Robust PCA

Recovers the intrinsic low-dimensional subspace from heavily corrupted data. This component captures the global correlation structure, representing the clean signal that classical PCA would miss in the presence of outliers. The recovery is exact under broad conditions, provided the low-rank component is not itself sparse and the sparse component is not low-rank.

• Mechanism: Minimizes the nuclear norm (sum of singular values) to enforce a low-rank structure.
• Application: Separating the background scene (low-rank) from moving foreground objects (sparse) in surveillance video.

Isolates grossly corrupted entries into a distinct sparse matrix. This component captures anomalies, adversarial perturbations, or sensor failures that deviate significantly from the low-rank model. The sparsity is enforced using the ℓ₁-norm, which acts as a convex surrogate for the non-convex ℓ₀ counting norm.

• Mechanism: Minimizes the ℓ₁-norm of the sparse matrix to promote entry-wise sparsity.
• Robustness: Effectively handles arbitrarily large corruption magnitudes, unlike Frobenius norm minimization.

In adversarial signal classification, RPCA serves as a pre-processing defense by projecting perturbed inputs onto the learned clean signal manifold. An adversarial perturbation is treated as the sparse component S, which is separated and discarded before classification. This neutralizes evasion attacks without requiring adversarial training.

• Assumption: Clean signals lie near a low-dimensional linear subspace.
• Limitation: Adaptive attackers may craft perturbations that are not strictly sparse, requiring non-convex extensions like Low-Rank Representation (LRR).

Distinguishes between two operational regimes. Exact recovery guarantees perfect decomposition when corruption is perfectly sparse. Stable recovery provides bounded error when data is additionally corrupted by dense, small-magnitude noise (e.g., Gaussian noise). The stable formulation adds a Frobenius norm error term: minimize ||L||_* + λ||S||_1 + (μ/2)||M - L - S||_F².

• Practicality: Stable RPCA is essential for real-world RF signals with thermal noise.
• Trade-off: Introduces hyperparameters λ and μ that require tuning.

An extension of RPCA where the low-rank subspace is learned from a clean training set and fixed. New test samples are decomposed into a projection onto this fixed subspace and a sparse residual. The ℓ₁-norm of the residual serves as an anomaly score, enabling open set recognition by flagging samples that do not conform to the learned subspace as unknown or adversarial.

• Efficiency: Avoids recomputing the full decomposition for each new sample.
• Use Case: Detecting novel modulation schemes or zero-day adversarial attacks in spectrum monitoring.

A carefully crafted, often imperceptible noise pattern added to an input signal to cause a machine learning model to misclassify it. In the context of Robust PCA, these perturbations manifest as the sparse component of the data matrix—isolated, high-magnitude deviations from the clean, low-rank signal structure. By decomposing a corrupted IQ sample matrix, Robust PCA can mathematically separate the legitimate modulation signature from an injected adversarial attack.

An attack deployed at inference time where an adversary modifies a malicious sample to bypass a trained classifier without altering the model itself. Robust PCA serves as a critical pre-processing defense against evasion. By treating the incoming signal stream as a matrix and solving for a low-rank background and a sparse outlier component, the system can strip away the adversarial evasion pattern before it reaches the neural network classifier, effectively sanitizing the input.

A defensive technique that injects adversarial examples into the training dataset to improve a model's robustness against future attacks. While adversarial training hardens the classifier's decision boundary, Robust PCA offers a complementary, model-agnostic approach. It operates on the input data directly, decomposing it into a low-rank matrix (the true signal) and a sparse matrix (the attack), providing resilience without requiring retraining or access to the model's loss function.

The task of identifying test samples that are drawn from a fundamentally different distribution than the model's training data, triggering a rejection flag. Robust PCA aids this process by analyzing the statistical properties of the residual sparse component. An unusually high-energy sparse decomposition indicates that the input contains anomalies or adversarial noise not present in the clean training distribution, providing a mathematically grounded metric for flagging and rejecting out-of-distribution signals.

An attack on model integrity where an adversary injects malicious samples into the training data to corrupt the learning process and implant a backdoor. Robust PCA is a powerful tool for data sanitization in the training pipeline. By decomposing the entire training dataset matrix, it can isolate poisoned samples as sparse outliers that deviate from the coherent, low-rank structure of legitimate data, allowing engineers to scrub the dataset before a backdoor is ever learned.

The maximum allowable magnitude of a perturbation, typically defined by an Lp-norm bound, within which an adversary is constrained to operate. The Robust PCA formulation directly mirrors this concept through its regularization parameter lambda, which controls the trade-off between the low-rank and sparse components. Tuning this parameter defines the algorithm's sensitivity to the adversary's budget, balancing the removal of attacks against the preservation of legitimate signal variation.