Adversarial robustness for deep metric learning

Deep metric learning has been virtually used in various clustering, recognition, and retrieval frameworks. The goal of deep metric learning is to learn a non-linear projection that maps input samples into a latent space where the distance between similar and dissimilar samples is minimized and maximized, respectively. Convolutional neural networks used in deep metric learning for images are known to be vulnerable to adversarial attacks that alter the model's behavior by adding imperceptible perturbation to input images. Adversarial training, where adversarial samples are generated at each iteration, is one of the prominent techniques to defend deep metric learning models against adversarial attacks. Despite its popularity, adversarial training poses several drawbacks, such as increasing computational complexity and trade-off between robustness and generalization. Therefore, the quest for adversarial defense techniques that apply to various architectures without burdening the model training continues. This thesis proposes an adversarial defense framework for deep metric learning without adversarial sample generation during training. The proposed framework generates adversarial samples using a pre-trained network once and employs them to learn a more robust mapping. Thus, the training time of the deep metric learning model is not increased with adversarial attack generation. In addition, the proposed robust training is done with a lightweight architecture in the latent space to prevent overfitting to specific adversarial perturbations that deepen the gap between the metric learning performance with natural and adversarial samples. The proposed approach is evaluated with the most prominent benchmark datasets in metric learning, and the results indicated that the proposed robust metric learning framework enhances the adversarial retrieval and clustering without causing a significant decline in natural performances.