论文标题
检索守卫：可证明可靠的1年最邻居图像检索
RetrievalGuard: Provably Robust 1-Nearest Neighbor Image Retrieval
论文作者
论文摘要
最近的研究工作表明，图像检索模型容易受到对抗性攻击的影响，在这种攻击中，稍微修改的测试输入可能导致有问题的检索结果。在本文中，我们旨在设计一个可证明的强大图像检索模型，该模型使最重要的评估度量召回@1对对抗性扰动不变。我们提出了第一个1-纽约最邻居（NN）图像检索算法，检索guard，它可证明在$ \ ell_2 $可计算半径的球中对抗对抗性扰动。面临的挑战是设计一种可证明的鲁棒算法，该算法考虑到1-NN搜索和嵌入空间的高维质。从算法上，给定基本检索模型和查询样本，我们通过仔细分析高维嵌入空间中的1-NN搜索过程来构建平滑的检索模型。我们表明，平滑的检索模型具有Lipschitz常数的界限，因此检索得分不变到$ \ ell_2 $对抗性扰动。图像检索任务的实验验证了我们检索方法的鲁棒性。
Recent research works have shown that image retrieval models are vulnerable to adversarial attacks, where slightly modified test inputs could lead to problematic retrieval results. In this paper, we aim to design a provably robust image retrieval model which keeps the most important evaluation metric Recall@1 invariant to adversarial perturbation. We propose the first 1-nearest neighbor (NN) image retrieval algorithm, RetrievalGuard, which is provably robust against adversarial perturbations within an $\ell_2$ ball of calculable radius. The challenge is to design a provably robust algorithm that takes into consideration the 1-NN search and the high-dimensional nature of the embedding space. Algorithmically, given a base retrieval model and a query sample, we build a smoothed retrieval model by carefully analyzing the 1-NN search procedure in the high-dimensional embedding space. We show that the smoothed retrieval model has bounded Lipschitz constant and thus the retrieval score is invariant to $\ell_2$ adversarial perturbations. Experiments on image retrieval tasks validate the robustness of our RetrievalGuard method.
