[Paper Review] Metric Learning for Adversarial Robustness

Chengzhi Mao, Ziyuan Zhong+3 more|arXiv (Cornell University)|Sep 3, 2019

Adversarial Robustness in Machine LearningComputer Science58 citations

TL;DR

The paper introduces Triplet Loss Adversarial (TLA) training, a metric-learning based regularization that uses adversarial anchors with a semi-hard negative mining strategy to tighten intra-class representations and enlarge inter-class margins, improving robustness and adversarial detection without changing model architectures.

ABSTRACT

Deep networks are well-known to be fragile to adversarial attacks. We conduct an empirical analysis of deep representations under the state-of-the-art attack method called PGD, and find that the attack causes the internal representation to shift closer to the "false" class. Motivated by this observation, we propose to regularize the representation space under attack with metric learning to produce more robust classifiers. By carefully sampling examples for metric learning, our learned representation not only increases robustness, but also detects previously unseen adversarial samples. Quantitative experiments show improvement of robustness accuracy by up to 4% and detection efficiency by up to 6% according to Area Under Curve score over prior work. The code of our work is available at https://github.com/columbia/Metric_Learning_Adversarial_Robustness.

Motivation & Objective

• Understand how adversarial attacks distort latent representations and motivate a metric-learning regularization.
• Propose a practical TLA training method to improve robustness and detection while preserving model architecture.
• Evaluate TLA across datasets and architectures against untargeted PGD and unseen attacks.
• Analyze how negative sampling and anchor choice affect robustness and provide guidance for training.

Proposed method

• Apply triplet loss on the penultimate layer to pull together clean and adversarial samples of the same class and push apart different classes.
• Use adversarial samples generated by PGD for the anchor while keeping positives as clean same-class examples and negatives as nearest same-batch samples from other classes.
• Define an angular distance metric in embedding space for the triplet loss.
• Combine cross-entropy loss on adversarial examples with the triplet loss and a feature norm decay term to stabilize training.
• Explore two variants: TLA-RN (random negatives) and TLA-SA (anchor-then-adversarial positive) with empirical evidence that semi-hard negatives improve performance.
• Evaluate with untargeted L-infinity attacks (and other norms) across MNIST, CIFAR-10, and Tiny ImageNet and with multiple architectures.

Experimental results

Research questions

• RQ1 Can a metric-learning based regularization improve adversarial robustness without altering model architecture?
• RQ2 How does triplet loss with adversarial anchors and semi-hard negative mining affect the embedding geometry under attacks?
• RQ3 Does TLA generalize to unseen attack types and different model architectures?
• RQ4 What is the impact of anchor selection and negative sampling strategy on robustness and detection performance?

Key findings

• TLA improves adversarial accuracy by up to 4% on CIFAR-10 under strong 20-step PGD attacks compared to baselines.
• TLA enhances adversarial sample detection, achieving up to ~6% higher AUC in adversarial example detection.
• Semi-hard negative mining (mini-batch nearest negatives) outperforms random negatives and improves robustness.
• TLA generalizes to unseen attack types (L0 and L2) with notable gains on CIFAR-10 and MNIST.
• TLA yields better nearest-neighbor consistency in embedding space under adversarial perturbations, aiding robust retrieval and detection.
• TLA is effective across multiple architectures (LeNet, WRN, MLP, ConvNet) with consistent robustness gains.