Pith. sign in

REVIEW 4 major objections 4 minor 61 references

Towards Adversarially Robust Deep Metric Learning

T0 review · 4 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that clustering-based inference in deep metric learning is left defenseless by existing adversarial defenses, and that a new ensemble-based method, EAT, restores robustness under white-box PGD attacks.

desk verdict The paper identifies a real gap—clustering-based DML inference—but its evaluation uses retrieval metrics and a self-consistency attack, so the central claim about clustering robustness is untested. read the letter →

arxiv 2501.01025 v2 pith:TUC2D2HC submitted 2025-01-02 cs.LG cs.AI

Xiaopeng Ke This is my paper · ORCID
classification cs.LGcs.AI
keywords deepmetriclearningadversarialrobustnessclustering-basedinferenceensembletrainingPGDattackdefensewhite-box
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Deep metric learning models are used in two ways: template matching and clustering-based inference. The paper argues that clustering-based inference is a neglected and more dangerous setting, because an attacker can perturb both images in every distance comparison. It shows that straightforward adaptations of classification defenses to metric learning, such as adversarial training, Mix-Up, IAT, and TRADES, fail badly under white-box PGD attacks. The paper introduces Ensemble Adversarial Training (EAT), which trains an ensemble of metric-learning models on complementary data splits and uses a self-transferring mechanism to share adversarially generated examples across the ensemble. If these results hold, EAT is a practical defense for clustering-style use of metric learning.

What carries the argument

The key mechanism is the combination of data-split ensemble diversity with self-transferring adversarial example generation. Data-split diversity means each of N models trains on a different subset of size N−1 of the data, forcing the ensemble members to develop different robustness features without relying on the high-dimensional embedding space. The self-transferring mechanism generates adversarial examples for the training of each model by summing the gradients of all ensemble members' metric losses on the perturbed input (Eq. 10), so the robustness statistics of the whole ensemble are transferred into every single model's update. Inference is performed by an undifferentiable voting mechanism over the ensemble, which prevents the attacker from exploiting the averaging operation.

What would settle it

Implement an end-to-end clustering-based attack: take a trained EAT ensemble, run a standard clustering algorithm (e.g., k-means) on embeddings of a test set, and then launch a white-box PGD attack that perturbs both images in every pairwise distance computation the clustering uses. Measure cluster purity under this combined attack. If the improvement of EAT over the adapted defenses disappears or shrinks substantially relative to the reported Recall@k and NMI numbers, the clustering-robustness claim is not supported.

Watch

Extended reading notes

Core claim

The central discovery is that clustering-based inference creates a distinct adversarial threat model for deep metric learning, and that the standard toolkit of classification defenses does not transfer. In the clustering setting there are no fixed templates or label vectors, and the attacker controls both inputs of each distance computation, so the optimization space is larger and the usual adversarial-training objectives cannot be directly applied. The paper proposes EAT: split the training data into N disjoint parts; train each of N metric-learning models on the complement of one part to promote diversity; during every update, generate adversarial examples by summing the gradients of all ensemble models with respect to a single model's loss, then use those examples to train that model. Evaluated on CUB200, CARS196, and In-Shop with MobileNetV2 and BN-Inception under PGD attacks, EAT substantially outperforms the adapted classification defenses on recall, F1-score, and NMI, while incurring only a small drop in clean accuracy.

Load-bearing premise

The paper claims to defend clustering-based inference, but its evaluation only measures retrieval-style metrics on a query set with no clustering algorithm or cluster-label assignment described, so the central claim rests on the assumption that these metrics capture the robustness of an actual clustering pipeline.

Editorial extensions

If this is right

  • If EAT is correct, clustering-based inference for deep metric learning can be defended under white-box PGD attacks without sacrificing much clean accuracy.
  • The failure of adapted classification defenses suggests that the unstable label vectors and high-dimensional embedding spaces of DML require defense designs that avoid explicit labels and low-dimensional diversity measures.
  • Each individual ensemble member is more robust than a single model trained with an adapted defense, so the self-transferring mechanism provides robustness beyond simple ensemble averaging.
  • The data-split diversity scheme is lightweight and dataset-arrangement-only, which makes it applicable to DML settings where embedding-space diversity is hard to compute.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper evaluates with retrieval metrics (Recall@k, F1, NMI) on a query set rather than with an actual clustering procedure, so the clustering-robustness claim is an extrapolation; a direct test using a clustering algorithm and attacks on both sides of every distance comparison would be needed to confirm it.
  • The threat model where both inputs of a distance computation are perturbed suggests that a defense should explicitly train on adversarial pairs where both images are simultaneously perturbed; EAT's construction approximates this but does not formalize it as a pairwise attack loss.
  • The data-split ensemble idea may transfer to other high-dimensional metric tasks such as re-identification or few-shot learning, where templates are not available at inference time.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper addresses adversarial robustness for deep metric learning (DML) in a clustering-based inference scenario, arguing that existing defenses for DML (which target template matching) are inapplicable and that simple adaptations of classification defenses (AT, Mix-Up, IAT, TRADES) perform poorly. The authors propose Ensemble Adversarial Training (EAT), which trains an ensemble of DML models on different data splits, generates adversarial examples using gradients from the whole ensemble, and uses a voting mechanism for inference. Experiments on CUB200, CARS196, and In-Shop with MobileNetV2 and BN-Inception report that EAT outperforms the adapted baselines under PGD attacks.

Significance. If validated, EAT would be a practical contribution to an under-explored area: adversarially robust deep metric learning for clustering. The idea of using data-split diversity plus a self-transferring adversarial training mechanism is intuitive and the reported results show consistent gains over the included baselines on the PGD-10 attack. However, the current evaluation does not actually exercise the clustering scenario that motivates the paper, and the attack used for training and testing is not aligned with the clustering threat model. The significance of the work is therefore conditional on a substantial revision of the evaluation protocol.

major comments (4)
  1. [Experiments, Evaluation Metrics] The paper's central claim concerns clustering-based inference (Introduction), but the evaluation protocol never specifies a clustering algorithm or cluster-label assignment. Equations (11)-(13) define Recall@k, F1-Score, and NMI, and for In-Shop the authors state they only select the query part as test data, indicating a query-vs-gallery retrieval protocol in which only one side of each pairwise distance is perturbed. This contradicts the stated threat model in the Introduction, where the attacker can perturb both input terms of a distance computation in clustering. As a result, the reported robustness numbers do not directly test the claimed scenario.
  2. [Proposed Approach, Eq. (10)] The adversarial generation used for training (and presumably at test time) optimizes the self-consistency loss L(F^(i)(x_adv), F^(i)(x)) summed over the ensemble, i.e., the distance between a perturbed image and its own clean embedding. This is not the tuple-based metric loss L_metric defined in Eq. (3), which is what determines clustering quality. An attack that only induces embedding drift may be much easier to defend against than one that moves points across cluster boundaries or destroys cluster structure. The paper needs to either use an attack based on L_metric (e.g., perturbing the triplet/pair structure that defines clusters) or explicitly justify why self-consistency is the correct threat model for clustering.
  3. [Proposed Approach, Model inference] The model inference paragraph describes a voting mechanism that counts predicted labels and selects the most frequent one. This is a classification-style inference that requires access to class labels or templates, which are unavailable in the clustering scenario the paper aims to defend. It is unclear how this voting mechanism is applied in a clustering evaluation, and if the reported results use this mechanism, they are not clustering results. The paper should either describe a clustering-compatible inference procedure or reconcile the voting description with the clustering threat model.
  4. [Experiments, Tables 1-4 and Table 3] The headline comparisons in Tables 1, 2, and 4 pit EAT, an N-model ensemble with voting, against single-model baselines (AT, Mix-Up, IAT, TRADES). This confounds the benefit of the proposed diversity and self-transfer mechanisms with the general advantage of ensembling. Although Table 3 provides a naive-ensemble ablation, the main claim of 'greatly outperforming' adapted defenses is based on the uncontrolled comparison. A controlled comparison, e.g., an ensemble of equally-sized adversarially trained single models, is needed to isolate EAT's contribution and to support the stated claim.
minor comments (4)
  1. [Throughout] The paper contains typos and grammatical errors, including 'adaptions' used repeatedly, 'untill' in the Problem Formulation section, and 'classifcation' in the Introduction; a careful proofread is needed.
  2. [Experiments, Implementation Details] The test-time attack is not fully specified; it is unclear whether the same loss as in Eq. (10) is used for evaluation or whether a different attack (e.g., one based on L_metric) is employed. The paper should state the exact objective used to generate PGD test examples.
  3. [Experiments, Result Analysis] No error bars or repeated-run variance are reported. Some differences between EAT and baselines are small (e.g., In-Shop NMI 85.30 vs. 84.68 and CUB200 NMI 38.02 vs. 35.54), so without variance estimates it is difficult to assess the significance of the reported improvements.
  4. [Proposed Approach, Algorithm 1] The notation in Algorithm 1 is slightly inconsistent: line 7 uses (F^1_{theta_i}, ..., F^N_{theta_i}) where the subscript should likely index the ensemble models' parameters rather than the current model; clarifying this would improve readability.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity found: the EAT defense is evaluated against independent adapted baselines on standard benchmarks; the clustering-versus-retrieval evaluation mismatch is a correctness concern, not a circular derivation.

full rationale

I walked the paper's derivation chain from the robust DML objective (Eq. 3) through the proposed EAT algorithm (Algorithm 1 and Eqs. 9-10) to the experimental evaluation (Tables 1-4). The reported robustness numbers are empirical comparisons against adapted classification defenses (AT, Mix-Up, IAT, TRADES) on standard DML datasets, not quantities derived from fitted parameters or from the paper's own definitions. No parameter is fitted to the test metrics, no load-bearing self-citation is used, and no uniqueness theorem is invoked. The training-time adversarial generation in Eq. 10 uses a self-consistency gradient sum over the ensemble, which differs from the tuple-based L_metric in Eq. 3; however, this is a design choice, and the paper does not claim to derive its results from that loss by construction. Similarly, the fact that test-time PGD attacks belong to the same attack family used during adversarial training is standard practice in robustness evaluation, not circular reasoning, because the baselines are evaluated under the same protocol. The most substantive concern is that the evaluation uses retrieval-style metrics (Eqs. 11-13) and, for In-Shop, only the query split, whereas the clustering threat model in the introduction requires both distance terms to be perturbable. That mismatch is a threat to the validity of the central claim, but it is a correctness issue, not circularity: the paper's conclusions are not true by definition of its inputs. Therefore, no circular step is exhibited, and the appropriate circularity score is 0.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The EAT method depends on several hand-chosen hyperparameters and on two assumptions that are not verified: retrieval metrics are treated as a proxy for clustering, and the gradient-sum PGD attack is treated as a valid white-box attack against a non-differentiable voting ensemble.

free parameters (6)
  • Ensemble size N (and number of data splits) = not stated in paper
    Controls the diversity and cost of EAT; Algorithm 1 takes N as input but the experiments never report its value.
  • Mixed ratio beta = not stated in paper
    Weights clean metric loss versus adversarial loss in Algorithm 1 Line 9; no value or sensitivity analysis is given.
  • Training perturbation budget epsilon = 16/255
    Used for PGD during adversarial training; chosen by hand, no ablation across training budgets.
  • Test perturbation budget epsilon = 8/255
    Used for PGD evaluation; differs from training budget, which can affect robustness comparison.
  • PGD attack iterations = 10 (both training and test)
    Attack strength setting; robustness is only shown for this iteration count and the paper notes fluctuations with randomness.
  • Learning rate and epochs = 1e-4 initial learning rate, 200 epochs
    Standard training hyperparameters chosen by hand; no sensitivity analysis.
assumptions (5)
  • domain assumption The proxy-based PAL loss is the state-of-the-art metric learning loss and is representative for DML.
    Used as the metric loss for all experiments; if PAL is not representative, the conclusions may not generalize.
  • domain assumption White-box PGD attacks with l_p-bounded perturbations are the appropriate threat model for DML robustness.
    The paper follows common practice but does not consider adaptive attacks or other attack families.
  • ad hoc to paper Recall@k, F1-Score, and NMI computed on a query set measure clustering-based inference performance.
    The paper defines the clustering scenario but never runs a clustering algorithm; the connection between these retrieval metrics and clustering is assumed rather than demonstrated.
  • ad hoc to paper The adapted versions of AT, Mix-Up, IAT, and TRADES are fair and representative uses of those defenses for DML.
    The exact adaptation equations for the baselines are not fully specified, so the reader cannot verify that the baselines were given reasonable implementations.
  • ad hoc to paper The attack in Eq. 10, which sums gradients over all ensemble models, is a valid white-box attack against the non-differentiable voting ensemble.
    Voting is not differentiable, so the gradient-based attack is a surrogate; no adaptive attack against the voting rule is reported.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Towards Adversarially Robust Deep Metric Learning." pith.science (2026). https://pith.science/paper/TUC2D2HC

@misc{pith2026250101025,
  author       = {Pith},
  title        = {Pith review of: Towards Adversarially Robust Deep Metric Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TUC2D2HC}},
  note         = {Machine review of arXiv:2501.01025}
}
read the original abstract

Deep Metric Learning (DML) has shown remarkable successes in many domains by taking advantage of powerful deep neural networks. Deep neural networks are prone to adversarial attacks and could be easily fooled by adversarial examples. The current progress on this robustness issue is mainly about deep classification models but pays little attention to DML models. Existing works fail to thoroughly inspect the robustness of DML and neglect an important DML scenario, the clustering-based inference. In this work, we first point out the robustness issue of DML models in clustering-based inference scenarios. We find that, for the clustering-based inference, existing defenses designed DML are unable to be reused and the adaptions of defenses designed for deep classification models cannot achieve satisfactory robustness performance. To alleviate the hazard of adversarial examples, we propose a new defense, the Ensemble Adversarial Training (EAT), which exploits ensemble learning and adversarial training. EAT promotes the diversity of the ensemble, encouraging each model in the ensemble to have different robustness features, and employs a self-transferring mechanism to make full use of the robustness statistics of the whole ensemble in the update of every single model. We evaluate the EAT method on three widely-used datasets with two popular model architectures. The results show that the proposed EAT method greatly outperforms the adaptions of defenses designed for deep classification models.

Figures

Figures reproduced from arXiv: 2501.01025 by the authors.

Figure 1
Figure 1. The t-SNE (Policar, Stra ˇ zar, and Zupan 2019) ˇ results of the adaptions of popular defenses (Adversarial Training (Madry et al. 2019) and Mix-Up (Zhang et al. 2018). The DML models are trained on CUB200 (Welin￾der et al. 2010) using the Proxy Anchor Loss (Kim et al. 2020). Before launching the attack, the DML model can clearly classify samples from different classes. But after the attack, DML models trained under… view at source ↗
Figure 2
Figure 2. Recall@1 and F1-Score for different iteration [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Recall@1 and F1-Score for different ε settings of the PGD attack with the different defenses on CUB200 (Training with the MobileNetV2) proposed EAT defense presents the SOTA performance un￾der the PGD attack. Especially on the recall metric, our EAT defense significantly outperforms other defenses. The adversarial robustness under different iteration numbers of the attack. As is shown in [PITH_FULL_IMAGE:figures/fu… view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Recall@1 for the individual model of the EAT de [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

61 extracted references · 38 canonical work pages

  1. [1]

    , " * write output.state after.block = add.period write newline

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Aziere, N.; and Todorovic, S. 2019. Ensemble deep manifold similarity learning using hard proxies. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 7299--7307

    work page 2019

  4. [4]

    Bai, S.; Li, Y.; Zhou, Y.; Li, Q.; and Torr, P. H. 2020. Adversarial Metric Attack and Defense for Person Re -Identification. IEEE Transactions on Pattern Analysis and Machine Intelligence, 1--1

    work page 2020

  5. [5]

    Bengio, Y.; Courville, A.; and Vincent, P. 2013. Representation learning: A review and new perspectives. IEEE transactions on pattern analysis and machine intelligence, 35(8): 1798--1828

    2013

  6. [6]

    a ckinger, E.; and Shah, R. 1994. Signature verification using a

    Bromley, J.; Guyon, I.; LeCun, Y.; S \"a ckinger, E.; and Shah, R. 1994. Signature verification using a" siamese" time delay neural network. Advances in neural information processing systems, 737--737

    work page 1994

  7. [7]

    Carlini, N.; and Wagner, D. 2017. Towards Evaluating the Robustness of Neural Networks . arXiv:1608.04644 [cs]

    arXiv 2017

  8. [8]

    Chen, B.; and Deng, W. 2018. Almn: Deep embedding learning with geometrical virtual point generating. arXiv preprint arXiv:1806.00974

    arXiv 2018

Show all 61 references
  1. [9]

    Chen, B.; and Deng, W. 2019 a . Energy Confused Adversarial Metric Learning for Zero - Shot Image Retrieval and Clustering . Proceedings of the AAAI Conference on Artificial Intelligence, 33: 8134--8141

    2019

  2. [10]

    Chen, B.; and Deng, W. 2019 b . Hybrid- Attention Based Decoupled Metric Learning for Zero - Shot Image Retrieval . In 2019 IEEE / CVF Conference on Computer Vision and Pattern Recognition ( CVPR ) , 2745--2754. Long Beach, CA, USA : IEEE . ISBN 978-1-72813-293-8

    2019

  3. [11]

    Chopra, S.; Hadsell, R.; and LeCun, Y. 2005. Learning a similarity metric discriminatively, with application to face verification. In 2005 IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR'05), volume 1, 539--546. IEEE

    2005

  4. [12]

    Deng, J.; Dong, W.; Socher, R.; Li, L.-J.; Li, K.; and Fei-Fei, L. 2009. ImageNet: A Large-Scale Hierarchical Image Database . In CVPR09

    2009

  5. [13]

    Duan, Y.; Zheng, W.; Lin, X.; Lu, J.; and Zhou, J. 2018. Deep Adversarial Metric Learning . 10

    2018

  6. [14]

    K.; Harandi, M.; and Sekhar, C

    Dutta, U. K.; Harandi, M.; and Sekhar, C. C. 2020. Unsupervised Deep Metric Learning via Orthogonality Based Probabilistic Loss . IEEE Transactions on Artificial Intelligence, 1(1): 74--84

    2020

  7. [15]

    J.; Shlens, J.; and Szegedy, C

    Goodfellow, I. J.; Shlens, J.; and Szegedy, C. 2015. Explaining and Harnessing Adversarial Examples . arXiv:1412.6572 [cs, stat]

    2015 arXiv

  8. [16]

    Guo, C.; Rana, M.; Cisse, M.; and Van Der Maaten, L. 2017. Countering adversarial images using input transformations. arXiv preprint arXiv:1711.00117

    2017 arXiv

  9. [17]

    Hadsell, R.; Chopra, S.; and LeCun, Y. 2006. Dimensionality reduction by learning an invariant mapping. In 2006 IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR'06), volume 2, 1735--1742. IEEE

    2006

  10. [18]

    He, K.; Fan, H.; Wu, Y.; Xie, S.; and Girshick, R. 2020. Momentum contrast for unsupervised visual representation learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 9729--9738

    2020

  11. [19]

    Hu, J.; Lu, J.; and Tan, Y.-P. 2014. Discriminative deep metric learning for face verification in the wild. In Proceedings of the IEEE conference on computer vision and pattern recognition, 1875--1882

    2014

  12. [20]

    Hu, W.; Chen, C.; Ye, F.; Zheng, Z.; and Du, Y. 2021. Learning deep discriminative representations with pseudo supervision for image clustering. Information Sciences, 568: 199--215

    2021

  13. [21]

    Huang, W.; Luo, M.; Zhang, P.; and Zha, Y. 2021. Full-scaled deep metric learning for pedestrian re-identification. Multimedia Tools and Applications, 80(4): 5945--5975

    2021

  14. [22]

    Huang12, M.; Wu, D.; Zhang12, W.; Xiong12, Z.; Li, B.; and Wang, W. 2020. Marginalized Graph Attention Hashing for Zero-Shot Image Retrieval

    2020

  15. [23]

    Ioffe, S.; and Szegedy, C. 2015. Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift. CoRR, abs/1502.03167

    2015 arXiv

  16. [24]

    Kim, S.; Kim, D.; Cho, M.; and Kwak, S. 2020. Proxy Anchor Loss for Deep Metric Learning . arXiv:2003.13911 [cs]

    2020 arXiv

  17. [25]

    Kim, S.; Seo, M.; Laptev, I.; Cho, M.; and Kwak, S. 2019. Deep metric learning beyond binary supervision. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2288--2297

    2019

  18. [26]

    P.; and Ba, J

    Kingma, D. P.; and Ba, J. 2014. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980

    2014 arXiv

  19. [27]

    Krause, J.; Stark, M.; Deng, J.; and Fei-Fei, L. 2013. 3D Object Representations for Fine-Grained Categorization. In 4th International IEEE Workshop on 3D Representation and Recognition (3dRR-13). Sydney, Australia

    2013

  20. [28]

    Lamb, A.; Verma, V.; Kannala, J.; and Bengio, Y. 2019. Interpolated Adversarial Training : Achieving Robust Neural Networks without Sacrificing Too Much Accuracy . arXiv:1906.06784 [cs, stat]

    2019 arXiv

  21. [29]

    Liu, X.; Vijaya Kumar, B.; You, J.; and Jia, P. 2017. Adaptive deep metric learning for identity-aware facial expression recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition workshops, 20--29

    2017

  22. [30]

    Liu, Z.; Luo, P.; Qiu, S.; Wang, X.; and Tang, X. 2016. DeepFashion: Powering Robust Clothes Recognition and Retrieval with Rich Annotations. In Proceedings of IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    2016

  23. [31]

    Loshchilov, I.; and Hutter, F. 2017. Fixing Weight Decay Regularization in Adam. CoRR, abs/1711.05101

    2017 arXiv

  24. [32]

    Lu, J.; Hu, J.; and Tan, Y.-P. 2017. Discriminative deep metric learning for face and kinship verification. IEEE Transactions on Image Processing, 26(9): 4269--4282

    2017

  25. [33]

    Madry, A.; Makelov, A.; Schmidt, L.; Tsipras, D.; and Vladu, A. 2019. Towards Deep Learning Models Resistant to Adversarial Attacks. arXiv:1706.06083 [cs, stat]

    2019 arXiv

  26. [34]

    K.; Ioffe, S.; and Singh, S

    Movshovitz-Attias, Y.; Toshev, A.; Leung, T. K.; Ioffe, S.; and Singh, S. 2017. No fuss distance metric learning using proxies. In Proceedings of the IEEE International Conference on Computer Vision, 360--368

    2017

  27. [35]

    Oh Song, H.; Jegelka, S.; Rathod, V.; and Murphy, K. 2017. Deep metric learning via facility location. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 5382--5390

    2017

  28. [36]

    Pang, T.; Xu, K.; Du, C.; Chen, N.; and Zhu, J. 2019. Improving Adversarial Robustness via Promoting Ensemble Diversity . arXiv:1901.08846 [cs, stat]

    2019 arXiv

  29. [37]

    Pang, T.; Xu, K.; and Zhu, J. 2020. Mixup Inference : Better Exploiting Mixup to Defend Adversarial Attacks . arXiv:1909.11515 [cs, stat]

    2020 arXiv

  30. [38]

    K.; Wang, Z.; Kan, P.; Fernandes, E.; and Jha, S

    Panum, T. K.; Wang, Z.; Kan, P.; Fernandes, E.; and Jha, S. 2021. Exploring Adversarial Robustness of Deep Metric Learning . arXiv:2102.07265 [cs]

    2021 arXiv

  31. [39]

    B.; and Swami, A

    Papernot, N.; McDaniel, P.; Jha, S.; Fredrikson, M.; Celik, Z. B.; and Swami, A. 2015. The Limitations of Deep Learning in Adversarial Settings . arXiv:1511.07528 [cs, stat]

    2015 arXiv

  32. [40]

    M.; Vedaldi, A.; and Zisserman, A

    Parkhi, O. M.; Vedaldi, A.; and Zisserman, A. 2015. Deep face recognition

    2015

  33. [41]

    G.; Stra z ar, M.; and Zupan, B

    Poli c ar, P. G.; Stra z ar, M.; and Zupan, B. 2019. openTSNE: a modular Python library for t-SNE dimensionality reduction and embedding. bioRxiv

    2019

  34. [42]

    Qian, Q.; Shang, L.; Sun, B.; Hu, J.; Li, H.; and Jin, R. 2020. SoftTriple Loss : Deep Metric Learning Without Triplet Sampling . arXiv:1909.05235 [cs]

    2020 arXiv

  35. [43]

    Qiao, L.; Shi, Y.; Li, J.; Wang, Y.; Huang, T.; and Tian, Y. 2019. Transductive episodic-wise adaptive metric for few-shot learning. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 3603--3612

    2019

  36. [44]

    Raff, E.; Sylvester, J.; Forsyth, S.; and McLean, M. 2019. Barrage of random transforms for adversarially robust defense. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 6528--6537

    2019

  37. [45]

    Ravi, S.; and Larochelle, H. 2016. Optimization as a model for few-shot learning

    2016

  38. [46]

    Roth, K.; Milbich, T.; Sinha, S.; Gupta, P.; Ommer, B.; and Cohen, J. P. 2020. Revisiting Training Strategies and Generalization Performance in Deep Metric Learning. arXiv:2002.08473

    2020 arXiv

  39. [47]

    G.; Zhu, M.; Zhmoginov, A.; and Chen, L

    Sandler, M.; Howard, A. G.; Zhu, M.; Zhmoginov, A.; and Chen, L. 2018. Inverted Residuals and Linear Bottlenecks: Mobile Networks for Classification, Detection and Segmentation. CoRR, abs/1801.04381

    2018 arXiv

  40. [48]

    Schroff, F.; Kalenichenko, D.; and Philbin, J. 2015. Facenet: A unified embedding for face recognition and clustering. In Proceedings of the IEEE conference on computer vision and pattern recognition, 815--823

    2015

  41. [49]

    Shi, H.; Zhu, X.; Liao, S.; Lei, Z.; Yang, Y.; and Li, S. Z. 2015. Constrained deep metric learning for person re-identification. arXiv preprint arXiv:1511.07545

    2015 arXiv

  42. [50]

    H.; and Hospedales, T

    Sung, F.; Yang, Y.; Zhang, L.; Xiang, T.; Torr, P. H.; and Hospedales, T. M. 2018. Learning to compare: Relation network for few-shot learning. In Proceedings of the IEEE conference on computer vision and pattern recognition, 1199--1208

    2018

  43. [51]

    Szegedy, C.; Zaremba, W.; Sutskever, I.; Bruna, J.; Erhan, D.; Goodfellow, I.; and Fergus, R. 2014. Intriguing Properties of Neural Networks. arXiv:1312.6199 [cs]

    2014 arXiv

  44. [52]

    Verma, V.; Lamb, A.; Beckham, C.; Najafi, A.; Mitliagkas, I.; Courville, A.; Lopez-Paz , D.; and Bengio, Y. 2019. Manifold Mixup : Better Representations by Interpolating Hidden States . arXiv:1806.05236 [cs, stat]

    2019 arXiv

  45. [53]

    Wang, J.; Zhou, F.; Wen, S.; Liu, X.; and Lin, Y. 2017. Deep metric learning with angular loss. In Proceedings of the IEEE International Conference on Computer Vision, 2593--2601

    2017

  46. [54]

    Wang, W.; Arora, R.; Livescu, K.; and Bilmes, J. 2015. On deep multi-view representation learning. In International conference on machine learning, 1083--1092. PMLR

    2015

  47. [55]

    T.; and Ni, L

    Wang, Y.; Yao, Q.; Kwok, J. T.; and Ni, L. M. 2020. Generalizing from a few examples: A survey on few-shot learning. ACM Computing Surveys (CSUR), 53(3): 1--34

    2020

  48. [56]

    Welinder, P.; Branson, S.; Mita, T.; Wah, C.; Schroff, F.; Belongie, S.; and Perona, P. 2010. Caltech-UCSD Birds 200 . Technical Report CNS-TR-2010-001, California Institute of Technology

    2010

  49. [57]

    Wojke, N.; and Bewley, A. 2018. Deep cosine metric learning for person re-identification. In 2018 IEEE winter conference on applications of computer vision (WACV), 748--756. IEEE

    2018

  50. [58]

    Xiao, T.; Li, S.; Wang, B.; Lin, L.; and Wang, X. 2017. Joint detection and identification feature learning for person search. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 3415--3424

    2017

  51. [59]

    Xie, C.; Wang, J.; Zhang, Z.; Ren, Z.; and Yuille, A. 2017. Mitigating adversarial effects through randomization. arXiv preprint arXiv:1711.01991

    2017 arXiv

  52. [60]

    N.; and Lopez-Paz , D

    Zhang, H.; Cisse, M.; Dauphin, Y. N.; and Lopez-Paz , D. 2018. Mixup: Beyond Empirical Risk Minimization . arXiv:1710.09412 [cs, stat]

    2018 arXiv

  53. [61]

    P.; Ghaoui, L

    Zhang, H.; Yu, Y.; Jiao, J.; Xing, E. P.; Ghaoui, L. E.; and Jordan, M. I. 2019. Theoretically Principled Trade -off between Robustness and Accuracy . arXiv:1901.08573 [cs, stat]

    2019 arXiv

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.