Title: Maximization of Average Precision for Deep Learning with Adversarial Ranking Robustness
Venue: NeurIPS 2023
Accepted: yes
Keywords: Adversarial Average Precision Maximization

Robust Average Precision

Adversarial Ranking Robustness

Adversarial Training
Abstract: This paper seeks to address a gap in optimizing Average Precision (AP) while ensuring adversarial robustness, an area that has not been extensively explored to the best of our knowledge. AP maximization for deep learning has widespread applications, particularly when there is a significant imbalance between positive and negative examples. Although numerous studies have been conducted on adversarial training, they primarily focus on robustness concerning accuracy, ensuring that the average accuracy on adversarially perturbed examples is well maintained. However, this type of adversarial robustness is insufficient for many applications, as minor perturbations on a single example can significantly impact AP  while not greatly influencing the accuracy of the prediction system. To tackle this issue, we introduce a novel formulation that combines an AP surrogate loss with a regularization term representing adversarial ranking robustness, which maintains the consistency between ranking of clean data and that of perturbed data. We then devise an efficient stochastic optimization algorithm to optimize the resulting objective. Our empirical studies, which compare our method to current leading adversarial training baselines and other robust AP maximization strategies, demonstrate the effectiveness of the proposed approach. Notably, our methods outperform a state-of-the-art method (TRADES) by more than 4\% in terms of robust AP against PGD attacks while achieving 7\% higher AP on clean data simultaneously on CIFAR10 and CIFAR100.The code is available at: <https://github.com/GangLii/Adversarial-AP>

Maximization of Average Precision for Deep Learning with Adversarial Ranking Robustness

Abstract

This paper seeks to address a gap in optimizing Average Precision (AP) while ensuring adversarial robustness, an area that has not been extensively explored to the best of our knowledge. AP maximization for deep learning has widespread applications, particularly when there is a significant imbalance between positive and negative examples. Although numerous studies have been conducted on adversarial training, they primarily focus on robustness concerning accuracy, ensuring that the average accuracy on adversarially perturbed examples is well maintained. However, this type of adversarial robustness is insufficient for many applications, as minor perturbations on a single example can significantly impact AP while not greatly influencing the accuracy of the prediction system. To tackle this issue, we introduce a novel formulation that combines an AP surrogate loss with a regularization term representing adversarial ranking robustness, which maintains the consistency between ranking of clean data and that of perturbed data. We then devise an efficient stochastic optimization algorithm to optimize the resulting objective. Our empirical studies, which compare our method to current leading adversarial training baselines and other robust AP maximization strategies, demonstrate the effectiveness of the proposed approach. Notably, our methods outperform a state-of-the-art method (TRADES) by more than 4% in terms of robust AP against PGD attacks while achieving 7% higher AP on clean data simultaneously on CIFAR10 and CIFAR100. The code is available at: https://github.com/GangLii/Adversarial-AP

1 Introduction

AP measures the precision of a model at different recall levels, offering a more nuanced understanding of the trade-offs between precision and recall. Optimizing AP for deep learning is of vital importance, especially in cases with highly imbalanced datasets. In such situations, accuracy alone can be misleading, as a model may perform well on the majority class but struggle with the minority class, thereby offering a superficially high accuracy score. In contrast, AP serves as a ranking metric that is particularly attuned to errors at the top of the ranking list, which makes it a more appropriate metric for applications dealing with highly imbalanced datasets. For example, deep AP maximization has been crucial in enhancing molecular property prediction performance, contributing to a winning solution in the MIT AICures challenge [54].

However, existing approaches of AP maximization are not robust against adversarial examples. It is notoriously known that deep neural networks (DNN) are vulnerable to adversarial attacks, where small, carefully-crafted perturbations to the input data can cause the model to produce incorrect predictions [46, 16]. These perturbations are often imperceptible to humans but can significantly impact the model's performance. Tremendous studies have been conducted to improve the adversarial robustness of DNN. A popular strategy to achieve adversarial robustness is through adversarial training [27, 59, 53, 45, 21, 2, 35, 44, 47, 15], which injects adversarial examples into the training

Tianbao Yang

Approaches

Objective

Regularization

Optimization

Trade-off

AdAP_MM

MiniMax AP Loss

No

Zero-sum Game

Yes

No

No

AdAP_PZ

AP Loss + Reg.

Pointwise

Zero-sum Game

No

Yes

Yes

AdAP_LZ

AP Loss + Reg.

Listwise

Zero-sum Game

Yes

Yes

No

AdAP_LN

AP Loss + Reg.

Listwise

Non-zero-sum Game

Yes

Yes

Yes

AdAP_LPN

AP Loss + Reg.

Listwise + Pointwise

Non-zero-sum Game

Yes

Yes

Yes

Ranking List

Ranking List

Top

Top

Bottom

Bottom

TRADES

Clean images        Acc:0.9,  AP 1.0

One perturbed image        Acc:0.9,  AP 0.6

+

=

One perturbed image        Acc:0.9,  AP 1.0

AdAP_LN

Clean images        Acc:0.9,  AP 1.0

DB(0.5)

Clean

Perturbation

Perturbed

DB(0.5)

P

P

N

N

N

N

N

N

N

N

0.5795!0.1453

0.1228

0.1187

0.1170

0.1167

0.1159

0.1130

0.1127

0.1123

P

N

N

N

N

N

N

N

N

0.5795

0.1228

0.1187

0.1170

0.1167

0.1159

0.1130

0.1127

0.1123

0.1094

N

N

N

N

N

N

N

N

0.999910.4765

0.4324

0.4212

0.4155

0.4035

0.3727

0.04840.0017

0.0003

P

N

N

N

N

N

N

N

N

0.9999

0.4451

0.4324

0.4212

0.4155

0.4035

0.3727

0.04840.0017

0.0003

Figure 1: Top are predictions on clean images of a robust model trained by a state-of-the-art adversarial training method TRADES [59] and our method on CIFAR-10 data for detecting trucks. Bottom are predictions on the same set of images with only one example adversarially perturbed, which is generated by PGD following a black-box attack. The results of TRADES (left) indicate that slightly changing one example could dramatically impact AP but not on the accuracy. The results of our approach (right) demonstrate that our solution is more robust to adversarial data in terms of ranking and AP score. The dashed blue line indicates the decision boundary at score 0.5.

that are generated by various attack methods. Nevertheless, almost all existing methods focus on robustness concerning accuracy, ensuring that the average accuracy on adversarially perturbed examples is well maintained. This type of adversarial robustness is insufficient for many applications with highly imbalanced datasets, as minor perturbations on a single example can significantly impact AP while not greatly influencing the accuracy of the prediction system (cf. an example in Figure 1). This presents a significant challenge for adversarially robust AP maximization.

In this paper, we conduct a comprehensive study on how to imbue AP maximization with adversarial robustness. There are several technical and practical concerns in the design of adversarial training methods for AP maximization to enjoy three nice properties: (i) capability to trade off between AP on a set of clean data and the robustness of the model on the perturbed data; (ii) robustness in terms of ranking performance instead of accuracy against adversarial perturbations; (ii) consistency of attacks between training and inference. The first property is obvious in light of existing works on adversarial training [59]. The importance of the second property has been explained in the previous paragraph. The third property is tricky as it does not exist in existing adversarial training methods. The adversarial attack is usually applied to an individual data during the inference phase. Hence, we expect that maintaining the consistency between the attacks generated in training process and that in the inference phase will help boost the performance. However, this will cause a dilemma for achieving pointwise attack and listwise robustness in a unified framework.

To acquire these properties in a unified framework, we draw inspiration from prior adversarial training methods through robust regularization, and integrate two distinct design elements. We examine robust objectives that combine an AP surrogate loss on the clean data and a regularization term depending on the perturbed data. The two unique design features are (i) a new listwise adversarial regularization defined by a divergence between two distributions that represent the top one probabilities of a set of clean data and their perturbed versions; (ii) a non-zero-sum game approach, which integrates pointwise adversarial attacks with the proposed listwise adversarial regularization. This will ensure the attack consistency between training and inference. Our contributions are summarized below.

We propose a non-zero-sum game optimization formulation for AP maximization with adversarial ranking robustness, which achieves listwise defense against pointwise attacks.

We propose an efficient stochastic algorithm for solving the resulting objective, which integrates traditional adversarial sample generation methods with a state-of-the-art deep AP maximization algorithm without requiring a large batch size.

We conduct extensive experiments to compare with existing leading adversarial training baselines, and ablation studies to compare different approaches shown in Table 1 for adversarial AP maxi-

mization. We conclude that AdAP_LN and AdAP_LPN achieve the best performance among all methods corroborating the effectiveness of the proposed techniques.

2 Related Work

Adversarial Robustness. To safeguard deep neural networks (DNNs) from adversarial attacks, a variety of adversarial defense techniques have been proposed in the literature, including (1) detection for defense [37, 48, 38, 24]; (2) input transformations for defense [25, 17, 39, 18, 58]; (3) adversarial training [1, 11, 47, 15]. Among these techniques, adversarial training has been demonstrated to be one of the most effective approaches [27, 59, 41, 45, 21, 14, 53]. Among these, [27] is the first to theoretically study and justify adversarial training by solving a min-max formulation for training adversarially robust models for deep learning. [59] presents an objective function that strike a balance between accuracy and robustness in light of their theoretical tight upper bound on the robust error. However, these previous methods focus on how to improve the robustness concerning accuracy, which is not sufficient for highly imbalanced data. [52] considers adversarial training for imbalanced data by combining a minimax weighted loss and a contrastive loss of feature representations. [60] considers adversarial ranking in the context of retrieval and proposes maximum-shift-distance attack that pushes an embedding vector as far from its original position as possible and uses it in a triplet loss for optimization. [20] presents a study on adversarial AUC optimization by reformulating the original tightly coupled objective as an instance-wise form for adversarial training. Nevertheless, none of these methods enjoy three nice properties simultaneously, i.e., adversarial ranking robustness, trade-off between AP and robustness, and consistent attacks between training and inference.

Average Precision Optimization. For imbalanced classification and information retrieval problems, AP optimization has attracted significant attention in the literature [13, 36, 31, 5, 10, 29, 28, 55]. To maximize the AP score for big data, some works employ stochastic optimization with mini-batch averaging to compute an approximate gradient of the AP function or its smooth approximation [6, 36, 42, 4]. These methods typically rely on a large mini-batch size for good performance. In contrast, [34] proposes a novel stochastic algorithm that directly optimizes a surrogate function of AP and provides theoretical convergence guarantee, without the need for a large mini-batch size. Then [50] further improve the stochastic optimization of AP by developing novel stochastic momentum methods with a better iteration complexity of O (1 /ϵ 4 ) . However, these approaches of AP maximization are vulnerable to adversarial examples created by introducing small perturbations to natural examples. The question of how to boost model's AP under adversarial perturbations while maintaining AP on clean data is still unresolved.

3 Preliminaries

For simplicity of exposition, we consider binary classification problems. However, the discussions and algorithms can be easily extended to mean AP for multi-class or multi-label classification problems. Let D = { ( x i , y i ) } n i =1 denote the set of all training examples with x i being an input data and y i ∈ {-1 , 1 } being its associated label. Denoted by h ( x ) = h w ( x ) the predictive function (e.g., a deep neural network), whose parameters are w ∈ R d . Denote by I ( · ) an indicator function of a predicate. Denoted by ∥ · ∥ = ∥ · ∥ p the L p -norm where p ∈ (1 , ∞ ] . Denoted by B (0 , ϵ ) = { x : ∥ x ∥ ≤ ϵ } the L p -norm ball centered at 0 with radius ϵ . Let D + and D -be the subsets of D with only positive examples and negative examples, respectively. Let n + = |D + | denote the number of positive examples. Denote by r ( x i , D ) = ∑ x j ∈D I ( h w ( x j ) ≥ h w ( x i )) the rank of x i in a set D according to the prediction scores in descending order, i.e., the number of examples that are ranked higher than x i including itself. Let ℓ ( h w ( x ) , y ) denote a pointwise loss function, e.g., the cross-entropy loss.

3.1 AP Maximization

According to its definition, AP can be expressed as: 1 n + ∑ x i ∈D + r ( x i , D + ) r ( x i , D ) [3]. Many different approaches have been developed for AP maximization [9, 36, 13, 4, 34]. We follow a recent work [34], which proposes an efficient stochastic algorithm for AP maximization based on differentiable surrogate loss minimization. In particular, the rank function is approximated by using a surrogate loss of the indicator function I ( h w ( x j ) ≥ h w ( x i )) [34], yielding the following problem:

where ℓ ( · ) denotes a smooth surrogate loss function, e.g., the squared hinge loss ℓ ( w ; x s ; x i ) = (max { m -( h w ( x i ) -h w ( x s )) , 0 } ) 2 , where m is a margin parameter.

To tackle the computational complexity of computing the stochastic gradient of P ( w ) , [34] has formulated this problem as a finite-sum coupled compositional optimization of the form 1 n + ∑ x i ∈D + f ( φ ( w ; x i )) , where φ ( w ; x i ) = [ φ 1 ( w ; x i ) , φ 2 ( w ; x i )] , φ 1 ( w ; x i ) = ∑ n s =1 I ( y s = 1) ℓ ( w ; x s ; x i ) /n , φ 2 ( w ; x i ) = ∑ n s =1 ℓ ( w ; x s ; x i ) /n , f ([ φ 1 , φ 2 ]) = -φ 1 /φ 2 . To compute a stochastic gradient estimator, their algorithm maintains two moving average estimators u 1 x i and u 2 x i for φ 1 ( w ; x i ) and φ 2 ( w ; x i ) . At iteration t , two mini-batches are sampeld B + ∈ D + and B ∈ D . The two estimators u 1 x i and u 2 x i are updated by Equation (2) for x i ∈ B + :

where γ 1 ∈ (0 , 1) is a moving average parameter. With these stochastic estimators, an stochastic estimate of ∇ P ( w ) is given by Equation (3)

Then the model parameter can be updated similar to SGD, momentum-based methods, or Adam.

3.2 Pointwise Attacks and Pointwise Adversarial Regularization

An adversarial attack is usually applied to a specific example x such that its class label is changed from its original label (non-targeted attack) or to a specific label (targeted attack). We refer to this kind of attack as pointwise attack. Various pointwise attacking methods have been proposed, including, FGSM [16], Basic Iterative Method [23], PGD [27], JSMA [32], DeepFool [30], and CW attack [8]. While our approach is agnostic to any pointwise attacks, we restrict our discussion to optimization-based non-target attacks, δ = arg min ∥ δ ∥≤ ϵ G ( w , x + δ, y ) , where G is an appropriate function, e.g., G ( w , x + δ, y ) = -ℓ ( h w ( x + δ ) , y ) . A classic adversarial training method is to solve a robust optimization problem that integrates the training loss with the adversarial attack, e.g.,

A deficiency of this approach is that it may not capture the trade-off between natural and robust errors [49]. To address this issue, robust regularization methods have been proposed, whose objective consists of a regular surrogate loss of error rate on clean data and a robust regularization term that accounts for the adversarial robustness. Different robust regularizations have been proposed [59, 45, 21]. A state-of-the-art approach is TRADES [59], whose objective is formulated by:

where λ > 0 is a regularization parameter and L ( · , · ) is an appropriate divergence function, e.g., cross-entropy loss between two predicted probabilities [59].

4 Adversarial AP Maximization

First, we discuss two straightforward approaches. The first method (referred to as AdAP_MM in Table 1) is to replace the loss in (4) as an AP surrogate loss yielding the following:

The second method (referred to as AdAP_PZ in Table 1) is to simply replace the first term in (5) with an AP surrogate loss:

The limitations of the first method are that it may not capture the trade-off between AP and robustness and the adversarial attacks during the training are inter-dependent, which is not consistent with pointwise attacks generated during the inference phase. While the second method is able to trade off between AP and robustness, the pointwise regularization is not suitable for tackling imbalanced datasets, as an perturbation on a single data point from a minority class does not change the pointwise regularization too much but could degrade the AP significantly.

4.1 Listwise Adversarial Regularization

To address the deficiencies of the above straightforward approaches, we draw inspiration from TRADES and propose a listwise adversarial regularization to replace the pointwise regularization. The key property of the listwise adversarial regularization is that it should capture the divergence between the ranking result of the clean data and that of the perturbed data. To this end, we leverage the top-one probability proposed in the literature of learning to rank [7].

Definition 1 The top one probability of an data x i represents the probability of it being ranked on the top, given the scores of all the examples i.e., p t ( x i ) = exp( h w ( x i )) ∑ j =1 exp( h w ( x j )) .

With the definition of top-one probability, we define the listwise adversarial regularization as the divergence between two listwise probabilities, i.e., { p t ( x i ) } n i =1 for the clean examples and { p t ( x i + δ i ) } n i =1 for the perturbed examples. Different metrics can be used to measure the divergence between two distributions, e.g., KL divergence between { p t ( x i ) } n i =1 and { p t ( x i + δ i ) } n i =1 , KL divergence between { p t ( x i + δ i ) } n i =1 and { p t ( x i ) } n i =1 , and their symmetric version Jensen-Shannon divergence. For illustration purpose, we consider the KL divergence:

To further understand the above listwise regularization, we conduct a theoretical analysis similar to [59] by decomposing the robust error into two components. The difference from [59] is that we need to use the misranking error. We consider the misranking error as R nat = E x i ∼D + I { h ( x i ) ≤ max x j ∈D -h ( x j ) } , which measures how likely a positive example is ranked below a negative example [43]. To characterize the robust ranking error under the attack of bounded ϵ perturbation, we define R rob = E x i ∼D + I {∃ δ i , δ j ∈ B (0 , ϵ ) , h ( x i + δ i ) ≤ max x j ∈D -h ( x j + δ j ) } . It is worth noting that R nat ≤ R rob is always satisfied, and in particular, R nat = R rob if ϵ = 0 . We show that the R rob can be decomposed into R nat and R bdy in Theorem 1.

Theorem 1 R rob = R nat + R bdy , where the second term is called the boundary error R bdy = E x i ∼D + I { h ( x i ) > max x j ∈D -h ( x j ) } I {∃ δ i , δ j ∈ B (0 , ϵ ) , h ( x i + δ i ) ≤ max x j ∈D -h ( x j + δ j ) } .

Remark: It is clear that the boundary error measures the divergence between two ranked list { h w ( x i ) } n i =1 and { h w ( x i + δ i ) } n i =1 , which provides an explanation of the divergence between the top-one probabilities on the clean data and on the perturbed data.

Since we are optimizing AP, we use an AP surrogate loss as a surrogate of the misranking error R nat on the clean data. Finally, it yields in a robust objective P ( w ) + R ( w , δ, D ) . A question remained is how to generate the perturbations. A simple strategy is to use the robust optimization approach that solves a zero-sum game: min w max δ ∈ Ω n P ( w ) + R ( w , δ, D ) (referred to as AdAP_LZ in Table 1). However, since R ( w , δ, D ) is a listwise regularization, the resulting perturbations { δ i } n i =1 are interdependent, which is not consistent with the pointwise attacks generated in the inference phase. To address this issue, we decouple the defense and the attack by solving a non-zero-sum game:

where the attacks are pointwise attacks generated for individual examples separately, e.g., FGSM, PGD. We refer to the above method as AdAP_LN. Finally, we experiment with another method by adding a pointwise regularization into the objective for optimizing the model parameter w , i.e.,

This method referred to as AdAP_LPN imposes a stronger advesarial regularization on the model.

4.2 Algorithms for Adversarial AP Maximization

Below, we will discuss efficient algorithms for adversarial AP maximization employing different objectives. Due to limit of space, we focus attention on solving (9). Equal efforts have been spent on solving other AdAP formulations with algorithms presented in the appendix.

Since there are two players one for minimizing over w and one for maximizing over δ , we adopt the alternating optimization framework that first optimizes δ for generating attacks of sampled data and then optimizes for w based on the sampled clean data and perturbed data. The optimization for δ is following the existing methods in the literature. We use the PGD method for illustration purpose. The major technical challenge lies at computing a gradient estimator of the listwise regularization R ( w , δ, D ) in terms of w . We consider δ to be fixed and rewrite R ( w , δ, D ) as:

Note that calculating the gradient of R ( w , δ, D ) in terms of w directly, which includes the prediction scores of all samples, is not feasible. To tackle this challenge, we cast R ( w , δ, D ) into a compositioal function and borrow the technique of stochastic compositional optimization. To this end, we define:

Let F ( g ) = g 1 g 2 -log g 2 +log g 3 . Then we write R ( w , δ, D ) = F ( g ( w )) = g 1 ( w ) g 2 ( w ) -log g 2 ( w ) + log g 3 ( w ) . The gradient of R ( w ; δ, D ) is given by:

The major cost for computing ∇ w R ( w , δ, D ) lies at evaluating g ( w ) and its gradient ∇ w g ( w ) , which involves passing through all examples in D . In order to develop a stochastic algorithm, we will approximate these quantities by using a mini-batch of random samples. The gradient ∇ w g ( w ) can be simply approximated by the stochastic gradient, i.e.,

where B denote a set of B random samples from D . Due to the non-linear dependence of ∇ w R ( w , δ, D ) on g ( w ) , we cannot simply use their mini-batch estimator in the calculation as it will yield a large optimization error [51]. To reduce the optimization error [34, 33], we will maintain a vector u = [ u 1 , u 2 , u 3 ] for tracking [ g 1 ( w ) , g 2 ( w ) , g 3 ( w )] . The vector u is updated by Equation (11), where γ 2 ∈ (0 , 1) is a parameter. An estimate of ∇ w R ( w , δ, D ) is given by

Equation (12):

Finally, we are ready to present the detailed steps of the proposed algorithm for solving AdAP_LZ in (9) in Algorithm 1, which employs PGD for generating adversarial attacks and stochastic compositional optimization techniques for updating the model parameter w .

5 Experiments

In this section, we perform extensive experiments to evaluate the proposed approaches against whitebox and black-box attacks on diverse imbalanced datasets. In order to provide a comprehensive understanding of our methods, we conduct experiments from three other perspectives: (1) trade-off between robustness and average precision; (2) a close look at the effect of the adversarial perturbations; (3) ablation study of different strategies for adversarial AP maximization.

Datasets. We conduct experiments on four distinct datasets sourced from various domains. These encompass CIFAR-10 and CIFAR-100 datasets [22], CelebA dataset [26] and the BDD100K dataset [57]. For CIFAR-10 and CIFAR100, we adopt one versus-all approach to construct imbalanced classification tasks. It should be noted that even for clean data, the task of distinguishing between 1 positive class and 99 negative classes in CIFAR100 is challenging. Hence, in our experiments, we employ the 20 superclass labels, of which we choose the first 10 superclasses for constructing 10 one-vs-all binary classification tasks to verify the adversarial robustness on the CIFAR100 dataset. We split the training dataset into train/validation sets at 80%/20% ratio, and use the testing dataset for testing. CelebA dataset is a large-scale face attributes dataset that contains over 200,000 images of celebrities, each of which is annotated with 40 facial attributes. In our experiments, we choose two attributes with the highest imbalanced ratio, i,e., Gray_hair and Mustache, to show the superiority of our method. We adopt the recommended training/validation/testing split. BDD100K dataset is a large-scale diverse driving video dataset, which also has collected image-level annotation on six weather conditions and six scene types. In our experiments, we choose two kinds of weather conditions, i.e., Rainy and Cloudy, and two kinds of scene types, i.e., Tunnel and Residential, which are more imbalanced than others. Since the official testing dataset is not handy, we take the official validation set as the testing data, and split the training dataset into train/validation sets at 80%/20% ratio. The statistics for each task in datasets are presented in Table 6 in the appendix.

Baselines. In all experiments, we compare our methods (AdAP_LN, AdAP_LPN) with the following baseline methods: (1) PGD [27], which solves a MiniMax objective directly to enhance the adversarial robustness in terms of accuracy; (2) TRADES [59], which considers the trade-off between robustness and accuracy by minimizing a form of regularized surrogate loss; (3) MART [53], which explores the effect of misclassified examples to the robustness of adversarial training. Furthermore, we include two normal training methods, namely CE minimization and AP maximization by [34], as references.

Experimental Details. We employ the ResNet18 [19] as the backbone network in our experiments. This choice is based on the fact that all the tasks involved in our study are binary classifications, and ResNet18 is considered to be expressive enough for the purpose. For all methods, with mini-batch size as 128, we tune learning rate in {1e-3,1e-4,1e-5} with standard Adam optimizer. We set the weight decay to 2e-4 for the CIFAR10 and CIFAR100 datasets and 1e-5 for the CelebA and BDD100k datasets. In the case of the CIFAR10 and CIFAR100 datasets, we run each method for a total of 60 epochs. For the CelebA and BDD100k datasets, we run each method for 32 epochs. The learning rate decay happens at 50% and 75% epochs by a factor of 10. For MART, AdAP_LN and AdAP_LPN, we tune the regularization parameter λ in {0.1, 0.4, 0.8, 1, 4, 8, 10}. For TRADES, we tune the regularization parameter in {1, 4, 8, 10, 40, 80, 100}, since they favor larger weights to obtain better robustness. In addition, for AdAP_LN and AdAP_LPN, we tune its moving average parameters γ 1 , γ 2 in {0.1, 0.9}. Similarly, we tune the moving average parameters γ 1 for AP maximization in {0.1, 0.9}. We set margin parameter in the surrogate loss of AP as 0.6 for all methods that use the AP surrogate loss. For all adversarial training methods, we apply 6 projected gradient ascent steps to generate adversarial samples in the training stage, and the step size is 0.01. We choose L ∞ norm to bound the perturbation within the limit of ϵ = 8 / 255 , as it is commonly used in the literature.

All the models in our experiments are trained from scratch, except direct AP maximization which is fine-tuned on a pretrained CE model as in [34]. For each experiment, we repeat three times with different random seeds, then report average and standard deviation.

5.1 Robustness against White-box Attacks

In this part, we evaluate the robustness of all models against PGD and APGD [12] white box attacks that have full access to model parameters. Specifically, we utilized 10-step PGD and APGD attack to generate adversarial perturbations constrained by the same perturbation limit ϵ = 8 / 255 . Given that APGD is a step size-free method, we set the step size for PGD to 0.007. For the adversarial training methods, hyperparameters and models are chosen based on the robust average precision (AP) metric on validation datasets, and their corresponding performances on test datasets are reported. For normal training methods, models are chosen based on the clean average precision. The results are presented in Table 2 and 3. Since we run all the classes of CIFAR10 and the first 10 classes of CIFAR100 to verify the effectiveness of our method, we report the mean average precision over the ten classes in the tables, and the performance on each class is shown in the appendix.

From Table 2 and 3, we can observe that our proposed methods outperform other baselines consistently by a large margin while maintaining notably higher clean AP scores. It is striking to see that our methods improve robust AP by 2 ∼ 7 percent on all datasets, compared with adversarial training methods which are concerning accuracy. The results also show that normal training methods (CE min. and AP max.) are vulnerable to adversarial attacks, while they can achieve pretty high clean AP. This is consistent with the observation from other literature [46, 16]. When comparing results in Table 3 with that in Table 2, we can see that APGD exhibits stronger attacks than PGD, as demonstrated in [12]. However, the superiority of our proposed methods still remains evident.

5.2 Robustness against Black-box Attacks

In this part, we examine all the models against adversarial black-box attacks. To achieve this, we utilize the model trained with CE loss minimization on clean datasets as an attacker model. So we do not include the performance of models of CE loss minimization here. With the well-trained model from CE loss minimization, we craft adversarial test images by PGD attack with 20 iterations and step size is 0.003, under perturbation limit ϵ = 8 / 255 . The models evaluated here are the same model evaluated in 5.1. The results are summarized in Table 4. Results show that our method exhibits significantly superior robustness against black-box attacks on all tasks, with evident advantages against white-box attacks shown in 5.1. From Table 4, we can also observe that the normal training method, i.e., AP maximization, is also susceptible when confronting adversarial black-box attacks.

5.3 Trade-off between Robustness and AP

As argued in various research studies [59, 40, 56], there exists a trade-off between accuracy and adversarial robustness. That is saying when one model boosts its adversarial performance, it may result in a decrease in its clean performance. In this part, we aim to study the trade-off between robustness and average precision and provide clear visualizations of the phenomenon. To accomplish this, we tune the weight of the regularization for the regularization-based approaches, i.e. TRADES, MART, AdAP_LN and AdAP_LPN, then show how their robust AP and clean AP changes. We evaluate the models at the last epoch to ensure that all methods reach a convergence point. For TRADES, AdAP_LN and AdAP_LPN, we tune the weight introduced in Experimental Details part, as well as 0.01, to better illustrate the trade-off trend. We also include non-regularization-based approaches as a point in this graph.

Based on Figure 2, we can observe that for TRADES, AdAP_LN and AdAP_LPN, as the weight of regularization increases, the clean AP decreases while the robust AP increases at first, which is consistent with the observation in [59]. But for MART, the trend is not clear as it is not a trade-off based approach. However, as the weight of regularization continues increasing, both the clean AP and robust AP decrease. This is because when the model places excessive emphasis on the regularization term, it may overlook the actual objective. Notably, our proposed methods place more towards the upper-right than other baselines, which indicates that our method is able to achieve better both robust and clean AP simultaneously.

5.4 Visualizing the Behavior after Adversarial Perturbations

To gain a deeper understanding of our approach, we have a close look at how defense models' predictions change after introducing adversarial perturbations. To be more specific, we compare our AdAP_LN method with another robust baseline, TRADES, to examine how their predictions are

affected by adversarial perturbations. For fair comparison, we apply the same perturbation crafted in 5.2 for both methods. From Figure 3, we can observe that for TRADES, all the samples' prediction scores cluster closely to a small value before perturbation as it is working on an imbalanced dataset, while the prediction scores of our method scatter more evenly. With introduced perturbations, the ranking order predicted by TRADE is changed significantly with small changes in prediction scores, which leads to a considerable decrease in terms of AP. On the contrary, the perturbation does not affect the predicted ranking order of our method, despite the impact on their prediction scores. This helps demonstrate why our method is more robust than other baselines in terms of AP.

5.5 Ablation Study

To investigate the significance of the new features in our proposed method, i.e., the listwise adversarial regularization and the non-zero-sum game approach, we conduct ablation studies to compare different approaches shown in Table 1 for adversarial AP maximization. Following the setting in 5.1, we

0.75

0.80

0.85

0.90

0.95

Clean AP

0.1

0.2

0.3

0.4

0.5

Robust AP

CIFAR10: class_1

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.5

0.6

0.7

0.8

0.9

Clean AP

0.1

0.2

0.3

0.4

Robust AP

CIFAR100: class_2

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.2

0.4

0.6

Clean AP

0.05

0.10

0.15

0.20

0.25

Robust AP

BDD100K: cloudy

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.4

0.6

0.8

Clean AP

0.05

0.10

0.15

0.20

0.25

0.30

Robust AP

CelebA: gray_hair

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

Clean

Perturbed

AdAP_LN

TRADES

AdAP_LN

TRADES

tunnel

tunnel

N

N

N

tunnel

tunnel

N

N

N

gray_hair gray_hair

N

N

N

gray_hair gray_hair

N

N

N

0.9990

0.5354

0.0848

0.0277

0.0022

0.0301

0.0262

0.0219

0.0213

0.0204

0.7559

0.5699

0.3844

0.3580

0.3455

0.1163

0.1160

0.1093

0.1037

0.1017

tunnel

tunnel

N

N

N

N

N

N

tunnel

tunnel

gray_hair gray_hair

N

N

N

N

N

N

gray_hair gray_hair

0.9984

0.4573

0.0975

0.0349

0.0028

0.0333

0.0250

0.0245

0.0227

0.0182

0.7340

0.5617

0.4086

0.3802

0.3577

0.1149

0.1147

0.1145

0.1063

0.1057

BDD100K Dataset

CelebA Dataset

run all these five approaches on Cifar10, CIFAR100 and BDD100K datasets. The experimental settings and the hyperparameters for AdAP_LN and AdAP_LPN are the same as those in 5.1. The hyperparameters we tune for AdAP_LZ are the same as those for AdAP_LN. For AdAP_PZ, we tune the weight parameter in {1, 4, 8, 10, 40, 80, 100}. For AdAP_MM, we tune γ 1 in {0.1,0.9}. The results are presented in Table 5. We can see that (i) robust regularization approaches are better than the minimax approach (AdAP_MM) (ii) the non-zero-sum game approaches (AdAP_LPN, AdAP_LN) are usually better than the zero-sum game approach (AdAP_LZ); (iii) combining listwise and pointwise adversarial regularization in AdAP_LPN could bring significant boost in term of both robust AP and clean AP.

Insensitivity to Batch Size. We investigate the proposed approximation method for g ( w ) by varying the mini-batch size for AdAP_LN algorithm and report results in Figure 4 in the appendix. We can see that AdAP_LN does not require a very large batch size and is generally not sensitive to the mini-batch size, which implies the effectiveness of our approximation method.

Sensitivity to γ 1 , γ 2 . We study the sensitivity of the hyper-parameters γ 1 , γ 2 for proposed AdAP_LN algorithm. From the results in Table 8 in the appendix, we can observe that γ 1 , γ 2 have a significant impact on the performance. However, when we tune γ 1 , γ 2 in { 0 . 1 , 0 . 9 } , it is able to achieve relatively good performance but not always the optimal one.

Empirical convergence analysis. We report the convergence curves of proposed AdAP_LN algorithm in Figure5 in the appendix, which demonstrates the convergence of the algorithm.

Time efficiency. We compare the training time efficiency of the proposed method with different algorithms in Table 7 in the appendix. We can observe that (i) adversarial training methods are generally more time-consuming than natural training; (ii) our proposed AdAP_LN and AdAP_LPN methods cost a little more time than traditional PGD method but much less time than TRADES.

6 Conclusions

In this paper, we have proposed a novel solution for maximizing average precision with adversarial ranking robustness. The proposed formulation is robust in terms of listwise ranking performance against individual adversarial perturbations and is able to trade off between average precision on clean data and adversarial ranking robustness. We have developed an efficient stochastic algorithm to solve the resulting objective. Extensive experimental results on various datasets demonstrate that the proposed method can achieve significantly improved adversarial robustness in terms of AP, compared with other strong adversarial training baselines. It would be interesting to extend our method to construct more robust systems with average precision as the objective, such as object detection systems and medical diagnosis systems.

Acknowledcements

Wethank anonymous reviewers for constructive comments. G. Li and T. Yang were partially supported by NSF Career Award 2246753, NSF Grant 2246757, NSF Grant 2246756, NSF Grant 2306572, and GMgift funding.

References

Sravanti Addepalli, Vivek BS, Arya Baburaj, Gaurang Sriramanan, and R Venkatesh Babu. Towards achieving adversarial robustness by enforcing feature consistency across bit planes. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 1020-1029, 2020.

Tao Bai, Jinqi Luo, Jun Zhao, Bihan Wen, and Qian Wang. Recent advances in adversarial training for adversarial robustness. CoRR , abs/2102.01356, 2021.

Kendrick Boyd, Kevin H Eng, and C David Page. Area under the precision-recall curve: point estimates and confidence intervals. In Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2013, Prague, Czech Republic, September 23-27, 2013, Proceedings, Part III 13 , pages 451-466. Springer, 2013.

Andrew Brown, Weidi Xie, Vicky Kalogeiton, and Andrew Zisserman. Smooth-ap: Smoothing the path towards large-scale image retrieval. In Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part IX 16 , pages 677-694. Springer, 2020.

Christopher Burges, Robert Ragno, and Quoc Le. Learning to rank with nonsmooth cost functions. Advances in neural information processing systems , 19, 2006.

Fatih Cakir, Kun He, Xide Xia, Brian Kulis, and Stan Sclaroff. Deep metric learning to rank. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 1861-1870, 2019.

Zhe Cao, Tao Qin, Tie-Yan Liu, Ming-Feng Tsai, and Hang Li. Learning to rank: from pairwise approach to listwise approach. In Proceedings of the 24th international conference on Machine learning , pages 129-136, 2007.

Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp) , pages 39-57. Ieee, 2017.

Kean Chen, Jianguo Li, Weiyao Lin, John See, Ji Wang, Lingyu Duan, Zhibo Chen, Changwei He, and Junni Zou. Towards accurate one-stage object detection with ap-loss. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 5119-5127, 2019.

Wei Chen, Tie-Yan Liu, Yanyan Lan, Zhi-Ming Ma, and Hang Li. Ranking measures and loss functions in learning to rank. Advances in Neural Information Processing Systems , 22, 2009.

Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In international conference on machine learning , pages 1310-1320. PMLR, 2019.

Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning , pages 2206-2216. PMLR, 2020.

Elad Eban, Mariano Schain, Alan Mackey, Ariel Gordon, Ryan Rifkin, and Gal Elidan. Scalable learning of non-decomposable objectives. In Artificial intelligence and statistics , pages 832-840. PMLR, 2017.

Logan Engstrom, Andrew Ilyas, and Anish Athalye. Evaluating and understanding the robustness of adversarial logit pairing. arXiv preprint arXiv:1807.10272 , 2018.

Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations , 2015.

Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 , 2014.

Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens Van Der Maaten. Countering adversarial images using input transformations. arXiv preprint arXiv:1711.00117 , 2017.

Puneet Gupta and Esa Rahtu. Ciidefence: Defeating adversarial attacks by fusing classspecific image inpainting and image denoising. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 6708-6717, 2019.

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 770-778, 2016.

Wenzheng Hou, Qianqian Xu, Zhiyong Yang, Shilong Bao, Yuan He, and Qingming Huang. Adauc: End-to-end adversarial auc optimization against long-tail problems. In International Conference on Machine Learning , pages 8903-8925. PMLR, 2022.

Harini Kannan, Alexey Kurakin, and Ian Goodfellow. Adversarial logit pairing. arXiv preprint arXiv:1803.06373 , 2018.

Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.

Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial intelligence safety and security , pages 99-112. Chapman and Hall/CRC, 2018.

Jiayang Liu, Weiming Zhang, Yiwei Zhang, Dongdong Hou, Yujia Liu, Hongyue Zha, and Nenghai Yu. Detection based defense against adversarial examples from the steganalysis point of view. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 4825-4834, 2019.

Zihao Liu, Qi Liu, Tao Liu, Nuo Xu, Xue Lin, Yanzhi Wang, and Wujie Wen. Feature distillation: Dnn-oriented jpeg compression against adversarial examples. In 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages 860-868. IEEE, 2019.

Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of International Conference on Computer Vision (ICCV) , December 2015.

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations , 2018.

Pritish Mohapatra, CV Jawahar, and M Pawan Kumar. Efficient optimization for average precision svm. Advances in Neural Information Processing Systems , 27, 2014.

Pritish Mohapatra, Michal Rolinek, CV Jawahar, Vladimir Kolmogorov, and M Pawan Kumar. Efficient optimization for rank-based loss functions. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages 3693-3701, 2018.

Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 2574-2582, 2016.

Harikrishna Narasimhan, Andrew Cotter, and Maya Gupta. Optimizing generalized rate metrics with three players. Advances in Neural Information Processing Systems , 32, 2019.

Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami. The limitations of deep learning in adversarial settings. In 2016 IEEE European symposium on security and privacy (EuroS&P) , pages 372-387. IEEE, 2016.

Qi Qi, Zhishuai Guo, Yi Xu, Rong Jin, and Tianbao Yang. An online method for a class of distributionally robust optimization with non-convex objectives. Advances in Neural Information Processing Systems , 34:10067-10080, 2021.

Qi Qi, Youzhi Luo, Zhao Xu, Shuiwang Ji, and Tianbao Yang. Stochastic optimization of areas under precision-recall curves with provable convergence. Advances in Neural Information Processing Systems , 34:1752-1765, 2021.

Zhuang Qian, Kaizhu Huang, Qiu-Feng Wang, and Xu-Yao Zhang. A survey of robust adversarial training in pattern recognition: Fundamental, theory, and methodologies, 2022.

Tao Qin, Tie-Yan Liu, and Hang Li. A general approximation framework for direct optimization of information retrieval measures. Information retrieval , 13:375-397, 2010.

Yao Qin, Nicholas Frosst, Sara Sabour, Colin Raffel, Garrison Cottrell, and Geoffrey Hinton. Detecting and diagnosing adversarial images with class-conditional capsule reconstructions. arXiv preprint arXiv:1907.02957 , 2019.

Yuxian Qiu, Jingwen Leng, Cong Guo, Quan Chen, Chao Li, Minyi Guo, and Yuhao Zhu. Adversarial defense through network profiling based path extraction. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 4777-4786, 2019.

Edward Raff, Jared Sylvester, Steven Forsyth, and Mark McLean. Barrage of random transforms for adversarially robust defense. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 6528-6537, 2019.

Aditi Raghunathan, Sang Michael Xie, Fanny Yang, John Duchi, and Percy Liang. Understanding and mitigating the tradeoff between robustness and accuracy. arXiv preprint arXiv:2002.10716 , 2020.

Alexander Robey, Luiz Chamon, George J Pappas, Hamed Hassani, and Alejandro Ribeiro. Adversarial robustness with semi-infinite constrained learning. Advances in Neural Information Processing Systems , 34:6198-6215, 2021.

Michal Rolínek, Vít Musil, Anselm Paulus, Marin Vlastelica, Claudio Michaelis, and Georg Martius. Optimizing rank-based metrics with blackbox differentiation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 7620-7630, 2020.

Cynthia Rudin. The p-norm push: A simple convex ranking algorithm that concentrates at the top of the list. 2009.

Samuel Henrique Silva and Peyman Najafirad. Opportunities and challenges in deep learning adversarial robustness: A survey. CoRR , abs/2007.00753, 2020.

Gaurang Sriramanan, Sravanti Addepalli, Arya Baburaj, et al. Guided adversarial attack for evaluating and enhancing adversarial defenses. Advances in Neural Information Processing Systems , 33:20297-20308, 2020.

Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 , 2013.

Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations , 2014.

Guanhong Tao, Shiqing Ma, Yingqi Liu, and Xiangyu Zhang. Attacks meet interpretability: Attribute-steered detection of adversarial samples. Advances in Neural Information Processing Systems , 31, 2018.

Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. arXiv preprint arXiv:1805.12152 , 2018.

Guanghui Wang, Ming Yang, Lijun Zhang, and Tianbao Yang. Momentum accelerates the convergence of stochastic auprc maximization. In International Conference on Artificial Intelligence and Statistics , pages 3753-3771. PMLR, 2022.

Mengdi Wang, Ethan X Fang, and Han Liu. Stochastic compositional gradient descent: algorithms for minimizing compositions of expected-value functions. Mathematical Programming , 161:419-449, 2017.

Wentao Wang, Han Xu, Xiaorui Liu, Yaxin Li, Bhavani Thuraisingham, and Jiliang Tang. Imbalanced adversarial training with reweighting. In 2022 IEEE International Conference on Data Mining (ICDM) , pages 1209-1214, 2022.

Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In International Conference on Learning Representations , 2020.

Zhengyang Wang, Meng Liu, Youzhi Luo, Zhao Xu, Yaochen Xie, Limei Wang, Lei Cai, Qi Qi, Zhuoning Yuan, Tianbao Yang, et al. Advanced graph and sequence neural networks for molecular property prediction and drug discovery. Bioinformatics , 38(9):2579-2586, 2022.

Peisong Wen, Qianqian Xu, Zhiyong Yang, Yuan He, and Qingming Huang. Exploring the algorithm-dependent generalization of auprc optimization with list stability. Advances in Neural Information Processing Systems , 35:28335-28349, 2022.

Yao-Yuan Yang, Cyrus Rashtchian, Hongyang Zhang, Russ R Salakhutdinov, and Kamalika Chaudhuri. A closer look at accuracy vs. robustness. Advances in neural information processing systems , 33:8588-8601, 2020.

Fisher Yu, Haofeng Chen, Xin Wang, Wenqi Xian, Yingying Chen, Fangchen Liu, Vashisht Madhavan, and Trevor Darrell. Bdd100k: A diverse driving dataset for heterogeneous multitask learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 2636-2645, 2020.

Jianhe Yuan and Zhihai He. Ensemble generative cleaning with feedback loops for defending adversarial attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 581-590, 2020.

Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning , pages 7472-7482. PMLR, 2019.

Mo Zhou, Zhenxing Niu, Le Wang, Qilin Zhang, and Gang Hua. Adversarial ranking attack and defense. In Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XIV 16 , pages 781-799. Springer, 2020.

A More Experimental Results

All experiments in our paper are run across 16 NVIDIA A10 GPUs and 10 NVIDIA A30 GPUs. We present the statistics for each task in our experiments in Table 6.

A.1 Time efficiency of our proposed algorithm

Time efficiency is typically a concern for adversarial training techniques. To order to investigate the time efficiency of our proposed method, we've conducted some experiments to show time efficiency comparison with different algorithms. In the experiment, we set the parameters, which could affect training time, exactly the same(e.g. batch size as 128, total epochs as 60, adversarial samples are generated with 6 projected gradient ascent steps) and run all the models over three times on the Class_0 task of CIFAR10. From the table 7, we can observe that (i) adversarial training methods are generally more time-consuming than natural training; (ii) our proposed AdAP_LN and AdAP_LPN methods cost a little more time than traditional PGD method but much less time than TRADES. This is because, to generate adversarial samples in training, TRADES is solving the maximization of KL divergence between the probabilities predicted with clean data and perturbed data(i.e. max ∥ δ ∥≤ ϵ ∑ k h ( x ) k log h ( x ) k -h ( x ) k log h ( x + δ ) k , where h ( x ) k and h ( x + δ ) k are predicted probabilities for class k on clean data and perturbed data respectively, which requires two forward propagations and one backpropagation in each projected gradient ascent step. However, PGD and our proposed methods are directly solving maximization of Cross Entropy(i.e. max ∥ δ ∥≤ ϵ -log h ( x + δ ) y ), which only needs one forward propagation and one backpropagation in each projected gradient ascent step. In adversarial training, since each gradient descent step w.r.t w requires multiple gradient ascent steps w.r.t δ , the computational expense primarily stems from the projected gradient ascent steps, which can be also observed by comparing the efficiency of CE Min. with PGD.

A.2 Sensitivity of proposed algorithm to batch size

In our proposed algorithm, one essential step is the approximation of g ( w ) . Due to the nonlinear dependence of ∇ w R ( w , δ, D ) on g ( w ) , we cannot simply use their mini-batch estimator in the calculation as it will yield a large optimization error [51]. Instead, we maintain a vector u = [ u 1 , u 2 , u 3 ] for tracking [ g 1 ( w ) , g 2 ( w ) , g 3 ( w )] to reduce the optimization error. The vector u is updated by Equation (11). To offer more empirical results on this, we have conducted some experiments to investigate the proposed AdAP_LN's sensitivity to batch sizes on CIFAR10 dataset. The results are shown in Figure 4. We can observe that our method does not require a very large batch size to achieve a good performance and is generally not sensitive to batch size, which implies the effectiveness of our approximation method.

100

200

300

400

500

0.0

0.1

0.2

0.3

0.4

0.5

0.6

Robust AP

CIFAR10

cls 0

cls 1

cls 2

cls 3

cls 4

cls 5

cls 6

cls 7

cls 8

cls 9

mAP

A.3 Sensitivity of proposed algorithm to γ 1 and γ 2

In our main experiments, the hyper-parameters γ 1 , γ 2 for our proposed algorithms are tuned in { 0 . 1 , 0 . 9 } as mentioned in Section 5. To study the sensitivity of these parameters, we conducted some more experiments on CIFAR10 and BDD100K datasets. The results are summarized in Table 8. From the table, we can observe that γ 1 , γ 2 have a significant impact on the performance. However, when we tune γ 1 , γ 2 in { 0 . 1 , 0 . 9 } , it is able to achieve relatively good performance but not always the optimal one.

A.4 Empirical convergence analysis

Since the theoretical convergence analysis of our proposed algorithm is very challenging, deriving the convergence would be a significant work by itself. Instead, we provides some empirical results to show the convergence of the proposed algorithm. Specifically, we set λ = 1 , γ 1 = 0 . 1 , γ 2 = 0 . 1 and run AdAP_LN algorithm on CIFAR10 dataset and BDD100K dataset for a total of 120 epochs and 80 epochs, respectively. We evaluate the training loss after each epoch and report the loss values. We present the AP loss (i.e., P ( w ) in Equation 9) and regularization term ( i.e., R ( w , δ, D ) in Equation 9) separately, as well as the summation of the two losses. For each experiment, we repeat three times with different random seeds. The results are shown in Figure 5, which demonstrates the convergence of our algorithm.

0

20

40

60

80

100

120

Epoch

0.5

0.4

0.3

0.2

0.1

0.0

0.1

Loss value

CIFAR10: class_0

P

R

P+R

0

20

40

60

80

100

120

Epoch

0.6

0.4

0.2

0.0

Loss value

CIFAR10: class_1

P

R

P+R

0

20

40

60

80

100

120

Epoch

0.30

0.25

0.20

0.15

0.10

0.05

0.00

0.05

0.10

Loss value

CIFAR10: class_2

P

R

P+R

0

20

40

60

80

Epoch

0.3

0.2

0.1

0.0

Loss value

BDD100K: rainy

P

R

P+R

A.5 Detailed values for Figure 2

To clearly demonstrate the relationship between robust AP/clean AP and λ , corresponding to Fig.2, we provide the detailed values in Table 9. For TRADES, AdAP_LN and AdAP_LPN, the results clearly indicate that there is a positive correlation between robust AP and λ for relatively small values of λ and this correlation diminishes when λ continues increasing. Moreover, a negative correlation between clean AP and λ is consistently observed, in accordance with our expectations. But for MART, the trend is not clear as it is not a trade-off based approach.

A.6 Detailed experimental results on CIFAR10 and CIFAR100 Dataset

Due to the limit of space, we include mAP results over 10 classes on CIFAR10 and CIFAR100 datasets in Section 5.1 and Section 5.2. Here, we present the detailed performance for each class on CIFAR10 and CIFAR100 datasets in Table 10, Table 11, Table 12,Table 13, Table 14, Table 15. From Table 10, Table 11, Table 12 and Table 13 about white-box robustness, we can observe that, in most cases, our methods improve other baselines significantly. There is one special case on CIfAR10 Class_3 in Table 10 that MART method behaves much better than others due to high variance(we can see it from the deviation in the parenthesis). When we look at Table 12 about white-box robustness against stronger APGD attacks, we can find that the superiority of MART disappears on CIfAR10 Class_3 since the advantage gained by high variance is not stable. From Table 14 and Table 15 about black-box robustness, we can observe that our methods outperform other baselines by a large margin consistently.

A.7 More plots for trade-off visualization

Due to page limitations, we present one single trade-off curve for each dataset in Section 5.3 to illustrate our findings. In this part, we include more trade-off curves on all the datasets in Figure 6, Figure 7, Figure 8, Figure 9. These additional figures provide further support for the superiority of our methods.

0.5

0.6

0.7

0.8

0.9

Clean AP

0.1

0.2

0.3

0.4

Robust AP

CIFAR10: class_0

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.75

0.80

0.85

0.90

0.95

Clean AP

0.1

0.2

0.3

0.4

0.5

Robust AP

CIFAR10: class_1

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.2

0.4

0.6

0.8

Clean AP

0.050

0.075

0.100

0.125

0.150

0.175

0.200

Robust AP

CIFAR10: class_2

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.2

0.4

0.6

Clean AP

0.06

0.08

0.10

0.12

0.14

0.16

Robust AP

CIFAR10: class_3

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.4

0.6

0.8

Clean AP

0.050

0.075

0.100

0.125

0.150

0.175

Robust AP

CIFAR10: class_4

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.4

0.6

0.8

Clean AP

0.05

0.10

0.15

0.20

0.25

Robust AP

CIFAR10: class_5

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.4

0.6

0.8

Clean AP

0.05

0.10

0.15

0.20

0.25

Robust AP

CIFAR10: class_6

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.5

0.6

0.7

0.8

0.9

Clean AP

0.1

0.2

0.3

0.4

Robust AP

CIFAR10: class_7

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.4

0.6

0.8

Clean AP

0.1

0.2

0.3

0.4

Robust AP

CIFAR10: class_8

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.4

0.6

0.8

Clean AP

0.1

0.2

0.3

Robust AP

CIFAR10: class_9

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.2

0.3

0.4

0.5

Clean AP

0.02

0.04

0.06

0.08

0.10

0.12

0.14

Robust AP

CIFAR100: class_0

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.2

0.4

0.6

Clean AP

0.05

0.10

0.15

0.20

Robust AP

CIFAR100: class_1

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.5

0.6

0.7

0.8

0.9

Clean AP

0.1

0.2

0.3

0.4

Robust AP

CIFAR100: class_2

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.2

0.4

0.6

Clean AP

0.05

0.10

0.15

0.20

Robust AP

CIFAR100: class_3

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.5

0.6

0.7

0.8

Clean AP

0.1

0.2

0.3

Robust AP

CIFAR100: class_4

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.2

0.4

0.6

Clean AP

0.02

0.04

0.06

0.08

0.10

0.12

0.14

Robust AP

CIFAR100: class_5

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.2

0.4

0.6

0.8

Clean AP

0.05

0.10

0.15

0.20

0.25

Robust AP

CIFAR100: class_6

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.2

0.4

0.6

Clean AP

0.05

0.10

0.15

0.20

Robust AP

CIFAR100: class_7

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.2

0.4

0.6

Clean AP

0.03

0.04

0.05

0.06

0.07

Robust AP

CIFAR100: class_8

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.2

0.4

0.6

0.8

Clean AP

0.05

0.10

0.15

0.20

Robust AP

CIFAR100: class_9

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.3

0.4

0.5

0.6

Clean AP

0.0

0.1

0.2

0.3

Robust AP

BDD100K: tunnel

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.2

0.3

0.4

0.5

0.6

Clean AP

0.06

0.08

0.10

0.12

0.14

0.16

0.18

Robust AP

BDD100K: residential

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.3

0.4

0.5

0.6

0.7

Clean AP

0.05

0.10

0.15

0.20

0.25

Robust AP

BDD100K: rainy

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.2

0.4

0.6

Clean AP

0.05

0.10

0.15

0.20

0.25

Robust AP

BDD100K: cloudy

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.4

0.6

0.8

Clean AP

0.05

0.10

0.15

0.20

0.25

0.30

Robust AP

CelebA: gray_hair

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

0.4

0.5

0.6

Clean AP

0.05

0.10

0.15

0.20

0.25

Robust AP

CelebA: mustache

AdAP_LPN

AdAP_LN

TRADES

MART

PGD

CE Min.

B Theoretical Results

B.1 Proof of theorem 1

Note that robust ranking error is defined as:

Notice that the last two terms above are exactly the considered boundary error R bdy and misranking error R nat . Therefore, we have R rob = R bdy + R nat .

B.2 Extra algorithms for adversarial AP maximization

Besides the Algorithm 1 shown in Section 4.2, we present the other algorithms for adversarial AP maximization in this part. Algorithms for solving AdAP_PZ in (7) and AdAP_LPN in (10) are similar to the Algorithm 1 and we present them in Algorithm 4 and Algorithm 3.

Different from above algorithms, the algorithm for solving AdAP_MM in (14) needs to solve inner maximization with AP surrogate loss to generate adversarial perturbations. Because this inner maximization problem includes all the samples in the dataset, we apply the similar compositional optimization technique borrowed from [34] to compute an estimate of ∇ δ P ( w , δ ) by:

where u δ 1 x i and u δ 2 x i are two estimators for tracking φ δ 1 ( w , δ i ; x i ) = 1 n ∑ n s =1 I ( y s = 1) ℓ ( w , x s + δ s , x i + δ i ) , φ δ 2 ( w , δ i ; x i ) = 1 n ∑ n s =1 ℓ ( w , x s + δ s , x i + δ i ) . At iteration t , the two estimators u δ 1 x i and u δ 2 x i are updated by

where γ 1 ∈ (0 , 1) is a parameter. And the stochastic gradient ̂ ∇ w P ( w , δ ) is computed by:

We present the whole algorithm for solving AdAP_MM in (14) in Algorithm 2.

The objective for AdAP_LZ is defined as

Since the listwise adversarial regularization includes all the samples in the dataset, the optimization for δ is also challenging. We extend the approach for computing an estimator of ∇ w R ( w , δ, D ) employed in Section 4.2 to estimate ∇ δ R ( w , δ, D ) . To avoid redundancy, we give the estimate directly by

where g ( δ ; w ) has the same definition as g ( w ) in Section 4.2, u = [ u 1 , u 2 , u 3 ] denotes a vector for tracking [ g 1 ( w ) , g 2 ( w ) , g 3 ( w )] . The whole algorithm for solving AdAP_LZ is presented in Algorithm 5.

Algorithm 2 Stochastic Algorithm for solving AdAP_MM in (14)

1: Initialize w , u δ 1 x , u δ 2 x , γ 1

2: for t = 1 , . . . , T do

3: Draw a batch of B + positive samples denoted by B + .

4: Draw a batch of B samples denoted by B .

5: For x i ∈ B ∪ B + , initialize δ i ∼ α · N (0 , 1)

6: for m = 1 , . . . , M do

7: For each x i ∈ B + , update u δ 1 x i and u δ 2 x i by Equation (16)

8: Compute ̂ ∇ δ P ( w t , δ ) by Equation (15)

9: Update δ i = Π ∥·∥≤ ϵ ( δ i + η 2 · sign ( ̂ ∇ δ i P ( w t , δ ))) , where Π Ω ( · ) is the projection operator.

10: end for

11: For each x i ∈ B + , update u δ 1 x i and u δ 2 x i by Equation (16)

12: Compute stochastic gradient estimator ∇ w t = ̂ ∇ w t P ( w t , δ ) by Equation (17)

13: Update w t +1 by using SGD, momentum-methods or Adam.

14: end for

Algorithm 3 Stochastic Algorithm for solving AdAP_LPN in (10)

1: Initialize w , u x , u , γ 1 , γ 2

2: for t = 1 , . . . , T do

3: Draw a batch of B + positive samples denoted by B + .

4: Draw a batch of B samples denoted by B .

5: for x i ∈ B do

6: Initialize δ i ∼ α · N (0 , 1)

7: for m = 1 , . . . , M do

8: Update δ i = Π ∥·∥≤ ϵ ( δ i + η 2 · sign ( ∇ δ i G ( w t , x i + δ i , y i ))) , where Π Ω ( · ) is the projection operator.

9: end for

10: end for

11: For each x i ∈ B + , update u 1 x i and u 2 x i by Equation (2)

12: Update u by Equation (11) and compute ̂ ∇ w t R ( w t , δ, D ) by Equation (12)

13: Compute stochastic gradient estimator:

14: Update w t +1 by using SGD, momentum-methods or Adam.

15: end for

Algorithm 4 Stochastic Algorithm for solving AdAP_PZ in (7)

1: Initialize w , u 1 x , u 2 x , γ 1

2: for t = 1 , . . . , T do

3: Draw a batch of B + positive samples denoted by B + .

4: Draw a batch of B samples denoted by B .

5: for x i ∈ B do

6: Initialize δ i ∼ α · N (0 , 1)

7: for m = 1 , . . . , M do

8: Update δ i = Π ∥·∥≤ ϵ ( δ i + η 2 · sign ( ∇ δ i L ( h w t ( x i ) , h w t ( x i + δ i )))) , where Π Ω ( · ) is the projection operator.

9: end for

10: end for

11: For each x i ∈ B + , update u 1 x i and u 2 x i by Equation (2)

12: Update u by Equation (11) and compute ̂ ∇ w t P ( w t ) by Equation (3)

13: Compute stochastic gradient estimator

14: Update w t +1 by using SGD, momentum-methods or Adam.

15: end for

Algorithm 5 Stochastic Algorithm for solving AdAP_LZ

1: Initialize w , u 1 x , u 2 x , u , γ 1 , γ 2

2: for t = 1 , . . . , T do

3: Draw a batch of B + positive samples denoted by B + .

4: Draw a batch of B samples denoted by B .

5: For x i ∈ B , initialize δ i ∼ α · N (0 , 1)

6: for m = 1 , . . . , M do

7: Update u by Equation (11) and compute ̂ ∇ δ R ( w t , δ, D ) by Equation (19)

8: Update δ i = Π ∥·∥≤ ϵ ( δ i + η 2 · sign ( ̂ ∇ δ i R ( w t , δ, D ))) , where Π Ω ( · ) is the projection operator.

9: end for

10: For each x i ∈ B + , update u 1 x i and u 2 x i by Equation (2)

11: Update u by Equation (11) and compute ̂ ∇ w t R ( w t , δ, D ) by Equation (12)

12: Compute stochastic gradient estimator ∇ w t = ̂ ∇ w t P ( w t ) + λ ̂ ∇ w t R ( w t ; δ )

13: Update w t +1 by using SGD, momentum-methods or Adam.

14: end for

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper studies the average precision issue in adversarial training. As attacking a single image may not affect the final accuracy, the average precision could be largely decreased. As a result, such a phenomenon is demonstrated to be harmful to applying adversarial training. To encourage AP robustness, a novel method is proposed by combining adversarial training and AP maximization. Additionally, by adding point-wise regularization, different variants are proposed. Through empirical analysis of many well-known datasets, the authors carefully validate the effectiveness of the proposed methods.\n\nSTRENGTHS:\n- This paper is well-written and can be easily understood.\n- The effectiveness is great on many datasets.\n- Detailed analysis of many variants of AdAP is provided.\n\nWEAKNESSES:\n- The major concern is the motivation of this paper. Why average precision is important in adversarial training is not sufficiently addressed. It seems like the research problem is ad hoc such that the proposed method could directly combine adversarial training and maximum precision. In the real world, I don’t think attacking a single example is worth investigating, and the described situation exists ubiquitously. Moreover, it is possible that in many realistic scenarios, the difference between the average accuracy and average precision might not be very large. Please justify.\n\n- I am not sure why two regularizations AdAP_MM and AdAP_PZ should be proposed together when the first one does not have a significant advantage compared to the last one.\n\n- The proposed method is limited to binary and imbalanced classification settings, which are strict on the problem setting. The performance of multi-class or balanced adversarial training is still questionable.\n\n- How does the hyper-parameters $\\lambda$, $\\gamma_1$ and $\\gamma_2$ are decided? Are they sensitive to different values?\n\nQUESTIONS:\nPlease refer to weaknesses.\n\nLIMITATIONS:\nLimitations are discussed in the paper. No potential negative societal impact is found.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-05"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper focuses on adversarial training in terms of Average Precision (AP), which is guided by three design principles: trade-off between AP and robustness, robustness in terms of AP instead of accuracy, and consistency of attacks. By utilizing the techniques of stochastic compositional optimization, the paper proposes a series of adversarial training algorithms to handle the inter-dependent perturbations.\n\nSTRENGTHS:\n1.\tNovelty: To the best of our knowledge, it is the first work to consider adversarial training of AP. It is a non-trivial extension due to the non-decomposable formulation of AP.\n\n2.\tSignificance: As a widely-used ranking metric, the robustness of AP is significant to the machine learning community. Besides, the design principles and techniques might be instructive to the robustness of other ranking metrics.\n\n3.\tClarity: The paper is overall well-written with clear notations.\n\n4.\tSoundness: The effectiveness of the proposed method is well-supported by experiments under various settings.\n\nWEAKNESSES:\n1.\tThe authors solve a non-zero-sum game to ensure consistency. However, unlike previous work on adversarial training, the equilibrium state of this game is unknown and requires more discussion.\n\n2.\tFig. 2 provides a visualization of the trade-off between robustness and AP, but how the hyperparameter $\\lambda$ affects the trade-off is unclear. Ideally, it should present a positive correlation.\n\n3.\tThe related work could be further improved by discussing the latest literature on AP stochastic optimization such as [1,2].\n\nRef:\n\n[1] Wang et. al. Momentum accelerates the convergence of stochastic auprc maximization. ICML, 2022.\n\n[2] Wen et. al. Exploring the algorithm-dependent generalization of auprc optimization with list stability. NeurIPS, 2022.\n\nQUESTIONS:\nPlease refer to the weaknesses part for the major concerns. Other minor issues are as follows:\n\n1.\tThe design of $R$ in Eq. (8) requires a detailed explanation: AP involves all examples, while the top-one probability focuses on the top-one examples. Could we apply ranking-based functions instead?\n\n2.\tThe proposed algorithms share similar properties with [19] and [32]. Is it possible to provide a corresponding convergence analysis based on these works?\n\nLIMITATIONS:\nLimitations are addressed.", "TITLE": "Official Review", "RECOMMENDATION": 8, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-07-05"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper considers the adversarial robustness of the AP metric, which is an important measure of deep learning under some imbalanced applications. To do this, the authors develop a novel formulation that combines an AP surrogate loss with a regularization term toward adversarial ranking robustness, maintaining the consistency between the ranking of clean data and that of perturbed data. Empirical studies demonstrate the effectiveness of the proposed methods.\n\nSTRENGTHS:\nTo the best of our knowledge, this is the first work to consider the AP-based adversarial robustness problem, which will bring some new insights to the adversarial robustness community.\nThe contributions of this paper are novel and the theoretical results are technically sound.\nThe empirical results are also promising.\n\nWEAKNESSES:\nHowever, some essential issues should be fixed:\n1. During the evaluation, this paper merely considers the simple FGSM-based attack manner, which is insufficient to support the effectiveness of the proposed method. Some stronger attacks, such as PGD-based and AutoAttack [1], should be considered.\n2. Another minor question is how AP-based AT impacts the performance of accuracy-based AT. Can the proposed methods improve AdAP without sacrificing overall accuracy? Because merely considering AP while overlooking accuracy may be meaningless.\n3. Why do we need to develop AdAP? What are the differences between AdAP and AdAUC in the ranking performance? Please give me some intuitive examples like Fig.1\n4. Finally, some latest advanced AP optimization methods are missed, such as [2].\n\n\nRef:\n[1] Reliable Evaluation of Adversarial Robustness with an Ensemble of Diverse Parameter-free Attacks.\n[2] Exploring the algorithm-dependent generalization of AUPRC optimization with list stability.\n\nQUESTIONS:\nPlease carefully address all my concerns in the weakness part.\n\nLIMITATIONS:\nThe authors do not include any limitations for their work.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-06"}

comments: SUMMARY:
This paper extends the discussion of adversarial robustness from accuracy to precision, and also extends TRADES solution to this new setting. The paper is fairly standard, with a new problem, a new solution, some minor theoretical studies (obviously also extended from TRADES), and some fairly good empirical results. The paper is highly condensed, so several critical points need further clarification.

STRENGTHS:
- The paper interestingly studies a new problem of precision in the adversarial setting. 

- The paper introduces a new algorithm to achieve the listwise regularizations

WEAKNESSES:
1. the empirical method and theoretical discussions are extended from TRADES, which might raise some concerns about the novel contributions of this work. 

2. the experiments are only conducted against FGSM attack, this is probably too limited, especially since there are several cases the performances are fairly close. 
    - please also use PGD and autoAttack. 

3. the an essential step of the algorithm is the approximation in Section 4.2, it's probably necessary to offer more empirical results on this regard, such as ablation studies with varying batch sizes.

QUESTIONS:
1. it seems the authors forgot to define AdAP_LPN properly. 
    - the only clue I can find is at line 337, where AdAP_LPN is combining listwise and pointwise adversarial regularization, then in contrast AdAP_LN is probably just listwise regularization. 

2. cannot find information about the threat model behind TRADES, and PGD, cannot confirm whether these threat models (models used to generated adversarial attacks) are the same as the AdAP family models or not.

LIMITATIONS:
do not find explicit discussions.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-07

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper investigates how to improve the robustness of a model under adversarial attacks while ensuring its Average Precision (AP) on clean data samples. This studied problem can be very important in some application scenarios but has not been extensively explored yet. By integrating the idea of existing adversarial training based methods into AP maximization algorithms, a novel solution is proposed in this paper. Experimental results obtained on multiple datasets with various binary imbalanced settings demonstrate the superiority of the proposed solution in terms of AP and robustness, comparing with baseline methods, which only focusing on optimizing either AP or robustness of models.\n\nSTRENGTHS:\n1. The problem explored in this paper, i.e., enhancing model robustness while maintaining AP, is a practical and important problem in some application scenarios but has not been well studied, as related works only focused on improving either model robustness or model AP.\n2. A novel solution is proposed in this paper by integrating existing adversarial training methods with AP maximization algorithms. Experimental results including performance comparison and ablation studies verify the effectiveness of the proposed solution.\n\nWEAKNESSES:\n1. To provide a more comprehensive perspective to evaluate the robustness of trained models, stronger attack methods, such as AutoAttack, should be included in experiments.\n2. Authors didn't discuss limitations of the proposed solution. Based on the description in the methodology part, the training efficiency of the proposed solution may be a problem.\n\nQUESTIONS:\n1. In the introduction part, authors mentioned one nice property when designing adversarial training methods for AP maximization is \"consistency of attacks between training and inference\". Can authors add more explanation about this claim? Why attacks are expected to be consistent in training and inference? Generally, to evaluate model robustness more comprehensively, any kinds of attacks can be used in the inference stage.\n2. How's the training efficiency of the proposed solution? It seems the proposed solution will take much longer time on training, comparing with adversarial training based methods.\n\nLIMITATIONS:\nThe efficiency of the proposed solution may be a problem. Hence, it would be better if authors can discuss or provide some experimental results to explain the efficiency of the proposed solution.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 2, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-10"}