Deep Neural Network (DNN) classifiers are vulnerable to adversarial attack,
where an imperceptible perturbation could result in misclassification. However,
the vulnerability of DNN-based image ranking systems remains under-explored. In
this paper, we propose two attacks against deep ranking systems, i.e.,
Candidate Attack and Query Attack, that can raise or lower the rank of chosen
candidates by adversarial perturbations. Specifically, the expected ranking
order is first represented as a set of inequalities, and then a triplet-like
objective function is designed to obtain the optimal perturbation. Conversely,
a defense method is also proposed to improve the ranking system robustness,
which can mitigate all the proposed attacks simultaneously. Our adversarial
ranking attacks and defense are evaluated on datasets including MNIST,
Fashion-MNIST, and Stanford-Online-Products. Experimental results demonstrate
that a typical deep ranking system can be effectively compromised by our
attacks. Meanwhile, the system robustness can be moderately improved with our
defense. Furthermore, the transferable and universal properties of our
adversary illustrate the possibility of realistic black-box attack.

本文提出了两种针对深度排序系统的攻击方法，即候选攻击和查询攻击，并且也提出了一种防御方法来提高排序系统的鲁棒性，我们的攻击和防御方法在 MNIST、Fashion-MNIST 和 Stanford-Online-Products 数据集中进行了评估。实验结果表明，我们的攻击可以有效地攻击典型的深度排序系统，同时使用我们的防御方法可以中等程度地提高系统的鲁棒性，此外，我们的攻击展示了可以实现黑盒攻击的可能性。