---
title: Partial Attribute Corruption
url: https://www.emergentmind.com/topics/partial-attribute-corruption
type: topic
---

# Partial Attribute Corruption

Searching arXiv for recent and foundational papers relevant to partial attribute corruption.
Partial attribute corruption denotes a family of supervised-learning settings in which only part of the input information is unreliable, unavailable, or corrupted, rather than the entirety of the observation. The term is not tied to a single canonical formalization. In a general Markov-kernel view, it is a form of attribute corruption on the input space \(X\), often acting non-trivially only on a subset of coordinates \(S\subset\{1,\dots,d\}\) [2307.08643]. In tabular learning, it appears as non-uniform, feature-dependent corruption with noisy measurements, missing entries, and feature-specific biases documented only through column-level reliability indicators [2602.03686]. In neural-network analyses of attribute noise, it refers to settings in which a fraction \(p\) of the features of each example is replaced or overwhelmed by noise while labels remain clean [2606.11319]. A closely related but distinct usage arises in online robust regression, where “partial attribute” refers to partial observability of features over time and a limited-memory feature budget, whereas the adversarial corruption itself is on the responses rather than on feature entries [1902.01729].

## 1. Conceptual scope and nomenclature

Partial attribute corruption is best understood as a structured subset of attribute corruption. The input vector is only partially compromised: some coordinates, some columns, or some cells are corrupted, while the remaining attributes remain intact or more reliable. The general corruption framework models supervised learning on \(Z=X\times Y\), with corruption represented by a Markov kernel that maps a clean learning problem to a corrupted one. Within that framework, a partial attribute corruption can be represented by a kernel that acts non-trivially only on selected coordinates of \(X\), leaving the complement unchanged [2307.08643].

This broad definition subsumes several practically distinct regimes. In tabular data, corruption can be non-uniform across columns, so that some features are “severe,” others “heavy,” “moderate,” or “mild,” and corruption may include additive noise, category replacement, and missingness. In neural attribute-noise studies, partial corruption is often feature-wise and stochastic: each feature is corrupted independently with probability \(p\), so that only a fraction \(1-p\) of attributes remains informative in expectation. In online-feature settings, the “partial” aspect may instead mean that the full feature matrix is never simultaneously accessible; only blocks of features arrive over time, and the learner must maintain a sparse active set under a memory budget [2602.03686].

A central source of confusion is the conflation of partial attribute corruption with label corruption or with missing data alone. The distinction matters. RoOFS, for example, studies adversarial corruption of responses \(y_i\) under partial feature availability; it does not directly model adversarial corruption of feature entries. QuAIL, by contrast, explicitly targets feature-dependent corruption in the training features and assumes clean labels. The heavy-input-corruption analysis of wide MLPs likewise keeps labels intact and corrupts only inputs. This suggests that “partial attribute corruption” is an umbrella term whose precise meaning depends on whether partiality is defined over coordinates, cells, columns, or temporal feature access [1902.01729].

| Setting | Corruption locus | Sense of “partial attribute” |
|---|---|---|
| Markov-kernel typology | Input space \(X\) | Only a subset of coordinates is corrupted |
| QuAIL | Training features | Column-wise, non-uniform cell corruption |
| Heavy input corruption in MLPs | Features of each example | Each feature corrupted independently with probability \(p\) |
| RoOFS | Responses \(y_i\) | Features are only partially accessible over time |

## 2. Formal models of partial corruption

The most general probabilistic formalization treats corruption as a Markovian transformation of the joint distribution. A supervised learning problem is \(\mathcal{L}=(\ell,\mathcal{H},P)\), and a Markovian corruption maps it to \(\tilde{\mathcal{L}}=(\ell,\mathcal{H},\tilde P)\) through a kernel
\[
\tau: Z \to Z,\qquad \tilde P = P\circ \tau.
\]
For attribute corruption, the kernel modifies \(X\). When \(X=X_1\times\cdots\times X_d\), a partial attribute corruption acting on a subset \(S\subset\{1,\dots,d\}\) can be written as
\[
\tau_S(x, d\tilde{x}) = \Big( \prod_{j\in S} \tau_j(x, d\tilde{x}_j)\Big) \Big( \prod_{j\notin S} \delta_{x_j}(d\tilde{x}_j)\Big),
\]
and a label-dependent version is
\[
\tau_S(x,y,d\tilde{x}) = \prod_{j\in S} \tau_j(x,y,d\tilde{x}_j) \prod_{j\notin S}\delta_{x_j}(d\tilde{x}_j).
\]
In the paper’s taxonomy, both are still attribute corruptions; “partial” is internal structure within the kernel rather than a separate corruption type [2307.08643].

QuAIL instantiates a column-wise corruption model for tabular data. It assumes non-uniform, feature-dependent corruption with fixed column-level severity: \(6.25\%\) of features are severe (\(40\%\) of cells corrupted), \(12.5\%\) heavy (\(20\%\)), \(25\%\) moderate (\(10\%\)), and the remaining mild (\(5\%\)), giving about \(10\%\) of all cells corrupted overall. Two regimes are defined. Under CCAR, a numerical feature \(x_j\) is corrupted as
\[
\tilde{x}_j = x_j + \epsilon, \quad \epsilon \sim \mathcal{N}(0,\sigma^2), \quad \sigma = \sigma_j / 10,
\]
categorical values are replaced uniformly from \(\mathcal{C}\setminus\{c\}\), and \(30\%\) of corrupted cells are set to NaN. Under CNAR, the corruption is value-dependent and correlated:
\[
\tilde{x}_j = x_j + (1 + 3x_j)\,\epsilon,\quad \epsilon \sim \mathcal{N}(0,\sigma^2),\quad \sigma = \sigma_j / 10^{0.75},
\]
together with MNAR-like missingness and anchor-induced correlated corruption across numerical features [2602.03686].

The neural-network attribute-noise formulation uses two canonical feature-wise models. Replacement noise is
\[
\tilde{x}_{k\chi} = (1-b_{k\chi}) x_{k\chi} + b_{k\chi} u_{k\chi},
\]
where \(b_{k\chi}\sim \mathrm{Bernoulli}(p)\), and additive noise is
\[
\tilde{x}_{k\chi} = (1-p) x_{k\chi} + p\, \xi_{k\chi}.
\]
The quantity \(\epsilon=1-p\) is the signal strength. When \(p>0.9\), more than \(90\%\) of the attributes are corrupted in the replacement model, or the clean component weight is below \(0.1\) in the additive model. This is a direct, feature-level notion of partial attribute corruption with clean labels [2606.11319].

RoOFS provides a mathematically different setting. At time \(t\), only a block of features
\[
X_t \in \mathbb{R}^{p_t \times n},\quad t=1,\dots,\mathcal{T},
\]
is observed, with \(p=\sum_t p_t\), and the responses satisfy
\[
\boldsymbol y = X^T \boldsymbol \beta^* + \boldsymbol u + \boldsymbol \varepsilon,
\]
where \(\boldsymbol u\) is an adversarial corruption vector on the responses and \(\|\boldsymbol \beta^*\|_0\le \mu\). Here the “partial attribute” aspect is partial observability over time and a feature budget \(\|\boldsymbol \beta\|_0\le \mu\), not corruption of feature entries themselves [1902.01729].

## 3. Algorithmic patterns for learning under partial attribute corruption

One response to partial attribute corruption is to encode feature reliability directly into optimization. QuAIL augments a differentiable tabular model \(f_{\boldsymbol{\theta}}:\mathbb{R}^D\to\mathcal{Y}\) with a diagonal multiplicative gating layer
\[
\tilde{\mathbf{x}}_i = \mathbf{g}\odot \mathbf{x}_i,
\qquad
\hat y_i = f_{\boldsymbol{\theta}}(\tilde{\mathbf{x}}_i),
\]
where \(\mathbf{g}=[g_1,\ldots,g_D]^\top\) is learnable. The gates are regularized toward an anchor \(\mathbf{g}_{\text{anchor}}\) using a quality-dependent proximal term
\[
\mathcal{L}_{\text{gate}} = \frac{1}{D}\sum_{j=1}^{D} w_j \left(g_j - g_{j,\text{anchor}}\right)^2,
\qquad
w_j = \phi(1-q_j),
\]
with \(\mathbf{q}=[q_1,\dots,q_D]^\top\in[0,1]^D\) the vector of column-level quality scores. Because \(w_j\) is larger for lower-quality features, low-reliability columns experience stronger resistance to gate updates, while trusted columns can adapt more freely. The method therefore does not repair corrupted cells; it modulates the model’s reliance on corrupted columns [2602.03686].

A second response is robust alternating estimation under partial feature availability. RoOFS maintains a current active feature set \(\Psi\) with \(|\Psi|\le \mu\), updates the coefficients by a gradient step on the currently estimated uncorrupted sample set \(S_t\),
\[
\boldsymbol \beta_{\Psi}^{t+1}
\leftarrow
\boldsymbol \beta_{\Psi}^{t} - \eta
X_{\Psi,S_t}^T
(X_{\Psi,S_t}^T \boldsymbol \beta_{\Psi}^t - \boldsymbol y_{S_t}),
\]
and prunes features whenever \(|\Psi|>\mu\) by removing the smallest-magnitude coefficients. Sample corruption is handled by residual trimming. Given
\[
\boldsymbol r = |\boldsymbol y - X^T \boldsymbol \beta|,
\]
the estimated uncorrupted set is
\[
S = \mathcal{H}_\tau(\boldsymbol r),
\]
that is, the indices of the \(\tau\) smallest residuals, with \(\tau\) chosen adaptively rather than supplied as a known corruption ratio. The resulting algorithm alternates between sparse coefficient refinement, feature substitution, and residual-based estimation of the clean sample set [1902.01729].

A third pattern is not an explicit training mechanism but an induced effective rule in the heavy-corruption regime. For wide MLPs trained on heavily corrupted inputs with clean labels, the leading-order behavior reduces to a prototype classifier: the class score depends on the similarity between the test point and the centered class mean. In that regime, the network effectively aggregates small amounts of surviving signal across many corrupted examples rather than reconstructing clean inputs example by example [2606.11319].

These approaches correspond to different assumptions about where corruption resides and what side information is available. QuAIL assumes exogenous column-level reliability indicators but no instance-level quality labels. RoOFS assumes no feature-level corruption model, but it assumes sparse coefficients, partial feature streaming, and sample-level response corruption. The wide-MLP analysis assumes i.i.d. feature corruption and clean labels, and derives the learned decision rule from the training dynamics in the infinite-width limit. This suggests that partial attribute corruption is methodologically heterogeneous: gating, trimming, and prototype formation address different operational regimes rather than constituting interchangeable solutions.

## 4. Theoretical perspectives

A major theoretical distinction concerns whether corruption can be absorbed into the loss alone. In the Markov-kernel analysis, label corruption can be pushed entirely into a transformed loss while leaving the hypothesis class unchanged. Attribute corruption is qualitatively different. When the corruption acts on \(X\), the transformed problem involves \(\tau(\ell\circ\mathcal{H})\), so the effective minimization set changes. The paper’s negative result is that classical loss correction does not extend in general to the attribute and joint corruption case. Even when a Bayesian inverse exists, proper correction for attribute corruption requires a generalized formulation that integrates over the distribution induced by the cleaning kernel, rather than a simple loss-side reweighting [2307.08643].

RoOFS develops a separate theory based on Subset Restricted Strong Convexity. For
\[
f_S(\boldsymbol \beta) = \|\boldsymbol y_S - X_S^T \boldsymbol \beta\|_2^2,
\]
SRSC requires that for all \(\mu\)-sparse vectors \(\boldsymbol\beta_1,\boldsymbol\beta_2\) and all sufficiently large uncorrupted subsets \(S\),
\[
f_S(\boldsymbol \beta_1) - f_S(\boldsymbol \beta_2)
\ge
\nabla^T f_S(\boldsymbol \beta_2) (\boldsymbol \beta_1 - \boldsymbol \beta_2)
+
\frac{\varphi_\mu}{2} \|\boldsymbol \beta_1 - \boldsymbol \beta_2\|_2^2.
\]
Under SRSC, sparsity \(\|\boldsymbol\beta^*\|_0\le\mu\), and a sufficiently large clean fraction \(\gamma>1/2\), the final solution satisfies a restricted error bound in loss relative to the optimal solution on the true uncorrupted set. The theorem is stated in terms of loss values rather than directly in parameter norm, but the paper notes that under SRSC such loss control implies control of the parameter error [1902.01729].

The heavy-input-corruption theory for wide MLPs adopts the infinite-width NTK regime. The logit for class \(i\) on a clean test input takes the form
\[
\tilde f_i(x_*;\epsilon) =
\tilde{\boldsymbol{\Theta}}^{(L)}_{*\chi}(\epsilon)
\left[\tilde{\boldsymbol{\Theta}}^{(L)}_{\chi\chi}(\epsilon)\right]^{-1}
\mathbf y_i,
\]
and in the high-corruption limit the leading class-dependent term becomes
\[
i^\star = \arg\max_{i=1,\dots,C}
\left\{
\frac{1}{d} \sum_{k=1}^d x_{k*}(\bar{x}_k^i - \bar{x}_k )
\right\},
\]
which is the nearest-class-mean rule in inner-product form. The result is described as universal across any depth, as well as a wide class of activation functions and noise distributions, because the leading term depends only on the centered class means and scalar coefficients arising from the kernel recursion [2606.11319].

QuAIL does not provide formal robustness theorems or convergence rates. Its theoretical contribution is conceptual: the proximal term acts as feature-wise inertial regularization, or a quality-dependent trust-region-like mechanism for the gate parameters. High-reliability features have weak proximal force and low-reliability features have strong proximal force. This suggests a selective-inertia interpretation rather than a formal error guarantee [2602.03686].

## 5. Empirical evidence across regimes

The empirical literature represented by these papers covers substantially different problem classes. QuAIL evaluates 50 classification and regression datasets under CCAR and CNAR. Relative to the best MLP baseline, the reported average improvement is \(+0.99\%\) F1 for classification and \(+2.99\%\) \(R^2\) for regression under CCAR, and \(+1.90\%\) F1 and \(+1.30\%\) \(R^2\) under CNAR. The improvements are averaged with a \(10\%\) trimmed mean. Stratified analysis reports about \(+2.95\%\) average improvement on small datasets (\(N<1000\)) and a similar trend for low feature counts, indicating stronger benefit when corrupted columns occupy a larger share of the available information [2602.03686].

The heavy-corruption MLP study reports that neural networks remain robust, maintaining well-above-chance accuracy even when inputs are \(>90\%\) corrupted. On MNIST, Fashion-MNIST, and KMNIST, 3-layer width-128 ReLU MLPs trained on replacement-noise-corrupted images and tested on clean images retain substantial accuracy until \(p\) approaches \(1\), despite training images at \(p=0.8\) appearing visually almost random. At \(p=0.97\), theory–experiment comparisons show that the effective centroid model closely matches the logits and test accuracy of trained width-2048 MLPs. The analysis also gives an SNR scaling
\[
\mathrm{SNR} \sim (1-p)^2\, d\,\frac{N}{C},
\]
and experiments varying \(N\) and \(d\) confirm that robustness improves with both feature dimension and training-set size per class [2606.11319].

RoOFS evaluates synthetic and real-world datasets under adversarial response corruption with online feature access. In synthetic experiments, \(p\) is as large as \(20{,}000\), corruption ratios vary from \(10\%\) to \(40\%\), and regression accuracy is measured by
\[
e = \|\hat{\boldsymbol \beta} - \boldsymbol \beta^*\|_2.
\]
The paper reports that RoOFS consistently has the lowest \(L_2\) error over a wide range of corruption ratios, feature dimensions, sample sizes, and sparsity ratios; without dense noise, it nearly exactly recovers \(\boldsymbol\beta^*\). For uncorrupted-set recovery, RoOFS improves F1 over baselines by up to \(\sim 15\%\) absolute and still yields F1 \(>0.90\) in many settings when corruption increases to \(40\%\). For feature selection, it achieves F1 \(>0.85\) across almost all settings, even when \(\mu/p\) is as low as \(10\%\). On IMDB sentiment prediction with about \(10\)K textual features, it achieves the lowest MAE, around \(3.07\), under corruption ratios \(5\%\)–\(40\%\), while runtime grows roughly linearly with both \(n\) and \(p\) [1902.01729].

Taken together, these empirical results show that partial attribute corruption does not induce a single failure mode. In some regimes, exploiting coarse feature-quality priors is effective; in others, simple prototype behavior emerges automatically under extreme i.i.d. feature corruption; and in streaming sparse regression, robustness to corrupted responses can coexist with partial feature observability.

## 6. Boundaries, misconceptions, and open directions

A recurring misconception is that partial attribute corruption is synonymous with missing values. The surveyed settings are broader: missingness is only one case among additive noise, random replacement, value-dependent corruption, correlated corruption, feature-specific bias, and feature streaming. Another misconception is that all “partial attribute” papers model feature corruption directly. RoOFS is explicitly a counterexample: its features are assumed clean but partially accessible, and robustness is with respect to adversarial sample-level label corruption [1902.01729].

The literature also delineates important boundaries on what current methods do not solve. QuAIL requires reasonably calibrated column-level quality scores \(\mathbf q\); if these are badly mis-specified, the method may anchor the wrong features. It is designed for feature-wise corruption rather than label noise and does not attempt to correct the data. The heavy-input-corruption theory assumes i.i.d. corruption across features and examples, clean labels, and a high-noise, high-dimensional regime; correlated, adversarial, or label-dependent feature corruption is outside its analysis. RoOFS requires sparsity, a clean majority (\(\gamma>1/2\)), and SRSC, and it does not directly address corruption on arbitrary feature entries [2602.03686].

The general corruption theory clarifies why these boundaries are not merely implementation details. Attribute corruption alters the effective hypothesis space, not only the loss, so generic label-noise remedies such as simple loss correction are structurally inadequate in the attribute and joint corruption case [2307.08643]. A plausible implication is that successful mitigation of partial attribute corruption will often require methods that are explicitly feature-aware or kernel-aware rather than purely sample-reweighting schemes.

Several extensions are suggested by the papers’ framing. RoOFS identifies natural directions toward nonlinear models, classification, multi-task settings, group-sparse structure, feature-level corruption, and missing features. QuAIL suggests broader corruption patterns, more sophisticated mappings from quality to regularization, and application beyond tabular data. The heavy-input-corruption analysis points to higher-order expansions, denoising models, and more realistic non-i.i.d. corruptions. These directions collectively indicate that partial attribute corruption is not a peripheral special case but a unifying problem class at the intersection of robust statistics, representation learning, and data quality modeling.

Source: https://www.emergentmind.com/topics/partial-attribute-corruption