Anchored Rank-Adversarial Fine-Tuning of Pretrained Visual Place Recognition Models

Summary

Foundation-model visual place recognition models such as SuperVLAD and BoQ fall to under 0.2% top-1 recall under a white-box ranking attack at a 1/255 budget. The authors propose anchored rank-adversarial fine-tuning (ARAFT), which tunes a released model with a listwise rank loss and an anchor to the frozen model's clean descriptors. ARAFT raises robust R@1 to 47.3 on SuperVLAD and 55.3 on BoQ within a fixed clean-accuracy budget, where plain adversarial training yields no admissible checkpoint.

Mitigation

ARAFT: fine-tune a released VPR model with a listwise rank loss on each adversarial query's hardest positive, plus an anchor to the clean descriptor of the frozen pretrained model, selecting checkpoints under a predefined clean-accuracy budget.

Related items

• InfoImage watermarking robustness under MLLM-guided semantic editing: Benchmark, defense, and diagnosisSimilar attack · Elsevier Security Journals
• LowYour Robot's Safety Functions Already Work. What If the Input Lies?Similar attack · VicOne Blog
• InfoSpeech Tokenizers are Vulnerable: Transferable Semantic Attack and Robust TokenizerSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoAdversarial Retraining for Machine Learning-Based Man-in-the-Middle Attack Detection in Smart Grid Industrial Control SystemsSimilar attack · OpenAlex (peer-reviewed AI security)
• LowMeasuring Robustness and Efficiency in a Connectome-Constrained Fly Visual System Model: Linking an Adversarial and a Perceptual IllusionSimilar attack · Arxiv (cs.RO + cs.CV security)