Maximization of Average Precision for Deep Learning with Adversarial Ranking Robustness
Authors: Gang Li
Wei Tong
Tianbao Yang
Venue: NeurIPS 2023 spotlight (2023)
Keywords: Adversarial Average Precision Maximization
Robust Average Precision
Adversarial Ranking Robustness
Adversarial Training
TL;DR: This paper introduces a novel formulation to address a gap in optimizing Average Precision (AP) while ensuring adversarial ranking robustness.

Abstract: This paper seeks to address a gap in optimizing Average Precision (AP) while ensuring adversarial robustness, an area that has not been extensively explored to the best of our knowledge. AP maximization for deep learning has widespread applications, particularly when there is a significant imbalance between positive and negative examples. Although numerous studies have been conducted on adversarial training, they primarily focus on robustness concerning accuracy, ensuring that the average accuracy on adversarially perturbed examples is well maintained. However, this type of adversarial robustness is insufficient for many applications, as minor perturbations on a single example can significantly impact AP  while not greatly influencing the accuracy of the prediction system. To tackle this issue, we introduce a novel formulation that combines an AP surrogate loss with a regularization term representing adversarial ranking robustness, which maintains the consistency between ranking of clean data and that of perturbed data. We then devise an efficient stochastic optimization algorithm to optimize the resulting objective. Our empirical studies, which compare our method to current leading adversarial training baselines and other robust AP maximization strategies, demonstrate the effectiveness of the proposed approach. Notably, our methods outperform a state-of-the-art method (TRADES) by more than 4\% in terms of robust AP against PGD attacks while achieving 7\% higher AP on clean data simultaneously on CIFAR10 and CIFAR100.The code is available at: <https://github.com/GangLii/Adversarial-AP>

Maximization of Average Precision for Deep Learning with Adversarial Ranking Robustness
Gang Li Texas A&M University College Station, USA gang- @tamu.u.... edu
Wei Tong General Motors Warren, USA wei twwg@gn.
Tianbao Yang Texas A&M University College Station, USA rianbao-yang@teee edu
Abstract
This paper seeks to address gap in optimizing Average Precision (AP) while ensuring adversarial robustness, an area that has not been extensively explored the best of our knowledge. AP maximization for deep learning has widespread applications, particularly when there a significant imbalance between positive and negative examples. Although numerous studies have been conducted on adversarial training, they primarily focus on robustness concerning accuracy, ensuring that the average accuracy on adversarially perturbed examples is well maintained. However, this type of adversarial robustness is insufficient for many applications, as minor perturbations single example significantly impact AP while not greatly influencing the accuracy of the prediction system. To tackle this issue, we introduce novel formulation that combines term representing adversarial ranking robustness, which maintains the consistency between ranking of clean data and that of perturbed data. We then devise efficient stochastic optimization algorithm to optimize the resulting objective. Our empirical studies, which compare method current leading adversarial training baselines and other robust AP maximization strategies, demonstrate the effectiveness of the proposed approach. Notably, (TRADES) by more than 4% in terms of robust AP against PGD attacks while achieving 7% higher AP on clean data simultaneously on CIFARIO and C0FAR100. The code is available at: httth:tt///// https://github.. http:////iiiiooo.ccaaaaaaa//////
AP surrogate loss with regularization
methods outperform state-of-the-art method
conn/Gangla///dveerrriaall
Introduction
AP measures the precision of model at different recall levels, offering a more nuanced understanding of the trade-off's between precision and recall. Optimizing AP for deep learning is of vital importance, especially in cases with highly imbalanced datasets. In such situations, accuracy alone can be misleading, model may perform well the majority class but struggle with the minority class, thereby offering superficially high accuracy score. In contrast, AP serves as a ranking metric that is particularly attuned errors at the top of the ranking list, which makes more appropriate metric for applications dealing with highly imbalanced datasets. For example, deep AP maximization has been crucial in enhancing molecular property prediction performance, contributing to a winning solution in the MIT AICures challenge [54].
However, existing approaches of AP maximization are not robust against adversarial examples. notoriously known that deep neural networks (DNN) are vulnerable to adversarial attacks, where small, carefully-crafter crafffedd perturbations to the input data cause the model to produce incorrect predictions [4]][6] [6]. These perturbations are often imperceptible to humans but can significantly impact the model's performance. Tremendous studies have been conducted to improve the adversarial robustness of DNN. A popular strategy to achieve adversarial robustness is through adversarial which injects adversarial examples into the training
training 27 59 53 45
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

Table I: Comparison of different approaches for Adversarial AP Maximization (AdAP). Red indicates
new features proposed in this paper.
Approaches
Objective
Regularization
Optimization
Ranking Robustness
Trado-off
Consistent Artack
MdP MM
MiniMax AP Loss
No
Zero-sum Game
Yes
No
No
AdAP PZ
AP Loss + Reg.
Pointwise
Zero-sum Game
No
Yes
Yes
AdAP 1Z
Loss Kog.
Listwise
Zero-sum Gome
Yos
Yes
No
AdAP LN
+ Reg.
Listwise
Non- Non-zero-oo sum Game
Yes
Yes
AdAP _LPN
AP Loss + Reg.
Listwiee Pointwise
Non-zero-sum Game
Yos
Yes
Yos
TRADES
AdAP LN
D8/0.5)
DD
Clean Images
Accos, AP10
Clisn Images
Acc-a AP1.0
2184
0000
Nattrrattion
perturbed Image
One perturbed Image
Arc:0. AP
Senuited
Ronking Litt
Rottom
Ronking
Bottom
Figure I: Top are predictions on clean images of a robust model trained by a state-of-the-art adversarial training method TRADES (59] and our method on CIFAR- 10 data for detecting trucks. Bottom are predictions on the same set of images with only one example adversarially perturbed, which is generated by PGD following a black-box attack. The results of TRADES (left) indicate that slightly changing one example could dramatically impact AP but not on the accuracy. The results of our approach (right) demonstrate that our solution is more robust to adversarial data in terms of ranking and AP score. The dashed blue line indicates the decision boundary score 0.5.
that are generated by various attack methods. Nevertheless, almost all existing methods focus on robustness concerning accuracy, ensuring that the average accuracy on adversarially perturbed examples is well maintained. This type of adversarial robustness is insufficient for many applications with highly imbalanced datasets, as minor perturbations on a single example can significantly impact AP while not greatly influencing the accuracy of the prediction system (cf. an example in Figure I This presents a significant challenge for adversarially robust AP maximization.
In this paper, we conduct a comprehensive study on how to imbue AP maximization with adversarial robustness. There are several technical and practical concerns in the design of adversarial training methods for AP maximization to enjoy three nice properties: (i) capability to trade off between AP on set of clean data and the robustness of the model the perturbed data; (ii) robustness in terms of ranking performance instead of accuracy against adversarial perturbations: (ii) consistency of attacks between training and inference. The first property is obvious in light of existing works on adversarial training [59]. The importance of the second property has been explained in the previous paragraph. The third property is tricky as it does not exist in existing adversarial training methods. The adversarial attack is usually applied to an individual data during the inference phase. Hence, we expect that maintaining the consistency between the attacks generated in training process and that in the inference phase will help boost the performance. However, this will cause a dilemma for achieving pointwise attack and listwise robustness in a unified framework.
To acquire these properties in a unified framework, we draw inspiration from prior adversarial training methods through robust regularization, and integrate two distinct design elements. We examine robust objectives that combine an AP surrogate loss on the clean data and a regularization term depending on the perturbed data. The two unique design features are (i) new listwise adversarial regularization defined by a divergence between two distributions that represent the top one probabilities of a set of clean data and their perturbed versions; (ii) a non-zero-sum game approach, which integrates pointwise adversarial attacks with the proposed listwise adversarial regularization. This will ensure the attack consistency between training and inference. Our contributions are summarized below.
We propose a non-zero-un sum game optimization formulation for AP maximization with adversarial ranking robustness, which achieves listwise defense against pointwise attacks.
We propose an efficient stochastic algorithm for solving the resulting objective, which integrates traditional adversarial sample generation methods with state-of-the-arr deep AP maximization algorithm without requiring large batch size.
We conduct extensive experiments to compare with existing leading adversarial training baselines, and ablation studies to compare different approaches shown in Table [ for adversarial AP maxi-

---

mization. We conclude that AdAP LN and AdAP LPN achieve the best performance among all methods corroborating the effectivvness of the proposed techniques.
2 Related Work
Adversarial Robustness. To safeguard deep neural networks (DNNs) from adversarial attacks, a variety of adversarial defense techniques have been proposed in the literature, including (1) detection for defense [7
48 38 24|; (2) imput transformations for defense [25 17 18 58]; (3) adversarial
training 1 47 LS Among these techniques, ad training has been demonstrated to be 21
14 [33. Among these, 2 is the first to theoretically study and justify adversarial training by solving min-max formulation for training adversarially robust models for deep learning. (59] presents an objective function that strike a balance between accuracy and robustness in light of their theoretical tight upper bound on the robust error. However, these previous methods focus on how to improve the robustness concerning accuracy, which is not sufficient for highly imbalanced data. [52] considers adversarial training for imbalanced data by combining a minimax weighted loss and a contrastive loss of feature representations. [60] considers adversarial ranking in the context of retrieval and proposes maximun--hiif-dditaaee attack that pushes an embedding vector as far from its original position as possible and uses it in a triplet loss for optimization. [20] presents a study on adversarial AUC optimization by reformulating the original tightly coupled objective as an instance-wise form for adversarial training. Nevertheless, none of these methods enjoy three nice properties simultaneously. i.e., adversarial ranking robustness, trade-off between AP and robustness, and consistent attacks between training and inference.
one the most effective approaches [27 55 45
Average Precision Optimization. For imbalanced classification and information retrieval problems, AP optimization has attracted significant attention in the literature [13 36 3 10
29. 28
55 To
maximize the AP score for big data, some works employ stochastic optimization with mini-batch averaging to compute an approximate gradient of the AP function or its smooth approximation 6 36
42
4
These methods typically rely large mini- size for good performance. In contrast,
34 proposes a novel stochastic algorithm that directly optimizes a surrogate function of AP and provides theoretical convergence guarantee, without the need for large mini-batch size. Then [50] further improve the stochastic optimization of AP by developing novel stochastic momentum methods with better iteration complexity of O(1/e4), However, these approaches of AP maximization are vulnerable to adversarial examples created by introducing small perturbations to natural examples. The question of how to boost model's AP under adversarial perturbations while maintaining AP on clean data is still unresolved.
3 Preliminaries
For simplicity of exposition, we consider binary classification problems. However, the discussions and algorithms can be easily extended to mean AP for multi-class or multi-label classification problems. Let D = {(xi, y: } denote the set of all training examples with x; being an input data and y/ (-1, 1} being its associated label. Denoted by h(x)
(x) the predictive function (e.g.. deep neural network), whose parameters are E Rd. Denote by I(-) indicator function of predicate. Denoted by ||
||r the -no-n where p E (1, oo).. Denoted by (0,,)) <) = {x |>||| S <) the nor-norm ball centered O with radius Let D+ and D be the subsets of D with only positive examples and negative examples, respectively. Let n. = =iD+1 denote the number of positive examples. Denote by r(x,, D) = -xx (x,) lww the rank of x; in set D according the prediction scores in descending order, i.e., the number of examples that are ranked higher than x; including itself. Let E(hw (x). y) denote a pointwise loss function, e.g., the cross-entropy loss.
3.1 AP Maximization
According to its definition, AP can be expressed as: - Σx.
r(x.
Many different ap- We follow a recent work (4),
X
ED
Fix.
DJ
proaches have been developed for AP maximization 9 36 which proposes an efficient stochastic algorithm for AP maximization based on differentiable surro- gate loss minimization. In particular, the rank function is approximated by using surrogate loss of the indicator function 11(bw (x₂) hw (x:)) 34 yielding the following problem:
13
4
34
Σ uly = ()x((x
min P(w)
(I)
74 x
Σ xw;x,;:))
3

---

where E(-) denotes a smooth surrogate loss function, e.g., the squared hinge loss ((W;x,:x.) (max(m (h. (x,) (x.)), where m is a margin parameter.
To tackle the computational complexity of computing the stochastic gradient of P(w), [34 has formulated this problem as finite-sum coupled compositional optimization of the form 1 -xxED, xi)), where x(w; = (pi(w;; x.), 92 (wW; (w; = = x):(w: (P((w;;)) = Σー= ((w: x.:xxxxx)))))) x,)/n. f([p1, (22)) = -P1/p2. To compute stochastic gradient estimator, their algorithm maintains two moving average estimators u and us, for y1 (w;x,) x,) and 92 (2(;; At iteration e, two mini-batcher are sampeld B E D+ and B D.
a=1 ly =
The two estimators us, and u², are updated by Equation (2) for x; E BB:
xx = (1 - m) + 71
(, x, =
B
X,EB
1
2 = =1 (1- (1-)))u
+ 71
E(wri
B
x,EB
where ?1 10 is moving average parameter. With these stochastic estimators, an stochastic
estimate of V (W() ) is given by Equation 33)
P(w.)
1
Σ
Σ
(uk.
u Jl, ()),((W.
(3)
B++
(
X xjEB
Then the model parameter can be updated similar to SGD, momentum- based methods, or Adam.
3.2 Pointwise Attacks and Pointwise Adversarial Regularization
An adversarial attack is usually applied to specific example x such that its class label is changed from its original label (non-targeted attack) or to a specific label (targeted attack). We refer to this kind of attack as pointwise attack. Various pointwise attacking methods have been proposed, including, FGSM [6), Basic Iterative Method (3), PGD 227, JSMA 32), DeepFool [0, and CW attack [8]. While our approach is agnostic to any pointwise attacks, we restrict our discussion to optimization-bant based non-targe attacks, 6 = arg min G(ww, x + d, y). where G' is an appropriate function, e.g., G(w, 5, y) - -h (x + 8), y). A classic adversarial training method solve a robust optimization problem that integrates the training loss with the adversarial attack, e.g.,
min
max 6(h + +6), 1S
(4)
A deficiency of this approach is that it may capture the trade-off between natural and robust errors [49]. To address this issue, robust regularization methods have been proposed, whose objective consists of regular surrogate loss of eтror rate clean data and robust regularization term that accounts for the adversarial robustness. Different robust regularizations have been proposed [59 45
21 A state-of-the-art approach is TRADES (59]. whose objective is formulated by:
(xhw(xi), m:) À max L(hw ltw (x: + 6.))
where A > 0 is regularization parameter and L(.-)) is an appropriate divergence function, e.g., cross-entropy loss between two predicted probabilities [59]
4 Adversarial AP Maximization
First, we discuss two straightforward approaches. The first method (referred as AdAP_MM in Table IT is to replace the loss in as an AP surrogate loss yielding the following:
ll = 1)((w, x. + 6,, x; + 5:)
min
(6)
n
x:ED+
l(w,x, 8,, + 5.)
The second method (referred to as AdAP_ Table TD is to simply replace the first term in with an AP surrogate loss:
min P( (w) +
max L(hw (x:), /w + 8.)).
(7)

---

The limitations of the first method are that it may not capture the trade-off between AP and robustness and the adversarial attacks during the training are inter-dependent, which is not consistent with pointwise attacks generated during the inference phase. While the second method is able to trade off between AP and robustness, the pointwise regularization is not suitable for tackling imbalanced datasets, as an perturbation on a single data point from minority class does not change the pointwise regularization too much but could degrade the AP significantly.
4.1 Listwise Adversarial Regularization
To address the deficiencies of the above straightforward approaches, we draw inspiration from TRADES and propose listwise adversarial regularization to replace the pointwise regularization. The key property of the listwise adversarial regularization is that it should capture the divergence between the ranking result of the clean data and that of the perturbed data. To this end, we leverage the top-one probability proposed in the literature of learning to rank (7].
Definition 1
The top one probability of an data x, represents the probability of it being ranked on exp( bog (x:))
the top, given the scores of all the examples i.e., px(x:) Σ5=1 exp(bbr(Xx))
With the definition of top-one probability, define the listwise adversarial regularization as the divergence between two listwise probabilities, i.e., {p:(x;)) );= for the clean examples and (p: + 8,));= for the perturbed examples. Different metrics can be used measure the divergence between two distributions, e.g., KL divergence between {x:)x)) and (pr (x; + } KL divergence
between {pr (x; + }=}=_1 and (x:)) (x)))==== and their symmetric version Sensen-Shannen divergence. For illustration purpose, we consider the KL divergence:
((w,8.D) >n i=1 px(x;) log (x()) pe (x;) log + 6.).
(8)
To further understand the above listwise regularization, we conduct a theoretical analysis similar to [59] by decomposing the robust error into two components. The difference from (59) is that we need to use the misranking error. We consider the misranking error as Rnot = Ex,-D, 1...-D,,(hhi [(((x.) s maxx, ED ((x,)), which measures how likely a positive example is ranked below negative example 43 To characterize the robust ranking error under the attack of bounded perturbation, we define Roob Ex,.D, II,8,,,,,,,, 6, E B (0, <). h(x; + 5,) S maxx,ED_ h(x, + 55)]. }.
It worth noting that Rrat I Rrot is always satisfied, and in particular, Ryat = Ryob if c = 0. We show that the Ryos can be decomposed into Rnat and Redy in Theorem
Theorem Rros- = Rnet + RRddy where the second term is called the boundary error Ridy = EXIND, [((xx)) maxx,ED ((x5))1(36,, 85 e), + 6;) S maxx,eD_ h(x; + 0;)].
Remark: It is clear that the boundary eπrоr measures the divergence between two ranked list (x:)] and (x: + ),)) which provides an explanation of the divergence between the top-one probabilities on the clean data and on the perturbed data.
Since we are optimizing AP, we use an AP surrogate loss surrogate of the misranking error Rnat on the clean data. Finally, it yields in a robust objective P(w) + R(w, ö, D). A question remained is simple strategy is to use the robust optimization approach that
how to generate the perturbations. solves a zero-sum game: minl max P(w)= + R(w, ò, D) (referred to as AdAP LZ in Table D However, since R(w, 6, D) is a listwise regularization, the resulting perturbations (6, ) are inter- dependent, which is not consistent with the pointwise attacks generated in the inference phase. To address this issue, we decouple the defense and the attack by solving non-zero-wn game:
min w
P(w) + AR(w, D,
(9)
|a. Σ" G(w,x, + v)),
i=1
where the attacks are pointwise attacks generated for individual examples separately, e.g., FGSM, PGD. We refer to the above method as AdAP LN. Finally, we experiment with another method by adding a pointwise regularization into the objective for optimizing the model parameter w, i.e.,
min P(w) + A(R(w, 6, D) + Σ L(h (xi), bw (x; + +))))
(10)
2=1
This method referred to as AdAP LPN imposes stronger advesarial regularization the model.
5

---

Algorithm Stochastic Algorithm for Solving AdAP_LN in
1: Initialize w, uz. u u, "1,77
2: for t- 1,..., 7 do
3: Draw a batch of B+ positive samples denoted by B+.
4: Draw batch of B samples denoted by B.
5: for x; E B do
6: Initialize 62
(N(0, 1)
7: for m = 1........ M do
Update operator. end for 10: end for
8:
Il + signi ( Va, G(w,, (.) where (T)()) () is the projection
9:
11:
For each x; E 14. update u and _ by Equation (2)
12: Update by Equation (11) and compute V w. R(w,, 6, D) by Equation 12
13: Compute stochastic gradient estimator W. Vw, P(w.) + AV w. O,
14: Update W++1 by using SGD, momentum-methods or Adam.
15:
end for
4.2 Algorithms for Adversarial AP Maximization
Below, will discuss efficient algorithms for adversarial AP maximization employing different objectives. Due to limit of space, we focus attention on solving ( Equal efforts have been spent on solving other AdAP formulations with algorithms presented in the appendix.
Since there are two players one for minimizing over w and one for maximizing over 6, we adopt the alternating optimization framework that first optimizes 5 for generating attacks of sampled data and then optimizes for w based on the sampled clean data and perturbed data. The optimization for is following the existing methods in the literature. We use the PGD method for illustration purpose. The major technical challenge lies at computing a gradient estimator of the listwise regularization R(w, 6, D) in terms of w. We consider ó to be fixed and rewrite R(w, 8,,8,77 D) as:
Σ (xx((((x))
h(x; + +.))
n
log Σ exp(h(xx)) log Σ exp((h(x,+ (00i(xx,))) +8)). j=1
Σ/=1 exp(h(x,))
j=1
Note that calculating the gradient of R(w, 8, D) in terms of w directly, which includes the prediction scores of all samples, is not feasible. To tackle this challenge, we cast R(w, 6, D) into compositioal function and borrow the technique of stochastic compositional optimization. To this end, define:
g (ww = [91 (w), 92 (w).gs())))
(xp(h(()))((xx))) n(x; + 6z)) Σ exp(h(x,)) n
1 Σ
exp(h(x; + 6.1]]
n
1=1
Let F(g)
logg2 log f3. Then we write R(w, 8, D) F(o(w)) = gi gw(w)
logg)((w)
ma(w)
d2
log (w). The gradient of R(w; 5, D) is given by:
1 91 (w) 92 92(w)
V Twl 6, Vwg(w)
VF(g(w)) (
V Vwg(w)T
92 (w)) (g2(w) (W)2
ga(w) (w(
The major cost for computing V R(w, 8, D) lies at evaluating g(w) and its gradient V (w). which involves passing through all examples in D. In order to develop stochastic algorithm, we will approximate these quantities by using a mini-batch of random samples. The gradient Vwg(w) can be simply approximated by the stochastic gradient, i.e.,
B ExTEB (xp(M(x;))
h(x; + 8,) + V))xx( V + 6,))
(ug(w)=
B Ex,E (xp(((xx)) Vwl(x))) B Exxeeexp((he) + V +5)
where B denote set of B random samples from D. Due to the non-linear dependence of V R(w, 6, D) on g(w), we cannot simply use their mini-batch estimator the calculation as it will yield a large optimization error [51]. To reduce the optimization error [4 33 we will
maintain a vector u W1, U2, uz] for tracking [g] (w). g2 (w), 9))93((w [w]. The vector u is updated
by Equation
[I where 72 E (0, 1) is parameter. An estimate of V R(w, 8, D) is given by

---

Equation 12
+L exx() n1xx 6.))
(x))
(1 (0-72)) 72) u+ 72
ExieB exp(h(x;))
(11)
B Ex, exp(h(xx + 6:))
V w (o.R((,,))) 6,
Vwol
-1 (2)
1
(12)
U2
RA3
Finally, we ready to present the detailed steps of the proposed algorithm for solving AdAP LZ in (9) in Algorithm [
which employs PGD for generating adversarial attacks and stochastic composi- tional optimization techniques for updating the model parameter w.
5 Experiments
In this section, we perform extensive experiments to evaluate the proposed approaches against white- box and black-box attacks on diverse imbalanced datasets. In order to provide a comprehensive understanding of our methods, we conduct experiments from three other perspectives: (1) trade-off between robustness and average precision; (2) close look at the effect of the adversarial perturbations; (3) ablation study of different strategies for adversarial AP maximization.
Datasets. We conduct experiments on four distinct datasets sourced from various domains. These en- compass CIFAR-10 10 and CIFAR-100 datasets (22). CelebA dataset (26) and the BDD 1001 dataset [57]. For CIFAR-10 and CIFAR100, we adopt one versus-all approach to construct imbalanced classifica- tion tasks. It should be noted that even for clean data, the task of distinguishing between positive class and 99 negative classes in CIFARIO0 is challenging. Hence, in experiments, we employ the 20 superclass labels, of which we choose the first 10 superclasses for constructing 10 one-vs-all binary classification tasks verify the adversarial robustness the CIFAR 100 dataset. We split the training dataset into train/validation sets at 80%/20% ratio, and use the testing dataset for testing. CelebA dataset a large-scale face attributes dataset that contains over 200,000 images of celebrities, each of which is annotated with 40 facial attributes. In our experiments, we choose two attributes with the highest imbalanced ratio, i.e., Gray_ _air and Mustache, show the superiority of our method. We halpo////vaiiation//tttttte
adopt the recommended driving video dataset, which also has collected image-level annotation on six weather conditions and six scene types. In our experiments, we choose two kinds of weather conditions, i.c., Rainy and Cloudy, and two kinds of scene types, i.c., Tunnel and Residential, which are more imbalanced than others. Since the official testing dataset is not handy, we take the official validation set as the testing data, and split the training dataset into vali/valiittion sets at 80%/20% ratio. The statistics for each task in datasets are presented in Table 6 in the appendix.
split. BDDI00K dataset is a large-scale diverse
Baselines. In all experiments, we compare our methods (AdAP_LY AdAP_LPN with the following baseline methods: (1) PGD 27 which solves a MiniMax objective directly to enhance the adversarial robustness terms of accuracy; (2) TRADES [59]. which considers the trade-off between robustness and accuracy by minimizing a form of regularized surrogate loss; (3) MART [53). which explores the effect of misclassified examples to the robustness of adversarial training. Furthermore, we include two normal training methods, namely CE minimization and AP maximization by [34], as references.
Experimental Details. We employ the ResNet18 [19 the backbone network in experiments. This choice is based on the fact that all the tasks involved in our study are binary classifications, and R is considered be expressive enough for the purpose. For all methods, with mini-batch size as I 128, we tune learning rate in 11e-3,1e-4 1e-5) with standard Adam optimizer. We set the weight decay to 2e-4 for the CIFARIO and CIFAR 100 datasets and le-5 for the CelebA and BDD100k datasets. In the case of the CIFAR 10 and CIFAR 100 datasets, we run each method for a total of 60 epochs. For the CelebA and BDD datasets, we run each method for 32 epochs. The learning rate decay happens at 50% and 75% epochs by a factor of 10. For MART, AdAP LN and AdAP LPN, we tune the regularization parameter X in 10.1, 0.4, 0.8, 1, 4, 8. 10). For TRADES, we tune the regularization parameter in (1, 4, 8, 10, 40, 80, 100), since they favor larger weights to obtain better robustness. In addition, for AdAP LN and AdAP LPN, we tune its moving average parameters 71. 72 in 10.1, 0.9). Similarly, we tune the moving average parameters ?1 for AP maximization in (0.1, We set margin parameter in the surrogate loss of AP as 0.6 for all methods that use the AP surrogate loss. For all adversarial training methods, we apply 6 projected gradient ascent steps to generate adversarial samples the training stage, and the step size is 0.01. We choose To norm to bound the perturbation within the limit of e = 8/2 8/255, as it is commonly used in the literature.
7

---

All the models in our experiments are trained from scratch, except direct AP maximization which fine-tuned on a pretrained CE model as in [34. For each experiment, we repeat three times with different random seeds, then report average and standard deviation.
5.1 Robustness against White-box Attacks
In this part, we evaluate the robustness of all models against PGD and APGD [12 white box attacks that have full access to model parameters. Specifically, we utilized 10-step PGD and APGD attack to generate adversarial perturbations constrained by the same perturbation limit = 8/ 8/255. Given that APGD is a step size-free method, we set the step size for PGD to 0.007. For the adversarial training methods, hyperparameters and models are chosen based on the robust average precision (AP) metric on validation datasets, and their corresponding performances on test datasets are reported. For normal training methods, models are chosen based on the clean average precision. The results are presented in Table and 3 Since we run all the classes of CIFARIO 10 and the first 10 classes of CIFAR 100 to verify the effectiveness of our method, we report the mean average precision over the ten classes in the tables, and the performance on each class is shown in the appendix.
From Tad 3 we can observe that our proposed methods outperform other baselines consistently by a large margin while maintaining notably higher clean AP scores. It is striking to see that our methods improve robust AP by 2 7 percent all datasets, compared with adversarial training methods which are concerning accuracy. The results also show that normal training methods (CE min. and AP max.) are vulnerable to adversarial attacks, while they can achieve pretty high clean AP. This is consistent with the observation from other literature [46] [6]. When comparing results in Table 3 with that in Table 2 we can see that APGD exhibits stronger attacks than PGD, demonstrated in 112 However, the superiority of our proposed methods still remains evident.
5.2 Robustness against Black-box Attacks
In this part, we examine all the models against adversarial black-box attacks. To achieve this, we utilize the model trained with CE loss minimization on clean datasets as an attacker model. So we do not include the performance of models of CE loss minimization here. With the well-trained model from CE loss minimization, we craft adversarial test images by PGD attack with 20 iterations and step size is 0.003, under perturbation limit c 8/255. The models evaluated here are the same model evaluated in 5.1. The results are summarized in Table 4 Results show that our method exhibits significantly superior robustness against black-box attacks on all tasks, with evident advantages against white-box attacks shown 5. From Table we can also observe that the normal training method, i.c., AP maximization, is also susceptible when confronting adversarial black-box attacks.
5.3 Trade-off between Robustness and AP
As argued in various research studies (59 40 56), there exists a trade-off between accuracy and adversarial robustness. That is saying when one model boosts its adversarial performance, it may result in a decrease in its clean performance. In this part, we aim to study the trade-off between robustness and average precision and provide clear visualizations of the phenomenon. To accomplish this, we tune the weight of the regularization for the regularization-based approaches, i.e. TRADES, MART, AdAP __ and AdAP LLPN,, then show how their robust AP and clean AP changes. We evaluate the models at the last epoch to ensure that all methods reach convergence point. For TRADES, AdAP LN and AdAP LPN, we tune the weight introduced in Experimental Details part, as well as 0.01, better illustrate the trade-off trend. We also include non ron-reuulatization based approaches as a point in this graph.
Based on Figure 2 can observe that for TRADES, AdAP LN and AdAP_ LPN, as the weight of regularization increases, the clean AP decreases while the robust AP increases at first, which is consistent with the observation in [59]. But for MART, the trend is not clear as it is not tra based approach. However, as the weight of regularization continues increasing, both the clean AP and robust AP decrease. This is because when the model places excessive emphasis on the regularization term, it may overlook the actual objective. Notably, our proposed methods place more towards the upper-right than other baselines, which indicates that our method is able to achieve better both robust and clean AP simultaneously.
5.4 Visualizing the Behavior after Adversarial Perturbations
To gain deeper understanding of our approach, we have close look at how defense models' predictions change after introducing adversarial perturbations. To be more specific, we compare our AdAP LN method with another robust baseline, TRADES, to examine how their predictions are
8

---

Table 2: Adversarial robustness against PGD white box attacks
CIFAR-10 (average)
CIPAR-10A (overage)
ColchMMgryy_bor
Colch&Amusttcche]
Mithhods
Robuat
Clean
Robust
Clean
Robust
Clean
Robust
Claan
CE Min.
00026
0.8911000033
0.0550000001
0.70460.0022]
0.0161000000
0,78510000000
0.019600.000
0.655000055)
AF Max.
(002))
0:300)0000057)
0.02670.0055)
0:7222(0.0077)
0,785 0.016160.0000
0.019600.0000
PGD
02275)000087)
0.99290,0085)
0.04)))00044)
0.3149000003)
0.257660.0020)
0.4946000
0200770.00055
0.5040/0.0019)
TRADES
0
0.563100.0445)
0.17670.00226
0.3975(0.0065)
0,969700.00 0.255)(0.0001)
0.206900.0016
0.50
MART
0.997100.0033
0.3167(0.8011) (6600000000)
0.4874/0:00035 0.266))3)00066
0.214700.0022
0.00550000115)
AGAP_LN
0.65450.0111)
0.462840.0138) 0.99570000009
0.2933100.00000
0.51860000330
0.25%60.0044
0.86930000019)
AGAP TPN
(.0002)))0022)
066266000020
0.2188/000040)
0.4675(0.0075)
0 0.2505(3.0022)
0.4944/0.0004 00477
0. 2.2200000100
0.54990.00-01
(DD]OOk
BLDDOOX
BDDTOOK(rmmn)
BDDDD0K,
Mathods
Ralear
Clean
Rohrat
Clean
Rohost
Cleam
Robust
Cleam
CE Min.
(000400000)
0.73740.00665
0.0559000000
006625018217
AF Max.
00004))00000
045000.01583)
0000))000000)
0.6262(0.0101)
0. (0.000)
0.0053(0300044
(.66810.0029)
PGD
0.609100.0140) 0.2263)00085)
0.1378000001)
0.180500.002)
0,3688/0.01 0.1620(0.0067)
0.16440.0067)
0.40970001055
TRADES
0.44900.3200)
0.1666000011)
0.257900001
0.2203(1.0016)
0.4807703
0.34110000013
0.52500.0002 (012)
MART
0.22300000777
0.40740.0164)
0.1865000002 10000.0007)
0.366100.008 0.17000.0044)
0215770.0000
0.46990.0055
AGAP LN
091880001177 37)
0157200.0111
01617000021
0:255500007 73
0.SROTO D033
0. 0.0000
0.3485000039
AGAP LPN
0.29))()0011))
D. 0.555520.0047
0.1752/0.0013
0.25520000044
0.259%(0.0032)
0.5194/0 00333
0. 0.24440000366
0.545)000088)
Table 3: Adversarial robustness against APGD white-box attacks
CIFAR-10 (averago)
CIFAR-100 (1veR-1000
Celeh-Aggmy Fuir)
ColehhAimustache)
Methods
Robeat
Clean
Robust
Clean
Robust
Clean
Robust
Clean
CE Min.
00524000005
0.89440.003)
0.0255000000
0.70+60.0062)
0.0161000000
0.785100.00222
0.019600.000)
0.6655000055)
AP Max.
20026(00012)
0:30)7(0.01557)
0.025)(00000)
0.7223(0.0K77)
0,7851 0.0163(0.000)
0.01560.30000
0.6517(0.005
PGD
0.2670000054
0.99290.0085)
0.15800.0055)
0.314900.0083)
0.2560(00000)
0.494600.000 0011)
0 0.20600000044
0.5040/0.0019)
TRADES
0.56310000455
0.17390000077)
0.30750.00K5)
0.2573(0.0025)
0.4697/0 (0120)
0.202200000133
0.5049/0.0000 1001)
MART
02222)
0.09710.0093)
(0020
0.316700.007)
0.25220.00225
0:987440.0035
0.505300.0155 (200000.002
AGAP EN
025940000561 08915000014
0:42250.0133) (135000000)
0.3186000030
0.2018000001)
0.4693000019
AdAP IPN
0.2252(000022)
0.6266000020)
0.2161N000040)
0.46750.00755)
0.2785(000027)
0.4944/00 00477
0. 0.22220000008
0.5489(0.0001)
BDDiOOk
BDDDOOX
BDD(OOK(rmmy)
BDDD00K/Glody
Mathods
Roleat
Clean
Rohrst
Clean
Robust
Clean
Robust
Clean
CF Min.
(001400000)
0.0 POR00000
0.757420.00653
006620010211 0.0000000000
AP Max.
0.00140.0000
063900.01583
0.0566000000)
0.26220.0101)
0 0.0382/0.000L)
0.756600 00565
0.0387.0.000
O 0.668 (0.002))
PGD
0.253500.0055)
0.449.0.0145
0114400.00)3
D. 1180500.0022
0,1722/0 (086)
0,3689CC 01 71)
0,212800 0.2777
0,4497(0.0105
TRADES
0.1819000015)
0.44590.0208)
0.257%00.0012 0.15630.0011)
0.2087).00114
0.4807700000 0023)
0.23660.00133
0.250/0.00226
MART
0.18650000000
0.160440.004)
0.212000.00383
0.44690000055 0055)
AGAPIIN
01GGG600013 (5726030141
0:2526000011
0.540100:0553)
0
0.3830000039)
AdAP_LPN
0.255(0.0114))
0.555%/0.004))
0.1747(0.0014)
0.255200.004)
0.2579(0.0031)
0.5194/0.0033)
0.2719000005)
0.5456/0.0087)
Table 4: Adversarial robustness against box attacks
CIFAR- 10 (avergg))
CIFAR- (overuge)
ColchAggra Pair)
ColehAimustache)
Robust
Robast
Robust
Clicn
Clean
AP Max.
0113700074
0.90070.0037
00088010511
0.7220-00077
000627000000
0.785100.0035)
0.0196000000)
060177000557
FCID
0.459400074
0:314900.0083)
0
0. 0015)
0.4 0:1180000010
0.30R000011)
TRADES
0.514810.0029)
0.563100.8015)
0.34200.0045)
0.397500.085)
0.4697/0.00000 0.436000.0033
0.395300.0009
0,504940.0001
MART
0.46260.0083) 0.897100.0093)
0229220.00077
0.316700.007)
0.167440.0033 (.0078
0411880000133
0.505340.0015)
AGAF
05500000777
550000009)
04755000011
0.31850000300
0.56350000111
0.662100015)
AGAP_LPN
0.00310000288
0.6526/0.81300
04166/0.0072)
0.4875/0.0055)
0.4623(0.0047)
0.4951(0:0047)
0.4334000046)
0.543900.0441
BDDD00Xtresdmmiall
BDD(OOKraing)
BDDTOOKcGkaty)
Methods
Robust
Clean
Robast
Clesn
Robust
Clean
Robust
Clean
Max.
0.63900.0155)
0111900:006)
0.262/0.0101
0.0699)0022))
0.75660.00566
0.19010.0064)
0000100
FCD
03722000231 0.009100.0116
0129700022
0.10050.0022)
0.356680072 72)
0.36850001755
0.11940.0089)
TRADES
03764(0.019)
0,44590-11208
02300)000010)
0.257900.0011)
0,4045(0.0005)
0.4807/0.0008
0,47520.00188
0,52500.003 D026)
MART
0.32770.0161) 0.6044000164)
0.16600.0020)
0.1865(0.0020)
0383990.0085)
0,366100.000
0.410%0.0047)
0.4669000055)
AGAP LN
0.34960.8168) 0.572600014))
02287:0000227
0.3090000022)
0.5234(0.0025)
0,3,0100,05S3
0.87220:0011
0.5185000039)
AGPP_LPN
0.525200.062)
0.555800.344)
0.24660000088
0.255200.0044)
0.5000000667
0.1194000053)
0.4975(0.085)
0.54770.0087)
Table 5: Comparison of different adversarial AP maximization methods
CIFAR- (average)
CIFAR- 100 (average)
BDD100K/(nne)
BDD10KKraing)
Methods
Rabust
Clean
Robust
Clean
Rohust
Cleta
Robust
Clean
AGAP_MM
02759100062)
0.4706/0:3136 26)
018878000047)
0.3843000105)
0.582916:0285)
0.219900:011
0451660.0053)
AdAP_FZ
03105100018)
0.61120000099
02109(0.0002)
0.270800.0100) 0.0765
0.57710.0516)
0.53400.0099
0.5031000104)
AdAP 1.Z.
03012)00194)
0650820.0129)
(1999000084)
0.4023)000000
0 0.3619000012))
0.6212/0:0007)
0.21080000011
04664000165)
A
0.24990.00477
0.64450.00144
0.195/0000699
0.46284000138)
0.2918(0.015))
0.57260.01413
0.2545/0.0017)
0.54010.0053)
AGAP LPN
(.3301().0222))
066266080229
0.2189(008440
0.2986(10122) 0446750.8075)
0.555800.004))
0.259%0000333
0.51940000335
affected by adversarial perturbations. For fair comparison, we apply the same perturbation crafted in we can observe that for TRADES, all the samples' prediction scores cluster closely to a small value before perturbation as it is working on an imbalanced dataset, while the prediction scores of our method scatter more evenly. With introduced perturbations, the ranking order predicted by TRADE is changed significantly with small changes in prediction scores, which leads to a considerable decrease terms of AP. On the contrary, the perturbation does not affect the predicted ranking order of our method, despite the impact on their prediction scores. This helps demonstrate why our method more robust than other baselines in terms of AP.
5.2 for both methods. From Figure 3
5.5 Ablation Study
To investigate the significance of the new features in our proposed method, i.e., the listwise adversarial regularization and the non-zero-sum game approach, we conduct ablation studies to compare different approaches shown in Table D for adversarial AP maximization. Following the setting in 5. we

---

CIAR1O class
CEANLOD: C
BOD100K: cluuy
CaleSA: gray. 1el
APrA Tha
Ten TIATES
025 K1A R.5
03
Figure 2: Visualization of the trade-off between robustness and average precision. For the sake of clarity in these figures, we defer the detailed values to Table 9 in the appendix to additionally demonstrate the correlation between robust AP/clean AP and A.
AdAP LN
TRADES
AGAP
TRADES
Cleen
0,5500
0.555
0.066
00777
0,0022
Patureed
BUDWOC Danzet
OdebA Detrett
Figure Visualization of models' predictions after perturbation
run all these five approaches on C0 CIFAR100 and BDD100K datasets. The experimental settings and the hyperparameters for AdAP_LN and AdAP AdAP_LPN are the same as those in 5.1. The hyperparameters we tune for AdAP LZ are the same as those for AdAP_LN, For AdAP_ AdAP_PZ. we tune the weight parameter in ( 11, 4, 8, 10, 40, 80, 1003. For AdAP_ A_MM, we tune ?1 in [0.1,0.9). The results are presented in Table 5 We can see that (i) robust regularization approaches are better than the minimax approach (AdAP MM) (ii) the non-zero-sum game approaches (AdAP LPN, AdAP LN) are usually better than the zero-sum game approach (AdAP LZ); (iii) combining listwise and pointwise adversarial regularization in AdAP LPN could bring significant boost in term of both robust AP and clean AP.
Insensitivity to Batch Size. We investigate the proposed approximation method for g(w) by varying the mini-batch size for AdAP _L algorithm and report results in Figure 4 in the appendix. We can see that AdAP LN does not require a very large batch size and generally not sensitive to the mini-batch size, which implies the effectiveness of our approximation method.
Sensitivity /1 72- We study the sensitivity of the apper-parameters ?/ 72 for proposed AdAP LN algorithm. From the results in Table & in the appendix, we can observe that 71 have significant impact on the performance. However, when we tune 7/, 72 in {0.1, 0.9). is able achieve relatively good performance but not always the optimal one.
Empirical convergence analysis. We report the convergence curves of proposed AdAP_ LN algo- rithm in Figure5 in the appendix, which demonstrates the convergence of the algorithm.
Time efficiency. We compare the training time efficiency of the proposed method with different algorithms in Table [ in the appendix. We can observe that (i) adversarial training methods are generally more time-consuming than natural training: (ii) our proposed AdAP_LN and AdAP_LPY methods cost a little more time than traditional PGD method but much less time than TRADES.
6 Conclusions
In this paper, we have proposed a novel solution for maximizing average precision with adversarial ranking robustness. The proposed formulation is robust in terms of listwise ranking performance against individual adversarial perturbations and is able to trade off between average precision on clean data and adversarial ranking robustness. We have developed an efficient stochastic algorithm to solve the resulting objective. Extensive experimental results various datasets demonstrate that the proposed method can achieve significantly improved adversarial robustness in terms of AP, compared with other strong adversarial training baselines. would be interesting to extend our method to construct more robust systems with average precision as the objective, such as object detection systems and medical diagnosis systems.
Acknowledcements
We thank anonymous reviewers for constructive comments. G. and T. Yang were partially supported by NSF Career Award 2246753, NSF Grant 2246757, NSF Grant 2246756, NSF Grant 2306572, and GM gift funding.
10

---

References
[1] Sravanti Addepalli, Vivek BS, Arya Baburaj. Gaurang Sriramanan, and R Venkatesh Babu. Towards achieving adversarial robustness by enforcing feature consistency across bit planes. In Proceedings of the IEEE/CVE conference on computer vision and pattern recognition, pages 1020-1029) 2020.
[2] Tao Bai, Jinqi Luo, Jun Zhao, Bihan Wen, and Qian Wang. Recent advances in adversarial training for ad adversarial robustness. CoRR, abs/2102.01355 2021.
[3] Kendrick Boyd, Kevin H Eng, and C David Page. Area under the precision-recall curve: point estimates and confidence intervals. In Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2013, Prague, Czech Republic, September 23-27, 2013, Proceedings, Part III 13, pages 451-466. Springer, 2013.
[4] Andrew Brown, Weidi Xie, Vicky Kalogeiton, and Andrew Zisserman. Smooth-ap: Smoothing the path towards large-scale image retrieval. In Computer Vision-ECCC 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part IX 16, pages 677-694. Springer, 2020.
[5] Christopher Burges, Robert Ragno, and Quoc Le. Learning to rank with nonsmooth cost functions. Advances in neural information processing systems, 19, 2006.
[6] Fatih Cakir, Kun He, Xide Xia, Brian Kulis, and Stan Sclaroff. Deep metric learning to rank. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 1861-1870, 2019.
[7] Zhe Cao, Tao Qin, Tie-Ya Yan Liu, Ming-Feng Tsai, and Hang Li. Learning rank: from pairwise approach to listwise approach. In Proceedings of the 24th international conference on Machine learning, pages 129-136, 2007.
[8] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks, In 2017 ieee symposium security and privacy (sp), pages 39-57. leee, 2017.
[9] Kean Chen, Jianguo Li, Weiyao Lin, John See, Ji Wang, Lingyu Duan, Zhibo Chen, Changwei He, and Junni Zou. Towards accurate one-stage object detection with ap-loss. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 5119-5127, 2019.
[10] Wei Chen, Tie- Yan Liu, Yanyan Lan, Zhi-Ming Ma, and Hang Li. Ranking measures and loss functions learning to rank. Advances in Neural Information Processing Systems, 22, 2009.
[11] Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In international conference machine learning, pages 1310-1320. PMIR, 2019.
[12] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning. pages 2206-2216. PMLR, 2020.
[13] Elad Eban, Mariano Schain. Alan Mackey, Ariel Gordon, Ryan Rifkin, and Gal Elidan. Scalable learning of won--ooonnooeee -ooccooopeo objectives. In Artificial intelligence and statistics, pages 832-840. PMLR, 2017.
[14] Logan Engstrom, Andrew Ilyas, and Anish Athalye. Evaluating and understanding the robust- ness of adversarial logit pairing, arXiv preprint 1rX1v:1807.11272.. 2018.
[15] Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations, 2015.
[16] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples. arXiv preprint arXiv:1412.6572 2014.
[17] Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens Van Der Maaten. Countering adversarial images using input transformations. arXiv preprint arXiv:1711.00117, 2017.

---

[18] Puneet Gupta and Esa Rahtu. Cideefence: Defeating adversarial attacks by fusing class- specific image inpainting and image denoising. In Proceedings of the IEEE/CVF International Conference Computer Vision, pages 6708-6715 67176717 2019.
[19] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770-778, 2016.
[20] Wenzheng Hou, Qianqian Xu, Zhiyong Yang, Shilong Bao, Yuan He, and Qingming Huang. Adauc: End-to-end adversarial auc optimization against long-tail problems. In International Conference on Machine Learning, pages 8903 8925. PMLR, 2022.
[21] Harini Kannan, Alexey Kurakin, and Ian Goodfellow. Adversarial logit pairing, arXiv preprint arXiv:1803.063373 2018.
[22] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
[23] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial intelligence safety and security, pages 99-112. Chapman and Hall/CRC, 2018.
[24] Jiayang Liu, Weiming Zhang, Yiwei Zhang, Dongdong Hou, Yujia Liu, Hongyue Zha, and Nenghai Yu. Detection based defense against adversarial examples from the steganalysis point of view. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4825 4834, 2019.
[25] Zihao Liu, Qi Liu, Tao Liu, Nuo Xu, Xue Lin, Yanzhi Wang, and Wujie Wen. Feature distillation: Dnn-oriented jpeg compression against adversarial examples. In 2019 JEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 160-868. IEEE, 2019.
[26] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of International Conference on Computer Vision (ICCV), December 2015.
[27] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks. In International Conference on Learning Representations, 2018.
[28] Pritish Mohapatra, CV Jawahar, and M Pawan Kumar. Efficient optimization for average precision svm. Advances in Neural Information Processing Systems, 27, 2014.
[29] Pritish Mohapatra, Michal Rolinck, CV Jawahar, Vladimir Kolmogorov, and M Pawan Kumar. Efficient optimization for rank-based loss functions. In Proceedings the IEEE Conference on Computer Vision and Pattern Recognition, pages 3693-3701, 2018.
[30] Seyed-Mohsen -oosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2574-2582, 2016.
[31] Harikrishna Narasimhan, Andrew Cotter, and Maya Gupta. Optimizing generalized rate metrics with three players. Advances in Neural Information Processing Systems, 32, 2019.
[32] Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Berkay Celik, and Ananthram Swami. The limitations of deep learning in adversarial settings In 2016 IEEE European symposium on security and privacy (EuroS&P), pages 372-387. IEEE, 2016
[33] Qi Qi, Zhishuai Guo, Yi Xu, Rong Jin, and Tianbao Yang. An online method for a class of distributionally robust optimization with non-convex objectives. Advances in Neural Information Processing Systems, 10067-1000000 2021.
[34] Qi Qi, Youzhi Luo, Zhao Xu, Shuiwang Ji, and Tianbao Yang. Stochastic optimization of areas under precision-recall curves with provable convergence. Advances in Neural Information Processing Systems, 34:1752-1765, 2021.
12

---

[35] Zhuang Qian, Kaizhu Huang, Qiu-Feng Wang, and Xu- Yao Zhang, A survey of robust adversar- ial training pattern recognition: Fundamental, theory, and methodologies, 2022.
[36] Tao Qin, Tie- Yan Liu, and Hang Li. A general approximation framework for direct optimization of information retrieval measures. Information retrieval, 13:375-397, 2010.
[37] Yao Qin, Nicholas Frosst, Sara Sabour, Colin Raffel, Garrison Cottrell, and Geoffrey Hinton. Detecting and diagnosing adversarial images with class-conditional capsule reconstructions. arXiv preprinl arXiv: /907.02977 2019.
[38] Yuxian Qiu, Jingwen Leng, Cong Guo, Quan Chen, Chao Li, Minyi Guo, and Yuhao Zhu. Adversarial defense through network profiling based path extraction. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4777-4786, 2019.
[39] Edward Raff, Jared Sylvester, Steven Forsyth, and Mark Mclean. Barrage of random transforms for adversarially robust defense. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 0228-6537,222 2019.
[40] Aditi Raghunathan, Sang Michael Xie, Fanny Yang, John Duchi, and Percy Liang. Un- derstanding and mitigating the tradeoff between robustness and accuracy. arXiv preprint arXiv:2002.10716, 2020.
[41] Alexander Robey, Luiz Chamon, George J Pappas, Hamed Hassani, and Alejandro Ribeiro. Adversarial robustness with semi-infinite constrained learning. Advances in Neural Information Processing Systems, 34:6198 6215, 2021.
[42] Michal Rolínek, Vít Musil, Anselm Paulus, Marin Vlastelica, Claudio Michaelis, and Georg Martius. Optimizing rank-based metrics with blackbox differentiation. In Proceedings the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7620-7630, 2020.
[43] Cynthia Rudin. The p-norm push: A simple convex ranking algorithm that concentrates the top of the list. 2009.
[44] Samuel Henrique Silva and Peyman Najafirad. Opportunities and challenges in deep learning adversarial robustness: A survey. CoRR, abs/2007.00753, 2020.
[45] Gaurang Sriramanan, Sravanti Addepalli, Arya Baburaj, al. Guided adversarial attack for evaluating and enhancing adversarial defenses. Advances in Neural Information Processing Systems, 33:20297-20308, 2020.
[46] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfel- low, and Rob Fergus. Intriguing properties of neural networks, arXiv preprint arXiv: 2013.
[47] Christian Szegedy, Wojeiech Zaremba, llya Sutskever, Joan Bruna, Dumitru Erhan, Ian Good- fellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2014.
[48] Guanhong Tao, Shiqing Ma, Yingqi Liu, and Xiangyu Zhang. Attacks meet interpretability: Strributessteerd detection of adversarial samples. Advances Neural Information Processing Systems, 31, 2018
[49] Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Turner, and Aleksander Madry, Robustness may be at odds with accuracy. arXiv preprint 1805. /2/52, 2018.
[50] Guanghui Wang. Ming Yang. Lijun Zhang, and Tianbao Yang. Momentum accelerates the convergence of stochastic aupre maximization. In International Conference on Artificial Intelligence and Statistics, pages 3753-3771. PMIR, 2022.
[51] Mengdi Wang, Ethan X Fang, and Han Liu. Stochastic compositional gradient descent: algo- rithms for minimizing compositions of expected-value functions. Mathematical Programming, 161:419 449, 2017.
13

---

[52] Wentao Wang, Han Xu, Xiaorui Liu, Yaxin Li, Bhavani Thuraisingham, and Jiliang Tang. Imbalanced adversarial training with reweighting. In 2022 IEEE International Conference on Data Mining (ICDM), pages 1209-1214, 2022.
[53] Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In International Conference on Learning Representations, 2020.
[54] Zhengyang Wang, Meng Liu, Youzhi Luo, Zhao Xu, Yaochen Xie, Limei Wang, Lei Cai, Qi Qi, Zhuoning Yuan, Tianbao Yang, et al. Advanced graph and sequence neural networks for molecular property prediction and drug discovery. Bioinformatics, 38(9):257--2586 2022.
[55] Peisong Wen, Qianqian Xu, Zhiyong Yang, Yuan He, and Qingming Huang. Exploring the algorithn-dependent generalization of aupre optimization with list stability. Advances in Neural Information Processing Systems, 35:28335-22 22344,, 2022.
[56] Yao- Yuan Yang, Cyrus Rashtchian, Hongyang Zhang, Russ Salakhutdinov, and Kamalika Chaudhuri. A closer look at accuracy vs. robustness. Advances in neural information processing systems, 33:8588-8601, 2020.
[57] Fisher Yu, Haofeng Chen, Xin Wang, Wenqi Xian, Yingying Chen, Fangchen Liu, Vashisht Madhavan, and Trevor Darrell. Bdd100k: A diverse driving dataset for heterogeneous mul- titask learning. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 1536-26453 2020.
[58] Jianhe Yuan and Zhihai He. Ensemble generative cleaning with feedback loops for defending adversarial attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 581-590, 2020.
[59] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning, pages 7472-7482, PMIR, 2019.
[60] Mo Zhou, Zhenxing Niu, Le Wang, Qilin Zhang, and Gang Hua. Adversarial ranking attack and defense. In Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XIV 16, pages 781-799. Springer, 2020.
14

---

A More Experimental Results
All experiments in our paper are run across 16 NVIDIA A10 GPUs and 10 NVIDIA A30 GPUs. We present the statistics for each task in our experiments Table 6
Table 6: Datasets statistics. The percentage in parenthesis represents the proportion of positive samples.
Dataset
Train
Validation
Test
CIFAR-IU
40000 (10%8)
10000 (10%)
10000 (10%))
CIFAR-100
40000 (5%)
10000 (5%)
10000 (5%)
(DD1OOK(unnel)
55890 (0.18%) )
13973 (0.19%)
10000 (0.27%))
(reioOK(rssdemmia)
55890 (11.56%)
13993 (11.56%)
10000 (12.53/8)
BDDIU0K(raiay)
55890 (7.26%%)
13973 (7.26%%
10000 (7.38%))
BDD (cckaud)))
55890 (6.9918)
13973 (6.98%)
10000 (7.38%)
CelehArgray hair)
(4,24%)
19867 (4.87%)
19962 (3.19%)
CelebA(tusstcche)
162770 (
19867 (5.05%)
19962 (3.87%)
A.1 Time efficiency of our proposed algorithm
Time efficiency is typically a concern for adversarial training techniques. To order to investigate the time efficiency of our proposed method, we' ve conducted some experiments to show time efficiency comparison with different algorithms. In the experiment, we set the parameters, which could affect training time, exactly the same(e-g. batch size as 128, total epochs as 60, adversarial samples are generated with 6 projected gradient ascent steps) and run all the models over three times on the Class_ O task of CIFARIO. From the table we can observe that (i) adversarial training methods are generally more time-consuming than natural training: (ii) our proposed AdAP LN and AdAP LPN methods cost a little more time than traditional PGD method but much less time than TRADES. This is because, to generate adversarial samples in training, TRADES is solving the maximiza- tion of KL divergence between the probabilities predicted with clean data and perturbed data(i.e. max] Σx h(r),, log h(x)) h(x)x, log h(x + d)R. where h(z)) and h(r + 5))x are predicted probabilities for class k on clean data and perturbed data respectively, which requires two forward propagations and one backpropagation in each projected gradient ascent step. However, PGD and our proposed methods are directly solving maximization of Cross Entropy(i.e. max f log (xx++)))) which only needs one forward propagation and one backpropagation in each projected gradient ascent step. In adversarial training, since each gradient descent step w.r.t w requires multiple gradient ascent steps w.r.t 8, the computational expense primarily stems from the projected gradient ascent steps, which can be also observed by comparing the efficiency of CE Min. with PGD.
Table 7: Training efficiency comparison
Methods
Run
Run 2
Run
Average
CE Min.
5633
56fs
5688
565.67s
AP Max.
5894
590s
589s
589.33s
PGD
2833s
2804s
28036
2813.33s
TRADES
4203s
4182s
4179s
4188.00 00s
3192s
32054
3194s
3197.00s
AdAP LN
32276
3213s
3211s
3217.00s
1PN
3234s
3219s
3218s
3223.67s
A.2 Sensitivity of proposed algorithm to batch size
In our proposed algorithm, one essential step is the approximation of g(w). Due to the non- linear dependence of V WwR,(,, D) on g(w), we cannot simply use their mini-batch estimator in the calculation as it will yield a large optimization error [51]. Instead, we maintain vector u [uj, u2, uz] for tracking [91 (w), (2).2((2)))))) (w).gs( to reduce the optimization error. The vector is updated by Equation (TI.. To offer more empirical results on this, we have conducted some experiments to investigate the proposed AdAP_LN' sensitivity to batch sizes on CIFAR10 1 dataset. The results are shown in Figure 4 We can observe that our method does not require very large batch size to achieve good performance and is generally not sensitive to batch size, which implies the effectiveness of our approximation method.
15

---

CIFAR10
ds
ds
Robust AP
0.4
ds
cls
cls
cls
dls
mAP
100
200
300
400
500
Batch Size
Figure 4: Illustration for insensitivity of AdAP LN to batch size
A.3 Sensitivity of proposed algorithm to 7/ and 7/2
In our main experiments, the hyper-paramene parameters Yı 72 for our proposed algorithms are tuned in {0.1, 0.9) mentioned in Section 5 To study the sensitivity of these parameters, we conducted some more experiments on CIFAR10 10 and BDD10OK datasets. The results are summarized in Table X From the table, we can observe that "/ 7/2 have significant impact the performance. However, when we tune 71, 72 in {0.1, 0.9), it is able to achieve relatively good performance but not always the optimal one.
Table 8: Robust AP validation for AdAP LN with different / and 722
CIFAR 10 (avenge)
23
0.3
Tg 0.5
Ta. 0.7
0.9
711 0.1
0.2719(0.0166)
0.2750.0079)
0.275(0.D103)
0.2756(0:0135)
6.27530.0114)
0,3
0.2701(0.012)
0.2696(0.01)
0,27530.0128)
0.2733(0.0101)
0.2745(0.0107)
11 0.7
0.2674(0.0088)
0.2741(0.01))
0.2688/0.1088)
0.26850000335)
0.274100.0113)
0.2649(0.0003)
0.2713(0.007)
0.268620.0165)
0.2696(0.0138)) 38)
0.2658(0.0103)
11
0.2668(0.0137)
0.2766(0.013))
0.2668(0.013)
0,2689(0.0139)
0.2641(0.012))
BDDJ00K(n)
0.1
0.3
0.5
0.7
0.9
11
0.2438000219
0.24420.0188
0,2415(0.0220)
0.3
0.2471(0.0219)
0.2440000114)
0.2432(0.0169
0.2473(0.0214)
0.24600000888)
71
0.2479(0.0210)
0.2475(0.0219)
0.245010.0189) 0.24760000117)
0.2472(0.0187)
11 0.7
0.2507(0.0203)
0.2453(0.0204)
0.2471(0.0199) 719))
0.246100.0006
0.2480X0.016)
11 0.2522000228)
0.2479(0.0200)
0.2485(00200))
0,2447(0.0193)
0.2478(0.0133)
A.4 Empirical convergence analysis
Since the theoretical convergence analysis of our proposed algorithm is very challenging, deriving the convergence would be a significant work by itself. Instead, we provides some empirical results to show the convergence of the proposed algorithm. Specifically, we set À 1, 0.1, 0. = 0.1 and run AdAP LN algorithm on CIFAR10 dataset and BDD100K dataset for total of 120 epochs and 80 epochs, respectively. We evaluate the training loss after each epoch and report the loss values. We present the AP loss (i.e., P(w) in Equation 9 and regularization term ( (i... R(w, 8, D) in Equation separately, as well as the summation of the two losses. For each experiment, we repeat three times with different random seeds. The results are shown in Figure 5, which demonstrates the convergence of our algorithm.
Spoth
Spoth
Epoch
2poch
Figure 5: Training convergence curves on CIFARIO 10 and BDD 100K dataset
16

---

A.5 Detailed values for Figure 2
To clearly demonstrate the relationship between robust AP/clean AP and X, corresponding to 22 we provide the detailed values in Table For TRADES, AdAP_IA IN and AdAP_IPN, the results clearly indicate that there is a positive correlation between robust AP and À for relatively small values of X and this correlation diminishes when À continues increasing. Moreover, a negative correlation between clean AP and consistently observed, in accordance with our expectations. But for MART, the trend is not clear as it is not a trade-off' based approach.
Table 9: The Correlation between Robust AP/Clean AP and A. The results are presented in the format of robust AP/clean AP, with the values representing the average of three runs with different seeds.
0.01
0.4
0.8
10
CIFARIOOGE_
TRADES
0.0521,0.9609
0.4514/0.913
D 0.4476088844 8846
0.4455/0.872
0,4040/0.299 2.00009993000
0. 0.3727/0.7779
MART
0,45118.8777
0,4548/0.8812
0.451900
0,4349/0 8622
0,424740.4400
0.4016/0.88 8164
0,403000 81
AdAP LN
0.1153X1.525
0.426400.925
0.45900.9190
0446660.9099
0.318180.86-19
0.269500.8885
0.2522/0 8356
AdAP LPN
0.1504009338
0.5185/0.9314
0.5263/0.1146
0.52290.9067
0,481889.8468
0.4517/0.8102
1/4411/0.7968
CIPARTOIGI
TRADES
0.0282X0.8823
0.3252/0.7107
0.3241/0.6571
0,309 63244
0.2782X0.5213
0.2759/0.5044
0.2757/0
MART
0.3263016669
4.3207/0.6518
0.3216/0.6527
0,3183/0.6421 6420
0.3075K). 6095
0,2990V0 5839
0,2950005576
AdAP LN
0.0811008752
0.2782/0.7984
73666/0.7668
0.3238/0.7500
0.3644806736
0.3437/0.6286
0.3436/0.66 1664
AdAP LPN
0.160400.3322
0.3475/0.7896
0.3809/0.5558
O. 0.3859/0,7441
0.3724X9.4700
0.3501/0.6011
0,339220.582
TRADES
0.0379X0.6499
0.2301/0.5554
0.23900.5260
0,2382005113
0,2105/0.4255
1565/0.244 2443
0.15100.2193
MART
0.2130N0.4499
0.2130/0.4455
0.2145/0.444
0,2129H0.4400
0,1993/0.3977
1974/039901
0,1887/0.363
AdAP EN
0.062100.604
0.2221/0 10.22/0..500 5986
0.27420.5632
502515
0,2796/0.495 4935
0.2347/0 4937
0.2103/04486
AdAP LPN
0,041 18066707
0,2455/0.5985
0,2682/0.5681
0.2726/0.5600
0.2725/0.48K6
0.2464/0-4366
0.2473/0.4299
CelehMggray hair)
TRADES
0.0161
0.2341/0.5422 5428
0.2581/0.4707
0.2571/0.4513
0.244770.3823
0.2206/0.366
0.2265/0.3422
MART
0.256780.4910
0,2576/0.4888
D. 0.258220.486
0. 0,259440. 4864
0,2617/0.4788
0,2613/0 4696
0.2616/04461
AdAP
0.026-N0.7037
0.1831/0.6288
0.2449/0.606
0.2696/160010
0,2859/0.5221
0.2714/0.4666
0.2601/0.4506
AdAP LPN
0.028400.123
0,2280/0.6259
0. 0.2555/0.5907
0,264480,5804
0.2799/0.4944
0,2676/0.4515
0.2676/0.415
A.6
Detailed experimental results on CIFARIO and CIFARI00 Dataset
Due to the limit of space, we include MAP results over 10 classes on CIFARIO and CIFARI00 datasets in Section 5.1 and Section 5.2. Here, we present the detailed performance for each class on CIFARIO and CIFAR 100 datasets in Table T0, Table IT, Table 12 Table [3] Table 14 Table 15 From Table I0 Table [I] Table [2 and Table 13 about white-box robustness, we can observe that, in most cases, our methods improve other basclines significantly. There is one special case on CIfARI0 Class_3 3 in TO) that MART method behaves much better than others due to high variance (we can see it from the deviation in the parenthesis). When look at Table [2] about white-box robustness against stronger APGD attacks, we can find that the superiority of MART disappears on CIfARIO 10 Class 3 since the advantage gained by high variance is not stable. From Table [4 and Table 15 about black-box robustness, we can observe that our methods outperform other baselines by a large margin consistently.
A.7 More plots for trade-off visualization
Due to page limitations, we present single trade-off curve for each dataset in Section 5.3 to illustrate our findings. In this part, we include more trade-off curves on all the datasets in Figure 6 Figure 7 Figure 8 Figure our methods.
9 These additional figures provide further support for the superiority of
Table 10: Adversarial robustness against PGD white-box attacks on CIFARIO dataset
clao_
Melaals
Robso
Clees
Robant
Cleas
Raland
Cless
Rulsod
Cleas
Rebeas
Cleas
CE Min
1100000000000
08828/30011
0.90560 (uU))
DED6GN (0G3)
019751080066
6A522100005)
0.502200 1921:
01726600 0125)
(.5566m D6D0)
POD
01315130339
KEGIOAA D1311
TUESGAN DOOKL
0.31000 R131T
10 TITO21 KEBBI
D WTT3NO (O7()
TRADUS
043730018113
MASTMOOIEES (ME5))
0.MMCAD (8544)
8 12922040904)
11228000 (RCM)
IL D0G0
ABAEIN
17 17155
TE IEGGMIIINEE
10 1E3000011177 TETROANTTT7
IL TUSSAIIEENT
(013))
6 40300000
I (012560118977
dew
28m
dbss
Metsals
Cleas
Robest
Clen
Rafent
Ribeet
Cleas
Relwe
AP Max.
0161909005
00449000022
0.041600 18221
O 005455888355
ILSS 1091309993))
17 07308009000 19911
T 11100001100
11 11
TRADES
222300000775
012290000000 (NI0O
034920080299
039220000235
0.090000000 201113
0337770400541
(060001190
0L706000012
AZXE
(3975100255)
11 HE0SS0TOO0
ARVELII
0 0.2611890044
0.54690010222
(.STR5VLUMDE))
063371000029)
9.35448-0831
0.2221000003
0.456498,9241
01415000029
0029)
17

---

Table 11: Adversarial robustness against PGD white-box attacks on CIFAR 100 dataset
Nethelk
Rabee
Robeer
Clean
Rebeer
Clean
Rebeet
Claan
Releett
Class
TEMM
062550 (600)
R.54ERN
I665660 (002)
0,559000 (022)
(000)
0.730000
0.00120000155
0.655500 (NEES)
TGD
T0 103000011 (896)
11316600
VESTRRRETNEER
TRADES
0.1770 0010
1035600 5009)
DJ 0J15420 (020)
0.355501 (007)
0.56500 0100)
10030
(053)
0.367600
(119)
0.30000 (03
6.528000 (990))
MART
0. 1116500
(057)
0.56510
01150/00000
(1444)
0.149/0
0J005500
0336600 0054)
0,40050
01558000
MJA LPN
0.3372000055
0.39660001--)
0231609.000)
0.44GN0.009
0.3916000000
0.73430.0111
0
0.3065/9.0455)
0.497NN (019)
(386649.0008)
0. 0.545960/0014
dlsr
clanpo
Natheb
Kobea
Clean
Robeat
Clean
Robeat
Cleas
Rebeat
Cleas
Rebsay
Cleen
IGD
I 8J56-0 1918)
01333000 (057)
11006200 1890)
Q. 0.158803 255000380005
01399 (1--7)
TRADES
B6563m 0000
0397750 60063
14550 0030
848800
17510 (3
100000 1000
1111000
AMAFTX TX
DUT1N00 (00))
015600008555
11395000 (000)
(C 0000
0230500
AMA 1PN
(L3800000000 (11766010660
B 06135000 (037790//177)
0107000 00077)
01 01195000001
0 11900000 (IOS)
Table 12: Adversarial robustness against APGD white-box attacks on CIFARIO dataset datasee
CIPARIO
Alsc
Mathok
Rabraa
Releat
Cleas
Relho
Barnaa
Belvet
(051R04001)
0.5000 (MQ6)
036321006111
0.2998 (31123
PGD
8429100085)
CAIDROULL11) 313
C44421001113 13
0 02209199244
0.31500000311 13
0.12200029555
031739/200255
04P221000254)
0.25C310/N121)
0.HOND (01
61339902004)
0.2085
MART
3.5500 0109
305680-29155
3 07796000000)
0.240000 (0114)
AdAP IN
cummonar IT)
B (066))
B 2001
0.56TRI00154)
0. 011440000000
0 01700000133) 01501000117)
0 TTT9AA (817))
MMP-_1PN
6452908825)
0.7992000088)
0.5133660033)
09145:00006)
0.201300800)
0,503600:0475
6.8422000600
0.2999/50035
0.1543/000065
0,5011/0100021
3lou3
cam_3
<lor
TIMB
B05 CESTROR
Mac.
DGS 005080000000
BCC 2000
000390000000
4
0 000000000000
INDD
02134060000
(
212271 0128)
009281022125
6481
0:2090000388)
TRADES
0.3700033557
0.
0.7009/200122
MART
0.335500009)
6.3344000155
0400NO (000)
0
0.35550
(062)
000651002200
1407770000177
0. 0.54420000055 0.7997500035
0 0.0035CC009 (967)
MAP 1N
0080)
0.909 (0/0063)
0016000000
0.59H 0006
028188000755
0.4346000555
0.898:00000 39
02209/000341
0.72560.0176
Table 13: Adversarial robustness against APGD white-box attack CIFAR100 dataset
CHARRO0
Mathack
Ratrer
Clean
Robea
Claan
Robeer
Clear
Robhet
Rolhert
TT. Mi
Booesa (ERR)
ICB HOT (00S)
Max.
(8A0))
EL370000 (4124)
(MEES)
PGD
0110000 0017)
0.31250
IU15310
033330
0.56180
(055))
(022))
TRADES
0.117100001 ()11)
D.256000 D020)
D. 0.102NO (X25)
0.3855/0.0O (067)
0.353-0 (943)
0,56570 0100)
16300 (X53)
0.39760 (119)
0. 0,502H5 (M92)
0. 61529R0C (M950)
MART
D. 1011000.000 (660)
012 (009)
0L16640 (033)
0.34170 (06
0.3220 10733
0.56510 (0544)
127600 12)
0.338000 (090)
0.31260 (0LE)
0.51400 (NSS)
LPN
(12128011066)
1133420111111
(14903001 (919))
0.3535/8/015)
Maebock
Bultea
Class
Rolkot
Cless
Roblet
Cless
Rollet
Cleas
Robeett
Cleas
Mis
DC3550 1000
IX506000 (005)
NV05550 (000
776600 (009)
885550 (000)
8 (057)
000000 1000)
005500 8007)
DIREOS 10005
035600 (WP5)
PGD
(ETTROL1665)
R151100150
IL34400 (919)
01341801182 (8CS)
0.13 (4577)
(L094300 19990)
0.150103,81599
(1291502
TRADES
BLC94501.00 (053)
IK297204 CORR)
0.34360 (000)
64289910000 (407)
0.3143 (011)
01284000 (400)
0.00400 (M03)
0.11790 (354))
C. 01300502 (0154)
0,400002 (N10O)
MARI
(1000
1345500
011572/210447)
1.
(607)
0,350000 (63i)
011T110 (070)
0159660
001.5
0.86400
0.05500
0.38510 8550
01550000 (117)
MIA 1PN
(L3866010605)
81176600066)
(.3121000017
0.56TIN 0153)
0.1350000009 (.3199111911
0 6115530 (.MI6011907
(015))
0.194399.0564
0 03500007 (IOS)
Table 14: Adversarial robustness against black-box attack on CIFARIO dataset
CIPARIO
clss.
clas.2 2
Metbokk
Bubrut
Cloon
Cleas
Rubbs
Clesn
Ruinus
Rulkutt
INDD
8571500115
CIAISSIO 315
6387500001155
38099-3 W7M..
n 1 0135)
61 111 OpSTV
(0005000155
TRADES
8 (011)
n 30600 Dona
d Sansic (8778)
MAKI
C00121000055
6314H09954)
0.B0WO (061)
029090022125
011221/00143
0.2510/0/0114
62782200088)
0365816.0113
(9145000066)
(458301857)
039066002475
62150000019)
0.2766/30039
0.3962109857)
015001/2/19022
Mattook
Clon
Claan
Robuo
Clon
Cloon
Relvet
Class
CIRMIDMES
TRAIES
TLT 2009
MART
84155000055
63924100025)
440000 (950)
66345008599
06657100500
066771000711
0.7997000000
0 0442500000500
AMAFTTN
03098000000
0.565800026)
0,70280000255
Table 15: Adversarial robustness against black-box attack on CIFARI00 dataset
Medaods
Rulnal
Closs
Ralral
Clan
Rubrad
Claa
Cloas
Robual
Clean
AP Ma..
21918000051
507041000455
015080100360
CXNNSTOO s0y
02306002200
077322000000
TRADES
0.2590000255
0.8454106081)
(33884000069)
0.353600 5065)
0,455K00 DE5500
0.5269M0 (000)
MART
9 3186900343
33145506677))
634110000000
8006)
(66511000345
0.226000 2079)
0338500-0000
0.88120 D000
0.51000 DEG1)
ABFF EN
0.3131000:55
s Clen
daa Clenn
daau Clean
clarg Clean
Metads
Bobeat
Clos
Rubvad
Ruller
Robea
MPM
15
DOTEEN 2064
BOST0000117
B.81500000
PUD
$1592000133
0.10/1000151)
A 51892190085)
63255108577
IL 0390150011477
MART
31756003355
0.551100010 dn)
0.1117N..00 5005)
nostsmm 2049)
0.665m 000r)
(134550 0150)
D 0.357700 (11T)
ARAFTT TN
5TT 1001111
2.9015001 316
APX 1PN
8-780/004140
8.89291081400
019039988115) 11)
EL11000 30134
01197800011)
0.55100 (IDK)
18

---

MAY
MATT
NO.
Clsan
579 0a0
Clann A7
Claan
CIARRO0 cl355,4
CRAKLO class
CIAKLO clas.
CIFRR10 coss
1.52
2.1
605
class
CPAR10: dlas
0 AP
Cran AP
Figure 6: Visualization of the trade-off between robustness and average precision on CIFARIO dataset
DPAR10:: daas
CIPAR302:
CHARBOO:
CHARSOO: cass.
3:14
Juar 275
MA
Mar.
of Mar.
Ocan AP
1.4 DEAR102:
65
05
04
CHAR100:
CEAR102 Saet
CEAR1O::
TRAPE
Claan
CEPAA1 risss
CIBAR1 b0 disss
Cean
Figure 7: Visualization of the trade-off between robustness and average precision on CIFAR100 dataset
Oe31 A0
Cloan AP
CeanAF
CeanAr
Figure 8: Visualization of the trade-off between robustness and average precision BDD100K dataset
CalesA: mudatte
5.20
AMFT
2P
0.55
CeanAr
Figure 9: Visualization of the trade-off between robustness and average precision on CelebA dataset
19

---

B Theoretical Results
B.1 Proof of theorem 1
Note that robust ranking error is defined as:
Rrob 103,,,,133,,000 E B((O,),, +6) 1 max h(x, + 8,)}.
(13)
xjED-
Then we can reformulate it as:
Rooh- = Pr(3,,, E B(0, e), (xx + 6:) v
max h(x; + +,)) x: E D+) xjED
= Pr (3,, 83 E B(0, e), [xx + 6:) -
max x,ED_
h(x; + 65) [((x;) > max (x
x,ED_
* Pr((((x)) > max xjED-
h(xz) x E D+)
+Pr(33, 8, E B c), M(x; + 6:) S max h(x, + (j)) [[(x;) S
max 1(x)),x; D+)
xjED_
x,ED_
Pr)(((x)) & max h(xz) x; E D+)
X,ED
-Pr(((((x,)> > max h(x;)) ^ (36; 0j E <B(O,e),l(xx + 5.) S max 1(x; +1]} x; E D+)) x,ED
x,ED_
max h(xz) |x, E (D+) x, +1 (xx)
=Ex,~D, 1(h(xx)
> max x,ED
(( 63 E (B(00)), h(x; + +0) S max h(x, + +b)}
xjED
+ Ex D, S max h(x,)} xFED_
Notice that the last two terms above are exactly the considered boundary error Rody and misranking error Root- Therefore, we have Ryob- Rody + Rnat-
B.2 Extra algorithms for adversarial AP maximization
Besides the Algorithm shown in Section 4.2, we present the other algorithms for adversarial AP maximization in this part. Algorithms for solving AdAP PZ. in 7 and AdAP LPN in (TOp are similar the Algorithm and we present them in Algorithm and Algorithm
Σ I(y, = I)e(w, X, + 8a, X; + 6.)
min max P(w, = [
Σ X.DD
(14)
The
Σ l(w,x, + 8g x, + 8,)
Different from above algorithms, the algorithm for solving AdAP MMM in 14] needs to solve inner maximization with AP surrogate loss to generate adversarial perturbations. Because this inner maximization problem includes all the samples in the dataset, we apply the similar compositional optimization technique borrowed from 34 to compute an estimate of V,P(W, by:
(u
u 2. T 1)) V
<(W, x, + 85. x; + 6z)
V Ps
(15)
B+
[ (u
x xjEB
where u and u are two estimators for tracking 4en (w, x;) = Σ I(y, 1)((w,x, x, 6, x, + 6,), (052(w,8; x;) = A E. f(w,x, X, + 6,, + 8.). At iteration t, the two estimators ux! and ? are updated by
61
(1 71 u + 71 B
l(we, + 8,, + 8,) 1)
(16)
62
= (1 - 7/ u + 71
Σ (( X2 + 5,,x, + 6,),
x.
B
20

---

where E (0, 1) is parameter. And the stochastic gradient V. P(w, is computed by:
[ Iy, 1)) (W, + 85, 5,)
V Pww,(w))
Σ
(17)
1++
X X,EB
We present the whole algorithm for solving AdAP_MP in (4) in Algorithm The objective for AdAP_LZ . is defined as
min max P(w) + R(w, 6, D) min (P(w) + max R(w, D))
(18)
w SEft
dE
Since the listwise adversarial regularization includes all the samples in the dataset, the optimization for 5 is also challenging. We extend the approach for computing an estimator of V Ri (w. 6, D) employed in Section 4.2 estimate V VaR(w,d D). To avoid redundancy, we give the estimate
directly by
(1. 01 -1 12 1
V R(w, D) Vsg(ō;
(19)
1/2
(u2)
where g(; w) has the same definition as g(w) in Section 4.2, [w1: u2. U3 denotes vector
for tracking [9 (w), ga())) (w)]. The whole algorithm for solving AdAP LZ is presented in Algorithm
Algorithm 2 Stochastic Algorithm for solving AdAP MM 14)
Initialize w, u&! u Y1
2: for (= 1,..., do
3: Draw batch B+ positive samples denoted by B+.
4: Draw batch of B samples denoted by B.
5: For x,
B4, initialize 6, a (0,
6: for 1, ..... .M do
7:
For each x; E B+. update _ and u by Equation (66
8: Compute P,P 6) by Equation 15
9:
Update II ||||| Sr (8; + 172 sign Vs, P(w,, 8))). where Ig(()) the projection operator.
10: end for
For each x; E B+, update Tt and _ by Equation 16
12: Compute stochastic gradient estimator V., = Vw, P(w,, 8) by Equation 17
13: Update W,+1 by using SGD, momentum-methode or Adam.
14:
end for
Algorithm Stochastic Algorithm for solving AdAP_LP (TO)
1: Initialize W, Ux, u, 71.72
2: for 1,..., do
3: Draw a batch of B+ positive samples denoted by B+.
4: Draw batch B samples denoted by B.
5: for E B do
6:
Initialize & a NN(0, 7: for 1.. M do
8: Update = (6. sign x; &6 y.)),, where llg(-) ) is the projection operator. end for end for
9:
10:
11:
For each x; E B+, update u and u², by Equation (2)
12:
Update by Equation (11) and compute &.,, R(w,, 5, D) by Equation 12
13:
Compute stochastic gradient estimator:
Vw, Vw, + X(V R(w,, D,
Σ
T.(hw, (xx), ), Aw, (x: 5z))
x,EB
14: Update W:+1 by using SGD, momentum-methods or Adam.
end for
21

---

Algorithm 4 Stochastic Algorithm for solving AdAP_ 1AAPP_PZ1 in
1: Initialize w, uz ux: 71
2: for t- 1,..., 7 do
3: Draw a batch B+ positive samples denoted by B++
4: Draw batch of B samples denoted by B.
5: for x; E B do
6: Initialize 62
(N(0,
7: for m = 1..... M do
8:
Update = I 11 (ō; + 1/2 sign( Vs, L(bw, (xx), Rww, (x; (:))))), where (T((:) is the
projection operator.
9:
end for
10:
end for
For each E update u and _ by Equation 2
12: Update by Equation (11) and compute V w., P(w.) by Equation 33)
Compute stochastic gradient estimator
À Σ x,EB
V w. ww, +
L(ww, (xx), tw (xi 6.))
B
Update W.+1 by using SGD, momentum-methods or Adam. 15: end for
14:
Algorithm 5 Stochastic Algorithm for solving AdAP_LA
1: Initialize w, u u u, 71,72
2: for t= 1,..., do
3: Draw batch B+ positive samples denoted by B+.
4: Draw batch of B samples denoted by B.
5: For X, B, initialize ó, ~ -N(0
6: for L,... M do
7:
Update by Equation 11 and compute VoR(w,, 6, D) by Equation 19
8: Update 6 | + 122 sign V a, R(w,, 6, D))), where [. the projection
operator.
9:
end for For each E B4, update u and u by Equation (2)
10:
Update u by Equation (11) and compute V., H((,, 6, D) by Equation 12
11:
12:
Compute stochastic gradient estimator Ww. Vw. -w.P((w,) )+++ + V R(w;;)
Update W.41 by using SGD, momentum
metthoss--methoss methods or Adam.
14:
end for
22


Reviews:
[{"review_id": "IGtJKqYePg", "reviewer": "Reviewer_axcz", "summary": "This paper investigates how to improve the robustness of a model under adversarial attacks while ensuring its Average Precision (AP) on clean data samples. This studied problem can be very important in some application scenarios but has not been extensively explored yet. By integrating the idea of existing adversarial training based methods into AP maximization algorithms, a novel solution is proposed in this paper. Experimental results obtained on multiple datasets with various binary imbalanced settings demonstrate the superiority of the proposed solution in terms of AP and robustness, comparing with baseline methods, which only focusing on optimizing either AP or robustness of models.\n", "questions": "1. In the introduction part, authors mentioned one nice property when designing adversarial training methods for AP maximization is \"consistency of attacks between training and inference\". Can authors add more explanation about this claim? Why attacks are expected to be consistent in training and inference? Generally, to evaluate model robustness more comprehensively, any kinds of attacks can be used in the inference stage.\n2. How's the training efficiency of the proposed solution? It seems the proposed solution will take much longer time on training, comparing with adversarial training based methods.", "limitations": "The efficiency of the proposed solution may be a problem. Hence, it would be better if authors can discuss or provide some experimental results to explain the efficiency of the proposed solution.", "rating": 7, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The problem explored in this paper, i.e., enhancing model robustness while maintaining AP, is a practical and important problem in some application scenarios but has not been well studied, as related works only focused on improving either model robustness or model AP.\n2. A novel solution is proposed in this paper by integrating existing adversarial training methods with AP maximization algorithms. Experimental results including performance comparison and ablation studies verify the effectiveness of the proposed solution.", "weaknesses": "1. To provide a more comprehensive perspective to evaluate the robustness of trained models, stronger attack methods, such as AutoAttack, should be included in experiments.\n2. Authors didn't discuss limitations of the proposed solution. Based on the description in the methodology part, the training efficiency of the proposed solution may be a problem.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the constructive comments.\n\n**Q1:** To provide a more comprehensive perspective to evaluate the\nrobustness of trained models, stronger attack methods, such as\nAutoAttack, should be included in experiments.\n\n**A:** We appreciate the reviewer's suggestion. To provide a more\ncomprehensive assessment, we have evaluated all the models again a\nstrong attack method $Auto-PGD_{CE}$ proposed in \\[Ref1\\]. The results\nare summarized in Table 1 in the global response(PDF file). We can observe that $Auto-PGD_{CE}$ exhibits a\nstronger attack as it leads to the deterioration of performance across\nall models, compared with the iterative FGSM (standard PGD) method\nemployed in section 5.1. However, we can see that the superiority of our\nproposed methods still remains evident. Please note that we did not\ncompare with the ensemble AutoAttack since it is tailored for\nmulti-class classification concerning accuracy. For instance, the\n$APGD_{DLR}$ approach presented in \\[Ref1\\] requires at least three\nclasses. We focus on AP maximization on imbalanced binary classification\ndata and the multi-class datasets such as CIFAR-10 are converted into\nmultiple one-vs-all binary classification tasks with reported\nperformance averaged over these multiple tasks.\n\nRef1: Croce & Hein. Reliable evaluation of adversarial robustness with\nan ensemble of diverse parameter-free attacks. ICML 2020.\n\n**Q2:** Authors didn't discuss limitations of the proposed solution.\nBased on the description in the methodology part, the training\nefficiency of the proposed solution may be a problem.\n\n**A:** We thank the reviewer for the constructive comment. We agree with\nthe reviewer that the proposed adversarial training methods are more\ntime-consuming than conventional natural training and some adversarial\ntraining methods (e.g. PGD). For detailed runtime analysis, please refer to\nthe response to Q4. We will add a limitation part to discuss this in the\nrevision.\n\n**Q3:** Regarding the \\\"consistency of attacks between training and\ninference\\\", can authors add more explanation about this claim? Why\nattacks are expected to be consistent in training and inference?\n\n**A:** We apologize for the confusion. The consistency of attacks\nbetween training and inference means that the attack is generated only\nbased on individual data. In the inference stage, the attack is usually\nimposed on individual data without referring to other data, which is\nreferred to as pointwise attack. Hence, we propose to use the pointwise\nattack instead of listwise attack in the training stage to maintain such\nconsistency, which is helpful for improving the results. It is important\nto note that we do not restrict the pointwise attacks used in the\ntraining to be the same as the inference. We have added an experiment to\ndemonstrate the effectiveness of our approaches when the inference uses\na different pointwise attack ($Auto-PGD_{CE}$ attack). The results are\ndemonstrated in response to Q1.\n\n**Q4:** How's the training efficiency of the proposed solution? It seems\nthe proposed solution will take much longer time on training, comparing\nwith adversarial training based methods.\n\n**A:** Below, we've included the results of efficiency comparisons for all the models. In the experiment, we set the\nparameters, which could affect training time, exactly the same(e.g.\nbatch size as 128, total epochs as 60, adversarial samples are generated\nwith 6 projected gradient ascent steps) and run all the models over\nthree times on the Class_0 task of CIFAR10. From the table, we can\nobserve that (i) adversarial training methods are generally more\ntime-consuming than natural training; (ii) our proposed AdAP_LN and\nAdAP_LPN methods cost a little more time than traditional PGD method but\nmuch less time than TRADES. This is because, to generate adversarial\nsamples in training, TRADES is solving the maximization of KL divergence\nbetween the probabilities predicted with clean data and perturbed\ndata(i.e.\n$\\max_{\\|\\delta\\|\\leq \\epsilon}\\sum_k h(x)_k\\log h(x)_k - h(x)_k\\log h(x+\\delta)_k$,\nwhere $h(x)_k$ and $h(x+\\delta)_k$ are predicted probabilities for class\nk on clean data and perturbed data respectively ) while PGD and our proposed methods are directly solving maximization of Cross Entropy \n(i.e. $\\max\\_{ \\|\\delta\\| \\leq \\epsilon }-\\log h(x+\\delta)_y$). In adversarial training, since each gradient descent step wrt $w$ requires multiple gradient ascent steps wrt $\\delta$, the\ncomputational expense primarily stems from the\nprojected gradient ascent steps, which can be also observed by comparing the efficiency of CE Min. with PGD.\nAnd TRADES requires two\nforward propagations and one backpropagation in each projected gradient\nascent step, whereas the latter method only needs one forward\npropagation and one backpropagation.\n\n| Methods   | Run 1 | Run 2 | Run 3 | Average |\n|-----------|---------|---------|---------|-----------|\n| CE Min.   | 563s    | 566s    | 568s    | 565.67s   |\n| AP Max.   | 589s    | 590s    | 589s    | 589.33s   |\n| PGD       | 2833s   | 2804s   | 2803s   | 2813.33s  |\n| TRADES    | 4203s   | 4182s   | 4179s   | 4188.00s  |\n| MART      | 3192s   | 3205s   | 3194s   | 3197.00s  |\n| AdAP\\_LN  | 3227s   | 3213s   | 3211s   | 3217.00s  |\n| AdAP\\_LPN | 3234s   | 3219s   | 3218    | 3223.67s  |\n"}, {"review_id": "ZvxkhEjKeN", "reviewer": "Reviewer_rUtg", "summary": "This paper extends the discussion of adversarial robustness from accuracy to precision, and also extends TRADES solution to this new setting. The paper is fairly standard, with a new problem, a new solution, some minor theoretical studies (obviously also extended from TRADES), and some fairly good empirical results. The paper is highly condensed, so several critical points need further clarification. ", "questions": "1. it seems the authors forgot to define AdAP_LPN properly. \n    - the only clue I can find is at line 337, where AdAP_LPN is combining listwise and pointwise adversarial regularization, then in contrast AdAP_LN is probably just listwise regularization. \n\n2. cannot find information about the threat model behind TRADES, and PGD, cannot confirm whether these threat models (models used to generated adversarial attacks) are the same as the AdAP family models or not. ", "limitations": "do not find explicit discussions. ", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The paper interestingly studies a new problem of precision in the adversarial setting. \n\n- The paper introduces a new algorithm to achieve the listwise regularizations", "weaknesses": "1. the empirical method and theoretical discussions are extended from TRADES, which might raise some concerns about the novel contributions of this work. \n\n2. the experiments are only conducted against FGSM attack, this is probably too limited, especially since there are several cases the performances are fairly close. \n    - please also use PGD and autoAttack. \n\n3. the an essential step of the algorithm is the approximation in Section 4.2, it's probably necessary to offer more empirical results on this regard, such as ablation studies with varying batch sizes. ", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your comments and feedback on our paper. In the following,\nwe are committed to addressing the raised concerns and questions.\n\n**Q1:** About the novel contributions of this work.\n\n**A:** We agree the adversarial regularization is similarly motivated as\nTRADES, which has been widely used for adversarial training. However,\nthere are some key differences between our work and TRADES in how the\nregularization and attack are set up. (1) the regularization in TRADES\nmeasures the pointwise difference between predictions on clean data and\nperturbed data; instead the regularization in our method measures the\nlistwise difference between predictions on clean data and perturbed\ndata; (2) the attacks in the training of TRADES are generated in a\nzero-sum framework to maximize the regularization term; in contrast, the\nattacks in our training are generated in a non-zero sum framework. These\ntwo differences are very important for improving the performance of\nadversarial AP. In addition, the optimization of the proposed listwise\nregularization, maintaining the consistency between the ranking of clean\ndata and that of perturbed data, is a non-trivial extension of TRADES.\n\n**Q2:** Adding more attacks, e.g., PGD and AutoAttack.\n\n**A:** We appreciate the reviewer's suggestion. First, we'd like to\napologize for the confusion caused by the terminology 'FGSM attack'. In\nall our experiments, we utilized the iterative FGSM attack method which\nindeed works as a $l_{\\infty}$-bounded PGD attack. Following \\[Ref2\\],\nwe abused the terminology in Section 5. To provide a more comprehensive\nassessment, we have evaluated all the models against a strong attack\nmethod $Auto-PGD_{CE}$ proposed in \\[Ref1\\]. The results\nare summarized in Table 1 in the global response(PDF file). We can observe that $Auto-PGD_{CE}$ exhibits a\nstronger attack as it leads to the deterioration of performance across\nall models, compared with the iterative FGSM (standard PGD) method\nemployed in section 5.1. However, we can see that the superiority of our\nproposed methods still remains evident. Please note that we did not \ncompare with the ensemble AutoAttack since it is tailored for\nmulti-class classification concerning accuracy. For instance, the\n$APGD_{DLR}$ approach presented in \\[Ref1\\] requires at least\nthree classes. We focus on AP maximization on imbalanced binary\nclassification data and the multi-class datasets such as CIFAR-10 are\nconverted into multiple one-vs-all binary classification tasks with\nreported performance averaged over these multiple tasks.\n\nRef1: Croce & Hein. Reliable evaluation of adversarial robustness with\nan ensemble of diverse parameter-free attacks. ICML 2020.\n\nRef2: Zhang et al. Theoretically principled trade-off between robustness\nand accuracy. International conference on machine learning. ICML 2019.\n\n**Q3:** Adding ablation studies with varying batch sizes to demonstrate\nthe approximation in Section 4.2.\n\n**A:** We appreciate the reviewer's constructive comment. We have\nconducted some empirical studies to investigate the proposed AdAP_LN's\nsensitivity to batch sizes on CIFAR10 dataset. The results are included\nin Figure 1 in the global response (PDF file). The results show that our method does\nnot require a very large batch size to achieve a good performance and is\ngenerally not sensitive to batch size.\n\n**Q4:** it seems the authors forgot to define AdAP_LPN properly. The\nonly clue I can find is at line 337, where AdAP_LPN is combining\nlistwise and pointwise adversarial regularization, then in contrast\nAdAP_LN is probably just listwise regularization.\n\n**A:** We apologize for the confusion. The AdAP_LPN is defined as\nEquation 10 in Section 4.1. Please refer to line 194.\n\n**Q5:** About the threat model behind TRADES, and PGD, confirm whether\nthese threat models (models used to generated adversarial attacks) are\nthe same as the AdAP family models or not.\n\n**A:** As introduced in Sec 5.1 and 5.2, when we evaluate the robustness\nagainst white-box attacks, the threat model is the evaluated model\nitself since white-box attacks have full access to the target model.\nHowever, when we evaluate the robustness against black-box attacks, the\nthreat model behind TRADES, PGD, MART and AdAP family models is the same\nmodel trained with CE loss minimization on clean data for fair\ncomparison.\n\n"}, {"review_id": "W9s12Yw68a", "reviewer": "Reviewer_N7Ak", "summary": "This paper considers the adversarial robustness of the AP metric, which is an important measure of deep learning under some imbalanced applications. To do this, the authors develop a novel formulation that combines an AP surrogate loss with a regularization term toward adversarial ranking robustness, maintaining the consistency between the ranking of clean data and that of perturbed data. Empirical studies demonstrate the effectiveness of the proposed methods.", "questions": "Please carefully address all my concerns in the weakness part.", "limitations": "The authors do not include any limitations for their work.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "To the best of our knowledge, this is the first work to consider the AP-based adversarial robustness problem, which will bring some new insights to the adversarial robustness community.\nThe contributions of this paper are novel and the theoretical results are technically sound.\nThe empirical results are also promising.", "weaknesses": "However, some essential issues should be fixed:\n1. During the evaluation, this paper merely considers the simple FGSM-based attack manner, which is insufficient to support the effectiveness of the proposed method. Some stronger attacks, such as PGD-based and AutoAttack [1], should be considered.\n2. Another minor question is how AP-based AT impacts the performance of accuracy-based AT. Can the proposed methods improve AdAP without sacrificing overall accuracy? Because merely considering AP while overlooking accuracy may be meaningless.\n3. Why do we need to develop AdAP? What are the differences between AdAP and AdAUC in the ranking performance? Please give me some intuitive examples like Fig.1\n4. Finally, some latest advanced AP optimization methods are missed, such as [2].\n\n\nRef:\n[1] Reliable Evaluation of Adversarial Robustness with an Ensemble of Diverse Parameter-free Attacks.\n[2] Exploring the algorithm-dependent generalization of AUPRC optimization with list stability. ", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for dedicating their time to provide a\ncomprehensive review, and we are committed to addressing the raised\nissues.\n\n**Q1:** Adding some stronger attacks, such as PGD-based and AutoAttack.\n\n**A:** We appreciate the reviewer's suggestion. First, we'd like to\napologize for the confusion caused by the terminology 'FGSM attack'. In\nall our experiments, we utilized the iterative FGSM attack method which\nindeed works as a $l_{\\infty}$-bounded PGD attack. Following \\[Ref2\\],\nwe abused the terminology in Section 5. To provide a more comprehensive\nassessment, we have evaluated all the models against a strong attack\nmethod $Auto-PGD_{CE}$ proposed in \\[Ref1\\]. The results are summarized in Table 1 in the global response(PDF file). We can observe that $Auto-PGD_{CE}$ exhibits a stronger attack as\nit leads to the deterioration of performance across all models, compared\nwith the iterative FGSM (standard PGD) method employed in section 5.1.\nHowever, we can see that the superiority of our proposed methods still\nremains evident. Please note that we did not compare with the ensemble\nAutoAttack since it is tailored for multi-class classification\nconcerning accuracy. For instance, the $APGD_{DLR}$ approach presented\nin \\[Ref1\\] requires at least three classes. We focus on AP maximization\non imbalanced binary classification data and the multi-class datasets\nsuch as CIFAR-10 are converted into multiple one-vs-all binary\nclassification tasks with reported performance averaged over these\nmultiple tasks.\n\nRef1: Croce & Hein. Reliable evaluation of adversarial robustness with\nan ensemble of diverse parameter-free attacks. ICML 2020.\n\nRef2: Zhang et al. Theoretically principled trade-off between robustness\nand accuracy. International conference on machine learning. ICML 2019.\n\n**Q2:** Another minor question is how AP-based AT impacts the\nperformance of accuracy-based AT. Can the proposed methods improve AdAP\nwithout sacrificing overall accuracy?\n\n**A:** Please note that in many applications (e.g., learning to rank,\nimbalanced classification), AP is much more informative than accuracy.\nFor example, in imbalanced classification with 99% data being negative,\nachieving 99% accuracy by a naive model that predicts everything as\nnegative is meaningless. Hence, the focus of the paper is to report AP.\nNevertheless, we have evaluated the performance of accuracy of our\nmodels on CIFAR10 dataset. To this end, we need to learn a threshold on\nthe validation data since our model is a ranking-based model. Based on\nour model and the threshold, we have also evaluated our models in terms\nof accuracy and compared them with other methods in Table 2 in the global response(PDF file). The\nresults show that (i) our proposed methods improve the AdAP and\nadversarial accuracy at the same time; (ii) all adversarial training\nmethods' accuracy cluster around 0.9, the ratio of negative samples,\noffering limited insight into the model's performance.\n\n**Q3:** Why do we need to develop AdAP? What are the differences between\nAdAP and AdAUC in the ranking performance? Please give me some intuitive\nexamples like Fig.1\n\n**A:** In scenarios involving highly imbalanced datasets, AP, as\ndemonstrated in \\[Ref1\\], offers a more accurate reflection of the\nmodel's performance as compared to AUC. For example, we have a dataset\nthat contains 10 positive samples and 10 thousand negative samples(e.g.\ndocument retrieval or object detection scenarios). Suppose one model\nranks 10 positives higher than all the negatives, then both AP and AUC\nachieve 1. After perturbation, if the model ranks 2 negatives at the top\nand keeps the rest lower than all the positives, the AUC score will\nremain at 0.9998 while the AP score will degrade to 0.8333. This\nillustrates that, in such case, AP metric could be more informative\nabout performance.\n\nRef1: Davis and Goadrich. The relationship between Precision-Recall and\nROC curves. ICML 2006.\n\n**Q4:** Adding citations to advanced AP optimization methods, such as\n\\[2\\].\n\n**A:** Thank you for your suggestion for improving our paper. we will\ninclude and discuss the suggested advanced AP optimization methods in\nthe revision."}, {"review_id": "ieSV1b01DH", "reviewer": "Reviewer_YhER", "summary": "The paper focuses on adversarial training in terms of Average Precision (AP), which is guided by three design principles: trade-off between AP and robustness, robustness in terms of AP instead of accuracy, and consistency of attacks. By utilizing the techniques of stochastic compositional optimization, the paper proposes a series of adversarial training algorithms to handle the inter-dependent perturbations.", "questions": "Please refer to the weaknesses part for the major concerns. Other minor issues are as follows:\n\n1.\tThe design of $R$ in Eq. (8) requires a detailed explanation: AP involves all examples, while the top-one probability focuses on the top-one examples. Could we apply ranking-based functions instead?\n\n2.\tThe proposed algorithms share similar properties with [19] and [32]. Is it possible to provide a corresponding convergence analysis based on these works?\n", "limitations": "Limitations are addressed.", "rating": 8, "confidence": 5, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "1.\tNovelty: To the best of our knowledge, it is the first work to consider adversarial training of AP. It is a non-trivial extension due to the non-decomposable formulation of AP.\n\n2.\tSignificance: As a widely-used ranking metric, the robustness of AP is significant to the machine learning community. Besides, the design principles and techniques might be instructive to the robustness of other ranking metrics.\n\n3.\tClarity: The paper is overall well-written with clear notations.\n\n4.\tSoundness: The effectiveness of the proposed method is well-supported by experiments under various settings.\n", "weaknesses": "1.\tThe authors solve a non-zero-sum game to ensure consistency. However, unlike previous work on adversarial training, the equilibrium state of this game is unknown and requires more discussion.\n\n2.\tFig. 2 provides a visualization of the trade-off between robustness and AP, but how the hyperparameter $\\lambda$ affects the trade-off is unclear. Ideally, it should present a positive correlation.\n\n3.\tThe related work could be further improved by discussing the latest literature on AP stochastic optimization such as [1,2].\n\nRef:\n\n[1] Wang et. al. Momentum accelerates the convergence of stochastic auprc maximization. ICML, 2022.\n\n[2] Wen et. al. Exploring the algorithm-dependent generalization of auprc optimization with list stability. NeurIPS, 2022.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We first address what the reviewer mentioned as weaknesses and then\nrespond to the reviewer's questions:\n\n**Q1:** The authors solve a non-zero-sum game to ensure consistency.\nHowever, unlike previous work on adversarial training, the equilibrium\nstate of this game is unknown and requires more discussion.\n\n**A:** We appreciate your comments. We acknowledge that this is a\nseparate theoretical issue. Even for zero-sum game approaches, the\nnon-convexity nature of the problem may render the Nash equilibrium\nnon-existent \\[Ref1\\]. We hope our research will motivate more\ntheoretical researchers to study this problem.\n\nRef1: Jin et al. What is Local Optimality in Nonconvex-Nonconcave\nMinimax Optimization. ICML, 2020.\n\n**Q2:** Fig. 2 provides a visualization of the trade-off between\nrobustness and AP, but how the hyperparameter affects the trade-off is\nunclear. Ideally, it should present a positive correlation.\n\n**A:** As the curves shown in Fig.2, it does presents a positive\ncorrelation between robust AP and $\\lambda$ for relatively small values\nof $\\lambda$. Nevertheless, as $\\lambda$ becomes excessively large, this\ncorrelation diminishes. This reasoning is logical to us since we might\nexpect a meaningless model if $\\lambda$ goes to infinity.\n\n**Q3:** The related work could be further improved by discussing the\nlatest literature on AP stochastic optimization such as \\[1,2\\].\n\n**A:** Thank you for your suggestion. we will incorporate discussion of\nthe suggested literature to enhance the related work section in the\nrevised paper.\n\n**Q4:** The design of in Eq. (8) requires a detailed explanation: AP\ninvolves all examples, while the top-one probability focuses on the\ntop-one examples. Could we apply ranking-based functions instead?\n\n**A:** Indeed, the regularization based on the top-one probability\n$p(x_i) = \\frac{\\exp(h_w(x_i))}{\\sum_{j=1}^n\\exp(h_w(x_j))}$\nis a ranking-based function. Please note that the regularization sums\nover all data instead of just one example. In addition, the denominator\nof the top-one probability also includes the all example, similar to AP.\nA similar loss was originally proposed in \\[Ref2\\] known as ListNet for\nlearning to rank. It encourages elevating positive samples to higher\npositions in the list as opposed to negative\n\nRef2: Cao et al. Learning to rank: from pairwise approach to listwise\napproach. ICML 2007.\n\n**Q5:** The proposed algorithms share similar properties with \\[19\\] and\n\\[32\\]. Is it possible to provide a corresponding convergence analysis\nbased on these works?\n\n**A:** Please note that our problem is much more challenging than that\nin \\[19, 32\\]. We can also view the problem as a bilevel optimization\nproblem. However, the lower-level problem itself is non-convex. Almost\nall existing convergence analysis for bilevel optimization assume\nconvexity for the lower-level problem. Deriving the convergence of our\nalgorithm and any other algorithms would be a significant work by\nitself."}, {"review_id": "6KoAimGrXP", "reviewer": "Reviewer_Szkp", "summary": "This paper studies the average precision issue in adversarial training. As attacking a single image may not affect the final accuracy, the average precision could be largely decreased. As a result, such a phenomenon is demonstrated to be harmful to applying adversarial training. To encourage AP robustness, a novel method is proposed by combining adversarial training and AP maximization. Additionally, by adding point-wise regularization, different variants are proposed. Through empirical analysis of many well-known datasets, the authors carefully validate the effectiveness of the proposed methods.", "questions": "Please refer to weaknesses.", "limitations": "Limitations are discussed in the paper. No potential negative societal impact is found.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- This paper is well-written and can be easily understood.\n- The effectiveness is great on many datasets.\n- Detailed analysis of many variants of AdAP is provided.", "weaknesses": "- The major concern is the motivation of this paper. Why average precision is important in adversarial training is not sufficiently addressed. It seems like the research problem is ad hoc such that the proposed method could directly combine adversarial training and maximum precision. In the real world, I don’t think attacking a single example is worth investigating, and the described situation exists ubiquitously. Moreover, it is possible that in many realistic scenarios, the difference between the average accuracy and average precision might not be very large. Please justify.\n\n- I am not sure why two regularizations AdAP_MM and AdAP_PZ should be proposed together when the first one does not have a significant advantage compared to the last one.\n\n- The proposed method is limited to binary and imbalanced classification settings, which are strict on the problem setting. The performance of multi-class or balanced adversarial training is still questionable.\n\n- How does the hyper-parameters $\\lambda$, $\\gamma_1$ and $\\gamma_2$ are decided? Are they sensitive to different values?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your constructive comments. Below we would like to address\nyour concerns.\n\n**Q1:** About the motivation of this paper.\n\n**A:** First, we'd like to clarify that average precision is important,\nespecially in scenarios with highly imbalanced datasets, e.g. medical\ndiagnosis, molecular property prediction (e.g. MIT AICures challenge,\nOpen Graph Benchmark) and object detection, where there could be\nthousands of negative samples but only few positive samples. Suppose we\nare required to diagnose a rare lethal disease that only 10 over 10,000\npatients suffer from. A naive model may infer all patients as negative\nto reach 99.9% accuracy. However, AP serves as a ranking metric that is\nparticularly attuned to errors at the top of the ranking list, which\nmakes it a more appropriate metric for reflecting models' performance\nwith highly imbalanced datasets. Such a naive model achieves an AP score\nof 0, indicating it learned nothing. Second, in this paper, we are not\nlimited to solving the problem that adversary is only attacking a single\nexample. The reason why we use only one attacked sample in the\nintroduction is to try to illustrate the importance of average precision\nwith a simple example. In fact, throughout the paper, we solve the\nproblems where all the input samples are attacked. In addition, we agree\nthat in some realistic scenarios, the difference between the average\naccuracy and average precision might not be very large, particularly\nwhen the dataset is balanced. But it is important to note that such\nscenarios with balanced datasets are not the primary focus of this\npaper.\n\n**Q2:** I am not sure why two regularizations AdAP_MM and AdAP_PZ should\nbe proposed together when the first one does not have a significant\nadvantage compared to the last one.\n\n**A:** AdAP_MM and AdAP_PZ represent two straightforward adversarial AP\nmaximization baselines by directly extending the ideas from \\[Ref1\\] and\nTRADES. We introduce them as baselines to contrast with our proposed\nAdAP_LN and AdAP_LPN methods since we are trying to compare our proposed\nmethod with other related adversarial AP maximization ideas to show the\nsuperiority. AdAP_LPN and AdAP_LN are proposed to show that (i) the\nproposed listwise regularization is key to improve the performance;\n(ii) neither of them is dominating the other meaning that the traditional\npointwise regularization can help sometimes.\n\nRef1: Madry, Aleksander, et al. Towards Deep Learning Models Resistant\nto Adversarial Attacks. ICLR 2018.\n\n**Q3:** The proposed method is limited to binary and imbalanced\nclassification settings, which are strict on the problem setting. The\nperformance of multi-class or balanced adversarial training is still\nquestionable.\n\n**A:** There have been tons of paper proposing solutions for multi-class\nor balanced setting. However, the adversarial training method for\nimbalanced data is still under-explored. Hence, as mentioned in the\nintroduction part, this paper focuses on solving imbalanced adversarial\ntraining problem which is meaningful and important and in which\naccuracy-based adversarial training methods are not sufficient. This\nshould not be considered as a limitation but rather as a strength.\n\n**Q4:** How does the hyper-parameters $\\lambda,\\gamma_1, \\gamma_2$, and\nare decided? Are they sensitive to different values?\n\n**A:** From Section 5.3, we can observe that $\\lambda$ is a sensitive\nparameter that balances the trade-off between robustness and clean AP\nperformance. This is expected. Hence, it's necessary to tune it\ncarefully to achieve desired performance. The $\\gamma_1, \\gamma_2$ are\ntuned in $\\\\{0.1, 0.9\\\\}$ as mentioned in the paper. We have added some\nexperiments on CIFAR10 and BDD100K datasets to show the sensitivity of\nthese parameters below.\n\n| CIFAR10 (average) | $\\gamma_2=0.1$          | $\\gamma_2=0.3$          | $\\gamma_2=0.5$ | $\\gamma_2=0.7$ | $\\gamma_2=0.9$ |\n|-------------------|-------------------------|-------------------------|----------------|----------------|----------------|\n| $\\gamma_1=0.1$    | 0.2719(0.0116)          | 0.273(0.0079)           | 0.275(0.0105)  | 0.2756(0.0135) | 0.2753(0.0114) |\n| $\\gamma_1=0.3$    | 0.2701(0.012)           | 0.2696(0.01)            | 0.2753(0.0128) | 0.2733(0.0101) | 0.2745(0.0107) |\n| $\\gamma_1=0.5$    | 0.2674(0.0088)          | 0.2741(0.011)           | 0.2688(0.0108) | 0.2685(0.0135) | 0.2741(0.0113) |\n| $\\gamma_1=0.7$    | 0.2649(0.0103)          | 0.2713(0.007)           | 0.2686(0.0165) | 0.2696(0.0138) | 0.2658(0.0103) |\n| $\\gamma_1=0.9$    | 0.2668(0.0137)          | **0.2766(0.0131)**   | 0.2668(0.013)  | 0.2689(0.0139) | 0.2641(0.0124) |\n| **BDD100K(rainy)**  | $\\gamma_2=0.1$          | $\\gamma_2=0.3$          | $\\gamma_2=0.5$ | $\\gamma_2=0.7$ | $\\gamma_2=0.9$ |\n| $\\gamma_1=0.1$    | 0.2433(0.0209)          | 0.2436(0.0205)          | 0.2404(0.0188) | 0.2415(0.0220) | 0.2423(0.0215) |\n| $\\gamma_1=0.3$    | 0.2471(0.0219)          | 0.2440(0.0174)          | 0.2432(0.0169) | 0.2473(0.0214) | 0.2460(0.0188) |\n| $\\gamma_1=0.5$    | 0.2479(0.0210)          | 0.2475(0.0209)          | 0.2476(0.0217) | 0.2450(0.0189) | 0.2472(0.0187) |\n| $\\gamma_1=0.7$    | 0.2507(0.0203)          | 0.2453(0.0204)          | 0.2471(0.0179) | 0.2461(0.0206) | 0.2480(0.0176) |\n| $\\gamma_1=0.9$    | **0.2522(0.0208)**    | 0.2479(0.0200)          | 0.2485(0.0201) | 0.2447(0.0193) | 0.2478(0.0193) |\n"}]

Author rebuttal:
We thank the reviewers for your comments and feedback on our paper. We have included some experimental results in the PDF file, including adversarial robustness against $Auto-PGD_{CE}$ white-box attack, adversarial accuracy against white-box iterative FGSM attack on CIFAR10 dataset, and illustration for insensitivity to batch size of AdAP\_LN.

Meta-review: AC browse through the paper and finds the problem interesting, which is to optimize for AP while training for adversarial robustness. This problem statement seems novel. Ratings are consistent across the board to accept.
Decision: Accept (spotlight)