carefully crafted perturbations. In applications such as medical imaging enhancement or satellite imagery analysis, a subtly corrupted reconstruction could have serious consequences. The review notes that defences developed for these architectures often borrow ideas from supervised adversarial training, but the absence of labels complicates the picture: without a correct output to train toward, robustness must be defined in terms of reconstruction fidelity, representation stability, or distributional consistency, each of which can be measured and attacked in different ways.

Clustering algorithms, among the oldest unsupervised techniques, turn out to be far from immune. The review documents how adversaries can manipulate cluster assignments by poisoning a small fraction of the training data or by crafting inputs that sit ambiguously between clusters. Because clustering is widely used in anomaly detection, network intrusion detection, and customer segmentation, such manipulation can have cascading effects: an attacker who can shift cluster boundaries may be able to hide malicious activity inside a cluster of benign examples, defeating the very purpose of the detection system. Transformers, too, appear in the review’s scope, reflecting their growing use in self-supervised and unsupervised pipelines beyond their original supervised applications.

One of the most valuable aspects of the study is its explicit comparison of how attacks and defences differ between supervised and unsupervised settings. The authors systematically synthesised these differences, pointing out that many defences validated on supervised classifiers cannot be transferred directly to unsupervised models. Adversarial training, the dominant defence in supervised learning, requires labelled examples of adversarial inputs and their correct outputs, something unsupervised pipelines simply do not have. Defences for unsupervised models therefore tend to rely on alternative strategies, such as anomaly detection over the training data, robust statistics, representation regularisation, and architectural safeguards. The review catalogues these nine defence types and evaluates where each has been demonstrated to work, and where the evidence remains thin.

That thin evidence base leads directly to the paper’s identification of critical gaps. Across the 93 studies, coverage is uneven: some model categories and attack types have attracted substantial research attention while others remain nearly unexamined. The authors argue that as industry increasingly deploys unsupervised models on unlabelled data, precisely because labelling is expensive and slow, the security community has not kept pace with the deployment curve. Their recommendations for future research call for more systematic evaluation of defences across model families, better benchmarks for measuring robustness without ground-truth labels, and greater attention to the intersection of data poisoning and generative modelling, where the consequences of compromise are potentially the most far-reaching.

The timing of this review could hardly be more significant. Foundation models and self-supervised pretraining, both heavily reliant on unlabelled data, now underpin everything from search engines to scientific discovery tools. If the systems that learn from the raw, uncurated internet are vulnerable to adversaries who can plant poisoned content in that data, the security of the entire AI stack is at stake. By mapping the terrain, eight attack types, nine defence types, six model families, and the crucial differences between labelled and unlabelled learning, Mohus and Li have given researchers and practitioners a foundational reference for hardening the next generation of machine learning. The work, funded through an NTNU PhD scholarship and published open access, arrives as a timely reminder that in artificial intelligence, learning without supervision should never mean defending without vigilance.

Subject of Research: Adversarial attacks and defences in unsupervised machine learning models

Article Title: Adversarial vulnerabilities and mitigations in unsupervised machine learning: a systematic review

Article References: Mohus, M. L., & Li, J. (2026). Adversarial vulnerabilities and mitigations in unsupervised machine learning: a systematic review. Artificial Intelligence Review. https://doi.org/10.1007/s10462-026-11695-3

Image Credits: AI Generated

DOI: 10.1007/s10462-026-11695-3

Keywords: unsupervised learning, adversarial attacks, machine learning security, generative adversarial networks, diffusion models, autoencoders, clustering, transformers, data poisoning, adversarial robustness, systematic review, AI safety