Deep Metric Learning (DML) models are vulnerable to adversarial examples, but existing defenses only address the template-matching use case and break down in the clustering-based inference scenario, where there is no fixed label vector (the target is the dynamic, high-dimensional class centroid) so adapted classification defenses (AT, Mix-Up, IAT, TRADES) fail to converge or generalize. The novel contribution is Ensemble Adversarial Training (EAT): (1) promote ensemble diversity through a training-data split — each of N members trains on a distinct (N-1)-of-N partition — instead of an output-space determinant diversity term that collapses in high dimensions; (2) a self-transferring mechanism that crafts PGD adversarial examples against the whole ensemble (summed member gradients) and uses them to train each member; and (3) a non-differentiable majority-vote inference that denies the attacker a smooth gradient. EAT beats adapted classification defenses under white-box PGD on CUB200/CARS196/In-Shop with negligible clean-accuracy loss.
This paper studies the adversarial robustness of Deep Metric Learning (DML) models, focusing on the previously neglected clustering-based inference scenario (as opposed to template matching). It show…