Recent research works have shown that image retrieval models are vulnerable
to adversarial attacks, where slightly modified test inputs could lead to
problematic retrieval results. In this paper, we aim to design a provably
robust image retrieval model which keeps the most important evaluation metric
Recall@1 invariant to adversarial perturbation. We propose the first 1-nearest
neighbor (NN) image retrieval algorithm, RetrievalGuard, which is provably
robust against adversarial perturbations within an $\ell_2$ ball of calculable
radius. The challenge is to design a provably robust algorithm that takes into
consideration the 1-NN search and the high-dimensional nature of the embedding
space. Algorithmically, given a base retrieval model and a query sample, we
build a smoothed retrieval model by carefully analyzing the 1-NN search
procedure in the high-dimensional embedding space. We show that the smoothed
retrieval model has bounded Lipschitz constant and thus the retrieval score is
invariant to $\ell_2$ adversarial perturbations. Experiments on image retrieval
tasks validate the robustness of our RetrievalGuard method.

本文旨在设计一个可证明鲁棒的图像检索模型，使得最重要的评估指标 Recall@1 对抗性扰动具有不变性，通过我们所提出的第一个最近邻图像检索算法 RetrievalGuard 来实现对抗性扰动的保证鲁棒性，并通过实验验证了方法的鲁棒性。

RetrievalGuard: 可证明稳健的一邻近图像检索

RetrievalGuard: Provably Robust 1-Nearest Neighbor Image Retrieval

Recent works have shown the effectiveness of randomized smoothing as a
scalable technique for building neural network-based classifiers that are
provably robust to $\ell_2$-norm adversarial perturbations. In this paper, we
employ adversarial training to improve the performance of randomized smoothing.
We design an adapted attack for smoothed classifiers, and we show how this
attack can be used in an adversarial training setting to boost the provable
robustness of smoothed classifiers. We demonstrate through extensive
experimentation that our method consistently outperforms all existing provably
$\ell_2$-robust classifiers by a significant margin on ImageNet and CIFAR-10,
establishing the state-of-the-art for provable $\ell_2$-defenses. Moreover, we
find that pre-training and semi-supervised learning boost adversarially trained
smoothed classifiers even further. Our code and trained models are available at
this http URL .

本文提出使用对抗训练来提高基于随机平滑的分类器的效果，并设计一种适应平滑分类器的攻击方法，通过大量实验，得出这种方法在 ImageNet 和 CIFAR-10 上的性能显著胜过所有现有的可证明的 L2 - 强健分类器，证明了这种方法是可靠的，且半监督学习和预训练能够进一步提高其效果。

通过对抗训练平滑分类器实现可证明健壮的深度学习

Provably Robust Deep Learning via Adversarially Trained Smoothed  Classifiers

Recent work has shown that it is possible to train deep neural networks that
are provably robust to norm-bounded adversarial perturbations. Most of these
methods are based on minimizing an upper bound on the worst-case loss over all
possible adversarial perturbations. While these techniques show promise, they
often result in difficult optimization procedures that remain hard to scale to
larger networks. Through a comprehensive analysis, we show how a simple
bounding technique, interval bound propagation (IBP), can be exploited to train
large provably robust neural networks that beat the state-of-the-art in
verified accuracy. While the upper bound computed by IBP can be quite weak for
general networks, we demonstrate that an appropriate loss and clever
hyper-parameter schedule allow the network to adapt such that the IBP bound is
tight. This results in a fast and stable learning algorithm that outperforms
more sophisticated methods and achieves state-of-the-art results on MNIST,
CIFAR-10 and SVHN. It also allows us to train the largest model to be verified
beyond vacuous bounds on a downscaled version of ImageNet.

通过分析，我们展示了如何利用一种简单的边界技术（interval bound propagation，IBP）来训练大型保正可证神经网络，从而打败了验证准确率最高的现有技术，在 MNIST，CIFAR-10 和 SVHN 数据集上达到了最先进的结果。