A DVERSARIAL D EEP M ETRIC L EARNING
Anonymous authors
Paper under double-blind review
A BSTRACT
Learning a distance metric between pairs of examples is widely important for various tasks.
Deep Metric Learning (DML) utilizes deep neural network architectures to learn semantic feature embeddings where the distance between similar examples is close and dissimilar examples are far.
While the underlying neural networks produce good accuracy on naturally occurring samples, they are vulnerable to adversarially-perturbed samples that can reduce their accuracy.
To create robust versions of DML models, we introduce a robust training approach.
A key challenge is that metric losses are not independent — they depend on all samples in a mini-batch.
This sensitivity to samples, if not accounted for, can lead to incorrect robust training.
To the best of our knowledge, we are the ﬁrst to systematically analyze this dependence effect and propose a principled approach for robust training of deep metric learning networks that accounts for the nuances of metric losses.
Using experiments on three popular datasets in metric learning, we demonstrate the DML models trained using our techniques display robustness against strong iterative attacks while their performance on unperturbed (natural) samples remains largely unaffected.
I NTRODUCTION
Many machine learning (ML) tasks rely on ranking entities based on the similarities of data points in the same class.
Deep Metric Learning (DML) is a useful technique for such tasks, particularly for applications involving test-time inference of classes that are not present during training (e.g., zero-shot learning).
Example applications of DML include person re-identiﬁcation (Hermans et al., 2017), face veriﬁcation (Schroff et al., 2015; Deng et al., 2019), phishing detection (Abdelnabi et al., 2020), and image retrieval (Wu et al., 2017; Roth et al., 2019).
At its core, DML relies on state-ofthe-art deep learning techniques that can produce lower-dimensional semantic feature embeddings of high-dimensional inputs.
Points in this embedding space cluster similar inputs together while dissimilar inputs are far apart.
Unfortunately, the underlying deep learning models are vulnerable to adversarial examples (Szegedy et al., 2014; Biggio et al., 2013) — inconspicuous input changes that can cause the model to output attacker-desired values.
Thus, DML models themselves are vulnerable to adversarial examples.
Given their wide usage in diverse ML tasks, including security-oriented ones, it is important to train robust DML models that withstand attacks.
This paper tackles the open problem of training DML models using robust optimization techniques (Ben-Tal et al., 2009; Madry et al., 2018).
A key challenge in robust training of DML models concerns the so-called metric losses (Wu et al., 2017; Wang et al., 2019; Chechik et al., 2010; Schroff et al., 2015).
Unlike loss functions used in typical deep learning settings, DML loss for a single data point depends on the other data points in the mini-batch.
A sampling process selects points for a mini-batch, and thus, the DML losses are sensitive to this process as well.
For example, the widely-used triplet loss requires three input points: an anchor, a positive sample similar to the anchor, and a negative sample dissimilar to the anchor.
To compute this loss, for a batch of size B , this would require O( B 3 ), making the training process inefﬁcient.
Thus, a sampling process ensures that a mini-batch contains enough positive and negative examples for the training to be useful while keeping the batch small enough to be efﬁcient.
This dependence of the DML loss on the contents of the mini-batch poses a challenge to adversarial training: (1) it is unclear what points should be adversarially perturbed; and (2) it is unknown whether the perturbations would cause training instability.
Training a DML model is sensitive to the sampling process, and selecting samples that are too “hard” or “negative” can lead to training collapse (Wu et al., 2017).
We systematically approach the above challenges and contribute a robust training objective formulation for DML models by considering the widely-used triplet loss.
Our key insight is that during an inference-time attack, adversaries seek to perturb data points such that the intra-class distance maximize, and thus this behavior needs to be accounted for during training to improve robustness.
Recent work has attempted to train robust DML models, but they do not consider the issue of loss dependence and sensitivity to sampling (Abdelnabi et al., 2020).
This leads to non-robust DML models (Panum et al., 2020).
Contributions
• We contribute a principled robust training framework for Deep Metric Learning models by considering the dependence of triplet loss on the other data points in the mini-batch and the sensitivity to sampling.
• We experiment with three commonly-used datasets for vision-based deep metric learning (CUB200-2011, CARS196, SOP) and show that naturally-trained models do not have any robustness — their accuracy drops to close to zero when subjected to PGD attacks that we formulate.
• Using our robust formulation, we achieve good robustness.
For example, for a PGD attacker with 5 iterations and (cid:107) δ (cid:107) ∞ < 0 .
01 , we obtain an adversarial accuracy of 48.7 compared to the state-of-the-art natural accuracy baseline of 71.8 for the SOP dataset (in terms of R@1 score, a common metric in DML to assess the accuracy of models).
Furthermore, the resulting robust model accuracies are largely unaffected for natural (unperturbed) samples.
R ELATED W ORK
Deep Metric Learning.
Deep Metric Learning (DML) is a popular technique to obtain semantic feature embeddings with the property that similar inputs are geometrically close to each other in the embedding space while dissimilar inputs are far apart (Roth et al., 2020).
DML employs a variety of metric losses such as contrastive (Hadsell et al., 2006), triplet (Schroff et al., 2015), lifted-structure (Hermans et al., 2017), and angular loss (Wang et al., 2017).
Recent surveys (Roth et al., 2020; Musgrave et al., 2020) highlight that performance of newer metric losses are lesser than previously reported.
Thus, we choose to focus on the two established metric losses, contrastive and triplet loss, as they are widely used and have good performance.
Adversarial Robustness.
Since early work in the ML community discovered adversarial examples in deep learning models (Szegedy et al., 2014; Biggio et al., 2013), a big focus has been to train adversarially-robust models.
We focus on robust optimization-based training that utilizes a saddle-point formulation (min-max) (Ben-Tal et al., 2009; Madry et al., 2018).
To the best of our knowledge, no prior work has considered training DML models using robust-optimization techniques.
Recent work, however, has used metric losses to improve adversarial training for standard deep network architectures (e.g., CNNs)
(Mao et al., 2019; Li et al., 2019).
These techniques use metric losses (e.g., triplet) instead of traditional ones like cross-entropy.
By contrast, our goal is to create a robust training objective for DML models themselves.
This requires considering the dependence of metric losses on mini-batch items and the sampling process that derives those items.
We propose a principled framework for robustly training DML models that considers these factors.
Duan et al.
(2018) propose the “Deep Adversarial Metric Learning” framework that uses generative models (e.g., GANs (Goodfellow et al., 2014a)) during training to generate hard negative samples from easy negatives.
We observe that this work is concerned with better natural training of DML models rather than adversarial training, which is the focus of this work.
T OWARDS R OBUST D EEP M ETRIC M ODELS
First, we describe some basic machine learning (ML) notation and concepts required in this paper.
We assume a data distribution D over X × Y , where X is the sample space and Y = { y 1 , · · · , y L } is the ﬁnite space of labels.
Let D X be the marginal distribution over X induced by D 1 .
Given
Y ⊆ Y we deﬁne D Y to be the measure of the subsets of X × Y induced by D .
For y ∈ D , D y and
D − y denote the measures of the sets D { y } and D Y\{ y } , respectively.
In the empirical risk minimization (ERM) framework we wish to solve the following optimization problem:
[Equation]
In the equation given above H is the hypothesis space and l is the loss function.
We will denote vectors in boldface (e.g. x , y ).
Since the distribution is usually unknown, a learner solves the following problem over a data set S
= { ( x 1 , y 1 ) , · · · .
( x n , y n ) } sampled from the distribution D .
[Equation]
Once we have solved the optimization problem given above, we obtain a w ∗ ∈ H which yields a classiﬁer F : X → Y (the classiﬁer is usually parameterized by w ∗ , but we will omit it for brevity).
3. D EEP M ETRIC M ODELS
A deep metric model f
θ is function from X to S d , where θ ∈ Θ is a parameter and S d is an unit sphere in R d (i.e. x ∈ S d iff (cid:107) x
(cid:107)= 1 ).
Since deep metric models embed a space X (which can itself be a metric space) in another metric space, we also sometimes refer to them deep embedding.
Deep metric models use very different loss functions than typical classiﬁcation networks described previously.
Next we discuss two kinds of loss functions – contrastive and triplet.
Let
S = { ( x 1 , y 1 ) , · · · , ( x n , y n ) } be a dataset drawn from D .
A contrastive loss function l c is deﬁned over a pair ( x , y ) , ( x 1 , y 1 ) of labeled samples from X × Y and is deﬁned as:
[Equation]
In the equation given above, 1 E is an indicator function for event E ( 1 if event E is true andotherwise), and d θ ( x , x 1 ) is (cid:80) dj
=1 ( f θ ( x ) j − f θ ( x 1 ) j ) , the (cid:96) 2 distance in the embedding space.
A triplet loss function l t is deﬁned over three ( x , y ) , ( x 1 , y 1 ) and ( x 2 , y 2 ) labeled samples and is deﬁned as follows:
[Equation]
In the equation given above [ x ] + is max( x, 0) .
3. A TTACKS ON D EEP M ETRIC M ODELS
Assume that we have learned a deep embedding network with parameter θ ∈ Θ using one of the loss functions described above.
Next we describe how the network is used.
Let A =
{ ( a 1 , c 1 ) , · · · , ( a m , c m ) } be a reference or test dataset (e.g. a set of faces along with their label).
A is distinct from the dataset S used during training time.
Suppose we have a sample z and let k ( A, z ) be the index that corresponds to arg min j ∈{ 1 , ··· ,m } d θ ( a j , z ) 2 .
We predict the label of z as lb ( A, z ) =
c k ( A, z ) (we will use the functions k ( ., . )
and lb ( ., . )
throughout this section).
Next we describe test-time attacks on a deep embedding with parameter θ .
Let A y ⊂
A be the subset of the reference dataset with label y ∈ Y (i.e. A y is equal to { ( a j , y ) | ( a j , y ) ∈ A } ).
Let z ∈ X .
Untargeted attack on z can be described as follows (we want the perturbed point to have a different label than before):
[Equation]
Targeted attack (with a target label t (cid:54) =
lb ( A, z ) ) can be described as follows (we desire to the predicted label of the perturbed point to be a speciﬁc label): [Equation] such that lb
[Equation]
A
[Equation] z [Equation] In the formulations given above we assume that X is a metric space with µ a metric on X (e.g.
X could R n with usual norms, such as (cid:96) ∞ , (cid:96) 1 , or (cid:96) p (for p ≥ 2 )).
Any algorithm that solves the optimization problem described above leads to a speciﬁc attack on deep metric models.
3. R OBUST D EEP M ETRIC M ODELS
Let S =
{ ( x 1 , y 1 ) , · · · , ( x n , y n ) } be a dataset drawn from distribution D .
For a sample ( x i , y i ) where 1 ≤ i ≤ n we deﬁne the following surrogate loss function
ˆ l ( θ, ( x i , y i ) , S ) for the contrastive loss function l c :
[Equation]
Similarly, for the triplet loss function l t we can deﬁne the following surrogate loss function:
[Equation]
Let S y and S − y be deﬁned as the following sets: { ( x , y ) | ( x , y ) ∈ S } and { ( x , y (cid:48) )
| ( x , y (cid:48) ) ∈
S and y (cid:48) (cid:54) = y } .
In the equation given above the sizes of the sets S y and S − y are denoted by n y and n − y .
Having deﬁned the surrogate loss function ˆ l the learner’s problem can be deﬁned as:
[Equation]
Recall that the learner’s problem for the usual classiﬁcation case is:
[Equation]
Note that in the classiﬁcation case the loss function l ( w, x i , y i ) of a sample ( x i , y i ) does not depend on the other samples in the dataset S .
However, in the deep metric model case the surrogate loss function
ˆ l ( θ, ( x i , y i ) , S ) for a sample ( x i , y i ) depends on the rest of the data set S .
This is the main difference between the embedding and classiﬁcation scenarios.
Formulation 1.
Let B p ( x , (cid:15) ) denote the (cid:15) -ball around the sample x using the (cid:96) p -norm.
The straightforward robust formulation is given in the equation below.
[Equation]
In the formulation given above, all samples are adversarially perturbed at the same time (note that the max is outside the summation).
Therefore, this formulation is not convenient for current training algorithms, such as SGD and ADAM.
This is because the entire dataset S has to be perturbed at the same time.
Moreover, this formulation is not conducive to various sampling strategies used in training of deep metric models.
Formulation 2.
In this formulation we push the max inside the summation sign of the optimization formulation.
[Equation]
In the formulation given above, the sample x i is adversarially perturbed while other samples in the dataset S are kept intact while computing the surrogate loss function ˆ l .
This formulation is more conducive to current training techniques, such as SGD and ADAM.
Moreover, this formulation is also conducive to various strategies for sampling pairs and triplets used in deep metric models.
Formulation 3.
Our third formulation adds a regularizer which enforces the following informal constraint: if x changes a bit, the distance in the embedding space does not change too much.
[Equation]
These robust optimization formulations follow the common notion of robustness from robust optimization (Ben-Tal et al., 2009), thus given an algorithm for solving one of the robust optimization formulations, leads to a robust model.
3. A TTACK A LGORITHM
Performing test-time attacks requires an algorithm to solve the optimization objective described in
Equation 5.
To evaluate adversarial robustness of DML models, we propose an attack algorithm to solve this formulation, it can be seen in Algorithm 1.
The intuition of the algorithm is that adversaries seek to push a data point (under attack)
x i further away from a close data point x j of the same label in the embedding space, thus consequently closer to an embedding of data point of a different label.
To select a close data point, the algorithm ﬁrstly examines the label of nearest neighboring data point in the embedding space
k ( A ( i ) , x i ) for the respective set of anchors
A ( i ) .
If the retrieved label is different from the label of the data point under going attack y i , then no perturbation is performed as the data point would also be misclassiﬁed under nearest neighbor inference, commonly used within DML.
If they share classes, then data point x i is adversarial perturbed by approximating a solution to arg max z ∈ B p ( x i ,(cid:15) )
d θ ( z , x j ) using established attacks methods, such as
Fast Gradient Sign Method (FGSM) (Goodfellow et al., 2014b), Carlini-Wagner (C&W) (Carlini &
Wagner, 2017), Projected Gradient Decent (PGD) (Madry et al., 2018).
Recall that the embedding space is normalized to the unit sphere, and this method is applicable to commonly (cid:96) p -norms in robust optimization.
for
m do
A ( i ) ← S \ { ( x i , y i ) } // Deﬁne the set of anchors used for inference j ← k ( A ( i ) , x i ) //
Find the index of the nearest neighbor data point (using d θ ( · , · ) ) if y i =
y j then //
Nearest neighbor has the same class as x i , thereby perform adversarial perturbation x (cid:48)
i ← arg max z ∈ B p ( x i ,(cid:15) ) d θ ( z , x j ) // Approximate using established attack methods else x (cid:48) i ← x // No perturbation for incorrect predictions end if eval( θ, x (cid:48)
i , y i , A ( i ) ) // Optional step: Perform evaluations end for Following the adversarial perturbation, eval( θ, x (cid:48) i , y i , A ( i ) ) is an explicit evaluation step, that is optional. For more details on evaluations performed throughout this work, see Section 4.
To improve robustness of DML models, we propose a training objective that align with the covered robust formulations and can be viewed as adversarial training (Madry et al., 2018) for DML models. Given a set of possible perturbations ∆ p
= { δ | (cid:107) δ (cid:107) p ≤ (cid:15) } , parameterized by (cid:15) and an (cid:96) p -norm, let ρ (( x i , y i ) , ( x j , y j ) , ( x k , y k )) be a function that outputs an adversarial perturbation for the data point x i , with respect to the two dependent datapoints x j and x k , be deﬁned as:
[Equation]
Given a triplet ( x i , y i ) , ( x j , y j ) , ( x k , y k ) where y i = y j and y i (cid:54) =
y k , this formulation is an inversion of the training objective enforced by metric losses (maximize inter-class distances, minimize intraclass distances (Boudiaf et al., 2020)) for some speciﬁed (cid:96) p -norm. Effectively, when x i and x j share classes ( y i = y j ), the distance in the embedding space between these two points is maximized, while if y i (cid:54) = y k , the distance in the embedding space between x i and x k is minimized. The constrained optimization problem deﬁned by ρ ( · , · , · ) can be solved using commonly approximation techniques for uncovering adversarial perturbations, such as FGSM (Goodfellow et al., 2014b), C&W (Carlini & Wagner, 2017), PGD (Madry et al., 2018).
To simplify notation in following equations, we adopt the notation of ρ ( i,j,k ) for ρ (( x i , y i ) , ( x j , y j ) , ( x k , y k )) , in addition to ρ ( i,j ) = ρ ( i,j,j ) .
The robust training objective for the contrastive loss function be given by:
[Equation]
Here, γ ∈ { 0 , 1 } is a discrete random variable for which P ( γ = 1) ∈ [0; 1] is a hyper-parameter that speciﬁes the attack rate during training.
For tuple-based losses perturbations are not performed on negative pairs, such that P ( γ = 1 | y 1 (cid:54) =
y 2 )
= 0 .
To simplify notation, we use the notation of
P ( γ = 1) interchangeably across losses, however, for tuple-based losses it refers to P ( γ = 1 | y 1 = y 2 ) .
Similarly, let the robust training objective for triplet-based metric losses be given by:
[Equation]
These robust training objectives align the usual objective of adversarial training for deep neural networks, i.e. replace a sample by their ”worst case” variant before normal training.
For the sake of concreteness, we apply the objective to the (cid:96) ∞ , but the method is applicable to other norms commonly used for adversarial training.
E XPERIMENTS
Our experiments explore the following research questions.
Q
How robust are naturally trained DML models towards established adversarial example attacks
Among commonly used datasets for visual similarity, we ﬁnd that DML models, trained with established hyper-parameters, are vulnerable to adversarial examples, similar to non-DML models (Table 1).
This forms our baseline for robustness.
Q2.
What is the accuracy of DML models when they are trained using our robust formulation?
We ﬁnd that DML models can be trained to become more robust towards a given threat model.
For example, for a PGD attacker with 5 iterations and (cid:107) δ (cid:107) ∞ < 0 .
01 , we obtain an adversarial accuracy of 48.7 compared to the state-of-the-art natural accuracy baseline of 71.8 for the SOP dataset (Table 2).
4. E XPERIMENTAL S ETUP
Each experiment use parameter choices of Roth et al. (2020), unless otherwise speciﬁed, and perform evaluations on the commonly used datasets within DML.
These choices are a reﬂecting of state-ofthe-art performance for naturally-trained DML networks.
We summarize some of these choices below, and emphasize deviations.
For further we details on parameter choices, we refer the reader to Appendix A or the original work of Roth et al.
Experiments were executed on an NVIDIA Tesla V100 GPU (32GB RAM).
Code for the experiments is available at: (anonymized repository) https://github.com/starving-panda/ adversarial-metric-learning .
Model & Optimizer.
Each experiment use a ResNet50 model (He et al., 2016) initialized with pre-trained ImageNet weights and frozen batch-norm layers.
The last output layer is replaced with a fully-connected untrained embedding layer of size 128.
ResNets are commonly used and preferable in DML due to their reduced amount of parameters (Musgrave et al., 2020; Roth et al., 2020), while having comparable performance to other more complex deep neural network (DNN) architectures.
For training, the ADAM (Kingma & Ba, 2015) optimizer with a learning rate 3 of 10 − 6 , weight decay of 4 · 10 − 4 is used. For contrastive loss α = 1 . 0 , while α = 0 . 2 for triplet loss.
Datasets.
We use datasets common for metric learning: (1) CUB200-2011 (Welinder et al., 2010) containing 11788 images of birds across 200 species; (2) CARS196 (Krause et al., 2013) containing 16185 images of cars across 196 different models;
(3) SOP (Song et al., 2016) containingimages of 22634 different online products.
Each dataset is divided into a training and testing set of approximately the same size, by respective selecting the ﬁrst half of classes for the training set, while having the remaining classes be the testing set. This split reﬂect a zero-shot learning scenarios, which is a common application of DML.
Similar to Roth et al.
, we train CUB200-2011 and CARS196 for 150 epochs and SOP for 100 epochs due to its volume.
Batches & Sampling.
The training process use a mini-batch size of 112 data points.
Each minibatch is sampled such that it contains a ﬁxed amount of classes per class (Roth et al., 2020), for which this ﬁxed amount is speciﬁed is two samples per classes.
Following this, sets of tuples and triplets (depending on loss used for training) are derived from the mini-batch.
The triplet-set’s size is the same as the mini-batch, for which each data point is used as an anchor.
The tuple-set’s size is double that of the mini-batch, thus balancing out the number of data points being compared relative to the triplet-set.
Furthermore, each data point within the tuple-set is used in a positive and negative pair.
DML models are prone to collapse during training, a phenomenon caused by too many distant negative samples in the tuple- or triplet-sets, causing the model to map any data point to the same point in the embedding space.
As a measure to avoid this phenomenon, distance-weighted sampling is used for sampling negatives (Wu et al., 2017).
Adversarial Perturbations.
The proposed attack algorithm, Algorithm 1, and ρ ( · , · , · ) depends on solving a constrained arg max formulation.
To solve this formulation, we use PGD (Madry et al., 2018) that is an established attack method for creating adversarial perturbations.
Each attack run for ﬁve iterations, this was chosen to keep the efﬁcient (in terms of runtime), as training is DML models is considered an expensive procedure (Roth et al., 2020), and because the performance of the attack is known to saturate with high iterations counts (Wong et al., 2020).
Step sizes are ﬁxed to 2( (cid:15)i ) , where (cid:15) speciﬁes the domain of valid perturbations under (cid:96) ∞ , thus any perturbation δ satisfy (cid:107) δ (cid:107) ∞ ≤ (cid:15) .
This step size was chosen to keep the step size small, while ensuring the any point within the (cid:15) -ball is reachable, regardless of initialization (Wong et al., 2020).
Alternative attack methods, and their effectiveness, can be seen in Appendix D.
Evaluation Metrics.
We use two DML-speciﬁc evaluation metrics proposed by Musgrave et al.
(2020), namely: Recall at one (R@1) and Mean Average Precision at R (mAP@R).
R@1 is the accuracy of using the embeddings that the model produces for inferring the output class label using the class of the nearest neighbor anchor.
Given a test set S
= { ( x 1 , y 1 ) , · · · , ( x m , y m ) } , R@1 is given by: [Equation]
[Table]
perturbations generated using Algorithm 1 with PGD across various (cid:15) for (cid:96) ∞ .
Results are an average of ﬁve random seeds.
Recall that, R@1 reﬂects a model’s inference accuracy, while mAP@R reﬂects its ability to rank similar entities. Naturally-trained DML models are not robust to the generated adversarial perturbations.
mAP@R (Musgrave et al., 2020) measures a given model’s ability to rank among classes in the embedding space; we adopted this metric for the reasons covered by Musgrave et al.
It is deﬁned as:
[Equation]
k
[Equation]
( i
[Equation]
k ) , [Equation] R ( i ) = (cid:88)
[Equation]
4. E XPERIMENTAL R ESULTS
First we seek to establish a baseline of robustness against adversarial perturbations for naturallytrained DML models, using Algorithm 1.
To apply the algorithm for three common values of (cid:15) ∈ { 0 . 01 , 0 . 05 , 0 . 1 } used for computer vision 4 , under the norm (cid:96) ∞ , such that an adversarial perturbation δ satisfy (cid:107) δ (cid:107) ∞ ≤ (cid:15) .
PGD with ﬁve iterations is used to approximate a solution to the arg max . Five iterations was chosen as (1) it saturates the maximum attack effect because R@1 ≈ 0 , and (2) in this situation, adding more iterations leads to stagnation (Wong et al., 2020).
Table 1 summarizes the ﬁndings, for which reported performance is an averaged over ﬁve random seeds.
We observe that naturally-trained DML models achieve very low robustness to our proposed attack, experiencing a drop in both R@1 (inference) and mAP@R (ability to rank) by several orders of magnitude.
Thus, to answer Q1, we conclude that DML models are not inherently robust to established attacks, suggesting that prior studies which report higher robustness of naturally-trained DML models is a potential sign of ineffective attacks instead (Abdelnabi et al., 2020).
Next, we examine the effectiveness of our robust training objective (Section 3.5) for creating robust DML models.
We set a threat model (cid:96) ∞ ( (cid:15) = 0 . 01) and optimize a min-max objective while re-using hyper-parameter choices from non-robust training for ﬁve attack rates P ( γ = 1) ∈ { 0 . 1 , 0 .
For the inner-maximization, we use PGD with a similar conﬁguration to the attack setting.
Table 2 summarizes the results for the best performing robust model, for which the performance is reported as an average of ﬁve attacks with distinct random seeds.
Performance of the trained robust models on benign (unperturbed) input largely remains unaffected, for more details on this, we refer the reader to Appendix C.
We observe that our robust formulation does improve model robustness against the speciﬁed PGDbased attack across any combination of loss and dataset.
Consistently, for all of the chosen attack rates P ( γ = 1) , the robustness increased, more details on this matter can be found in Appendix C. We also observed that the gained robustness towards the PGD-based also transfer to other established attack methods, such as C&W and FGSM, see Appendix B for related results. [Table] To provide more clarity into the effects of the robust training objective on the embedding space
[Table]
we also provide a small experiment using a high-dimensional synthetic data set in Appendix E, highlighting that the robust training objective provide more stability to embeddings as data points are adversarially perturbed.
D ISCUSSION
The proposed robust training objective relies on perturbing positive data points within tuples and triplets, for reasons addressed in Section 3.4.
Experimentation of alternative perturbation targets, in Appendix F, demonstrate that the choice of perturbation target (positive) out perform alternatives (anchor, positive) in ﬁve out of six cases.
For one particular case (contrastive loss on CUB200-2011), perturbing the anchor data points achieves better performance (R@1 = 20 . 9 ) than the proposed method (R@1 = 18 . 4 ). We speculate that the inability of other perturbation targets are associated with known instabilities of metric losses (Wu et al., 2017).
Namely, that large distances between anchors and negatives cause gradients during training to be unstable. Stability is thus achieved by applying a sampling process that account for this phenomenon, and thus select a certain distribution of tuples or triplets. The proposed robust training objective induce noise (high loss) post-sampling, potentially causing instabilities during training. We hypothesis that this fact could be related to the observed drop in performance for certain training scenarios with high attack rates, P ( γ = 1)
= 1 , as seen in Appendix C.
We encourage future research to explore the inherent dilemma between robust optimization and instabilities in DML further.
C ONCLUSION
Deep Metric Learning (DML) creates feature embedding spaces where similar input points are geometrically close to each other, while dissimilar points are far apart.
However, the underlying
DNNs are vulnerable to adversarial inputs, thus making the DML models themselves vulnerable.
We demonstrate that naturally-trained DML models are vulnerable to strong attackers, similar to other types of deep learning models.
To create robust DML models, we contribute a robust training framework that can account for the dependence of metric losses — the phenomenon that the loss at any point depends on the other items in the mini-batch and the sampling process that was used to derive the mini-batch.
Our robust training formulation yields robust DML models that can withstand powerful PGD attackers without severely degrading their performance on natural inputs.
A T RAINING P ARAMETERS (E XPANDED )
Data Augmentation.
We augment the dataset using the following operations for each input image: (1) random cropping to an image patch of size 60-100% of the original image area; (2) scaling; (3) normalization of pixel intensities.
One difference is that our patch sizes differ from Roth et al. (2020) that employs patches of size 8-100% of original area. We change this parameter because recent work suggests that computer vision models can be biased by backgrounds and textures during during (Xiao et al., 2020). To combat this, we use cropping and scaling values based on Szegedy et al.
The robust DML models trained using the proposed adversarial training algorithm (covered in Section 3.5) approximate the solution to the arg max in ρ (( x i , y i ) , ( x j , y j ) , ( x k , y k ))
(deﬁned in Equation 14) using PGD (Madry et al., 2018), and have demonstrated improved robustness towards attacks using on PGD (see Table 2). However, as a measure to see if the increased robustness also apply to attacks relying on other attack methods, such as FGSM and C&W, we conduct a robustness evaluation using Algorithm 1 with these two attack methods under (cid:96) ∞ ( (cid:15) = 0 . 01) . For FGSM we use α = (cid:15) , to maximize the perturbation, and thereby attack strength, under the given norm.
Despite C&W being originally designed for (cid:96) 2 , we sought out to adopt an implementation created by the author 5 have implement the for (cid:96) ∞ .
However, it must be noted that the author now discourage the use of the attack method in favor of PGD for (cid:96) ∞ 6 . For C&W we had to only apply 50 iterations as a measure to combat extreme runtime, that were infeasible to run on our available resources, thereby the applied attack might not be able capture the full potential of the attack method. Results of these experiments can be seen in Table 3 and Table 4.
It can be seen that, despite having used PGD for the adversarial training, the improved robustness also improve across other attack methods.
C E XPERIMENT D ETAILS : A TTACK R ATES
This section expands upon the training process of the proposed robust formulation, particularly the impact of attack rate P ( γ = 1) , and the following performance of the DML models.
In Table 5, the performance of models against adversarial perturbations across various attack rates can be seen.
These results demonstrate that robustness of the models being trained increases across all of the covered attack rates P ( γ = 1) ∈ { 0 . 1 , 0 . 25 , 0 . 5 , 0 . 75 , 1 . 0 } . Additionally, there seems to be an association between higher attack rates yielding higher robustness. However, this relationship is not monotonic, and across data sets and losses optimal choices for attack rate vary. In Table 6, the performance for the robust (and a naturally-trained) models against benign (unperturbed) input can
[Table] [Table] be seen. Generally, it can be seen that the robust formulation has minor impact on performance on benign input, as each model’s evaluation metrics are close to performance of the naturally-trained baseline.
Interestingly, for contrastive loss on CUB200-2011 and CARS196 ( P ( γ = 1) = 0 .and
P ( γ = 1) = 0 . 1 ), the robust training objective have enable the benign performance to exceed the naturally-trained baseline.
This could suggest that a low frequency of adversarial perturbations could potentially improve the training process of non-robust DML.
We deem more details on this to out of scope for our work, but see it as an promising direction for future research to explore more thoroughly.
D E XPERIMENT : N ATURAL R OBUSTNESS (A LTERNATIVES )
This section covers the robustness for naturally-trained DML models for two other established attack methods, FGSM (Goodfellow et al., 2014b) and C&W (Carlini & Wagner, 2017).
Using the Algorithm 1 with these methods, it can be seen in Table 7 that they also lower the performance for (cid:96) ∞ ( (cid:15) = 0 . 01) . Hyper-parameters for C&W are covered in Appendix B, particularly iterations had to remain low to feasible runtime under the available resources. Thereby, tuning parameters to a greater extend could yield a more powerful attack and thus lower robustness.
[Table]
, metric, loss combinations.
Higher attack rates are often associated with lower performance on benign input.
For contrastive loss [Table] E E XPERIMENT : S YNTHETIC D ATA As a measure to establish more clarity into the effects of induced by the robust training objective (covered in Section 3), we seek to construct an experiment with two high-dimensional and well-deﬁned data distributions being mapped to low-dimensional embedding space.
We deﬁne the dimensionality of the high-dimensional input space as k = 3 × 224 × 224 , in order to share the dimensionality of the other experiments using real-world datasets.
We construct the dataset with two classes, “a” and “b”, for which each has an associated independent k -dimensional Gaussian distribution.
These distributions are N k ( µ a , Σ ) and N k ( µ b , Σ ) , for class “a” and “b” respectively, where:
[Equation] Here, I k ∈ R k × k is the identity matrix of size k and σ = 0 . Following this, we draw a dataset
D N with a ﬁxed amount of data points for each class and train a deep metric model f θ : R k
→ Rparameterized by θ .
We choose to have the embedding space be two-dimensional as a measure to enable visualizations of the learned embedding space. Using D N , we train two variants of f θ , one using the traditional (non-robust) training objective and another using the proposed robust training objective (for (cid:96) ∞ ( (cid:15) = 0 . 01) ). Each model use contrastive loss, is trained across 25 epochs ontrain data points, while being evaluated on 516 test data points. Following, we perform a test-time attack using Algorithm 1 with PGD ( (cid:15) = 0 . 01 ).
Differences of the learned embedding spaces, and the inﬂuence of the adversarial perturbations, can be seen in Figure E. [Figure] Generally, it can be seen that embeddings of the robust model remain more stable (in terms of position) in the embedding space, when compared to naturally-trained model.
{+Both models have R@1 = 100 . 
 for benign (unperturbed) data, while+} the naturally-trained model have R@1 = 4 .for adversarial data points, while the robust model attains R@1 = 0 for those data points
F E XPERIMENT : P ERTURBATION T ARGET
The proposed adversarial training techniques for DML apply perturbations to positive data points. This choice was made to establish alignment with the adversarial behavior covered in Section 3.4.
However, the “adversarial loss” ρ ( · , · , · ) can capture violations across various data point types (anchor, positive, negative). To assess the impact of using alternative perturbation targets (negative, anchor) for adversarial training, we performed an experiment with P ( γ = 1) = 0 .
5 (unless otherwise stated) across these alternative perturbation targets. Losses and attack rates used during adversarial training, for the other perturbation targets, are speciﬁed below. Negative perturbations for contrastive loss: [Equation]
[Equation] [Equation] [Equation] [Equation]
γρ (
[Equation]
[Equation]
[Equation]
P ( γ
[Equation]
[Equation]
y
[Equation]
y
[Equation]
=
[Equation]
and P ( γ = 1 | y 1 (cid:54) =
y 2 )
= 0 .
Anchor perturbations for contrastive loss: [Equation] [Equation] [Equation]
y
[Equation]
[Equation]
[Equation]
y
[Equation]
[Equation]
Negative perturbations for triplet loss:
[Equation]
Anchor perturbations for triplet loss: [Equation] [Equation] [Equation]
[Equation] y
[Equation]
( x 3 , y 3 )) Training processes for contrastive- and triplet loss can be seen in Figure 2 and Figure 3, respectively.
Across each combination of loss and dataset, the proposed adversarial training (positive perturbation) yields the most robustness for ﬁve out six experiments, with the exception of CUB200for contrastive loss.
Additionally, it reaches several orders of magnitudes higher performance on the CARS196 and SOP datasets.
We speculate that this inability for the alternative perturbation targets to reach similar performance can be linked to alterations on distance between anchors and negatives during training. Having large distance between anchor data points and negative data points are known to cause instabilities during training, causing models to reach a local minima (Wu et al., 2017).
[Figure] [Figure]