Research map / Adversarial robustness and security / Certified and empirical robustness

Collapse-Aware Triplet Decoupling for Adversarially Robust Image Retrieval

ICML 2024 · Adversarial robustness and security › Certified and empirical robustness · approach: Adversarial training with feature consistency · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes CA-TRIDE, an adversarial training method for deep metric learning image retrieval that decouples triplet perturbations (anchor vs candidates) and uses a collapse-aware metric to prevent model collapse, plus a new robustness metric ARS.

Problem

Adversarial training for robust deep metric learning in image retrieval suffers from weak adversaries (perturbation spreads embedding shifts across anchor, positives, negatives) and model collapse when adversaries are strengthened; existing robustness metric ERS also has flaws.

Approach

Alternate between candidate perturbation (CAP) and anchor perturbation (ANP) per mini-batch (TRIDE) to yield larger embedding shifts, and gate perturbations with a proactive collapseness metric C (distance-weighted triplet margin) that stops perturbation once C>=0, plus a top-rank pair; also proposes ARS to replace ERS.

Key results

• On CUB, CA-TRIDE reaches overall ARS 51.6% vs 47.2% for HM and ERS 38.6 vs 36.0 for HM, using 16 PGD steps versus 32.
• On SOP, CA-TRIDE achieves ARS 81.3% vs 77.7% for HM and ERS 62.4 vs 61.6 for HM.
• CA-TRIDE takes about 15% less training time than HM (470 vs 550 minutes on CUB with an RTX3090) and half the computational cost per the authors' analysis.

Measured effects reported in the paper

Surprising findings

• Naive TRIDE, CAP, and ANP without collapse awareness cause model collapse (R@1 of 0.8% to 7.8%), showing the stronger adversary alone is harmful.
• TMA, a cosine-similarity attack, scores higher-robustness models lower, which the authors attribute to metric mismatch with Euclidean-trained models.

Limitations

• Lower GTM robustness than HM on CUB and CARS, attributed to conflict between top-rank pair design and the GTM attack.
• Attention factor lambda is dataset-dependent and must be tuned per dataset or model, correlated with dataset entanglement.
• Gains over HM are modest (about 1-4 points), and results are on a single ResNet-18 backbone.

Experimental setup

Datasets: CUB-200-2011 Cars-196 Stanford Online Products (SOP)

Benchmarks: CUB-200-2011 Cars-196 Stanford Online Products

Metrics: R@1 R@2 mAP NMI ERS ARS separability

Baselines: ACT HM NT (naive training) Naive AT

Builds on: hardness manipulation anti-collapse triplet semi-hard sampling PGD adversarial training

Closest papers by meaning

• Threshold-Consistent Margin Loss for Open-World Deep Metric Learning (ICLR 2024 · similarity 0.85)
• Perturbation-Invariant Adversarial Training for Neural Ranking Models: Improving the Effectiveness-Robustness Trade-Off (AAAI 2024 · similarity 0.84)
• Adversarial generalization of unfolding (model-based) networks (NeurIPS 2025 · similarity 0.83)
• RAMP: Boosting Adversarial Robustness Against Multiple $l_p$ Perturbations for Universal Robustness (NeurIPS 2024 · similarity 0.83)
• Expressive Losses for Verified Robustness via Convex Combinations (ICLR 2024 · similarity 0.83)
• Robust SAM: On the Adversarial Robustness of Vision Foundation Models (AAAI 2025 · similarity 0.83)