SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Gang Li  
Texas A&M University  
College Station, USA  
gang-li@amu.edu
Wei Tong General Motors Warren, USA wei.tong@gm.com
Tianbao Yang  
Texas A&M University  
College Station, USA  
tianbao-yang@tamu.edu
This paper seeks to address a gap in optimizing Average Precision (AP) while ensuring adversarial robustness, an area that has not been extensively explored to the best of our knowledge. AP maximization for deep learning has widespread applications, particularly when there is a significant imbalance between positive and negative examples. Although numerous studies have been conducted on adversarial training, they primarily focus on robustness concerning accuracy, ensuring that the average accuracy on adversially perturbed examples is well maintained. However, this type of adversarial robustness is insufficient for many applications, as minor perturbations on a single example can significantly impact AP while not greatly influencing the accuracy of the prediction system. To tackle this issue, we introduce a novel formulation that combines an AP surrogate loss with a regularization term representing adversarial ranking robustness, which maintains the consistency between ranking of clean data and that of perturbed data. We then devise an efficient stochastic optimization algorithm to optimize the resulting objective. Our empirical studies, which compare our method to current leading adversarial training baselines and other robust AP maximization strategies, demonstrate the effectiveness of the proposed approach. Notably, our methods outperform a state-of-the-art method (TRADES) by more than  $4\%$  in terms of robust AP against PGD attacks while achieving  $7\%$  higher AP on clean data simultaneously on CIFAR10 and CIFAR100. The code is available at: https://github.com/GangLii/Adversarial-AP
AP measures the precision of a model at different recall levels, offering a more nuanced understanding of the trade-offs between precision and recall. Optimizing AP for deep learning is of vital importance, especially in cases with highly imbalanced datasets. In such situations, accuracy alone can be misleading, as a model may perform well on the majority class but struggle with the minority class, thereby offering a superficially high accuracy score. In contrast, AP serves as a ranking metric that is particularly attuned to errors at the top of the ranking list, which makes it a more appropriate metric for applications dealing with highly imbalanced datasets. For example, deep AP maximization has been crucial in enhancing molecular property prediction performance, contributing to a winning solution in the MIT AICures challenge [54].
However, existing approaches of AP maximization are not robust against adversarial examples. It is notoriously known that deep neural networks (DNN) are vulnerable to adversarial attacks, where small, carefully-crafted perturbations to the input data can cause the model to produce incorrect predictions [46, 16]. These perturbations are often imperceptible to humans but can significantly impact the model's performance. Tremendous studies have been conducted to improve the adversarial robustness of DNN. A popular strategy to achieve adversarial robustness is through adversarial training [27, 59, 53, 45, 21, 2, 35, 44, 47, 15], which injects adversarial examples into the training
Table 1: Comparison of different approaches for Adversarial AP Maximization (AdAP). Red indicates new features proposed in this paper.
Approaches	Objective	Regularization	Optimization	Ranking Robustness	Trade-off	Consistent Attack
AdAP_MM	MiniMax AP Loss	No	Zero-sum Game	Yes	No	No
AdAP_PZ	AP Loss + Reg.	Pointwise	Zero-sum Game	No	Yes	Yes
AdAP_LZ	AP Loss + Reg.	Listwise	Zero-sum Game	Yes	Yes	No
AdAP_LN	AP Loss + Reg.	Listwise	Non-zero-sum Game	Yes	Yes	Yes
AdAP_LPN	AP Loss + Reg.	Listwise + Pointwise	Non-zero-sum Game	Yes	Yes	Yes
TRADES
AdAP LN
Figure 1: Top are predictions on clean images of a robust model trained by a state-of-the-art adversarial training method TRADES [59] and our method on CIFAR-10 data for detecting trucks. Bottom are predictions on the same set of images with only one example adversarially perturbed, which is generated by PGD following a black-box attack. The results of TRADES (left) indicate that slightly changing one example could dramatically impact AP but not on the accuracy. The results of our approach (right) demonstrate that our solution is more robust to adversarial data in terms of ranking and AP score. The dashed blue line indicates the decision boundary at score 0.5.
that are generated by various attack methods. Nevertheless, almost all existing methods focus on robustness concerning accuracy, ensuring that the average accuracy on adversarially perturbed examples is well maintained. This type of adversarial robustness is insufficient for many applications with highly imbalanced datasets, as minor perturbations on a single example can significantly impact AP while not greatly influencing the accuracy of the prediction system (cf. an example in Figure 1). This presents a significant challenge for adversarially robust AP maximization.
In this paper, we conduct a comprehensive study on how to imbue AP maximization with adversarial robustness. There are several technical and practical concerns in the design of adversarial training methods for AP maximization to enjoy three nice properties: (i) capability to trade off between AP on a set of clean data and the robustness of the model on the perturbed data; (ii) robustness in terms of ranking performance instead of accuracy against adversarial perturbations; (iii) consistency of attacks between training and inference. The first property is obvious in light of existing works on adversarial training [59]. The importance of the second property has been explained in the previous paragraph. The third property is tricky as it does not exist in existing adversarial training methods. The adversarial attack is usually applied to an individual data during the inference phase. Hence, we expect that maintaining the consistency between the attacks generated in training process and that in the inference phase will help boost the performance. However, this will cause a dilemma for achieving pointwise attack and listwise robustness in a unified framework.
To acquire these properties in a unified framework, we draw inspiration from prior adversarial training methods through robust regularization, and integrate two distinct design elements. We examine robust objectives that combine an AP surrogate loss on the clean data and a regularization term depending on the perturbed data. The two unique design features are (i) a new listwise adversarial regularization defined by a divergence between two distributions that represent the top one probabilities of a set of clean data and their perturbed versions; (ii) a non-zero-sum game approach, which integrates pointwise adversarial attacks with the proposed listwise adversarial regularization. This will ensure the attack consistency between training and inference. Our contributions are summarized below.
- We propose a non-zero-sum game optimization formulation for AP maximization with adversarial ranking robustness, which achieves listwise defense against pointwise attacks.
- We propose an efficient stochastic algorithm for solving the resulting objective, which integrates traditional adversarial sample generation methods with a state-of-the-art deep AP maximization algorithm without requiring a large batch size.
- We conduct extensive experiments to compare with existing leading adversarial training baselines, and ablation studies to compare different approaches shown in Table 1 for adversarial AP maxi
mization. We conclude that AdAP_LN and AdAP_LPN achieve the best performance among all methods corroborating the effectiveness of the proposed techniques.
Adversarial Robustness. To safeguard deep neural networks (DNNs) from adversarial attacks, a variety of adversarial defense techniques have been proposed in the literature, including (1) detection for defense [37, 48, 38, 24]; (2) input transformations for defense [25, 17, 39, 18, 58]; (3) adversarial training [1, 11, 47, 15]. Among these techniques, adversarial training has been demonstrated to be one of the most effective approaches [27, 59, 41, 45, 21, 14, 53]. Among these, [27] is the first to theoretically study and justify adversarial training by solving a min-max formulation for training adversarially robust models for deep learning. [59] presents an objective function that strike a balance between accuracy and robustness in light of their theoretical tight upper bound on the robust error. However, these previous methods focus on how to improve the robustness concerning accuracy, which is not sufficient for highly imbalanced data. [52] considers adversarial training for imbalanced data by combining a minimax weighted loss and a contrastive loss of feature representations. [60] considers adversarial ranking in the context of retrieval and proposes maximum-shift-distance attack that pushes an embedding vector as far from its original position as possible and uses it in a triplet loss for optimization. [20] presents a study on adversarial AUC optimization by reformulating the original tightly coupled objective as an instance-wise form for adversarial training. Nevertheless, none of these methods enjoy three nice properties simultaneously, i.e., adversarial ranking robustness, trade-off between AP and robustness, and consistent attacks between training and inference.
Average Precision Optimization. For imbalanced classification and information retrieval problems, AP optimization has attracted significant attention in the literature [13, 36, 31, 5, 10, 29, 28, 55]. To maximize the AP score for big data, some works employ stochastic optimization with mini-batch averaging to compute an approximate gradient of the AP function or its smooth approximation [6, 36, 42, 4]. These methods typically rely on a large mini-batch size for good performance. In contrast, [34] proposes a novel stochastic algorithm that directly optimizes a surrogate function of AP and provides theoretical convergence guarantee, without the need for a large mini-batch size. Then [50] further improve the stochastic optimization of AP by developing novel stochastic momentum methods with a better iteration complexity of  $O(1 / \epsilon^4)$ . However, these approaches of AP maximization are vulnerable to adversarial examples created by introducing small perturbations to natural examples. The question of how to boost model's AP under adversarial perturbations while maintaining AP on clean data is still unresolved.
For simplicity of exposition, we consider binary classification problems. However, the discussions and algorithms can be easily extended to mean AP for multi-class or multi-label classification problems. Let  $\mathcal{D} = \left\{\left(\mathbf{x}_i,y_i\right)\right\}_{i = 1}^n$  denote the set of all training examples with  $\mathbf{x}_i$  being an input data and  $y_{i}\in \{-1,1\}$  being its associated label. Denoted by  $h(\mathbf{x}) = h_{\mathbf{w}}(\mathbf{x})$  the predictive function (e.g., a deep neural network), whose parameters are  $\mathbf{w}\in \mathbb{R}^{d}$ . Denote by  $\mathbb{I}(\cdot)$  an indicator function of a predicate. Denoted by  $\| \cdot \| = \| \cdot \| _p$  the  $L_{p}$ -norm where  $p\in (1,\infty ]$ . Denoted by  $\mathbb{B}(0,\epsilon) = \{x:\| x\| \leq \epsilon \}$  the  $L_{p}$ -norm ball centered at 0 with radius  $\epsilon$ . Let  $\mathcal{D}_{+}$  and  $\mathcal{D}_{-}$  be the subsets of  $\mathcal{D}$  with only positive examples and negative examples, respectively. Let  $n_+ = |\mathcal{D}_+\|$  denote the number of positive examples. Denote by  $r(\mathbf{x}_i,\mathcal{D}) = \sum_{\mathbf{x}_j\in \mathcal{D}}\mathbb{I}(h_{\mathbf{w}}(\mathbf{x}_j)\geq h_{\mathbf{w}}(\mathbf{x}_i))$  the rank of  $\mathbf{x}_i$  in a set  $\mathcal{D}$  according to the prediction scores in descending order, i.e., the number of examples that are ranked higher than  $\mathbf{x}_i$  including itself. Let  $\ell (h_{\mathbf{w}}(\mathbf{x}),y)$  denote a pointwise loss function, e.g., the cross-entropy loss.
3.1 AP Maximization
According to its definition, AP can be expressed as:  $\frac{1}{n_{+}}\sum_{\mathbf{x}_{i}\in \mathcal{D}_{+}}\frac{r(\mathbf{x}_{i},\mathcal{D}_{+})}{r(\mathbf{x}_{i},\mathcal{D})}$  [3]. Many different approaches have been developed for AP maximization [9, 36, 13, 4, 34]. We follow a recent work [34], which proposes an efficient stochastic algorithm for AP maximization based on differentiable surrogate loss minimization. In particular, the rank function is approximated by using a surrogate loss of the indicator function  $\mathbb{I}(h_{\mathbf{w}}(\mathbf{x}_j)\geq h_{\mathbf{w}}(\mathbf{x}_i))$  [34], yielding the following problem:
$$
\min  _ {\mathbf {w}} P (\mathbf {w}) = - \frac {1}{n _ {+}} \sum_ {\mathbf {x} _ {i} \in \mathcal {D} _ {+}} \frac {\sum_ {s = 1} ^ {n} \mathbb {I} \left(y _ {s} = 1\right) \ell \left(\mathbf {w} ; \mathbf {x} _ {s} ; \mathbf {x} _ {i}\right)}{\sum_ {s = 1} ^ {n} \ell \left(\mathbf {w}; \mathbf {x} _ {s}; \mathbf {x} _ {i}\right)}, \tag {1}
$$
where  $\ell(\cdot)$  denotes a smooth surrogate loss function, e.g., the squared hinge loss  $\ell(\mathbf{w};\mathbf{x}_s;\mathbf{x}_i) = (\max \{m - (h_{\mathbf{w}}(\mathbf{x}_i) - h_{\mathbf{w}}(\mathbf{x}_s)), 0\})^2$ , where  $m$  is a margin parameter.
To tackle the computational complexity of computing the stochastic gradient of  $P(\mathbf{w})$ , [34] has formulated this problem as a finite-sum coupled compositional optimization of the form  $\frac{1}{n+}\sum_{\mathbf{x}_i\in\mathcal{D}_+}f(\varphi(\mathbf{w};\mathbf{x}_i))$ , where  $\varphi(\mathbf{w};\mathbf{x}_i) = [\varphi_1(\mathbf{w};\mathbf{x}_i),\varphi_2(\mathbf{w};\mathbf{x}_i)]$ ,  $\varphi_1(\mathbf{w};\mathbf{x}_i) = \sum_{s=1}^n\mathbb{I}(y_s = 1)\ell(\mathbf{w};\mathbf{x}_s;\mathbf{x}_i)/n$ ,  $\varphi_2(\mathbf{w};\mathbf{x}_i) = \sum_{s=1}^n\ell(\mathbf{w};\mathbf{x}_s;\mathbf{x}_i)/n$ ,  $f([\varphi_1,\varphi_2]) = -\varphi_1/\varphi_2$ . To compute a stochastic gradient estimator, their algorithm maintains two moving average estimators  $\mathbf{u}_{\mathbf{x}_i}^1$  and  $\mathbf{u}_{\mathbf{x}_i}^2$  for  $\varphi_1(\mathbf{w};\mathbf{x}_i)$  and  $\varphi_2(\mathbf{w};\mathbf{x}_i)$ . At iteration  $t$ , two mini-batches are sampled  $\mathcal{B}^+ \in \mathcal{D}_+$  and  $\mathcal{B} \in \mathcal{D}$ . The two estimators  $\mathbf{u}_{\mathbf{x}_i}^1$  and  $\mathbf{u}_{\mathbf{x}_i}^2$  are updated by Equation (2) for  $\mathbf{x}_i \in \mathcal{B}^+$ :
$$
\mathbf {u} _ {\mathbf {x} _ {i}} ^ {1} = \left(1 - \gamma_ {1}\right) \mathbf {u} _ {\mathbf {x} _ {i}} ^ {1} + \gamma_ {1} \frac {1}{| \mathcal {B} |} \sum_ {\mathbf {x} _ {j} \in \mathcal {B}} \ell \left(\mathbf {w} _ {t}; \mathbf {x} _ {j}, \mathbf {x} _ {i}\right) \mathbb {I} \left(y _ {j} = 1\right) \tag {2}
$$
$$
\mathbf {u} _ {\mathbf {x} _ {i}} ^ {2} = (1 - \gamma_ {1}) \mathbf {u} _ {\mathbf {x} _ {i}} ^ {2} + \gamma_ {1} \frac {1}{| \mathcal {B} |} \sum_ {\mathbf {x} _ {j} \in \mathcal {B}} \ell (\mathbf {w} _ {t}; \mathbf {x} _ {j}, \mathbf {x} _ {i}),
$$
where  $\gamma_{1} \in (0, 1)$  is a moving average parameter. With these stochastic estimators, an stochastic estimate of  $\nabla P(\mathbf{w})$  is given by Equation (3)
$$
\widehat {\nabla} _ {\mathbf {w} _ {t}} P \left(\mathbf {w} _ {t}\right) = \frac {1}{| \mathcal {B} ^ {+} |} \sum_ {\mathbf {x} _ {i} \in \mathcal {B} ^ {+}} \sum_ {\mathbf {x} _ {j} \in \mathcal {B}} \frac {\left(\mathbf {u} _ {\mathbf {x} _ {i}} ^ {1} - \mathbf {u} _ {\mathbf {x} _ {i}} ^ {2} \mathbb {I} \left(\mathbf {y} _ {j} = 1\right)\right) \nabla \ell \left(\mathbf {w} _ {t}; \mathbf {x} _ {j} , \mathbf {x} _ {i}\right)}{| \mathcal {B} | \left(\mathbf {u} _ {\mathbf {x} _ {i}} ^ {2}\right) ^ {2}}. \tag {3}
$$
Then the model parameter can be updated similar to SGD, momentum-based methods, or Adam.
3.2 Pointwise Attacks and Pointwise Adversarial Regularization
An adversarial attack is usually applied to a specific example  $\mathbf{x}$  such that its class label is changed from its original label (non-targeted attack) or to a specific label (targeted attack). We refer to this kind of attack as pointwise attack. Various pointwise attacking methods have been proposed, including, FGSM [16], Basic Iterative Method [23], PGD [27], JSMA [32], DeepFool [30], and CW attack [8]. While our approach is agnostic to any pointwise attacks, we restrict our discussion to optimization-based non-target attacks,  $\delta = \arg \min_{\| \delta \| \leq \epsilon} G(\mathbf{w}, \mathbf{x} + \delta, y)$ , where  $G$  is an appropriate function, e.g.,  $G(\mathbf{w}, \mathbf{x} + \delta, y) = -\ell(h_{\mathbf{w}}(\mathbf{x} + \delta), y)$ . A classic adversarial training method is to solve a robust optimization problem that integrates the training loss with the adversarial attack, e.g.,
$$
\min  _ {\mathbf {w}} \frac {1}{n} \sum_ {i = 1} ^ {n} \max  _ {\| \delta_ {i} \| \leq \epsilon} \ell \left(h _ {\mathbf {w}} \left(\mathbf {x} _ {i} + \delta_ {i}\right), y _ {i}\right). \tag {4}
$$
A deficiency of this approach is that it may not capture the trade-off between natural and robust errors [49]. To address this issue, robust regularization methods have been proposed, whose objective consists of a regular surrogate loss of error rate on clean data and a robust regularization term that accounts for the adversarial robustness. Different robust regularizations have been proposed [59, 45, 21]. A state-of-the-art approach is TRADES [59], whose objective is formulated by:
$$
\min  _ {\mathbf {w}} \frac {1}{n} \sum_ {i = 1} ^ {n} \left\{\ell \left(h _ {\mathbf {w}} \left(\mathbf {x} _ {i}\right), y _ {i}\right) + \lambda \max  _ {\| \delta_ {i} \| \leq \epsilon} L \left(h _ {\mathbf {w}} \left(\mathbf {x} _ {i}\right), h _ {\mathbf {w}} \left(\mathbf {x} _ {i} + \delta_ {i}\right)\right) \right\}, \tag {5}
$$
where  $\lambda > 0$  is a regularization parameter and  $L(\cdot, \cdot)$  is an appropriate divergence function, e.g., cross-entropy loss between two predicted probabilities [59].
4 Adversarial AP Maximization
First, we discuss two straightforward approaches. The first method (referred to as AdAP_MM in Table 1) is to replace the loss in (4) as an AP surrogate loss yielding the following:
$$
\min  _ {\mathbf {w}} \max  _ {\| \delta \| \leq \epsilon} - \frac {1}{n _ {+}} \sum_ {\mathbf {x} _ {i} \in \mathcal {D} _ {+}} \frac {\sum_ {s = 1} ^ {n} \mathbb {I} \left(y _ {s} = 1\right) \ell \left(\mathbf {w} , \mathbf {x} _ {s} + \delta_ {s} , \mathbf {x} _ {i} + \delta_ {i}\right)}{\sum_ {s = 1} ^ {n} \ell \left(\mathbf {w} , \mathbf {x} _ {s} + \delta_ {s} , \mathbf {x} _ {i} + \delta_ {i}\right)}. \tag {6}
$$
The second method (referred to as AdAP_PZ in Table 1) is to simply replace the first term in (5) with an AP surrogate loss:
$$
\min  _ {\mathbf {w}} P (\mathbf {w}) + \frac {\lambda}{n} \sum_ {i = 1} ^ {n} \max  _ {\| \delta_ {i} \| \leq \epsilon} L \left(h _ {\mathbf {w}} \left(\mathbf {x} _ {i}\right), h _ {\mathbf {w}} \left(\mathbf {x} _ {i} + \delta_ {i}\right)\right). \tag {7}
$$
The limitations of the first method are that it may not capture the trade-off between AP and robustness and the adversarial attacks during the training are inter-dependent, which is not consistent with pointwise attacks generated during the inference phase. While the second method is able to trade off between AP and robustness, the pointwise regularization is not suitable for tackling imbalanced datasets, as an perturbation on a single data point from a minority class does not change the pointwise regularization too much but could degrade the AP significantly.
4.1 Listwise Adversarial Regularization
To address the deficiencies of the above straightforward approaches, we draw inspiration from TRADES and propose a listwise adversarial regularization to replace the pointwise regularization. The key property of the listwise adversarial regularization is that it should capture the divergence between the ranking result of the clean data and that of the perturbed data. To this end, we leverage the top-one probability proposed in the literature of learning to rank [7].
Definition 1 The top one probability of an data  $\mathbf{x}_i$  represents the probability of it being ranked on the top, given the scores of all the examples i.e.,  $p_t(\mathbf{x}_i) = \frac{\exp(h_{\mathbf{w}}(\mathbf{x}_i))}{\sum_{j=1}^n \exp(h_{\mathbf{w}}(\mathbf{x}_j))}$ .
With the definition of top-one probability, we define the listwise adversarial regularization as the divergence between two listwise probabilities, i.e.,  $\{p_t(\mathbf{x}_i)\}_{i=1}^n$  for the clean examples and  $\{p_t(\mathbf{x}_i + \delta_i)\}_{i=1}^n$  for the perturbed examples. Different metrics can be used to measure the divergence between two distributions, e.g., KL divergence between  $\{p_t(\mathbf{x}_i)\}_{i=1}^n$  and  $\{p_t(\mathbf{x}_i + \delta_i)\}_{i=1}^n$ , KL divergence between  $\{p_t(\mathbf{x}_i + \delta_i)\}_{i=1}^n$  and  $\{p_t(\mathbf{x}_i)\}_{i=1}^n$ , and their symmetric version Jensen-Shannon divergence. For illustration purpose, we consider the KL divergence:
$$
R (\mathbf {w}, \delta , \mathcal {D}) = \sum_ {i = 1} ^ {n} p _ {t} \left(\mathbf {x} _ {i}\right) \log p _ {t} \left(\mathbf {x} _ {i}\right) - p _ {t} \left(\mathbf {x} _ {i}\right) \log p _ {t} \left(\mathbf {x} _ {i} + \delta_ {i}\right). \tag {8}
$$
To further understand the above listwise regularization, we conduct a theoretical analysis similar to [59] by decomposing the robust error into two components. The difference from [59] is that we need to use the misranking error. We consider the misranking error as  $\mathcal{R}_{nat} = \mathbb{E}_{\mathbf{x}_i\sim \mathcal{D}_+}\mathbb{I}\{h(\mathbf{x}_i)\leq \max_{\mathbf{x}_j\in \mathcal{D}_-}h(\mathbf{x}_j)\}$ , which measures how likely a positive example is ranked below a negative example [43]. To characterize the robust ranking error under the attack of bounded  $\epsilon$  perturbation, we define  $\mathcal{R}_{rob} = \mathbb{E}_{\mathbf{x}_i\sim \mathcal{D}_+}\mathbb{I}\{\exists \delta_i,\delta_j\in \mathbb{B}(0,\epsilon),h(\mathbf{x}_i + \delta_i)\leq \max_{\mathbf{x}_j\in \mathcal{D}_-}h(\mathbf{x}_j + \delta_j)\}$ . It is worth noting that  $\mathcal{R}_{nat}\leq \mathcal{R}_{rob}$  is always satisfied, and in particular,  $\mathcal{R}_{nat} = \mathcal{R}_{rob}$  if  $\epsilon = 0$ . We show that the  $\mathcal{R}_{rob}$  can be decomposed into  $\mathcal{R}_{nat}$  and  $\mathcal{R}_{bdy}$  in Theorem 1.
Theorem 1  $\mathcal{R}_{rob} = \mathcal{R}_{nat} + \mathcal{R}_{bdy}$ , where the second term is called the boundary error  $\mathcal{R}_{bdy} = \mathbb{E}_{\mathbf{x}_i\sim \mathcal{D}_+}\mathbb{I}\{h(\mathbf{x}_i) > \max_{\mathbf{x}_j\in \mathcal{D}_-}h(\mathbf{x}_j)\} \mathbb{I}\{\exists \delta_i,\delta_j\in \mathbb{B}(0,\epsilon),h(\mathbf{x}_i + \delta_i)\leq \max_{\mathbf{x}_j\in \mathcal{D}_-}h(\mathbf{x}_j + \delta_j)\} .$
Remark: It is clear that the boundary error measures the divergence between two ranked list  $\{h_{\mathbf{w}}(\mathbf{x}_i)\}_{i = 1}^n$  and  $\{h_{\mathbf{w}}(\mathbf{x}_i + \delta_i)\}_{i = 1}^n$ , which provides an explanation of the divergence between the top-one probabilities on the clean data and on the perturbed data.
Since we are optimizing AP, we use an AP surrogate loss as a surrogate of the misranking error  $\mathcal{R}_{nat}$  on the clean data. Finally, it yields in a robust objective  $P(\mathbf{w}) + R(\mathbf{w},\delta ,\mathcal{D})$ . A question remained is how to generate the perturbations. A simple strategy is to use the robust optimization approach that solves a zero-sum game:  $\min_{\mathbf{w}}\max_{\delta \in \Omega^n}P(\mathbf{w}) + R(\mathbf{w},\delta ,\mathcal{D})$  (referred to as AdAP_LZ in Table 1). However, since  $R(\mathbf{w},\delta ,\mathcal{D})$  is a listwise regularization, the resulting perturbations  $\{\delta_i\}_{i = 1}^n$  are interdependent, which is not consistent with the pointwise attacks generated in the inference phase. To address this issue, we decouple the defense and the attack by solving a non-zero-sum game: