[Paper Review] RetrievalGuard: Provably Robust 1-Nearest Neighbor Image Retrieval

Yihan Wu, Hongyang Zhang+1 more|arXiv (Cornell University)|Jun 17, 2022

Advanced Image and Video Retrieval Techniques4 citations

TL;DR

RetrievalGuard is the first provably robust 1-nearest neighbor (1-NN) image retrieval framework that ensures Recall@1 remains invariant under $ε$-bounded $σ$-norm adversarial perturbations. It achieves this by applying Gaussian smoothing to the embedding space of a base model, enabling certified robustness through a Lipschitz-bounded smoothed embedding with a calculable certified radius.

ABSTRACT

Recent research works have shown that image retrieval models are vulnerable to adversarial attacks, where slightly modified test inputs could lead to problematic retrieval results. In this paper, we aim to design a provably robust image retrieval model which keeps the most important evaluation metric Recall@1 invariant to adversarial perturbation. We propose the first 1-nearest neighbor (NN) image retrieval algorithm, RetrievalGuard, which is provably robust against adversarial perturbations within an $\ell_2$ ball of calculable radius. The challenge is to design a provably robust algorithm that takes into consideration the 1-NN search and the high-dimensional nature of the embedding space. Algorithmically, given a base retrieval model and a query sample, we build a smoothed retrieval model by carefully analyzing the 1-NN search procedure in the high-dimensional embedding space. We show that the smoothed retrieval model has bounded Lipschitz constant and thus the retrieval score is invariant to $\ell_2$ adversarial perturbations. Experiments on image retrieval tasks validate the robustness of our RetrievalGuard method.

Motivation & Objective

• To address the vulnerability of 1-NN image retrieval models to adversarial perturbations that degrade Recall@1.
• To develop a provably robust framework that guarantees Recall@1 remains unchanged under $σ$-bounded $σ$-norm adversarial attacks.
• To extend randomized smoothing—originally designed for classification—to high-dimensional embedding spaces used in retrieval tasks.
• To provide a model-agnostic, certified defense with a calculable robustness radius for 1-NN retrieval.
• To empirically validate the robustness-accuracy trade-off and scalability of the method across varying embedding dimensions and noise levels.

Proposed method

• Apply Gaussian smoothing to the embedding output of a base image retrieval model, generating a smoothed model $g(x)$ via Monte Carlo averaging over perturbed inputs.
• Define the smoothed embedding as $g(x) = \mathbb{E}_{\xi \sim \mathcal{N}(0, \sigma^2 I)}[h(x + \xi)]$, where $h(\cdot)$ is the base encoder.
• Prove that the smoothed model $g$ has a bounded Lipschitz constant, ensuring that small $σ$-norm perturbations do not change the 1-NN result.
• Use Monte Carlo sampling with $n = 100,000$ to estimate the smoothed embedding and compute the certified radius for each input.
• Apply a confidence threshold $\alpha = 0.01$ to determine the certified radius $r(x; g)$ such that the 1-NN result is guaranteed to be unchanged for all $\delta$ with $\|\delta\|_2 \leq r(x; g)$.
• Use the margin loss with hyperparameters $\beta = 1.2$, $\gamma = 0.2$, and $\sigma = 1$ to train the base metric learning model (DML/GDML) prior to smoothing.

Experimental results

Research questions

• RQ1 Can randomized smoothing be adapted to 1-NN image retrieval, where the output is a high-dimensional embedding rather than a discrete label?
• RQ2 What is the theoretical bound on the certified robustness radius for 1-NN retrieval under $σ$-norm perturbations?
• RQ3 How does the number of Monte Carlo samples and confidence level $\alpha$ affect the accuracy and reliability of the certified robustness guarantee?
• RQ4 What is the trade-off between robustness (certified radius) and retrieval accuracy (Recall@1) under varying levels of Gaussian noise $\sigma$?
• RQ5 How does the embedding dimension $k$ influence the certified robustness and retrieval performance?

Key findings

• RetrievalGuard achieves provable robustness: for any input $x$, the 1-NN result remains unchanged for all perturbations $\delta$ with $\|\delta\|_2 \leq r(x; g)$, where $r(x; g)$ is a calculable certified radius.
• With $\sigma = 1$, the model achieves a certified radius of up to 0.85 on the Online-Products dataset, with Recall@1(r) dropping only slightly as $r$ increases.
• The rejected ratio (false negatives in certified prediction) decreases from 14% at $n=10,000$ to 4% at $n=100,000$, indicating stable and reliable estimation.
• Increasing Monte Carlo samples from 1,000 to 100,000 significantly improves Recall@1(r), but further increases to 1,000,000 yield diminishing returns.
• The model is robust across different confidence levels $\alpha$, with Recall@1(r) remaining stable under $\alpha \in \{0.01, 0.05, 0.1\}$, indicating low sensitivity to $\alpha$.
• Larger embedding dimensions $k$ (e.g., $k=128$) improve robustness, as higher-dimensional spaces allow for larger margins between dissimilar samples, increasing $\underline{d}(x; g)$.