Riemannian Adversarial Attacks on Symmetric Positive Definite Matrices

In this paper, we study adversarial vulnerabilities when inputs lie on the manifold of symmetric positive definite (SPD) matrices by proposing a Riemannian Projected Gradient Descent (R-PGD) attack. This attack performs updates along the affine-invariant geometry and projects using a geodesic budget. We also give a reconstruction procedure that maps adversarial SPD matrices back to the original signals while enforcing spectral constraints. On Brain Computer Interface datasets and SPDNet, R-PGD is more effective than Euclidean PGD and yields geometrically tailored perturbations that remain adversarial after pre-processing. Our results motivate robustness analyses and defenses for manifold deep models.