Adversarial Deep Metric Learning
Authors: Thomas Kobber Panum
Zi Wang
Pengyu Kan
Earlence Fernandes
Somesh Jha
Venue:  (2021)
Keywords: Deep metric learning
adversarial robustness
adversarial examples
adversarial perturbations
adversarial training

Abstract: Learning a distance metric between pairs of examples is widely important for various tasks. Deep Metric Learning (DML) utilizes deep neural network architectures to learn semantic feature embeddings where the distance between similar examples is close and dissimilar examples are far. While the underlying neural networks produce good accuracy on naturally occurring samples, they are vulnerable to adversarially-perturbed samples that can reduce their accuracy. To create robust versions of DML models, we introduce a robust training approach. A key challenge is that metric losses are not independent --- they depend on all samples in a mini-batch.  This sensitivity to samples, if not accounted for, can lead to incorrect robust training.  To the best of our knowledge, we are the first to systematically analyze this dependence effect and propose a principled approach for robust training of deep metric learning networks that accounts for the nuances of metric losses. Using experiments on three popular datasets in metric learning, we demonstrate the DML models trained using our techniques display robustness against strong iterative attacks while their performance on unperturbed (natural) samples remains largely unaffected. 

Under review as a conference paper at ICLR 2021
ADVERSARIAL DEEP METRIC LEARNING
Anonymous authors Paper under double-blind review
ABSTRACT
Learning a distance metric between pairs of examples is widely important for various tasks. Deep Metric Learning (DML) utilizes deep neural network archi- tectures to learn semantic feature embeddings where the distance between similar examples is close and dissimilar examples are far. While the underlying neural networks produce good accuracy on naturally occurring samples, they are vulner- able to adversarially -eertrrrlll--ettubeedd samples that can reduce their accuracy. To create robust versions of DML models, we introduce robust training approach. A key challenge that metric losses are not independent - they depend on all sam- ples in mini-batch. This sensitivity to samples, if not accounted for, can lead to incorrect robust training. To the best of our knowledge, we are the first to sys- tematically analyze this dependence effect and propose a principled approach for robust training of deep metric learning networks that accounts for the nuances metric losses. Using experiments three popular datasets in metric learning, we demonstrate the DML models trained using our techniques display robustness against strong iterative attacks while their performance on unperturbed (natural) samples remains largely unaffected.
INTRODUCTION
Many machine learning (ML) tasks rely on ranking entities based on the similarities of data points in the same class. Deep Metric Learning (DML) is useful technique for such tasks, particularly for applications involving test-time inference of classes that are not present during training (e.g., zero-shot learning). Example applications of DML include person re-identification (Hermans et al., 2017) face verification (Schroff et al. 2015 Deng et al. 2019), phishing detection (Abdelnabi et al, 2020). and image retrieval ( (Wu et al., 2017 Roth et al. 2019 At its core, DML relies on state-of- the-art deep learning techniques that can produce diver-dimensional semantic feature embeddings of nigh-dimensional inputs. Points in this embedding space cluster similar inputs together while dissimilar inputs are far apart.
Unfortunately. the underlying deep learning models are vulnerable to adversarial examples (Szegedy) et al. 2014| Biggio et al. (013) inconspicuous input changes that can cause the model to output attacker-desired values. Thus, DML. models themselves vulnerable adversarial examples. Given their wide usage in diverse ML tasks, including security-oriented ones, it is important to train robust DML models that withstand attacks. This paper tackles the open problem of training DML models using robust optimization techniques (Ben-Tal et al. 2009 Madry et al., 2018).
A key challenge in robust training of DML models concerns the so-called metric losses (Wu al. 2017 Wang et al., 2019 Chechik et al. 2010, Schroff et al. 2015). Unlike loss functions used in typical deep learning settings, DML loss for single data point depends on the other data points in the mini-batch. A sampling process selects points for a mini-batch, and thus, the DML losses are sensitive to this process as well. For example, the widely-used triplet loss requires three input points: an anchor, positive sample similar to the anchor, and negative sample dissimilar to the anchor. To compute this loss, for a batch of size B, this would require O(B"), making the training process inefficient. Thus, sampling process ensures that mini-batch contains enough positive and negative examples for the training to be useful while keeping the batch small enough to be efficient.
This dependence of the DML loss the contents of the mini-batch poses challenge to adversarial training: (1) it is unclear what points should be adversarially perturbed; and (2) it is unknown whether the perturbations would cause training instability. Training DML. model is sensitive to

---

Under review as a conference paper at ICLR 2021
the sampling process, and selecting samples that are too "hard" or "negative" can lead to training collapse (Wu et al. (017).
We systematically approach the above challenges and contribute robust training objective formu- lation for DML models by considering the widely-used triplet loss. Our key insight is that during an inference-time attack, adversaries seek perturb data points such that the intra-class distance maximize, and thus this behavior needs to be accounted for during training to improve robustness. Recent work has attempted to train robust DML models, but they do not consider the issue of loss dependence and sensitivity to sampling (Abdelnabi el al. 2020). This leads to non-robust DML models (Panum al., 2020).
Contributions.
We contribute principled robust training framework for Deep Metric Learning models by considering the dependence of triplet loss on the other data points in the mini-batch and the sensitivity sampling.
We experiment with three commonly-used datasets for vision-based deep metric learning (CUB200-2011, CARSI96, SOP) and show that naturally-traines models do not have any robustness their accuracy drops close zero when subjected to PGD attacks that we formulate.
Using our robust formulation, achieve good robustness. For example, for PGD at- tacker with five iterations and ||ō]| < 0.01, we obtain an adversarial accuracy of 48.7 compared to the state-of-the-an natural accuracy baseline of 71.8 for the SOP dataset (in terms of @ score, a common metric in DML to assess the accuracy of models). Further- more, the resulting robust model accuracies are largely unaffected for natural (unperturbed) samples.
RELATED WORK
Deep Metric Learning. Deep Metric Learning (DML) is a popular technique to obtain seman- tic feature embeddings with the property that similar inputs are geometrically close each other in the embedding space while dissimilar inputs are far apart (Roth et al.] 2020). DML employs variety of metric losses such contrastive (Hadsell et al. (006), triplet (Schroff et al.) 2015), lifted-structure (Hermans et al. 2017), and angular loss (Wang et al. 2017). Recent surveys (Roth al. 2020 Musgrave et al. 2020) highlight that performance of newer metric losses are lesser than previously reported. Thus, we choose to focus on the two established metric losses, contrastive and triplet loss, as they are widely used and have good performance.
Adversarial Robustness. Since early work in the MI community discovered adversarial exam- ples in deep learning models (Szegedy et al. 2014; Biggio al. (013), a big focus has been to train adversarially-robur models. We focus on robust optimization-
training that utilizes saddle-point formulation (min-max) (Ben-Tal et al. 2009; Madry et al. 2018 To the best of our knowledge, no prior work has considered training DML models using robust-optimization tech- niques. Recent work, however, has used metric losses to improve adversarial training for standard deep network architectures (e.g., CNNs) (Mao et al.) 2019 Li et al. 2019). These techniques use metric losses (e.g., triplet) instead of traditional ones (e.g. cross-entropy). By contrast, our goal is to create robust training objective for DML models themselves. This requires considering the dependence of metric losses on mini-batch items and the sampling process that derives those items. We propose principled framework for robustly training DML models that considers these factors.
Duan et al. (2018) propose a framework that uses generative models (e.g., GANs (Goodfellow et al, 2014h) during training to generate hard negative samples from easy negatives. We observe that this work concerned with better natural training of DML models rather than adversarial training, which is the focus of this work.
2

---

Under review as a conference paper at ICLR 2021
3 TOWARDS ROBUST DEEP METRIC MODELS
First, we describe some basic machine learning (ML) notation and concepts required in this paper. We assume data distribution D over X' V/ where X' is the sample space and 3 {y1 , Vy is the finite space of labels. Let Dx be the marginal distribution over A' induced by D Given Y S y define Dy be the measure of the subsets of X x Y induced by D. For y E D. Dy and --y denote the measures of the sets (1)) and Dyr(x)- respectively.
In the empirical risk minimization (ERM) framework wish to solve the following optimization problem:
min EX (ww,x.)
WEH
In the equation given above is the hypothesis space and is the loss function. We will denote vectors in boldface (e.g. x, y). Since the distribution is usually unknown, learner solves the following problem over a data set = {(x1, v1), (Xx, {n)] sampled from the distribution D.
min 1 wEH
Σ
[w, x;, Vi)
(2
Once we have solved the optimization problem given above, we obtain w² E H which yields classifier F: X - y (the classifier is usually parameterized by w", but we will omit it for brevity).
3.1 DEEP METRIC MODELS
A deep metric model fe is function from to Sd where 0 E is a parameter and Sd is an unit sphere in Rd (i.e x St iff |||||
1). Since deep metric models embed space X' (which can itself be a metric space) in another metric space, we also sometimes refer to them deep embedding. Deep metric models use very different loss functions than typical classification networks described previously, Next we discuss two kinds of loss functions contrastive and triplet. Let = {xx1, y1),... (Xn, yn)] } be a dataset drawn from D. A contrastive loss function 4, is defined over pair (x, y). (x1.81) of labeled samples from X x y and is defined as:
(0, (x, v), (x1, 21)) 1 y= do x1) 1 utt1 (a x1)]
In the equation given above, LE is an indicator function for event (1 if event E true and otherwise), and dx, x1) is Ee= (fo(x); - (x(x));) the &a distance in the embedding space. A triplet loss function le is defined over three (x, v). (x1, v1) and (x2, labeled samples and is defined as follows:
46, (x, y). (1), (X2, = 1y= Luzeo (do(x.x1) do(x,x)) + +a++
(4)
In the equation given above [x]+ +. max(xr, 0).
3.2 ATTACKS ON DEEP METRIC MODELS
Assume that we have learned deep embedding network with parameter O E θ using one of the loss functions described above. Next we describe how the network is used. Let A = {(a1, (am, {m) be a reference or test dataset (e.g. a set of faces along with their label). is distinct from the dataset used during training time. Suppose we have a sample and let k(A, z) be the index that corresponds to arg min m) do do(a,. z We predict the label of z as 1b(A,z) z) (2) (we will use the functions k(..-) and Ib(.,.) throughout this section).
Next we describe test-time attacks on a deep embedding with parameter Let Ay C A be the subset of the reference dataset with label y y (i.e. Ag is equal to {(a),)) (ay. y) E A}). Let z E X. Untargeted altack on z can be described as follows (we want the perturbed point to have a different label than before):
minsex μu() such that lb( A, 2) 26(A,z+0)
(S)
1 'The measure set X' under distribution Dx is the measure of the set 7 x y in distribution D. In case one more anchors share the minimal distance to the tie is broke by random selection among these anchors.
3

---

Under review as a conference paper at ICLR 2021
Targeted attack (with target label t * 1b(A,z) can be described follows (we desire to the predicted label of the perturbed point to be a specific label):
minsex pu()) such that lb(A, + 6) =t
(6)
In the formulations given above we assume that X' is a metric space with μ a metric on X' (c.g. X' could R" with usual norms, such foc, f1, Ep (for 2)). Any algorithm that solves the optimization problem described above leads to a specific attack on deep metric models.
3.3 ROBUST DEEP METRIC MODELS
Let S ((x1,81)..... (Xx, }n)} be dataset drawn from distribution D. For a sample (x, yi) where 1 S S n we define following surrogate loss function i(0, (1r. S) for the contrastive loss function le:
1 " (0, (x; Ui), (z))
1(0 (I:; 3)),
n 1=1
Similarly, for the triplet loss function 1, define the following surrogate loss function:
I(0, (:), Bl. TAys
ΣΣ 400, (xi, (x), (x&, uk))
Let S,, and Sy be defined the following sets: {(x, y) (x, y) E S} and ((x, v') and y' # y). In the equation given above the sizes of the sets Sy and S-y are denoted by my and ny
(x, 3/)
Having defined the surrogate loss function the learner's problem can be defined as:
min Σ i(0, U.), PEe
(9)
i=1
Recall that the learner's 's problem for the usual classification case is:
min
Σ lww x,, 34)
(10)
WEH 7
Note that in the classification case the loss function I(w,x, X4, Wr) of a sample (x,, y:) does not depend on the other samples in the dataset S. However, in the deep metric model case the surrogate loss
function i(0, (x,, 9i), S) for a sample (x., yi) depends on the rest of the data set S. This is the main difference between the embedding and classification scenarios.
Formulation 1. Let B, e) denote the e-ball around the sample x using the ly-norm. The straight- forward robust formulation is given in the equation below.
1
Σ i(0, (Z).
min PEB (2
max
(11)
.,) n
In the formulation given above, all samples are adversarially perturbed at the same time (note that the is outside the summation). Therefore, this formulation is not convenient for current training algorithms, such as SGD and ADAM. This because the entire dataset has to be perturbed at the same time. Moreover, this formulation is not conducive various sampling strategies used in training of deep metric models.
Formulation 2. In this formulation we push the max inside the summation sign of the optimization formulation.
min- PEO n
max ZE (x.ee
i(0, (z, (4)
(12)
In the formulation given above, the sample x; is adversarially perturbed while other samples in the dataset. are kept intact while computing the surrogate loss function i. This formulation is more
4

---

Under review as a conference paper at ICLR 2021
conducive to current training techniques, such as SGD and ADAM. Moreover, this formulation is also conducive to various strategies for sampling pairs and triplets used in deep metric models.
Formulation 3. Our third formulation adds regularizer which enforees the following informal constraint: x changes bit, the distance in the embedding space does not change too much.
min Σ 1(0,, (z. (.) + DE T2
max dg(z,x.) (x.,(
(13)
These robust optimization formulations follow the common notion robustness from robust opti- mization (Ben-Tal et al. 2009), thus given an algorithm for solving one of the robust optimization formulations, leads to a robust model.
3.4 ATTACK ALGORITHM
Performing test-time attacks requires an algorithm to solve the optimization objective described in Equation 5 To evaluate the adversarial robustness of DMI. models, we propose the attack algo- rithm seen Algorithm [ The intuition of the algorithm is that adversaries seek to push a data point (under attack) x; further away from close data point xj of the same label in the embedding space, thus consequently closer to an embedding embedding space is normalized to the unit sphere. To select close data point, the algorithm firstly examines the label of nearest neighboring data point in the embedding space k:( ((4(), xxx) for the re- spective set of anchors ( If the retrieved label is different from the label of the data point under going attack y/s then no perturbation performed as the data point is already misclassified under nearest neighbor inference, commonly used within DML. If they share classes, then data point x; is adversarial perturbed by approximating a solution to arg max Bg. do 2)) using established attacks methods, such as Fast Gradient Sign Method (FGSM) (Goodfellow et al. 2015), Carlini- Wagner (C&W) (Carlini & Wagner 2017), Projected Gradient Decent (PGD) (Madry et al. 2018 The algorithm, and the mentioned attack methods, are applicable to commonly used norms in robust optimization.
data point of a different label. Recall that the
Algorithm Evaluation of adversarial robustness for a model parameterized by 0 and dataset S {(x1, 11), :.. (Xms }m)} under some for respective l-- nonor.
for = 1... m do
(0) + S) {(11, v:) // Define the of anchors used for inference
j ((A(()) .x.) // Find the index of the nearest neighbor data point (using do(;:))
if' y Vý then
// Nearest neighbor has the same class as Xx, thereby perform adversarial perturbation
x + arg max do (2, Xj) Approximate using established attack methods
else
x +- // No perturbation for incorrect predictions
end if
eval(0, x yc. A0) Optional step: Perform evaluations
end for
Following the adversarial perturbation, eval x', Vi, A() is explicit evaluation step, that throughout experiments, however it is optional for the actual attack. For more details on evaluations performed throughout the experiments, see Section 4
3.5 ADVERSARIAL TRAINING
To improve robustness of DML models, we propose a training objective that align with the covered robust formulations and can be viewed as adversarial training (Madry et al. 2018) for DML models. Given a set of possible perturbations A, {ō || < c), parameterized by and an normorm, let p((x; y:). (x,+ Vj), (Xe, yk)) be a function that outputs an adversarial perturbation for the data point x;, with respect to the two dependent datapoints x, and be defined as:
p (x,, v.), (xy, Vo (x&, 3k)) arg max = de (x, + 8, x,))) Iu do(x; + 6, xx) BEA,
(14)
5

---

Under review as a conference paper at ICLR 2021
Given triplet (x, Ut), (x,, Viy (Xx. M/s) where y4 yj and Ye # yk. this formulation is inversion of the training objective enforced by metric losses (maximize inter-class distances, minimize intra- class distances (Boudiaf et al. 2020)) for given norm. Effectively, when x; and x, share classes (y: Vj), the distance in the embedding space between these two points maximized, while Yi o yk- the distance in the embedding space between x; and X5 is minimized. The constrained optimization problem defined by p(-..-)) can be solved using commonly approximation techniques for uncovering adversarial perturbations, such FGSM (Goodfellow al. 2015), C&W (Carlini & Wagner 2017). PGD (Madry et al. 2018). To simplify notation in following equations, we adopt the notation of P()j.)) for p((x, yr), x Mj), (Xx. }k)), J, addition to P(r.) = P(ijd))
The robust training objective for the contrastive loss function be given by:
arg min 1(0, (1), (x2 + 7P((,,)) 7)(()1),))))
(15)
9EB
Here, E ] is discrete random variable for which P(7 1) E [0; 1] is hyper- hyper-parameter that specifies the attack rate during training. For tuple-based losses perturbations are not performed negative pairs, such that P(y 1 y/1 # 12) O. To reduce notation clutter, we the notation P(r = 1) interchangeably across losses, however, for tuple-based losses refers to P(7 1 y1 y2)- Similarly, let the robust training objective for triplet-based metric losses be given by:
mrgmin lee
min 1(0, (x1,8)), + 7P(221)) (Xa, (x3,
(16)
These robust training objectives align the usual objective of adversarial training for deep neural networks, i.c replace a sample by their "worst case" variant before normal training. For the sake of concreteness, apply the objective the foo norm, but the method is applicable other norms commonly used for adversarial training.
4 EXPERIMENTS
Our experiments explore the following research questions.
Q1. How robust naturally trained DML models towards established adversarial example attacks?
Among commonly used datasets for visual similarity, we find that DML models, trained with established haper-parameters, are vulnerable to adversarial examples, similar to non-DML models (Table [). This forms our baseline for robustness.
Q2. What is the accuracy of DML models when they are trained using our robust formulation?
We find that DML models can be trained become more robust towards a given threat model. For example, for PGD atlacker with 5 iterations and || < 0.01, we obtain an udversarial uccuracy of 48.7 compared to the state-of-the-art natural accuracy baseline of 71.8 for the SOP dataset (Table 2
4.1 EXPERIMENTAL SETUP
Each experiment use parameter choices Roth al. (2020), unless otherwise specified, and perform evaluations the commonly used datasets within DML. These choices are reflecting of state-of- the-art performance for naturally-trainet DML networks.
summarize some these choices below, and emphasize deviations. For further details parameter choices, refer the reader to Appendix A or the original work of Roth et al. (2020).
Experiments
executed on NVIDIA Tesla V100 GPU (32GB RAM). Code for the experi- ments is available at: (anonymized repository) https: /ttpt//ttttbbtt///// com/ starving-panda. adversare rasiaarral -metri c- g-learning

---

Under review as a conference paper at ICLR 2021
Model & Optimizer. Each experiment use ResNet50 model (He et al. 2016) initialized with pre-trained ImageNet weights and frozen batch-norm layers. The last output layer is replaced with a fully-connected untrained embedding layer of size 128. ResNets are commonly used and preferable in DMI. due to their reduced amount of parameters (Musgrave et al. having comparable performance other more complex deep neural network (DNN) architectures. For training, the ADAM (Kingma & Ba, 2015) optimizer with a learning rate of 10-6, weight decay of 4 10
2020; Roth et al. 2020), while
used. For contrastive loss a 1.0, while a 0.2 for triplet loss.
Datasets. We use datasets common for metric learning: (1) CUB200-2011 (Welinder et al. 2010) containing 11788 images of birds across 200 species; (2) CARS 196 (Krause et 20.33 containing 16185 images of cars across 196 different models; (3) SOP (Song et al. 2016) containing 120053 images of 22634 different online products. Each dataset is divided into training and testing set of approximately the same size, by respective selecting the first half of classes for the training set, while having the remaining classes be the testing set. This split reflect zero-shot learning scenarios, which is a common application of DML. Similar to Roth et al. (2020), we train CUB200-201 and CARS196 for 150 epochs and SOP for 100 epochs due to its volume.
Adversarial Perturbations. The proposed attack algorithm, Algorithm 1 and " depends on solving an arg max expression. To solve this formulation, we use PGD (Madry et al. 2018). which is established attack method for creating adversarial perturbations. Attacks are run for five iterations, this was chosen to keep the efficient (in terms of runtime), as training is DML models is considered an expensive procedure (Roth al., (220)), and because the performance of the attack is known to saturate with high iterations counts (Wong et al. 2020)). Step sizes are fixed to 2(5 ), where e specifies the domain of valid perturbations under Zoo. thus any perturbation satisfy || llo I E. This step size was chosen to keep the step size small, while ensuring the any point within the e-ball reachable, regardless of initialization (Wong et al., (020). Alternative attack methods, and their effectiveness towards naturally trained DML models, can be seen in Appendix D
Evaluation Metrics. We two DML-specific evaluation metrics proposed by Musgrave et al. (020), namely: Recall at one (R 1) and Mean Average Precision at R (mAP@R). R@ 1 is the accuracy of using the embeddings that the model produces for inferring the output class label using the class of the nearest neighbor anchor. Given a test set S = (x1181)). (X., vn) R@ is given by:
n R@1
Prec(i, 1). where Pree(i, 1
Σ ww jEI(K)
(17)
12
k
I(k) arg min
Σ do (x;,
(18)
K K
JEK
mAP@R (Musgrave et al. 2020) measures given model's ability to rank among classes in the embedding space; we adopted this metric for the reasons covered by Musgrave et al.) (2020). defined as:
n(
mAP@R
Prec(i, k), where R(i) =
Σ
1
(19)
R(1)
(x igfs
4.2 EXPERIMENTAL RESULTS
First we seek establish a baseline of robustness against adversarial perturbations for naturally- trained DML models. We obtain this baseline by applying Algorithm for three common values
This learning rate differ from the one stated by Roth et al. 2020) in their publication, 10-5 but reflects the actual learning rate used throughout their experiments. See the field "r"" within experiment configuration: https://ht..ly344F//.

---

Under review as a conference paper at ICLR 2021
CUB200-2011
CARSI96
SOP
(e=
R@1
mAP@R
R@1
mAP@R
R@D
mAP@R
Triplet Contrastive
Unperturbed
59.1 + 0.0
21.0 1 0.0
74.0 1 0.0
20.9 1 0.0
71.8 4: 0.0
44.7 1.0
0.01
2.1 + 0.1
2.0
0.0
1.5
1.3 0.0
1.7
0.05
0,1 = 0,0
2.0
0.2
1.4
0.0
1.1
0.10
0.0
2.0
0.2
1.4
0.0
1.1
Unperturbed
59.3 0.0
2.07
7.00
21.4
69.6
42.1 +.0
0.01
2.5 0.1
3.0
0.0
1.6
0.5
1.4
0.05
0.0 - 0.0
2.5
0.1 0.0
1.5
0.0
1.2
0.10
0.0 0.0
2.0
0.1 0.0
1.0
0.0
1.2
Performance of naturally-trained DML models against adversarial perturbations gener- ated using Algorithm D with PGD across various for f.o. Results average of five random seeds. Recall that, R@ @ reflects a model's inference accuracy, while mAP@R R reflects its ability rank similar entities. Naturally-trained DML models perturbations.
Table 1:
robust to the generated adversarial
Loss
(x = 0.01)
CUB200-2011
CARSI96
SOP
R@1
mAP@R
R@1
mAP@R
R@1
mAP@R
Natural
2.1
2.6
+
1.5 0.0
+
C
Robust
18.7 +: 0.3
7.5 +: 0.0
41.4 + 0.0
11.5 + 0.0
48.7 + 0.0
28.3 + 0.0
Natural
2.5 +
3.0 0.0
0.3 +
+
+ 0.0
1.4
T
Robust
23.0 +: 0.2
8.6 + 0.0
40.7 + 0.0
11.9 - 0.0
38.0 + 0.1
21.1 + 0.0
Table 2: Performance of DML models trained using the proposed adversarial training objective (using PGD) compared to naturally-trained DML for adversarial perturbations within (x 0.01). Losses are denoted by C (contrastive) and T (triplet). The robustly trained model attain both higher inference accuracy (R @ and improved ability to rank similar entities (mAP R) than the naturally- trained baseline model. Thereby, the proposed robust training objective improves the robustness towards adversarial perturbations.
of (0.01, 0.1) used for computer vision" under the Eo norm, such that perturbation satisfy || I c. PGD with five iterations is used to approximate solution to the arg max. Five iterations was chosen as (1) it saturates the maximum attack effect because R@ 1 0, and (2) in this situation, adding more iterations leads to stagnation (Wong et al. 2020). Table ! summarizes findings, for which reported performance an averaged over five distinct random seeds for the attacks algorithm.
We observe that naturally-traine -rrined DML models achieve very low robustness to our proposed attack, experiencing drop in both R @ (inference) and mAP@R (ability to rank) by several orders of magnitude. Thus, to answer QI we conclude that DML models are not inherently robust to estab- lished attacks, suggesting that prior studies which report higher robustness of naturally-traines DML models a potential sign of ineffecctive attacks instead (Abdelnabi et al., (020))
Next, examine the effectiveness of our robust training objective (Section 3.5 for creating bust DML models. We set a threat model (e = 0.01) and optimize a min-max objective while re-using hyper-parameter choices from non-robust training for five attack rates P(y 1) (0.1, 0.25, 0.5, 0.75, 1.0). For the inner-maximization we use PGD with similar configuration to the attack setting. Table summarizes the results for the best performing robust model, for which the performance is reported as an average of five attacks with distinct random seeds. Performance of the trained robust models on natural (unperturbed) input largely remains unaffected, for more details on this, we refer the reader to Appendix C
We observe that our robust formulation does improve model robustness against the specified PGD- based attack across any combination of loss and dataset. Consistently, for all of the considered
8

---

Under review as a conference paper at ICLR 2021
attack rates, the robustness increased, more details this matter can be found in Appendix An example of inference across training objectives can be seen in Figure | For more examples we refer the reader to the online gallery We also observed that the gained robustness towards the PGD- based also transfer to other established attack methods, such as C& W and FGSM, see Appendix B for related results. More details the effects of the robust training objective space, is provided by a small experiment using high--dimensionl synthetic data set in Appendix highlighting the embeddings of robust model remain more stationary when input is adversarially perturbed.
the embedding
Natural
Robust
nb(x)
nn(x')
nn(x)
nn(x')
Figure 1: Example of inference of naturally-trained DML model and robustly trained variant on the CUB200-2011 dataset. Each model infer the class the natural data point x, and its perturbed x' counterpart, using the class of the nearest anchor na((). Green and red borders indicate correct- (same class) and incorrect inference, respectively. Both models infer the natural input correctly, however, the naturally-trained DML fails to infer the adversarial perturbed input correctly.
DISCUSSION
The proposed robust training objective relies on perturbing positive data points within tuples and triplets, for reasons addressed in Section 3.4 Experimentation of alternative perturbation targets, in Appendix|B [F] demonstrate that the choice of perturbation target (positive) out perform alternatives (anchor, positive) in five out of six cases. For one particular case (contrastive loss on CUB200-201 I), perturbing the anchor data points achieves better performance (R@ 20.9) than the proposed method (R@1 = 18.4). We speculate that the inability of other perturbation targets are associated with known instabilities of metric losses (Wu al., 2017). Namely, that large distances between anchors and negatives cause gradient updates during training to be noisy across batches. Stability is typically achieved by applying a sampling process that account for this phenomenon, and thus select certain distribution of tuples or triplets. The proposed robust training objective induce noise (high loss) post-sampling, potentially causing instabilities during training. We hypothesis that this fact could be related to the observed drop in performance for certain training scenarios with high attack rates, P(y = 1) = 1, as seen in Appendix Despite the proposed robust training objective already demonstrating promising results, we encourage future research to explore the inherent dilemma between robust optimization and instabilities in DML further.
CONCLUSION
Deep Metric Learning (DML) creates feature embedding spaces where similar input points are ge- ometrically close to each other, while dissimilar points are far apart. However, the underlying DNNs are vulnerable adversarial inputs. thus making the DML models themselves vulnerable. We demonstrate that ceturally-trainee DML models are vulnerable to strong attackers, similar to other types of deep learning models. To create robust DML models, we contribute a robust training objective that can account for the dependence of metric losses the phenomenon that the loss at any point depends on the other items in the mini-batch and the sampling process that was used to derive the mini-batch. Our robust training formulation yields robust DML models that can withstand powerful PGD attackers without severely degrading their performance on natural inputs.
aanonymized http://ttttt////t/gigtttaaaa git. i sampl e- gal 1ery/

---

Under review as a conference paper at ICLR 2021
REFERENCES
Sahar Abdelnabi, Katharina Krombholz, and Mario Fritz. VisualPhishNet: Zero-Day Phishing Web- site Detection by Visual Similarity. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, CCS 2020, November 9-13, 2020. ACM, 2020.
A. Bal, L. El Ghaoui, and A.S. Nemirovski. Robust Optimization. Princeton Series in Applied Mathematics. Princeton University Press, October 2009.
Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Šmdić, Pavel Laskov, Gior- gio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. Lecture Notes in Computer Science, pp. 387 2013. ISSN 161 1-3499. doi: 10.
URL http: wttp::/oo......111....100
642 40994-333 1-044-3_25 2_2
Malik Boudiaf, Jérôme Rony, Imtiaz Masud Ziko, Eric Granger, Marco Pedersoli, Pablo Piantanida, and Ismail Ben Ayed. A unifying mutual information view of metric learning: cross-entropy vs. pairwise losses. In European Conference on Computer Vision, pp. 548-564, Springer, 2020.
N. Carlini and D. Wagner. Towards evaluating the robustness of neural networks. 2017 IEEE Symposium Security and Privacy (SP), pp. 39-57, 2017.
Gal Chechik, Varun Sharma, Uri Shalit, and Samy Bengio. Large scale online learning of image similarity through ranking. Mach. Learn. Res., 11:1109-1135, March 2010. ISSN 1532-4435.
Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou. Areface: Additive angular margin loss for deep face recognition. 2019 IEEE/CVF Conference Computer Vision and Patlern Recognition (CVPR), Jun 2019, doi: 00.11099cxp:.2011.004539 URL BRL/http:///e wtt/xxxdoi.o. .rr/
10. 1119/CVPR. 2019 00482
Y. Duan, W. Zheng, X. Lin, J. Lu, and J. Zhou. Deep Adversarial Metric Learning. In 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 2780-2789, 2018.
Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In Z. Ghahramani, M. Welling, C. Cortes, N. D. Lawrence, and K. Q. Weinberger (eds.), Advances in Neural Information Pro-
cessing Systems 27, pp. 2672-262260 Curran Associates, Inc., 2014. URL http://papers. 542 http::cc..pprrrr/222e.aaaaaaaaaa www.-vvvvvveaaarraaaaaaaaaaaaaaa
Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial
examples. In International Conference on Learning Representations, 2015. URL http://
arxiv. wwt.:oogg/abbs///// 6572
Raia Hadsell, Sumit Chopra, and Yann LeCun. Dimensionality reduction by learning an invariant mapping. In Proceedings of the 2006 IEEE Computer Society Conference Computer Vision and Pattern Recognition Volume 2, CVPR '06. IEEE Computer Society, 2006. doi: 10.1
CVPR.2006.100 URL httph: org/ 0 1...110000 1109/11PPPP 20066100000
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep Residual Learning for Image Recognition. 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Jun 2016.
Alexander Hermans, Lucas Beyer, and Bastian Leibe. In defense of the triplet loss for person identification. ArXiv, abs/ abs/1703.07737, 2017.
Diederick P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In International Conference Learning Representations (ICLR), 2015.
Jonathan Krause, Michael Stark, Jia Deng, and Li Fei-Fei. 3d object representations for Ane-grained categorization. In 4th International IEEE Workshop on 3D Representation and Recognition (3dRR-13) 13), Sydney, Australia, 2013.
10

---

Under review as a conference paper at ICLR 2021
Pengcheng Li, Jinfeng Yi, Bowen Zhou, and Lijun Zhang. Improving the robustness of deep neural networks via adversarial training with triplet loss. In Proceedings of the Twenty-Eightt Interna- tional Joint Conference on Artificial Intelligence, IJCAI-19, pp. 2909-29999999 2915. International Joint Conferences on Artificial Intelligence Organization, 7 2019. doi: 10.24963/ijcai 20149/9 URL
htt.ps://dob .rr./ooggggio www.oorooo..... 242234 2019:220114440
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant to adversarial attacks, In International Conference on Learn- ing Representations, 2018.
net.
Chengzhi Mao, Ziyuan Zhong, Junfeng Yang, Carl Vondrick, and Baishakhi Ray. Metric learning for adversarial robustness, 2019.
Kevin Musgrave, Serge Belongie, and Ser-Nam Lim. A metric learning reality check, 2020.
T. K. Panum, K. D. Hageman, R. R. Hansen, and J. M. Pedersen. Towards Adversarial Phishing Detection, 2020.
Karsten Roth, Biagio Brattoli, and Bjorn Ommer. Mic: Mining interclass characteristics for im- proved metric learning. 2019 IEEE/CVF International Conference on Computer Vision (ICCV), Oct 2019. doi: 10.1109fice.201990000 09.099................ URL http:/ /xx o1t..dlo..000..11/////......
2019.. 00809
Karsten Roth, Timo Milbich, Samarth Sinha, Prateek Gupta, Bjöm Ommer, and Joseph Paul Cohen. Revisiting Training Strategies and Generalization Performance in Deep Metric Learning, 2020.
Florian Schroff, Dmitry Kalenichenko, and James Philbin. Facenet: A unified embedding for face recognition and clustering. 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Jun 2015.
Hyun Oh Song, Yu Xiang, Stefanie Jegelka, and Silvio Savarese. Deep metric learning via lifted structured feature embedding. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2016.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfel- low, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2014. URL
1312.6199
Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Du- mitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going Deeper with Convolutions. In Computer Vision and Pattern Recognition (CVPR), 2015.
J. Wang, F. Zhou, S. Wen, X. Liu, and Y. Lin. Deep metric learning with angular loss. In 2017 IEEE International Conference on Computer Vision (ICCV), pp. 2612-2620, 2017.
Xun Wang, Xintong Han, Weilin Huang, Dengke Dong, and Matthew R. Scott. Multi-similarity loss with general pair weighting for deep metric learning. 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Jun 2019. doi: 10.11099cvp:.2199.00511 URL htthttp 7/dx. doi. www.org//// 10. 1109/ CVRR. wtw.w.p.......... 2019.0051661
Welinder, S. Branson, Mita, C. Wah, Schroff, Belongie, and P. Perona. Caltech-UCSD Birds 200. Technical Report
California Institute of Technology, 2010.
Eric Wong, Leslie Rice, and J. Zico Kolter. Fast is better than free: Revisiting adversarial training. In 8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020, 2020.
http:ttpps.//ppeeeviee...... net forrm id 40x040
Chao-Yins Wu, R. Manmatha, Alexander J. Smola, and Philipp Krahenbuhl. Sampling matters in deep embedding learning. 2017 IEEE International Conference on Computer Vision (ICCV), Oct 2017. doi: 10.1 10.1109/cv..2017..300 URL attp:://ds doi wegiiioogg/ae 309
2017.
Kai Xiao, Logan Engstrom, Andrew Ilyas, and Aleksander Madry. Noise or signal: The role of image backgrounds in object recognition, 2020.

---

Under review as a conference paper at ICLR 2021
A TRAINING PARAMETERS (EXPANDED)
This section expands upon details and hyper-parametes used throughout the training of the respec- tive DML models.
Batches & Sampling. The training process use a mini-batch size of 112 data points. Each mini- batch is sampled such that it contains a fixed amount of classes per class (Roth et al. 2020). for which this fixed amount is specified two samples per classes. Following this, sets of tuples and triplets (depending on loss used for training) are derived from the mini-batch. The triplet-set's size the same as the mini-batch, for which each data point is used as an anchor. The tuple-set's size is double that of the mini-batch, thus balancing out the number of data points being compared relative to the triplet-set. Furthermore, each data point within the tuple-set is used in a positive and negative pair. DML. models are prone collapse during training, phenomenon caused by too many distant negative samples in the tuple- or triplet-sets, causing the model to map any data point to the same point in the embedding space. As measure to reduce the probability of facing this phenomenon, distance-weighted sampling is used for sampling negatives (Wu et al. 2017).
Data Augmentation. We augment the dataset using the following operations for each input image: (1) random cropping an image patch of size 60-100% of the original image area; (2) scaling; (3) normalization of pixel intensities. One difference is that our patch sizes differ from Roth et al. 2020) that employs patches of size 8-100% of original area. We change this parameter because recent work suggests that computer vision models can be biased by backgrounds and textures during during (Xiao et al., 2020). To combat this, we use cropping and scaling values based on SSzeedyy et al. 2015).
B
EXPERIMENT: UNIVERSALITY OF ROBUSTNESS
The robust DML models trained using the proposed adversarial training algorithm (covered in Sec- tion 3.5) approximate the solution to the arg max in (( U:), (x;, Vj), (Xt, V:)) (defined in Equa- tion 14 using PGD (Madry et al. 2018). and have demonstrated improved robustness towards at- tacks using PGD (see Table 2 However, as a measure to test if the increased robustness also apply to attacks relying on other attack methods, such as FGSM and C&W: we conduct robustness evaluation using Algorithm with these two attack methods for & (e 0.01). For FGSM, a = e, to maximize the perturbation, and thereby attack strength, under the given norm. Despite implementation created
C&W being originally designed for the la norm, we sought out to adopt by the author / for the to norm. However, it must be noted that the author now discourage the use of the attack method in favor of PGD for &x | For C&W, we had to limit the attack 50 iterations as a measure to combat extreme runtime, that were infeasible to run on our available resources. Thus the applied attack might not be able capture the full potential of the attack method. Results of these experiments can be seen in Table and for the adversarial training, the improved robustness is also useful for perturbations of other attack methods.
and Table 4 It can be seen that, despite having used PGD
C EXPERIMENT DETAILS: ATTACK RATES
This section expands upon the training process of the proposed robust formulation, particularly the impact of attack rate P(> 1), and the following performance of the DML models. In Table 5] the performance of models against adversarial perturbations across various attack rates can seen. These results demonstrate that robustness of the models being trained increases across all of the covered attack rates P(7 = 1) E (0.1, 0.25, 0.5, 0.75, 1.0). Additionally, there seems to be an association between higher attack rates yielding higher robustness. However, this relationship is not monotonic, and across data sets and losses optimal choices for attack rate vary. In Table 6 the
6C&W for foc. TensorFlow Implementation: attacks/blcb/masttte Niccolaa Carlini on C&W for Exo:
http://gttaa...c//aaaa/////a
httDss//gittbb..om//eeeoofffff
ssues/97841 sauecomment 0tteecccmmeen-445445555555
464594668
12

---

Under review as a conference paper at ICLR 2021
Loss
FGSM
CUB200-2011
CARS1%6
SOP
R@1
mAP@R
R@1
mAP@R
R@1
mAP@R
Natural
19.7
7.2
14.6
3.8
18.4
10.8
Robust
24.6
9.9
44.6
12.4
50.3
29.2
Natural 18.9
7.7
15.5
4.1
14.5
8.5
T
Robust 27.4
11.0
44.1
13.0
43.2
24.2
Table 3: Performance of DML models trained using the proposed adversarial training objective (using PGD) compared naturally-trained DML for adversarial perturbations within 6 0.01) discovered using FGSM. Losses are denoted by C (contrastive) and T (triplet). The robustly trained model attain both higher inference accuracy (R@) and improved ability rank similar entities (mAP@) @ R) than the naturally-trainee baseline model. Thereby, the proposed robust training objec- tive improves the robustness towards adversarial perturbations.
Loss
C&W
CUB200-2011
CARS1%
SOP
R@1
mAP@R
R@1
mAP@R
R@D
mAP@R
Natural Robust
15.1
6.0
5.6
2.3
23.1
13.9
C
37.4
14.7
58.6
15.3
57.2
32.6
Natural
22.9
10.0
13.4
3.6
10.0
6.1
T Robust
39.9
16.2
58.9
16.0
55.1
32.2
Table 4: Performance of DML models trained using the proposed adversarial training objective (using PGD) compared to naturally-trained DML for adversarial perturbations within (x = 0.01) discovered using C&W. Losses are denoted by C (contrastive) and T (triplet). The robustly trained model attain both higher inference accuracy (R@) I) and improved ability to rank similar entities (mAP@ R) than the naturally-trainee baseline model. Thereby, the proposed robust training objec- tive improves the robustness towards adversarial perturbations.
performance for the robust (and naturally-trainele models against benign (unperturbed) input be seen. Generally, it can be seen that the robust formulation has minor impact on performance on benign input, as each model's evaluation metrics are close to performance of the naturally-trained baseline. Interestingly, for contrastive loss on CUB200-201 and CARS196 (P(y 1) = 0.25
and P(y = 1) 0.1), the robust training objective have enable the benign performance to exceed baseline. This could suggest that a low frequency of adversarial perturbations
the naturally-traine could potentially improve the training process non-robust DMI. We deem more details on this to out of scope for our work, but see it as an promising direction for future research to explore more thoroughly.
D EXPERIMENT: NATURAL ROBUSTNESS (ALTERNATIVES)
This section covers the robustmess for attack methods, FGSM (Goodfellow et al. 2015) and C&W (Carlini & Wagner 2017). Using the Algorithm [ with these methods, it can be seen in Table that they also lower the performance for (e 0.01). Hyper-parameters for C&W are covered in Appendix B particularly iterations had to remain low to feasible runtime under the available resources. Thereby, tuning parameters greater extend could yield more powerful attack and thus lower robustness.
DML models for two other established
E EXPERIMENT: SYNTHETIC DATA
As measure to establish more clarity into the effects of induced by the robust training objec- tive (covered in Section 3). we seek to construct an experiment with two high-dimensional and well-defined data distributions being mapped to low-dimensional embedding space. We define the dimensionality of the high-dimensional input space as = 224 x 224, in order to share the dimensionality of the other experiments using real-world datasets. We construct the dataset with
13

---

Under review as a conference paper at ICLR 2021
CUR200-2011
CARS196
SOP
P(y 1)4
R@1
mAP@R
R@1
mAP@R
R@1
mAP@R
Naturallytrrineed
2.1
2.6
0.4
1.5
1.3
1.7
Contrastive
0.1
8.0
4.0
8.5
2.7
21.3
12.2
0.25
17.9
6.8
27.1
7.2
39.8
23.7
0.5
18.4
7.5
35.7
10.2
44.9
26.2
0.75
18.4
7.3
39.5
11.4
48.7
28.3
1.0
15.4
6.5
41,4
11.5
44.0
24.9
Naturally-trained
2.5
3.0
0.3
1.6
0.5
1.4
Triplet
0.1
22.3
8.8
29.7
8.0
26.8
15.2
0.25
22.1
8.8
32.7
9.2
32.2
18.4
0.5
23.1
8.6
36.7
10.7
38.1
21.1
0.75
20.4
7.7
39.7
11.6
38.1
20.9
3.7
40.6
11.9
28.8
15.4
Table 5: Performance of robust DML models adversarial input for various specified (training) attack rates P(y 1). These models were trained using the proposed adversarial training algorithm (covered in Section 3.5) with PGD for loo 0.01). Evaluations Naturally-trained marks the performance DML models using traditional non-robust training objectives. Bold marks best performance for dataset, metric, loss combinations. Robust models reach higher inference accuracy @R@ 1) and better ability to rank similar entities (mAP@R R) on adversarial imput than naturally-train DML models. Higher attack rates are often associated with higher robustness.
conducted adversarial
input generated using Algorithm] [
CUB200-2011
CARS196
SOP
P(y = 1)
R@1
mAP@R
R@1
mAP@R
R@1 1
mAP@R
naturally-trainee
59.1
21.0
74.0
20.9
71.8
44.7
Contrastive
0.1
54.5
17.2
74.4
20,9
69.7
42,2
0.25
60.1
21.9
74.0
20.3
66.7
39.2
0.5
52.1
15.8
71.8
18.3
65.1
37.3
0.75
50.7
14.8
70.1
17.3
62.0
34.4
1.0
48.3
13.2
67.7
15.9
59.7
32.1
Naturally-trained
59.3
21.7
74.0
21.4
69.6
42.1
Triplet
0.1
51.7
16.9
72.2
19.2
67.0
39.1
0.25
52.2
16.8
70.9
18.4
65.2
37.2
0.5
53.8
17.4
71.7
18.9
64.9
36.6
0.75
53.0
16.5
70.3
18.1
63.5
35.3
1.0
47.5
13.0
70.2
17.3
56.7
29.0
Table Performance of robust DML models on benign input for various specified (training) attack
rates P(q = 1) These models were trained using the proposed adversarial training algorithm (covered Section 3.5) with PGD for fox (c = 0.01). Evaluations on benign data. Naturally-traine marks the performance of DML models using traditional non-robust training objectives. Bold marks best performance for dataset, metric, loss combinations. Higher attack rates are often associated with lower performance benign input. For contrastive loss
14

---

Under review as a conference paper at ICLR 2021
(e 0.01)
CUB200-2011
CARS196
SOP
R@1
mAP@R
R@1
mAP@R
R@D
mAP@
Benign
59.1
21.0
74.0
20.9
71.8
44.7
C FGSM
19.7
7.2
14.6
3.8
18.4
10.8
C&W
15.1
6.0
5.6
2.3
23.1
13.9
Benign
59.3
21.7
74.0
21.4
69.6
42.1
T
FGSM
18.9
7.7
15.5
14.5
8.5
C&W
22.9
10.0
13.4
3.6
10.0
6.1
trained DML models against adversarial examples generated using Algorithm|] with two alternative attack methods: FGSM and C&W. Losses are denoted by C (contrastive) and T (triplet). Recall that, @ reflects model's inference accuracy, while mAP@R reflects its ability to rank similar entities.
Table 7: Performance of naturally-trained
two classes, "a" and "b", for which each has an associated independent k-dimensional Gaussian distribution. These distributions are (u Σ) and Ni E), for class "a" and "b" respectively, where:
Ne (0.25
0.25) I2, jAb (0.75
0.75) R and == 1
(20)
Here, I Rxck is the identity matrix of size & and o = 0.025. Following this, we draw a dataset Dy with fixed amount of data points for each class and train deep metric model fo: R$ - R parameterized by 0. We choose to have the embedding space be two-dimensional as a measure enable visualizations of the learned embedding space. Using Dy. we train two variants of fe. one using the natural (non-robust) training objective and another using the proposed robust training objective (for Le 0.01)). Each model use contrastive loss, trained across 25 epochs on 508 train data points, while being evaluated on 516 test data points. Following, we perform test-time attack using Algorithm [ with PGD (c 0.01). Differences of the learned embedding spaces, and the influence of the adversarial perturbations, can be seen in Figure D
Generally, it can seen that embeddings the robust model remain more stable (in terms of position) in the embedding space, when compared to naturally-trained model. Both models have R@I = 100.0 for benign (unperturbed) data, while the naturally-trained model have R@ = 4.6 for adversarial data points, while the robust model attains R@ I 100.0 for those data points.
F EXPERIMENT: PERTURBATION TARGET
The proposed adversarial training techniques for DML apply perturbations to positive data points. This choice was made establish alignment with the adversarial behavior covered in Section 3.4 However, the "adversarial loss" ::) can capture violations across various data point types (an- chor, positive, negative). assess impact of using alternative perturbation targets (negative, an- chor) for adversarial training, we performed experiment with P(r 1) 0.5 (unless otherwise stated) across these alternative perturbation targets. Losses and attack rates used during adversarial training. for the other perturbation targets, specified below.
Negative perturbations for contrastive loss:
[(0, (1), (X2 + YP(2,1), 92))
P(y
y1 y2) 0 and P(y | * y2) 0.5.
Anchor perturbations for contrastive loss:
1(0, (xi (P(1.)) V1), (X2, 222)
P(y = 1 yı = y2) = P(r 1 + v2) 0.5.
Negative perturbations for triplet loss:
1(0, (x1, (X2, y2), (x3 + 7P(3.1).33) v3))
15

---

Under review as a conference paper at ICLR 2021
Natural of perturbation)
Rabust (effect of perturbation)
0.75
0.30
0.25
0.00
-0.50
0.775
-1.00
neighbourr for perturbed ed input)
(nearest hbour for perturbed input)
raise int.
adv. shif.
0.75
0.50
0.25
0.00
-0.50
-0.75
-1.0
-0.5
0.0
0.5
1.0 -1.0 -0.5
0.0
0.5
1.0
Figure 2: Effects of adversarial perturbations in the embedding space (embedding shift, inference) for 16 randomly sampled data points. Circles mark embeddings unperturbed data points, while crosses are adversarial perturbations for the respective data points. (first row) Grey lines connect the unperturbed data points their perturbed counterpart, to highlight the shift in the embedding space. (second row) Green and red lines connect the embedding of the respective adversarial data point to nearest (and unperturbed) neighbor. the line is green, this neighbor is of the same class (correct) while red is the opposite (wrong). It can be seen that embeddings of the robustly- trained model shifts much less, when faced with adversarial perturbed input, and are thus more robust.
Anchor perturbations for triplet loss:
1(0, (x1 + 7P(,2333) (X2, 122, (X3, Va))
Training processes for contrastive- and triplet loss can seen Figure 3 and Figure respectively. Across each combination of loss and dataset, the proposed adversarial training (positive perturba- tion) yields the most robustness for five out six experiments, with the exception of CUB200-2011 for contrastive loss. Additionally, it reaches several orders of magnitudes higher performance the CARS196 and SOP datasets. We speculate that this inability for the alternative perturbation targets to reach similar performance can be linked alterations distance between anchors and negatives during training. Having large distance between anchor data points and negative data points known to cause instabilities during training, causing models to reach local minima (Wu al. 2017).
16

---

Under review as a conference paper at ICLR 2021
CUB200-207 2011
CARS196
SDP
3.0
2.0
0.9
0.0
0.0
0.6
0.20
0.3
0.4
0.25
0.3
Perturbation Target
0.30
0.2
0.2
Anther
Neggntte
0.05
0.1
Foxil
0.0
0.015
02
0.050
0.4-0
0.0
Epoch
Epsch
Figure 3: Metrics (Loss, R@ and mAP@R) for contrastive loss training procedure across pertur- bation targets.
CUB200-2011
CARS196
SDP
0.5
0.20
0.2
0.1
0.30
0.0
0.0
0.4
802 (68ba))
0.3
0.55
Parturbation Target Anther
0.10
0.2
0.2
14/4
0.05
Posil
0.00
0.0
0.0
Mug 1y
0.100
Mw/ Mnn // myyay
0.075
0:15
0.050
0.10
0.025
0.02
25
30
125
75
100
125
100
Esoch
Ebooh
Figure 4: Metrics (Loss, R R@1 and mAP@R) for triplet loss training procedure across perturbation targets.
17


Reviews:
[{"review_id": "zCrTGfIYQY-", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Summary:\n\nThis paper analyzes the robustness to adversarial attacks of deep metric learning (DML) models for image similarity. A robust training framework is proposed. Experiments are performed on standard DML datasets, showing that existing deep metric learning models are vulnerable to adversarial attacks and that the proposed training protocol improves their robustness.\n\nPositive points:\n- The topic of rendering deep metric learning robust to adversarial attacks has received little attention in the past, and the results presented in the paper seem indeed novel.\n- The proposed attack and robust training procedure show results consistent with the original PGD attack and the adversarial training based on it.\n- The experiments show clear robustness improvements with the proposed training strategy (although, the performance of the models seems too low for practical use).\n- The code for the submission is provided.\n\nConcerns:\n- The derivation of the proposed robust training framework for DML is a bit unclear. The final optimization objective seems to be stated without much justification as to why it enforces robustness.\n- It would be great to be able to compare the proposed strategy with other results. Maybe R@1 could be compared to [Mao et al.] (cited by the paper)?.\n\nReasons for score:\n\nOverall, I lean towards accepting the paper, as it seems to propose the first results around robust deep metric learning. The topic does seem somewhat relevant to the community. Good practices from the community around strong attacks and adversarial training seem to have been followed.\n\nQuestions / suggestions:\n- How come robust performance on clean data is almost as good as baseline performance (Appendix Tab. 3)?\n\nMinor comments:\n- A few typos remain throughout the paper.\n- Different values of the attack strength $\\epsilon$ do not represent different threat models.\n- Appendix Tab. 3: the bold value for CUB200-2011 with contrastive loss does not seem to reflect the best performance.\n\nReferences:\n[Mao et al.] Metric learning for adversarial robustness, 2019.", "extra_scores": {}, "extra_text": {}}, {"review_id": "_QIRY3MBq2", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "\nThe authors propose a novel robust training approach for deep metric learning (DML), accounting for the dependencies of metric losses within mini-batches. The proposed approach is evaluated on several popular metric learning datasets, demonstrating that the method works as intended, and achieves a certain level of robustness, unlike the baseline non-robust model which achieves a very poor performance when exposed to an adversarial attack.\n\nComments:\n\nIn the opening paragraphs of the paper, the authors state ‘Our key insight is that during an inference-time attack, the positive point in the triplet will be modified by the attacker, and thus, during training, we must perturb positive points in the triplets, instead of anchors or negative points.’, yet towards the end (and despite having motivated it in between), they show that the results on this are inconclusive and that it is not clear that perturbing only the positive points in the triplets is the right / best thing to do. Unless I am misunderstanding something, this feels out of sync - either it is a key insight, or inconclusive? It can’t be both.\n\nOpening paragraphs / under Q1 and Q2 in Section 4 (Experiments) - this feels both redundant (both were mentioned before under Contributions) and also out of place, as it mentions results before even introducing the experimental setup.\n\nThe authors evaluate their proposed robustness approach under a projected gradient descent (PGD) attack. While this is certainly sufficient to establish that the method works and that it provides some level of robustness to adversarial attacks, it feels really limiting to only assess a single attack type, of various options that are available - as it would have been potentially valuable to establish the degree of provided robustness under these different cases. As is, it is unclear whether the proposed approach will be universally helpful, or merely helpful with a particular attack type. While there is no reason to believe in the latter, the former hasn’t been substantiated nor argumented.\n\nApart from the general metrics shown in the tables, there isn’t much additional analysis that would aim to reveal whether there were any patterns in these datasets on where the method worked vs didn’t. For example, was the performance uniform across (pairs of) classes? If not, why? What about contrasting class pairs that are more/less similar? Or are there issues with rare classes?\n\nTables 1, 2 and 3 should include confidence intervals.\n\nThe authors use the phrase significant to qualify differences in several parts of the paper, yet there is no mention of which statistical test has been used to claim statistical significance of the differences? The authors should conduct proper statistical testing and highlight the exact test in the text.\n\nThere is no discussion of the limitations of the current approach / areas for potential improvement and future work in the main paper - instead, some open questions are mentioned in the Appendix. It would be good to include key discussion points in the main body of the paper.\n\nNit: Page 3, when giving lb(A,z) = c_k(A,z) - what if there is more than a single index returned by the argmin - what if there is a tie? The authors should specify if they are doing random tie breaking or taking the majority label (if a multi-way tie)\n\nNit: Figure 4, please update with the finalized results.", "extra_scores": {}, "extra_text": {}}, {"review_id": "EhRiT16WjiJ", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Authors research the problem of robust metric learning in this work. They propose a min-max formulation to learn the adversarial example and robust representations, simultaneously. The empirical study confirms the effectiveness of the proposed method. My concerns are as follows.\n\n1.\tIn this work, authors adopt the positive example rather than anchor in a triplet for perturbation. However, as they illustrated in Section 3.2, the attack only can be applied on anchors while the reference points are fixed. The reason for current choice is that having perturbation on positive example achieves best performance as shown in appendix. But it may be due to the problem in the algorithm or implementation since the behavior of optimizing anchors is weird as reported. Moreover, perturbing anchors work well as reported in other work [2]. The current setting for perturbation is inconsistent with the practical applications.\n2.\tIt is not clear how $\\rho(x_i, x_j)$ is obtained. Is the optimization problem solved to be optimum or just an approximated solution?\n3.\tThere is no baseline from robust optimization for comparison. At least robust triplet loss in [2] can be included. Besides, classification is a strong baseline for metric learning [3]. Therefore, a robust classification model can be involved in the empirical study.\n\n\n[1] A. Sinha, et al. Certifying Some Distributional Robustness with Principled Adversarial Training.\n[2] C. Mao, et al. Metric Learning for Adversarial Robustness.\n[3] A. Zhai, et al. Classification is a Strong Baseline for Deep Metric Learning.\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "8-Rd2jhmHL", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "edit after rebuttal:\n\nMy opinion about the paper has not changed. Although the general idea is interesting, my main concern is that the approach aims at performing defense against a specific attack. The robustness of the approach w.r.t. other attacks (such as L_2 and L_0) needs to be evaluated.\n\n====\n\nThe paper proposes a robust deep metric learning approach to adversarial attacks. Unlike previous Deep Metric Learning (DML) approaches, the approach focuses on robust optimization-based training that uses a saddle-point formulation. The approach considers the dependence of two classic metric losses (constrastive and triplet-loss) on the samples of a mini-batch to produce adversarial attacks. \nGiven a pair of samples in a mini-batch i and j, a perturbed variant of i wrt j is created as formulated in the first equation of Section 3.4. Depending on whether i and j are similar or not, a perturbation delta in some epsilon-ball increases or decreases the squared Euclidean distance between the representations of i and j. \n\nThe paper then evaluates how classic deep metric learning approaches are robust to Projected Gradient Descent (PGD) attacks. The results on some standard datasets show that classic metric learning approaches are very weak to PGD attacks (see Table 1), and the proposed approach is more robust as illustrated in Table 2.\n\nThe paper is well written in general although the experimental section is sometimes hard to follow. It took me some time to understand what the difference between the tables was. \nMy main concern is that only one kind of adversarial attack is considered in the paper. In the second contribution, the authors state that classic DML approaches \"do not have any robustness — their accuracy drops to close to zero when subjected to PGD attacks that we formulate.\" Classic DML approach are weak to the evaluated adversarial attack, but what about other kinds of adversarial attacks? \nIt is not surprising that a specific method optimized for this attack is more robust. Is the proposed approach robust to other kinds of adversarial attacks?\n\nIf I understand correctly, according to the definition of the distance in Section 3.1, the perturbation delta is performed in the input space of the neural network. How is the argmax/argmin problem solved in Section 3.4? I tried to check the code but only saw inputs perturbed by -epsilon or +epsilon and then clipped. I do not see where the argmax/argmin problem is solved, if the neural network is highly nonconvex, the problem might be hard to solve. This needs a discussion, or at least a reference.\nFor instance, if (x_j, x_i) are dissimilar and x_j is in the epsilon-ball centered at x_i, then rho(x_i, x_j) should be equal to x_j. How can the proposed approach be robust to such a case?\n\nHow does the proposed approach have an impact on the norm of the learned representations?\nCan the authors perform an analysis on the difference of representations between classic DML and the proposed approach?\nWhat about the robustness for a different value of epsilon or type of norm used during training?\n\n\n\n\nMinor comment: The equation in Formulation 1 is confusing because i is used as index twice (once in the sum, and once in the max). Also please keep equation indices for most equations, it makes reviewing easier.", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper proposed a novel Adversarial Deep Metric Learning approaches. The reviews pointed out the paper proposes an interesting idea and it is among the rare works that address directly robust metric learning which an important topic for efficient metric learning. 
Some concerns were raised about the analysis and the lack of comparisons notably with other types of adversarial attacks. 
The authors provide a rebuttal where they addressed some concerns raised by reviewers with some precisions on the work, its positioning with respect to other related papers and additional comparisons notably with other types of attacks. 
A minor remark: there is a typo in Eq(13), where the $z$ in the loss function is actually not defined and should be included in the max function.
That being said, the contribution is still limited in considering only the infinite norm, analysis and comparisons to prior work remain weak. The paper does not meet the requirements for acceptance to ICLR in its current form.
I have then to propose rejection.

Decision: Reject