# Unsupervised Multi-Criteria Adversarial Detection in Deep Image Retrieval

Yanru Xiao
Old Dominion University
Norfolk, VA, USA
<EMAIL_ADDRESS>Cong Wang
Zhejiang University
Hangzhou, China
<EMAIL_ADDRESS>Correspondence to<EMAIL_ADDRESS>Xing Gao
University of Delaware
Newark, DE, USA
<EMAIL_ADDRESS>
###### Abstract

The vulnerability in the algorithm supply chain of deep learning has imposed
new challenges to image retrieval systems in the downstream. Among a variety
of techniques, deep hashing is gaining popularity. As it inherits the
algorithmic backend from deep learning, a handful of attacks are recently
proposed to disrupt normal image retrieval. Unfortunately, the defense
strategies in softmax classification are not readily available to be applied
in the image retrieval domain. In this paper, we propose an efficient and
unsupervised scheme to identify unique adversarial behaviors in the hamming
space. In particular, we design three criteria from the perspectives of
hamming distance, quantization loss and denoising to defend against both
untargeted and targeted attacks, which collectively limit the adversarial
space. The extensive experiments on four datasets demonstrate $2-23\%$
improvements of detection rates with minimum computational overhead for real-
time image queries.

##  1 Introduction

Powered by neural networks, deep hashing enables image retrieval at a large
scale [27, 8, 7, 49, 26, 47]. By representing high-dimensional images with
compact binary codes, retrieval becomes an efficient similarity computation of
Hamming distance. Google [3], Bing [2], Pinterest [4], Taobao [1] have all
incorporated image query as part of their products. Despite of its great
success, deep hashing also inherits the vulnerabilities from neural networks
[36] with new attack vectors and effects. By introducing adversarial
perturbations either on the query or database images, normal requests can be
diverted to an irrelevant (_untargeted attack_) [46] or specific category
(_targeted attack_) [6, 40, 42], e.g., turning a query of “husky dog” into
retrieving a branded “dog food” so the attacker can advertise their products
for free.

Figure 1: Miss rate of different detections for untageted/targeted adversarial
examples in deep hashing. The solid and hollow markers are for CIFAR-10 and
ImageNet respectively. The proposed UMCD has the lowest miss rate on both
datasets.

With a handful of efforts on the attack side [46, 6, 40, 42], deep hashing
still falls short to defend against adversarial examples in the hamming space.
_Adversarial training_ and _detection_ are the two common defenses in softmax
classification. Yet, adversarial training has to deal with the non-trivial
trade-off between robustness and accuracy [48]. According to our
implementation (see appendix), finding the min-max saddle points becomes even
more difficult under the hash function, which suffers from a large accuracy
loss. On the other hand, detection aims to unveil the adversarial behaviors on
different levels of raw pixel [15, 17], feature distribution [17, 23, 28],
softmax probabilities [19] and frequency components [39] in a _supervised_
[11] or _unsupervised_ manner [45]. Based on the prior knowledge of attack
methods, supervised detection trains a classifier to distinguish the
adversarial images, but is hard to extrapolate to the unknown attacks. To this
end, we pursue the direction of unsupervised anomaly detection in this paper.
Different from softmax classification on a closed set of class probabilities,
deep hashing maps similar/dissimilar images into binary codes in an open
Hamming space. Thus, the focus of our work is to tap into the unique
adversarial behaviors in deep hashing to detect both untargeted and targeted
attacks.

Figure 2: The proposed detection framework: highlighted by the dash lines.

Starting from the untargeted attacks [46], we first theoretically deduce the
hamming distance distribution from the adversarial image to other categories,
which asymptotically approaches a Gaussian distribution. For targeted attacks,
we discover an interesting adversarial behavior on the quantization loss: when
the adversarial objective is to produce the same hash code of a targeted
category [6, 40], it unintentionally brings the quantization loss close to
zero. Thus, we first develop two thresholding methods that take hamming
distance and quantization loss as the proxies. Then we combine the two
criteria with a denoising-based detection to measure the disagreement between
an input and its denoised transformation. We demonstrate that this combination
can successfully defend against both _gray-box_ attackers, who have no prior
knowledge of the detection method, and the strongest white-box attackers, who
know the existence of the detection and can implement countermeasures. The
overall framework is shown in Fig. 2.

The main contributions of this paper are summarized below. To the best of our
knowledge, this is the first, unsupervised effort to defend against
adversarial attacks in deep hashing. Based on the novel discoveries and
analysis, we propose three criteria to unveil adversarial behaviors of
targeted and untargeted attacks in the hamming space, and demonstrate their
complementing relations against the strongest white-box attackers. The
extensive experiments on CIFAR-10, ImageNet, MS-COCO and NUSWIDE datasets show
that the proposed method surpasses the state-of-the-art defenses by up to 23%
in detection rates with negligible computational overhead for real-time image
queries.

##  2 Preliminary

This section illustrates the fundamentals of deep hashing and adversarial
attacks.

###  2.1 Deep Hashing

Given a dataset of $N$ samples $X=\\{x_{1},x_{2},\ldots,x_{N}\\}$,
$x_{i}\in\mathbb{R}^{D}$ and their corresponding labels
$Y=\\{y_{1},y_{2},\ldots,y_{N}\\}$, $y_{i}\in\mathbb{R}^{C}$, where $x_{i}$ is
the $i$-th sample and $y_{c,i}=1$ if the $i$-th image is associated with class
$c$. Deep hashing learns a function $f_{\theta}(x)$ that maps the input image
$x$ into a $K$-bit binary code $h(x)$ via a sign operation,

$\small\vspace{-0.02in}h(x)=sign(f_{\theta}(x))\in\\{-1,+1\\}^{K},\vspace{-0.02in}$
(1)

where $\theta$ are the parameters learned from minimizing the weighted
combination of the similarity loss $\mathcal{L}_{S}$ and quantization loss
$\mathcal{L}_{Q}$ [27, 8, 7, 49, 26, 47],

$\small\vspace{-0.05in}\theta=\operatorname*{arg\,min}\limits_{\theta}\mathcal{L}_{S}+\lambda\mathcal{L}_{Q}.\vspace{-0.05in}$
(2)

$\mathcal{L}_{S}$ represents the hamming distance $D_{h}(h(x_{i}),h(x_{j}))$
between two images $x_{i}$ and $x_{j}$ with their similarity $s(y_{i},y_{j})$,

$s(y_{i},y_{j})=\begin{cases}+1,&\mbox{if $y_{i}y_{j}^{T}>0$ }\\\
-1,&\mbox{otherwise}.\end{cases}$ (3)

$\mathcal{L}_{Q}$ is the quantization loss to minimize the difference between
the continuous output of $f_{\theta}(x)$ and its binary code $h(x)$. The
objective is to minimize the hamming distance $D_{h}(h(x_{i}),h(x_{j}))$
between two samples $x_{i}$ and $x_{j}$ when they are similar, maximize the
hamming distance when they are dissimilar, and meanwhile, represent the
continuous $f_{\theta}(x)$ as binary codes. Both $D_{h}({h}_{1},{h}_{2})$ and
$h(x)$ are non-differentiable regarding their inputs. A common technique is to
use the differentiable form of $D_{h}({h}_{1},{h}_{2})$ noted as
$\frac{1}{2}(K-{{h}_{1}}^{T}{h}_{2})$ during backpropagation, where
${h}_{1},{h}_{2}$ are the continuous floating point representation in
$[-1,+1]$, and the binary hash codes $h(x)$ are represented by the continuous
output of $f_{\theta}(x)$. The gap between such continuous and binary
representations is considered as the quantization loss $\mathcal{L}_{Q}$,
which is minimized in Eq. (2).

Deep hashing consists of two main components, a _database_ and a _model_. The
database stores the images and their pre-computed hash codes. Given a query
image $x$ with hash code $h(x)$, the system returns the top-$k$ images from
the database which are $h(x)$’s $k$-nearest neighbors determined by hamming
distance. The retrieval performance is calculated by the mean average
precision (mAP), which is the ratio of images similar to $x$. In this paper,
we base the hashing framework on the state-of-the-art method called Central
Similarity Quantization (CSQ) [47]. CSQ pre-determines the optimal hash codes
based on the Hadamard matrix and randomly selects a set of hash codes with
sufficient distances from each other as the hash centers from the Hadamard
matrix (or from a random binary matrix if the Hadamard matrix is not
available). Since different hashing techniques share the general objective of
Eq. (2), our defense applies to other techniques as well [27, 8, 7, 49, 26].

###  2.2 Adversarial Attacks

Untargeted Attack [46] finds an adversarial image $x^{\prime}$ by maximizing
the hamming distance between the hash codes of adversarial examples and
original images, subject to the $\mathcal{L}_{\infty}$ bound of $\epsilon$.

$\displaystyle\max\limits_{x^{\prime}}D_{h}\bigl{(}h(x^{\prime}),h(x)\bigr{)}$
(4) $\displaystyle\textrm{s.t.}\;\left\lVert
x-x^{\prime}\right\rVert_{\infty}\leq\epsilon$

It works effectively to reduce the mAP by pushing the original image towards
the furthest hamming distance in the hash space.

Targeted Attack [6, 40, 42] attempts to minimize the hamming distance from
$x^{\prime}$ to the targeted hash code $h_{t}$ of a specific category,

$\displaystyle\min\limits_{x^{\prime}}D_{h}(h(x^{\prime}),h_{t})$ (5)
$\displaystyle\textrm{s.t.}\;\left\lVert
x-x^{\prime}\right\rVert_{\infty}\leq\epsilon$

Once the attacker has embedded the adversarial images in the database,
targeted attacks enable image retrieval from a specific category upon user
queries. For example, as illustrated in [42], the database could mistakenly
return the advertisements of branded beer from the database upon the query of
facial lotions.

Attack Model. Attackers can carry out both untargeted and targeted attacks. In
particular, we consider two types of _gray-box_ and _white-box_ attackers.
_Gray-box_ attackers have access to all the information including network
architecture, weights and data, but are not aware of the existence of
adversarial detection. The stronger _white-box_ attackers are aware of both
the model function/parameters and the existence of the detection. So they
implement different bypassing strategies as discussed in Section 4.

##  3 Adversarial Behaviors in the Hamming Space

Among a variety of artifacts left by adversarial images in classification
networks, one of the most evident “adversarial behaviors” is from the softmax
function [23, 19]. Due to the fast-growing exponentiation, it magnifies small
changes in the logits [19] and becomes overconfident in the presence of
adversarial images by regularizing other categories [23]. In contrast to
softmax, which makes the decision from a closed set of categories, hashing
maps similar images into compact hamming balls in an open hamming space of
$\\{-1,1\\}^{K}$. In this section, we define three criteria to identify
adversarial behaviors in the hamming space.

(a)

(b)

Figure 3: t-SNE visualization of untargeted adversarial images vs. original
images of different datasets (a) CIFAR-10. (b) MS-COCO.

###  3.1 Detecting Untargeted Attacks ($C_{1}$)

We start with untargeted attacks that maximize the hamming distance between
$x^{\prime}$ and $x$ [46]. Though such behavior is straightforward to discern,
we seek a theoretical answer to the distribution of $h(x^{\prime})$ when the
attacking capacity is maximized.

Assumption 1. The network is capable of learning _perfect_ hash codes with the
minimum intra-class distance (i.e., equals to zero) and maximum margin between
each other.

If Assumption 1 holds, what is the hamming distance from the adversarial
$h(x^{\prime})$ to the rest of the hash codes? To answer this question, we
first establish the distribution of the maximum inter-class distance as
illustrated in the following Lemma.

Lemma 1. Given a number of $C$ classes in the $K$-bit hamming space with
(ideally) compact hash codes, the inter-class hamming distance follows a
Binomial Distribution of $\mathcal{X}\sim B(K,p)$, where $p=\frac{C}{2(C-1)}$
and $p\approx\frac{1}{2}$ when $C$ is large.

###### Proof.

For all $C$ classes, consider only one bit location at a time. The maximum
hamming distance is achieved when there is an equal number of $\frac{C}{2}$,
$\\{+1\\}$ and $\\{-1\\}$ codes among the $C$ classes. The hamming distance
between two bits is either $0$ or $1$. Thus, among $\binom{C}{2}$ selection of
pairs, the probability that the hamming distance equals to $1$ is
$(\frac{C}{2}\cdot\frac{C}{2})/\binom{C}{2}=\frac{C}{2(C-1)}$. Since all $K$
bits can be selected independently, the probability of the inter-class hamming
distance between $h_{i}$ and $h_{j}$ equals to $d$ is,

$\small\vspace{-0.04in}Pr\bigl{(}D_{h}(h_{i},h_{j})=d\bigr{)}=\binom{K}{d}p^{d}(1-p)^{K-d},\hskip
10.84006ptp=\frac{C}{2(C-1)},$ (6)

in which mean value is $Kp$ and variance is $Kp(1-p)$. ∎

From _Lemma 1_ , we can further deduce the next theorem.

Theorem 1. For untargeted attacks, the hamming distance from the adversarial
image to any other classes follows a Gaussian distribution
$\mathcal{N}\sim(K(1-p),Kp(1-p))$.

###### Proof.

In the ideal situation, the untargeted attack maximizes the hamming distance
from $D_{h}(h(x^{\prime}),h(x_{i}))$ to $K$. Thus, for any other hash codes
$h(x_{j})$, the hamming distance is
$D_{h}(h(x^{\prime}),h(x_{j}))=K-D_{h}(h_{i},h_{j})$, which is also a Binomial
distribution with the mean of $K(1-p)$ and the same variance. When the hash
bits $K$ is a large value, it can be approximated by a Gaussian distribution
$\mathcal{N}\sim(K(1-p),Kp(1-p))$ [34]. ∎

Example. When $K=64$ bits, and $C$ is large ($p\rightarrow\frac{1}{2}$), using
the three-sigma rule, the confidence interval is
$(K(1-p)-3\sqrt{Kp(1-p)},K(1-p)+3\sqrt{Kp(1-p)})$. In other words, there is
99.73% confidence that the hamming distance from an untargeted adversarial
image to any other classes would be within the $[20,44]$ hamming distance
interval with the mean of $K/2=32$, which is sufficiently distinguishable in
the hamming space. Note that the above analysis serves a theoretical upper
bound because achieving Assumption 1 is still an ongoing effort [47, 20]. To
see some examples, we visualize the t-SNE of untargeted adversarial images vs.
benign images on CIFAR-10 and MS-COCO in Fig. 3. It is observed that despite
of a few samples, the majority of the adversarial images are sufficiently
distinguishable based on hamming distance. Hence, we formalize the first
detection criterion.

(a)

(b)

(c)

Figure 4: Example of identifying targeted attacks based on quantization loss
on ImageNet. (a) The quantization loss for targeted attacks concentrates
around zero vs. the benign samples. (b) Targeted attacks push the quantization
loss to zero compared to untargeted attacks. (c) 60% of the untargeted attacks
also concentrate around zero.

Criterion 1 (Hamming Distance). For query $x$, collect the set of top-$k$ hash
codes $\mathcal{H}_{k}$ and calculate the average hamming distance to $h(x)$.

$\small\vspace{-0.05in}{C}_{1}=\frac{1}{|\mathcal{H}_{k}|}\sum_{h(x_{k})\in\mathcal{H}_{k}}D_{h}\bigl{(}h(x_{k}),h(x)\bigr{)}\vspace{-0.05in}$
(7)

${C}_{1}$ is the average hamming distance of the top-$k$ retrieval results,
i.e., a scalar value and we can compare it with a threshold $\mathcal{T}_{1}$
calculated on benign samples. The computational process of ${C}_{1}$ follows
the normal retrieval procedures using the top-$k$ hash codes. To detect
targeted attacks, we develop the next criterion.

###  3.2 Detecting Targeted Attacks (${C}_{2}$)

While untargeted attacks attempt to induce a bit flip that makes
$h(x^{\prime})=-h(x)$, targeted attacks minimize the hamming distance between
$h(x^{\prime})$ and an arbitrary target code $h_{t}$ (e.g., such as computed
from consensus voting [6] of a category). To find an appropriate metric to
identify them, we have the following observation.

Observation 1. For the quantization loss of benign images
$\mathcal{L}_{Q}^{b}$ and targeted images $\mathcal{L}_{Q}^{t}$, the relation
$\mathcal{L}_{Q}^{b}>\mathcal{L}_{Q}^{t}\approx 0$ holds.

To illustrate this observation, recall that the original targeted objective in
Eq. (5) is not differentiable regarding the targeted binary code of
$x^{\prime}$. The implementation approximates via a continuous relaxation and
the goal is to minimize the distance between the continuous output from the
$\tanh(\cdot)$ function and the target code [8]. As more gradient descent
steps are taken, the quantization loss $\mathcal{L}_{Q}^{t}\rightarrow 0$,
when their inter-distance is minimized. This is in close analogy with the
adversarial images on softmax classifications while the targeted probabilities
become overconfident [23], and surprisingly, similar phenomenon is reflected
on the quantization loss in deep hashing. In contrast, for all the benign
samples, it is difficult to find the optimal model parameters to push
$\mathcal{L}_{Q}^{b}$ towards zero during the training process. An example of
ImageNet is shown in Fig.4(a) as the targeted attacks leave a distinguishable
gap from benign samples. It is also interesting to compare with the
quantization loss of untargeted attacks in Fig.4(a), which is larger than
zero. This is because for untargeted attacks, finding an adversarial subspace
that reduces the mAP to zero can be achieved before flipping all the bits,
which is much easier than targeted attacks. Based on these observations, we
develop the second detection criterion.

Criterion 2 (Quantization Loss). Calculate the $\bm{L}_{p}$ distance from the
output of network $f_{\theta}(x)$ (logits before the sign function) and its
hash code $h(x)$,

$\small C_{2}=\lVert h(x)-f_{\theta}(x)\rVert_{p}$ (8)

$C_{2}$ is the quantization loss of query $x$. Here, we use the $\bm{L}_{1}$
distance ($p=1$) and obtain a threshold $\mathcal{T}_{2}$ on benign samples
offline. Figs. 4(b)(c) show the distribution of quantization loss between the
adversarial and the benign images. As $C_{2}\rightarrow 0$ for targeted
attacks, we can see that using $\mathcal{T}_{2}$ can effectively identify most
of the attacks; using $C_{2}$ also identifies about 60% of the untargeted
attacks,

###  3.3 Detecting Prediction Inconsistency ($C_{3}$)

$C_{1}$ and $C_{2}$ alone are not sufficient. In principle, detection works by
limiting the attacker’s action space in a confined region. Perturbation can be
generally treated as an artificial noise with high-frequency components [39].
Thus, a common approach is to apply local, non-local smoothing filters [45],
auto-encoder denoiser [30], color bit reduction [45], quantization [25], and
measure the response sensitivity to the denoised images. The adversarial
images are more prone to produce a different result, while the benign samples
are less sensitive. These denoising operations reduce the entropy (randomness)
and the input dimensions of adversarial space that the perturbations can act
upon.

We extend this principle in deep hashing to formulate Criterion 3. Denote the
transformation [45, 30, 25] as $t(\cdot)$. For query $x$, $C_{3}$ measures the
hamming distance between a transformed $t(x)$ and $x$ based on the output
before the sign function.

Criterion 3 (Prediction Inconsistency).

$\small C_{3}=D_{h}\bigl{(}f_{\theta}(t(x)),f_{\theta}(x)\bigr{)}$ (9)

In other words, $C_{3}$ quantifies the disagreement between the original and
transformed inputs, which can be evaluated against a threshold
$\mathcal{T}_{3}$ calculated offline on benign samples.

###  3.4 Put Everything Together

The overall detection combines the three criteria: given a query image $x$, we
calculate $\\{C_{1},C_{2},C_{3}\\}$ and compare with thresholds
$\\{\mathcal{T}_{1},\mathcal{T}_{2},\mathcal{T}_{3}\\}$. If (a)
$C_{1}<\mathcal{T}_{1}$; (b) $C_{2}>\mathcal{T}_{2}$; (c)
$C_{3}<\mathcal{T}_{3}$, the input is considered as benign; otherwise, if any
of them is not satisfied, the input is rejected as an adversarial example. The
computation time is bounded by $C_{3}$ since it requires two retrievals. To
minimize the compute time, the system can combine the original query and its
denoised copy into a batched query. In case the GPU has sufficient resources,
it should have minimum overhead as discussed in Section 4.5.

##  4 Experiments

###  4.1 Implementation

We evaluate our mechanism on the CIFAR-10, ImageNet, MS-COCO and NUSWIDE
datasets that are commonly used for deep hashing [27, 8, 7, 49, 26, 47] and
adopt CSQ [47] with ResNet50 [18] as the base model. The RMSProp optimizer
[37] with learning rate $10^{-5}$ is used for training of 150 epochs. The
weight of the quantization loss is set to $10^{-4}$. For four datasets, our
trained models achieve mAP of 0.854, 0.883, 0.884, and 0.843, respectively.

We compare with several benchmarks originally designed for softmax
classification: Local Intrinsic Dimensionality (LID) [28], Median Smoothing
(FS-Median), Non-local Means (FS-NLM) [45], FS-Adaptive [25], and MeanBlur
[23]. FS-Adaptive uses the entropy of input as a metric to adaptively reduce
the input space using scalar quantization and smoothing spatial filter. We
select MeanBlur as the denoising technique for our method. True Positive Rate
(TPR), False Negative Rate (FNR, Miss Rate), and Area-Under-Curve (AUC) are
used as the evaluation metric, where adversarial examples are considered as
Positive and benign samples are considered as Negative. Thus, a detected
adversarial example is counted as a true positive, while a misidentified
benign sample is counted as false positive.

All detection methods are evaluated against both untargeted [46] and targeted
[6] deep hashing adversarial attacks (based on the PGD attack) and an
untargeted deep hashing CW [10] attack111The CW attack is initially designed
for softmax classification thus only a few logits are optimized. But for deep
hashing, all hashing bits need to be optimized which rarely succeed for
targeted CW attacks. Thus, we focus on the untargeted CW attack in deep
hashing.. The step sizes of the former two are set to 1.0 with $100$ steps,
limited by an $\bm{L}_{\infty}$ norm of perturbation $\epsilon=8$. For CW
attack, the learning rate is set to $0.01$ with $500$ steps. Additional
experimental details and results are available in appendix.

###  4.2 Detection of Gray-Box Attacks

|  |  Untgt [46] |  Tgt [6] |  Untgt CW [10]
---|---|---|---|---
CIFAR-10 |  LID [28] | 14.90 | 4.00 | 12.16
FS-Median [45] | 13.40 | 54.30 | 2.40
FS-NLM [45] | 18.80 | 18.10 | 14.41
FS-Adaptive [25] | 54.00 | 48.30 | 52.55
MeanBlur [23] | 11.60 | 26.90 | 2.40
UMCD (Ours) | 7.50 | 0.40 | 0.15
ImageNet |  LID [28] | 21.78 | 6.40 | 75.95
FS-Median [45] | 8.54 | 19.20 | 1.41
FS-NLM [45] | 2.62 | 3.40 | 8.02
FS-Adaptive [25] | 4.05 | 4.30 | 13.68
MeanBlur [23] | 0.76 | 4.54 | 0.94
UMCD (Ours) | 0.42 | 0.34 | 0.47
MS-COCO |  LID [28] | 3.24 | 1.20 | 54.59
FS-Median [45] | 0.26 | 7.10 | 0.00
FS-NLM [45] | 0.00 | 1.72 | 0.08
FS-Adaptive [25] | 0.00 | 2.84 | 0.08
MeanBlur [23] | 0.00 | 2.12 | 0.00
UMCD (Ours) | 0.00 | 1.12 | 0.00
NUSWIDE |  LID [28] | 25.34 | 0.08 | 47.96
FS-Median [45] | 3.52 | 16.33 | 0.00
FS-NLM [45] | 0.00 | 2.90 | 0.00
FS-Adaptive [25] | 0.00 | 4.57 | 0.00
MeanBlur [23] | 0.19 | 4.29 | 0.00
UMCD (Ours) | 0.00 | 1.29 | 0.00
Table 1: A comparison with state-of-the-arts methods of _Detection Miss Rate_
(False Negative Rate) against adversarial attacks for deep hashing, when
allowing 5% FPR on benign samples. Lower miss rate is better. Top two numbers
of each column are bolded, with the best in red and the second in blue.

Our Method. Table 1 shows the detection miss rate of different methods when we
fix the FPR at 5%. The proposed method can make robust detection of targeted
attacks with less than 1% miss rate in the most cases. Compared to the SOTA
benchmarks, our method is $2.13\%$ to $23.44\%$ better than other methods on
average. Untargeted attacks are relatively easier to detect, so the overall
miss rates are lower than targeted attacks. Our method can still improve the
baselines by $1.15\%$-$14.33\%$.

Compare with LID. Although LID performs well on most of the targeted attacks,
it does not generalize to the CW attack. Furthermore, different from the
softmax networks that the last few layers often offer better detection [28],
LID is quite sensitive to which layers should those features be extracted in
deep hashing, which adds extra configuration overhead. In sum, LID is not
always effective against all types of attacks.

Compare with Spatial Denoising Methods. LID does not take advantage of the
spatial information like the rest four benchmarks using non-local mean,
median, etc. As shown in Table 1, though they generally have less than 10%
miss rates on untargeted attacks, there is a 0.5-17.8% gap in detecting
targeted attacks. Such gaps can be explained by the attack mechanisms as
targeted attacks take more gradient steps. This lands the image deep into the
adversarial space, which is more robust to pixel-level modifications such as
denoising [21, 42]. However, our method provides an extra layer of defense
from $C_{2}$ to specifically monitor the value of quantization loss as
targeted attacks bring it to zero, thereby complementing $C_{3}$ when targeted
attacks push the inputs deep into the adversarial space.

| CIFAR-10 | ImageNet | MS-COCO | NUSWIDE | _Avg. Gain_
---|---|---|---|---|---
| Untgt | Tgt | Untgt | Tgt | Untgt | Tgt | Untgt | Tgt | Untgt | Tgt
$C_{3}$ Alone | 0.8160 | 0.7460 | 0.9110 | 0.8338 | 0.9954 | 0.9076 | 0.9757 | 0.8904 | – | –
$C_{1}+C_{3}$ | 0.9870 | 0.7580 | 0.9522 | 0.8460 | 0.9966 | 0.9098 | 0.9757 | 0.8904 | _0.0533_ | _0.0066_
$C_{2}+C_{3}$ | 0.8170 | 0.9830 | 0.9504 | 0.9828 | 0.9992 | 0.9784 | 0.9961 | 0.9847 | _0.0161_ | _0.1377_
$C_{1}+C_{2}+C_{3}$ | 0.9880 | 0.9950 | 0.9916 | 0.9956 | 0.9992 | 0.9784 | 0.9961 | 0.9847 | _0.0692_ | _0.1439_
Table 2: Ablation study: detection rates of different combinations
($\epsilon=32$)

###  4.3 Detection of White-box Attacks

Next, we demonstrate the detection of white-box attackers, who know the
existence of our detection and conduct countermeasures accordingly. The
attacker adopts _backward pass differentiable approximation_ [5] to estimate
the gradients and develops different strategies against $C_{1}$, $C_{2}$ and
$C_{3}$:

Against $\bm{C_{1}}$. $C_{1}$ relies on the hamming distance between hash
codes to detect outliers. Thus, an effective evasion is to drive the
adversarial examples into the neighborhoods of benign images, e.g., generating
the same binary hash codes of certain targeted images $h_{t}$:

$\small\mathcal{L}_{1}=\underbrace{D_{h}(f_{\theta}(x^{\prime}),h_{t})}_{\textrm{adv
loss}}$ (10)

Against $\bm{C_{2}}$. $C_{2}$ detects near-zero quantization loss by accessing
the logits before the sign function. To bypass this detection, the attacker
aims to maximize the quantization loss, which amortizes the adversarial
behavior identified from $C_{2}$.

$\small\mathcal{L}_{2}=-\underbrace{\left\lVert
h(x^{\prime})-f_{\theta}(x^{\prime})\right\rVert_{1}}_{\textrm{quantization
loss}}$ (11)

Against $\bm{C_{3}}$. $C_{3}$ detects the disagreement between
$f_{\theta}(x^{\prime})$ and the denoised copy $f_{\theta}(t(x^{\prime}))$.
The attacker minimizes such difference by enforcing distance between
$f_{\theta}(x^{\prime})$ and $f_{\theta}(t(x^{\prime}))$ to be small,

$\small\mathcal{L}_{3}=\underbrace{D_{h}(f_{\theta}(t(x^{\prime})),f_{\theta}(x^{\prime}))}_{\textrm{denoised
adv loss}}$ (12)

We use MeanBlur [23] as the transformation $t(\cdot)$ here. By combining them,
the white-box attacker constructs a joint optimization objective,

$\small\min\limits_{x^{\prime}}\mathcal{L}=\mathcal{L}_{1}+\lambda_{1}\mathcal{L}_{2}+\lambda_{2}\mathcal{L}_{3}$
(13)

(a) $\lambda_{2}=0.3$

(b) $\lambda_{2}=3$

Figure 5: White-box attack results. x-axis is the $\lambda_{1}$ value and
y-axis is the percentage. Once the white-box attacks achieve a lower detection
rate at $\lambda_{1}=$1e-2, the success rate of generating such adversarial
examples also drops significantly. The three detection criteria compensate
each other by observing the AUC values: when $C_{1},C_{3}$ are low, $C_{2}$ is
high and vice versa.

Detection of White-box Attacks. Optimizing (13) turns out to be quite
difficult by finding $\lambda_{1}$, $\lambda_{2}$ that breach all three
criteria. We demonstrate the best effort in Fig. 5 that fixes $\lambda_{2}$ to
$0.3$ and $3$ and adjusts $\lambda_{1}$ from $0$ to $0.03$. The best case is
when $\lambda_{1}$=$0.01$, the detection rate has been lowered to around 0.4
(the yellow bars). However, the number of adversarial examples that can
successfully optimize (13) is also decreased to around 45% (the blue bars of
success rate). Hence, although the strongest white-box attackers still have
some chances, our detection has successfully confined the adversarial space by
enlarging the attacker’s efforts. It is also interesting to see that different
criteria form compensating relations as indicated by the AUC values. When
$C_{2}$ (green curve) declines, $C_{1},C_{3}$ quickly rise and vice versa.
This relation is further validated by the ablation study next.

###  4.4 Ablation Study

We present the ablation study to quantify the contribution of each criterion.
We use $C_{3}$ alone as the baseline and add $C_{1}$ and $C_{2}$ with their
averaged gain shown in Table 2. The result is consistent with the defense
objectives as the addition of $C_{1}$ and $C_{2}$ helps improve the detection
rates of the untargeted and targeted attacks by $\bm{0.0533}$ and
$\bm{0.1377}$, respectively. Meanwhile, $C_{1}$ and $C_{2}$ contribute almost
independently on the overall detection, e.g., $C_{1}+C_{3}=\bm{0.0533}$ plus
$C_{2}+C_{3}=\bm{0.0161}$ is equal to $C_{1}+C_{2}+C_{3}=\bm{0.0692}$ for
untargeted attacks and the same also holds for targeted attacks. This
validates that all three criteria act as indispensable parts in the detection.

###  4.5 Computational Time

Finally, we evaluate the computational overhead of the detection mechanism. In
practice, the system can accumulate queries into a batch to enhance the
utilization of GPU resources and reduce cost. Fig. 6 shows the average
retrieval time per sample/batch. First, it is observed that the average time
per sample is under 50 ms and further reduced as we increase the batch size.
Once the batch size is small, detection introduces negligible overhead because
the GPU is underutilized; as the batch size increases, an additional retrieval
from the denoised copy in $C_{3}$ enlarges the gap between normal retrieval
since the GPU resources have been fully utilized. Thus, our detection
introduces minimum overhead when the system accumulates relatively small batch
and responds to queries in real-time.

(a)

(b)

Figure 6: Computation time of different batch size: a) per sample; b) per
batch.

##  5 Related Work

###  5.1 Deep Hashing

Image retrieval uses nearest neighbor search to return the semantically
related images of query inputs. Traditionally, it relies on hand-crafted
visual descriptors to reduce the computational cost of similarity measure [31,
14]. Powered by deep learning, end-to-end hash learning improves the
performance to a new level [27, 8, 7, 49, 26, 47]. They use the similarities
between image pairs to train deep hashing models in a supervised manner by
transforming the high-dimensional images into compact hash codes, on which
neighboring search can be efficiently performed based on hamming distance. To
convert the continuous outputs into discrete binary codes, common approaches
use continuous relaxation such as sigmoid or hyperbolic tangent functions to
approximate the discrete binary thresholding [27, 8, 7, 49, 26, 47]. Our work
exploits the adversarial behaviors originated from this approximation process,
thus can be applied to a variety of deep hashing models.

###  5.2 Adversarial Attacks

Deep neural networks are known to be vulnerable to the non-perceptible
perturbations [36]. The Fast Gradient Sign Method (FGSM) [16] generates
perturbations in the direction of the signed gradient to maximize the loss
function in one-shot computation. The Basic Iterative Method (BIM) [22] and
Projected Gradient Descent (PGD) [29] take iterative steps (from random
initialization) to achieve higher attack success. There are several other
variants [10, 5, 32, 38], e.g., the CW attack aims at minimizing the
perturbations to evade detection.

By using the deep learning backends, deep hashing inherits the vulnerability
from neural networks. With some slight adaptation, recent works have shown
that adversarial attacks can also mislead image retrieval systems [46, 43, 6,
42, 40]. The attacks can be generally categorized into _untargeted_ and
_targeted attacks_. _Untargeted attacks_ divert the query away from the
correct results, which make the system retrieve irrelevant images or simply
nothing. [46] proposes an untargeted attack to maximize the hamming distance
between adversarial and benign samples. [24, 12] craft adversarial examples
based on iterative retrievals from a black-box model. [43] hides private
images in the database into a non-retrievable subspace by minimizing the
number of samples around the private images. _Targeted attacks_ make the
systems return images from a targeted category, different from the inputs. [6,
40] minimize the average hamming distance between the adversarial examples and
a set of images with a target label. [42] enhances targeted transferability to
a black-box model via injecting random noise into the adversarial generation.
Our work defends against both untargeted and targeted attacks in deep hashing.

###  5.3 Adversarial Defenses

Most of the defense mechanisms are based on softmax classification. As
proactive measures, gradient masking [33] and adversarial training [29, 13,
35, 41] learns a robust model. The early defense of [33] starts with an
incorrect conjecture that ascribes adversarial example to high
nonlinearity/overfitting, and develops defensive distillation to reduce the
variations around input. The method is quickly subverted by [9, 10, 5] as
argued in [16] that the primary cause is due to local linearity of neural
networks instead.

Hence, a large body of works focus on adversarial training [29, 13, 35, 41] by
solving a min-max saddle point problem. However, it is non-trivial to tackle
the trade-off between robustness and accuracy [48], which often leads to
significant loss on clean image accuracy, with extensive training efforts.
Applying adversarial training into the deep hashing domain suffers from even
higher accuracy loss as we have experimented (see appendix). For image
retrieval system, as long as the adversarial images are detected at the input,
we can equivalently thwart the attacks without accuracy loss and training
complexities.

Adversarial detections extract the artifacts left by the adversarial examples
at different levels: raw pixels [15, 17], feature distributions [17, 23],
softmax distributions [19] and frequency components [39]. By analyzing the
contrastive distributions of the adversarial and natural images, a detector
can be efficiently trained in a supervised or unsupervised manner. Another
thread of works rely on the prediction inconsistency by exploiting denoise
method and measuring the disagreement between the results [30, 45, 25]. All
these works are based on softmax classification. In this work, we discover
adversarial behaviors from the hamming space and propose a set of detection
criteria including defending against the strongest white-box attackers.

##  6 Conclusion

In this paper, we propose an efficient, unsupervised detection of adversarial
examples in deep hashing based image retrieval. We design three criteria to
identify adversarial behaviors of both targeted and untargeted attacks in the
hamming space and consider white-box attackers who are aware of the existence
of the defense. The extensive evaluations demonstrate that the proposed
detection can surpass previous defense techniques by a large margin and is
also robust against white-box attacker by limiting its action space.

## References

  * [1] Alibaba’s pailitao.  http://www.pailitao.com.  Accessed: 2022-02-03.
  * [2] Bing image search.  https://www.bing.com.  Accessed: 2022-02-03.
  * [3] Google image search.  https://www.google.com/imghp.  Accessed: 2022-02-03.
  * [4] Pinterest visual search tool.  https://www.pinterest.com.  Accessed: 2022-02-03.
  * [5] Anish Athalye, Nicholas Carlini, and David Wagner.  Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples.  In International Conference on Machine Learning, pages 274–283. PMLR, 2018.
  * [6] Jiawang Bai, Bin Chen, Yiming Li, Dongxian Wu, Weiwei Guo, Shu-tao Xia, and En-hui Yang.  Targeted attack for deep hashing based retrieval.  In European Conference on Computer Vision, pages 618–634. Springer, 2020.
  * [7] Yue Cao, Mingsheng Long, Bin Liu, and Jianmin Wang.  Deep cauchy hashing for hamming space retrieval.  In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 1229–1237, 2018.
  * [8] Zhangjie Cao, Mingsheng Long, Jianmin Wang, and Philip S Yu.  Hashnet: Deep learning to hash by continuation.  In Proceedings of the IEEE international conference on computer vision, pages 5608–5617, 2017.
  * [9] Nicholas Carlini and David Wagner.  Defensive distillation is not robust to adversarial examples.  arXiv preprint arXiv:1607.04311, 2016.
  * [10] Nicholas Carlini and David Wagner.  Towards evaluating the robustness of neural networks.  In 2017 IEEE Symposium on Security and Privacy (SP), pages 39–57. IEEE, 2017.
  * [11] Fabio Carrara, Rudy Becarelli, Roberto Caldelli, Fabrizio Falchi, and Giuseppe Amato.  Adversarial examples detection in features distance spaces.  In Proceedings of the European Conference on Computer Vision (ECCV) Workshops, September 2018.
  * [12] Mingyang Chen, Junda Lu, Yi Wang, Jianbin Qin, and Wei Wang.  Dair: A query-efficient decision-based attack on image retrieval systems.  In Proceedings of the 44th International ACM SIGIR Conference on Research and Development in Information Retrieval, pages 1064–1073, 2021.
  * [13] Francesco Croce and Matthias Hein.  Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks.  In International Conference on Machine Learning, pages 2206–2216. PMLR, 2020.
  * [14] Navneet Dalal and Bill Triggs.  Histograms of oriented gradients for human detection.  In 2005 IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR’05), volume 1, pages 886–893. IEEE, 2005.
  * [15] Zhitao Gong, Wenlu Wang, and Wei-Shinn Ku.  Adversarial and clean data are not twins.  arXiv preprint arXiv:1704.04960, 2017.
  * [16] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and harnessing adversarial examples.  arXiv preprint arXiv:1412.6572, 2014.
  * [17] Kathrin Grosse, Praveen Manoharan, Nicolas Papernot, Michael Backes, and Patrick McDaniel.  On the (statistical) detection of adversarial examples.  arXiv preprint arXiv:1702.06280, 2017.
  * [18] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.  Deep residual learning for image recognition.  In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 770–778, 2016.
  * [19] Dan Hendrycks and Kevin Gimpel.  A baseline for detecting misclassified and out-of-distribution examples in neural networks.  arXiv preprint arXiv:1610.02136, 2016.
  * [20] Jiun Tian Hoe, Kam Woh Ng, Tianyu Zhang, Chee Seng Chan, Yi-Zhe Song, and Tao Xiang.  One loss for all: Deep hashing with a single cosine similarity based learning objective.  Advances in Neural Information Processing Systems, 34, 2021.
  * [21] Shengyuan Hu, Tao Yu, Chuan Guo, Wei-Lun Chao, and Kilian Q Weinberger.  A new defense against adversarial images: Turning a weakness into a strength.  Advances in Neural Information Processing Systems, 32, 2019.
  * [22] Alexey Kurakin, Ian J Goodfellow, and Samy Bengio.  Adversarial examples in the physical world.  arXiv preprint arXiv:1607.02533, 2016.
  * [23] Xin Li and Fuxin Li.  Adversarial examples detection in deep networks with convolutional filter statistics.  In Proceedings of the IEEE International Conference on Computer Vision, pages 5764–5772, 2017.
  * [24] Xiaodan Li, Jinfeng Li, Yuefeng Chen, Shaokai Ye, Yuan He, Shuhui Wang, Hang Su, and Hui Xue.  Qair: Practical query-efficient black-box attacks for image retrieval.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 3330–3339, 2021.
  * [25] Bin Liang, Hongcheng Li, Miaoqiang Su, Xirong Li, Wenchang Shi, and Xiaofeng Wang.  Detecting adversarial image examples in deep neural networks with adaptive noise reduction.  IEEE Transactions on Dependable and Secure Computing, 18(1):72–85, 2018.
  * [26] Kevin Lin, Huei-Fang Yang, Jen-Hao Hsiao, and Chu-Song Chen.  Deep learning of binary hash codes for fast image retrieval.  In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, pages 27–35, 2015.
  * [27] Haomiao Liu, Ruiping Wang, Shiguang Shan, and Xilin Chen.  Deep supervised hashing for fast image retrieval.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2064–2072, 2016.
  * [28] Xingjun Ma, Bo Li, Yisen Wang, Sarah M Erfani, Sudanthi Wijewickrema, Grant Schoenebeck, Dawn Song, Michael E Houle, and James Bailey.  Characterizing adversarial subspaces using local intrinsic dimensionality.  arXiv preprint arXiv:1801.02613, 2018.
  * [29] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards deep learning models resistant to adversarial attacks.  In International Conference on Learning Representations, 2018.
  * [30] Dongyu Meng and Hao Chen.  Magnet: a two-pronged defense against adversarial examples.  In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pages 135–147, 2017.
  * [31] Aude Oliva and Antonio Torralba.  Modeling the shape of the scene: A holistic representation of the spatial envelope.  International Journal of Computer Vision, 42(3):145–175, 2001.
  * [32] Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami.  Practical black-box attacks against machine learning.  In Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, pages 506–519, 2017.
  * [33] Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami.  Distillation as a defense to adversarial perturbations against deep neural networks.  In 2016 IEEE Symposium on Security and Privacy (SP), pages 582–597. IEEE, 2016.
  * [34] Sheldon M Ross.  A first course in probability, volume 6.  Prentice Hall Upper Saddle River, NJ, 2002.
  * [35] Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein.  Adversarial training for free!  arXiv preprint arXiv:1904.12843, 2019.
  * [36] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus.  Intriguing properties of neural networks.  arXiv preprint arXiv:1312.6199, 2013.
  * [37] Tijmen Tieleman, Geoffrey Hinton, et al.  Lecture 6.5-rmsprop: Divide the gradient by a running average of its recent magnitude.  COURSERA: Neural Networks for Machine Learning, 4(2):26–31, 2012\.
  * [38] Florian Tramèr, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel.  The space of transferable adversarial examples.  arXiv preprint arXiv:1704.03453, 2017.
  * [39] Haohan Wang, Xindi Wu, Zeyi Huang, and Eric P Xing.  High-frequency component helps explain the generalization of convolutional neural networks.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8684–8694, 2020.
  * [40] Xunguang Wang, Zheng Zhang, Guangming Lu, and Yong Xu.  Targeted attack and defense for deep hashing.  In Proceedings of the 44th International ACM SIGIR Conference on Research and Development in Information Retrieval, pages 2298–2302, 2021.
  * [41] Eric Wong, Leslie Rice, and J Zico Kolter.  Fast is better than free: Revisiting adversarial training.  arXiv preprint arXiv:2001.03994, 2020.
  * [42] Yanru Xiao and Cong Wang.  You see what i want you to see: Exploring targeted black-box transferability attack for hash-based image retrieval systems.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1934–1943, 2021.
  * [43] Yanru Xiao, Cong Wang, and Xing Gao.  Evade deep image retrieval by stashing private images in the hash space.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9651–9660, 2020.
  * [44] Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan L Yuille, and Quoc V Le.  Adversarial examples improve image recognition.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 819–828, 2020.
  * [45] Weilin Xu, David Evans, and Yanjun Qi.  Feature squeezing: Detecting adversarial examples in deep neural networks.  arXiv preprint arXiv:1704.01155, 2017.
  * [46] Erkun Yang, Tongliang Liu, Cheng Deng, and Dacheng Tao.  Adversarial examples for hamming space search.  IEEE Transactions on Cybernetics, 2018.
  * [47] Li Yuan, Tao Wang, Xiaopeng Zhang, Francis EH Tay, Zequn Jie, Wei Liu, and Jiashi Feng.  Central similarity quantization for efficient image and video retrieval.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 3083–3092, 2020.
  * [48] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan.  Theoretically principled trade-off between robustness and accuracy.  In International Conference on Machine Learning, pages 7472–7482. PMLR, 2019.
  * [49] Han Zhu, Mingsheng Long, Jianmin Wang, and Yue Cao.  Deep hashing network for efficient similarity retrieval.  In Proceedings of the AAAI Conference on Artificial Intelligence, volume 30, 2016.

##  7 Appendix

We provide additional experiments of adversarial training and white-box
attacks in the Appendix.

###  7.1 Adversarial Training

As a proactive defense, adversarial training aims to solve a min-max
optimization problem, that the inner optimization finds adversarial examples
to maximize the loss function, whereas the outer optimization minimizes the
overall loss. Thus, the trade-off between model accuracy and robustness
becomes the key in adversarial training. In the following, we show that such
gap becomes even larger in deep hashing and is non-trivial to handle with the
conventional adversarial training method.

Implementation Details. Our implementation is based on Free Adversarial
Training (FreeAT) [35]. It parallelizes parameter update and adversarial
generation, thus reducing the overhead from the inner optimization. During
training, it replays the same minibatch data $m$ times to update the model
parameters as well as generates adversarial examples for the next iteration.
Small $m$ has little effect on robustness but large one would impact on the
model accuracy. From [35], the best case of softmax classification (when
$m=8$) has $0.46$ accuracy gain from the adversarial attacks (PGD and CW) and
loses about $0.1$ accuracy on CIFAR-10. Next, we validate if similar value
holds for deep hashing.

We adopt the FreeAT method in deep hashing using their configuration on
CIFAR-10. We set $||\epsilon||_{\infty}=8$ , with four different repeat times
$m$ from $2$ to $16$, to train four ResNet50 models. For each one of them, we
generate PGD adversarial examples with various steps, denoted as PGD-8, PGD-40
and PGD-100 for $8$, $40$ and $100$ steps, respectively.

Training | Evaluated Against
---|---
Benign | PGD-8 | PGD-40 | PGD-100
No FreeAT | 0.854 | 0.028 | 0.030 | 0.033
FreeAT $m=2$ | 0.889 | 0.070 | 0.035 | 0.035
FreeAT $m=4$ | 0.838 | 0.222 | 0.070 | 0.055
FreeAT $m=8$ | 0.769 | 0.328 | 0.146 | 0.130
FreeAT $m=16$ | 0.683 | 0.278 | 0.122 | 0.114
Table 3: Clean and adversarial mAPs of implementing FreeAT [35] for deep
hashing on CIFAR-10

Results. The first row of Table 3 shows that without adversarial training, PGD
attacks have successfully lowered the mAP to near zero. With FreeAT, the mAP
improves under PGD-8, but still performs poorly with large attack steps such
as PGD-40 and PGD-100. For the best case here when $m=8$, PGD attack with 100
steps still manages to lower the mAP to $0.130$. Not only having such low
fidelity in defense, adversarial training also brings down the model accuracy
on benign samples. With more $m$ steps involved, the mAP on benign samples
decreases drastically from $0.854$ to $0.683$222The only exception is the
model with $m=2$, which improves the performance on benign samples. It is
inline with [44], where adversarial training is found to improve accuracy on
clean images for some parameter settings., while no significant improvement of
adversarial robustness is found. Compared to softmax classification, the gap
is widening for deep hashing so we pursue adversarial detection in this paper.

###  7.2 White-box Experiments

We present additional results of the white-box attacks. Since the attacker
need to design specific objectives regarding the detection methods, we choose
MeanBlur [23] as a benchmark for comparison. The detection rate is True
Positive Rate (TPR) with a certain threshold calculated by False Positive Rate
(FPR) on benign samples. We use the PGD attack with
$||\epsilon||_{\infty}=32$. For the best success rate and ability to bypass
the detection, we choose $\lambda_{1}=0.0075$. In Table 4, we show the
detection results on four datasets evaluated by TPR. Given FPR$=0.1$ and
FPR$=0.2$, our method achieves an average of $0.7309$ and $0.8403$ white-box
detection rates, whereas the detection rates for MeanBlur is close to zero.
This further validates that our method is robust against the strongest white-
box attackers. It is also interesting to see that both methods perform
relatively better on single-label datasets (CIFAR-10 and ImageNet) than multi-
label datasets (MS-COCO and NUSWIDE), which is different from the gray-box
attacks. The reason behind that need to be further studied in the future.

Detecotr | FPR | CIFAR10 | ImageNet | MS-COCO | NUSWIDE
---|---|---|---|---|---
MeanBlur [23] | 0.1 | 0.0340 | 0.0218 | 0.0044 | 0.0057
0.2 | 0.0480 | 0.0250 | 0.0076 | 0.0076
Our Method | 0.1 | 0.9560 | 0.8824 | 0.4648 | 0.6204
0.2 | 0.9790 | 0.9180 | 0.6742 | 0.7900
Table 4: Detection rate (TPR) of the adversarial examples against white-box
attacks (PGD, $\epsilon=32$, $\lambda_{1}=0.0075$)


Missing 'biblatex' package
The bibliography requires the 'biblatex' package.

Academic Press, Inc.

titleLearning Regular Sets from Queries and Counterexamples
journaltitleInformation and Computation

Springer Berlin Heidelberg

booktitleFundamental Approaches to Software Engineering
seriesLecture Notes in Computer Science
titleOn the Correspondence Between Conformance Testing and Regular

The MIT Press

titlePrinciples of Model Checking

Springer Berlin Heidelberg

booktitleComputer Aided Verification
seriesLecture Notes in Computer Science
titlelibalf: The Automata Learning Framework

Springer Berlin Heidelberg

seriesLecture Notes in Computer Science
titleModel-Based Testing of Reactive Systems

titleActive learning for extended finite state machines
journaltitleFormal Aspects of Computing

Springer Berlin Heidelberg

booktitleFinite-State Methods and Natural Language Processing
seriesLecture Notes in Computer Science
titleZulu: An Interactive Learning Competition

given=Eui ChulRichard,

booktitleProceedings of the 17th ACM Conference on Computer and
Communications Security
seriesCCS '10
titleInference and Analysis of Formal Models of Botnet Command and
Control Protocols
New York, NY, USA

booktitleProceedings of the 2013 ACM SIGPLAN International
Conference on Object Oriented Programming Systems Languages & Applications
seriesOOPSLA '13
titleGuided GUI Testing of Android Apps with Minimal Restart and
Approximate Learning
New York, NY, USA

Springer Berlin Heidelberg

booktitleTesting Software and Systems
seriesLecture Notes in Computer Science
titleCase Studies in Learning-Based Testing

booktitleProceedings of the Twenty-fifth Annual ACM Symposium on
Theory of Computing
seriesSTOC '93
titleEfficient Learning of Typical Finite Automata from Random

titleTest Selection Based on Finite State Models
journaltitleIEEE Transactions on Software Engineering

Springer Berlin Heidelberg

booktitleModel-Based Testing of Reactive Systems
seriesLecture Notes in Computer Science
titleConformance Testing

titleState-Identification Experiments in Finite Automata
journaltitleInformation and Control

Kluwer Academic Publishers-Plenum Publishers

titleCheck Words for the States of a Finite Automaton

titleA Linear Algorithm for Testing Equivalence of Finite
Dept. of Computer Science, Cornell University

booktitleProceedings of the 2003 International Test Conference
titleTest-Based Model Generation For Legacy Systems

Addison-Wesley Longman Publishing Co., Inc.

titleIntroduction to Automata Theory, Languages, and

Stanford University

titleAn N Log N Algorithm for Minimizing States in a Finite
Stanford, CA, USA

Springer Berlin Heidelberg

booktitleLeveraging Applications of Formal Methods, Verification
and Validation
seriesLecture Notes in Computer Science
titleInferring Semantic Interfaces of Data Structures

Springer Berlin Heidelberg

booktitleLeveraging Applications of Formal Methods, Verification,
and Validation
seriesCommunications in Computer and Information Science
titleThe Teachers’ Crowd: The Impact of Distributed Oracles on
Active Automata Learning

titleActive Learning of Interface Programs
TU Dortmund University

booktitleLeveraging Applications of Formal Methods, Verification,
and Validation - 4th International Symposium on Leveraging Applications
titleFrom ZULU to RERS - Lessons Learned in the ZULU

Springer US

titleLearning register automata: from languages to program
journaltitleMachine Learning

Springer International Publishing

booktitleRuntime Verification
seriesLecture Notes in Computer Science
titleThe TTT Algorithm: A Redundancy-Free Approach to Active
Automata Learning

booktitleCAV (1)
seriesLecture Notes in Computer Science
titleThe Open-Source LearnLib - A Framework for Active Automata

IEEE Computer Society

titleCONNECT Challenges: Towards Emergent Connectors for Eternal
Networked Systems.

Springer Berlin Heidelberg

booktitleTesting Software and Systems
seriesLecture Notes in Computer Science
titleAdaptive Homing and Distinguishing Experiments for
Nondeterministic Finite State Machines

American Mathematical Society

titleJohann Faulhaber and Sums of Powers
journaltitleMathematics of Computation

Pleiades Publishing, New York; MAIK 'Nauka/Interperiodica', Moscow

titleEstimated Length of a Minimal Simple Conditional Diagnostic
journaltitleAutomation and Remote Control

Springer Berlin Heidelberg

booktitleModel-Based Testing of Reactive Systems
seriesLecture Notes in Computer Science
titleState Identification

booktitleProceedings of the 12th International Conference on
Grammatical Inference
titleLearning Nondeterministic Mealy Machines

MIT Press

titleAn Introduction to Computational Learning Theory
Cambridge, MA, USA

titleTesting Finite-State Machines: State Identification and
journaltitleIEEE Transactions on Computers

titleA Method for Synthesizing Sequential Circuits
journaltitleBell System Technical Journal

Princeton University Press

booktitleAutomata Studies
titleGedanken-Experiments on Sequential Machines
Princeton, NJ

Springer International Publishing

booktitleNASA Formal Methods
titleSound Black-Box Checking in the LearnLib

American Mathematical Society

titleLinear automaton transformations
journaltitleProceedings of the American Mathematical Society

titleAn Integrated Approach to Testing Complex Systems
TU Dortmund University

titleBlack Box Checking
Magdeburg, Germany, Germany

journaltitleJournal of Automata, Languages and Combinatorics

booktitleProceedings of the 2008 Workshop on Testing, Analysis,
and Verification of Web Services and Applications
seriesTAV-WEB '08
titleHybrid Test of Web Applications with Webtest
New York, NY, USA

titleInference of Finite Automata using Homing Sequences
journaltitleInformation and Computation

Kluwer Academic Publishers-Plenum Publishers

titleProof of an Achievable Bound on the Length of a Conditional
Diagnostic Experiment for a Finite Automaton

Springer Berlin Heidelberg

booktitleFormal Methods for Eternal Networked Software Systems
seriesLecture Notes in Computer Science
titleIntroduction to Active Automata Learning from a Practical

Kluwer Academic Publishers-Plenum Publishers

titleDiagnostic Experiments with Automata

notecurrently accepted paper in ICFEM 2015
titleApplying Automata Learning to Embedded Control Software

Springer US

titleHardness and inapproximability of minimizing adaptive
distinguishing sequences
journaltitleFormal Methods in System Design

booktitleComputer Aided Verification, 18th International
titleLEVER: A Tool for Learning Based Verification

Springer US

titleSTAMINA: a competition to encourage the development and
assessment of software model inference techniques
journaltitleEmpirical Software Engineering

titleKontinuierliche Qualitätskontrolle von Webanwendungen auf
Basis Maschinengelernter Modelle
TU Dortmund University

family=Springer Science+Business Media,

notevisited on 01.09.2015
titleOCS Website


††thanks: These authors contributed equally to this work.††thanks: These
authors contributed equally to this work.

# Ion trap with gold-plated alumina: substrate and surface characterization

Myunghun Kim  Department of Electrical Engineering, Pohang University of
Science and Technology (POSTECH), 37673 Pohang, Korea  Keumhyun Kim
Department of Electrical Engineering, Pohang University of Science and
Technology (POSTECH), 37673 Pohang, Korea  Jungsoo Hong  Department of
Electrical Engineering, Pohang University of Science and Technology (POSTECH),
37673 Pohang, Korea  Hyegoo Lee  Department of Electrical Engineering, Pohang
University of Science and Technology (POSTECH), 37673 Pohang, Korea  Youngil
Moon  Department of Electrical Engineering, Pohang University of Science and
Technology (POSTECH), 37673 Pohang, Korea  Wonchan Lee  Department of Physics,
Pohang University of Science and Technology (POSTECH), 37673 Pohang, Korea
Sehyun Kim  Pohang Accelerator Laboratory (PAL), Pohang University of Science
and Technology (POSTECH), 37673 Pohang, Korea  Taekyun Ha  Pohang Accelerator
Laboratory (PAL), Pohang University of Science and Technology (POSTECH), 37673
Pohang, Korea  Jae-Yoon Sim  Department of Electrical Engineering, Pohang
University of Science and Technology (POSTECH), 37673 Pohang, Korea  Moonjoo
Lee<EMAIL_ADDRESS>Department of Electrical Engineering, Pohang
University of Science and Technology (POSTECH), 37673 Pohang, Korea

###### Abstract

We describe a complete development process of a segmented-blade linear ion
trap. Alumina substrate is characterized with an X-ray diffraction and loss-
tangent measurement. The blade is laser-micromachined and polished, followed
by the sputtering and gold electroplating. Surface roughness is examined at
each step of the fabrication via both electron and optical microscopies. On
the gold-plated facet, we obtain a height deviation of tens of nanometers in
the vicinity of the ion position. Trapping of laser-cooled 174Yb+ ions is
demonstrated.

##  I Introduction

Trapped atomic ion is a preeminent system for developing a quantum computer
[1, 2]. Nowadays, quantum gate operation and qubit measurement can be
performed at a state-of-the-art level [3, 4, 5]. Several quantum algorithms
and error-correction codes were implemented recently [6, 7, 8], which would
have given stronger impact if executed with more ion qubits. As well, in order
to realize quantum advantage [9, 10] or to solve more practical problems [11,
12] with the ions, it is needed to develop a trap device in which a very large
number of qubits can be controlled and measured at high fidelities [13, 14].
To this end, great efforts have been devoted with various engineering
technologies [15, 16]. For example, microelectromechanical system (MEMS)
techniques were employed to develop miniaturized ion traps [17, 18, 19, 20],
cryogenics offered a stable environment to the ions [21, 22, 23], and
complementary metal-oxide semiconductor (CMOS) technology enabled high-
resolution, repeatable production of the ion-trap hardware [24, 25, 26].

The scalable ion traps would be broadly categorized into two groups [27]:
according to the substrate, semiconductor-based materials or other
dielectrics. In case of the former, on a substrate like Si/SiO2 [28, 29, 30,
27] or GaAs/AlGaAs [31], a series of well-established microfabrications, such
as etching, lithography, and metal deposition, were done to develop a trapping
chip. This approach enabled the generation of “High Optical Access” trap [32],
and would also be compatible with the CMOS and very-large-scale integration
(VLSI) technologies. In other dielectric substrates, such as alumina [33, 34,
35, 36, 37], fused silica and quartz [38], and diamond [39, 40], remarkable
achievements were reported including a junction trap [33, 34], transport gates
[41, 36], and stable operation at cryogenic temperatures [23]. Differently
from the former, the fabrication on such dielectrics/ceramics would not
precisely follow those of standard semiconductor engineering, therefore
certain development steps, like laser machining [42], gold electroplating [43,
44], and its surface control [45], have actively been investigated in the ion-
trap research.

Here, we present a detailed fabrication process of a segmented-blade ion trap,
and trapping of laser-cooled 174Yb+ ions. X-ray diffraction (XRD) spectroscopy
shows that our substrate is a crystalline $\alpha$-alumina, and the loss
tangent is measured to be about $10^{-2}$ at 20 MHz. The alumina is machined
with a laser to make the holes and grooves at the micrometer scale, succeeded
by the sputtering of titanium and gold layers. Electroplating of gold follows
to obtain a total thickness of gold layer about 3 $\mu$m. After each
fabrication step, we assess the surface quality with a scanning electron
microscope (SEM) and high-resolution optical microscope. The surface roughness
is further quantified through a confocal optical microscopy, from which we
obtain a height deviation of gold surface as small as $<30$ nm, at a location
close to ions. We proceed to assemble an ion-trapping system with the blades,
and load laser-cooled 174Yb+ ions successfully.

The novelty of our work is pointed out in the following ways. First, in the
ion-trap research, it is for the first time that an actual substrate is
characterized with the XRD and loss-tangent measurements, as far as we are
aware. Second, it is also an original approach that surface roughness is
quantified at every step of the fabrication, which gives sequential
information for the final shape of a device. Finally, we hereby provide a
full, detailed description of developing an ion-trap system that exploits a
dielectric substrate.

##  II Trap fabrication

###  II.1 Alumina blade

We consider the segmented-blade ion trap of Refs. [46, 47, 48] and note that,
in our trap here, auxiliary biasing rods are installed for compensating the
micromotion [49]. The blade body is made of sintered alumina (Al2O3), an often
used substrate in ion-trap platforms [33, 34, 35, 36, 37]. Alumina has been
employed in the ion-trap research for several reasons: low radio frequency
(RF) losses reduce heat dissipation in the trap [50], large bandgap of several
eVs [51, 52] precludes the light-induced charge carrier effect [53], and it is
feasible to engineer the substrate through pulsed or continuous wave (CW)
laser machining [54, 55, 56]. Moreover, alumina is a ceramic with relatively
high thermal conductivity ($20\sim 30$ W/(m$\cdot$K)), and is chemically
stable such that one can perform nano/microfabrication reliably.

Figure 1:  (a) X-ray diffraction spectrum of alumina. Diffracted intensity as
a function of twice the sample rotation angle $\theta$. (b) Measured loss
tangent of alumina. Four samples (denoted by different colors and symbols) are
measured at frequency range from 10 kHz to 100 MHz.

####  II.1.1 X-ray diffraction

In order to characterize our alumina, we first examine the sample with an
X-ray diffraction (XRD) spectroscopy. The XRD is an extensively used technique
to assess the physical properties of a solid, including the crystallinity,
strain, defects, and crystal orientations. In formation of a bulk alumina from
powders, the alumina exists in a series of different polymorphs: amorphous
alumina is formed when the thermal decomposition occurs below
$450\,^{\circ}\mathrm{C}$, seven metastable phases
($\gamma,\delta,\kappa,\rho,\eta,\theta$ and $\chi$) are generated at
temperatures from 450 to 1,200$\,{}^{\circ}\mathrm{C}$, and thermally stable
$\alpha$-alumina is created by sintering above 1,200$\,{}^{\circ}\mathrm{C}$
[57, 58]. Our XRD measurement (Fig. 1(a)) shows that the diffraction peaks are
clearly resolved, indicating our sample is well crystallized. Also, from the
angles of the diffraction peaks, we identify that it is an $\alpha$-alumina
[57] with the crystal indices denoted in Fig. 1(a). To be used as a substrate,
the $\alpha$-alumina is more appropriate than others, since the surface of
$\alpha$-alumina is much less porous [59], and the thermal conductivity and
bandgap are larger than that of other phases of alumina [52].

Figure 2:  Machining steps of alumina blade. (a), (b) Substrate with a
thickness of 300 $\mu$m and $L=25.2$ mm. Blade is shaped and tapered with
diamond grinding wheel. (c) Tapered corner. $\theta_{1}=8.0^{\circ}$. Four
grooves in (d) and five holes in (e) are micromachined with laser. (f) Central
area with $\theta_{2}=62.6^{\circ}$, $\theta_{3}=26.5^{\circ}$, and
$w=50\,\mu$m.  Figure 3:  (a) Photograph of machined alumina blade. Scale bar
refers to 2 mm. (b) Optical microscope image of non-tapered edge. $T=300$
$\mu$m. (c), (e) Scanning electron microscope image of groove and tapered
edge. $t=50$ $\mu$m. (d) Optical microscope image of central zone.

####  II.1.2 Loss tangent

Next characterization consists of a loss-tangent measurement. The loss tangent
is a dimensionless value that quantifies the loss effect of an electromagnetic
wave in a dielectric medium. Given a complex permittivity $\varepsilon$ of a
dielectric, it follows that $\varepsilon=\epsilon(1+i\tan{\delta})$ with a
real-number permittivity $\epsilon$ and loss tangent $\tan{\delta}$ [60]. We
perform the loss-tangent measurement using a precision impedance analyzer
(Agilent Inc., 4294A). This device measures the both resistance and inductive
reactance at a given frequency, which returns the impedance and phase angle
(loss tangent) consequently. Fig. 1(b) shows the measurement results for four
different alumina substrates. In our samples, the overall tendency is that the
loss tangent varies between $1.5\cdot 10^{-2}$ to $2.5\cdot 10^{-2}$ as the
driving frequency increases from 10 kHz to few MHz, then the measured value
decreases below $10^{-2}$ as the frequency increases to tens of MHz. Our data
are at a similar level with the results in Ref. [50], however larger than the
literature values in Refs. [61, 62, 60]. The difference would be attributed to
several factors during the sintering, like temperature, pressure, and
impurities in forming a bulk alumina from powders.

####  II.1.3 Machining

We present the machining process of an alumina blade in Fig. 2. This
engineering was performed in 21st Century, Co. Ltd., Korea. We make use of an
alumina with a purity of 99.7%. The overall shaping shown in Figs. 2(a)–(c) is
done using a diamond grinder. Note that the tapering along one edge of the
blade (rectangle in Fig. 2(b) and Fig. 2(c)) allows us to image or address the
ion with a numerical aperture (NA) of 0.39 along one direction and 0.80 in the
other direction, at a given blade-blade distance of 500 $\mu$m and the angle
given in Ref. [49]. After such shaping, the grooves and holes are made with
laser micromachining (Figs. 2(d) and (e)). The deployed light source is a CW
fiber laser with a power of 300 W operating at 1064 nm. While the alumina body
is exposed to the laser, the melted or evaporated ceramic residues are blown
with nitrogen gas. The laser machining speed is about $0.4$ mm/min, resulting
in a total elapsed time of 2 hours per blade. Fine polishing of the blade edge
(only along the tapered side) follows as the last step of the blade machining.

Figure 4:  (a) Schematic and photograph of electroplating setup. Photographs
of gold-plated RF blade in (b) and DC blade in (c) held with “anchor”.
Scanning electron microscope image after gold plating, on sidewall at groove
in (d) and on tapered edge in (e). $t=50$ $\mu$m.

Fig. 3 shows microscope images of a machined blade, which are observed after
the cleaning process described in Sec. II.2. We point out three notable
features. First, the overall nonuniform surface is a consequence of sintering,
and this nonuniformity varies significantly by changing the sintering
temperatures [63]. Second, in Fig. 3(c), we find the half-cylindrical shapes
on the sidewall of the groove. It is because, while the alumina is melted by
the high-power laser and hardened, the waist of the laser ($\sim 15$ $\mu$m)
is approximately “mapped” to this sidewall. Third, as shown in the bottom left
(red rectangle) of Fig. 3(d), we sometimes observe the thread-like feature
that exists between the grooves, probably due to the imperfect laser
machining. This would be problematic after plating with gold, because a short
between the adjacent blade and spurious capacitance/inductance would be
formed. We therefore disconnect it by inserting a thin thread between the
grooves; in the DC blade, this connection could also be broken by applying a
high current between the shorted blades after gold coating. In Sec. II.3, we
discuss the surface roughness of the blade in more detail.

###  II.2 Gold coating

After the blade machining described above, we clean the alumina blade to
remove ceramic residues and other contaminants. The cleaning is carried out in
two stages, wet Piranha cleaning succeeded by dry oxygen plasma etching. We
perform the Piranha cleaning for 30 minutes, where the blade is immersed in a
solution of 4:1 mixture of sulfuric acid (H2SO4) and hydrogen peroxide (H2O2)
at $100\,^{\circ}\mathrm{C}$. Next, we made mild oxygen plasma etching on both
sides of the blade, taking 1 minute for each facet.

Next, we continue with the metal sputtering, for an adhesion layer of a 30-nm
thick titanium and a gold layer with a thickness of 200 nm. A dc sputtering is
performed once for each blade side — this causes, on the tapered edge and
other three edges along the blade, four layers of titanium, gold, titanium,
and gold are deposited sequentially. The deposition speed is 2.7 nm/min for
titanium and 18 nm/min for gold. While the RF blade is sputtered without a
mask, for the DC blade, a metal mask is used to block the deposition between
adjacent segments (four white zones in Fig. 4(c)). After the sputtering,
possible dirts are removed by a mild oxygen plasma cleaning, which would
facilitate the next step of gold electroplating.

Figure 5:  Measured surface roughness on the tapered edge, after (a) laser
machining, (b) polishing, (c) sputtering, and (d) gold plating.  Figure 6:
(a) Photograph of our ion-trap system. Fluorescence image of 174Yb+ ion cloud
in (b), single ion in (c), and two ions in (d). Scale bars denote 20 $\mu$m.

Fig. 4 presents our electroplating setup and SEM images of the completed RF
and DC blades. In the setting shown in Fig. 4(a), we hold the blade with a
customized, platinum-titanium “anchor” structure, that makes a simultaneous
electrical contact of all five segments. The other end of the anchor is
connected to the ground of a current-stabilized power supply, corresponding to
the cathode of our plating system. The immersed parts of the anode are also
made of platinum-titanium mesh, placed at both sides of the blade: this
arrangement would assist a uniform plating over the whole surface. With a non-
cyanide gold solution (JDC Inc., Temperresist K91S), we carry out a dc
electroplating at a voltage 0.31 V and current 10 mA. The plating is done at
$65\,^{\circ}\mathrm{C}$ for 12 minutes while gently stirring the solution
with a magnetic bar, resulting in a target thickness of 3 $\mu$m. After the
plating, the blade is cleaned with deionized water, acetone, isopropyl
alcohol, and dried with a nitrogen gun. The blade is stirred for 1 minute in
each solution at $60\,^{\circ}\mathrm{C}$. The gold plated surface is
investigated using the SEM, as shown in Figs. 4(d) and (e). The whole surface
is well covered with gold, and we provide quantitative descriptions in Sec.
II.3.

###  II.3 Surface roughness

We discuss the surface roughness measurements. After each step of the blade
fabrication, i.e. laser machining, polishing, sputtering, and electoplating,
we make use of a three-dimensional confocal scanning microscope (Lasertec
Inc., OPTELICS HYMRID C3) for the surface topography. The surface roughness is
quantified using the parameter $R_{a}=\sum_{i}^{N}|z_{i}-\bar{z}|/N$, where
$N$ is the total measurement points, $z_{i}$ is the sample height at the
measurement point $i$, and $\bar{z}$ is the average of all $z_{i}$. The
results are shown in Fig. 5. Denoting the smallest $R_{a}$ values for the
first three fabrication steps, we find 1.189 $\mu$m after laser machining
(Fig. 5(a)), 41 nm on polished surface (Fig. 5(b)), and 20 nm after sputtering
(Fig. 5(c)) respectively, over a scanning distance of 40 $\mu$m.

The roughness on the gold-plated facet, directly seen by the ions, is
investigated more carefully. We measure $R_{a}$ for randomly chosen several
positions on the tapered edge, from which we obtain 24, 36, 50, 122, 136, and
188 nm over a scan length of 40 $\mu$m; the case of $R_{a}=24$ nm is presented
in Fig. 5(d). We remark the following points regarding this measurement.
First, the roughness of electrodeposits would be dominantly determined by that
of alumina substrate underneath. Thus, in order to obtain a great surface
quality, it would be crucial to perform a high-quality sintering and to polish
the alumina as finely as possible. Second, the high $R_{a}$ values, like
$>100$ nm, on the gold-plated facet would be mostly originated from the small
“dents” that appear in Fig. 4(e). For removing these dents, the polishing
should have been done more strongly, which takes the risk of breaking the
corners of each segment. We also find that the surface quality is generally
better on the central part, rather than both corners of the segment. Lastly,
we carry out an energy dispersive X-ray spectroscopy [64] on the individual
dents: gold is plated well at these locations.

##  III Ion-trap operation

In Fig. 6(a), we present our ion-trap apparatus made of the gold-plated
alumina blades. Each blade is mounted to an alumina adapter that is fixed to
the surrounding titanium holder. The blade-blade distance is 500 $\mu$m at an
angle given in Ref. [49]. The blades are aligned and assembled by hand, while
monitoring the relative position with an optical microscope. Two biasing rods,
made of tungsten with a diameter of 1 mm, are shown behind the blades in Fig.
6(a).

We point out that our chamber is “passivated” for reducing the outgassing
rate. The empty chamber (viewports and feedthroughs replaced with blank
flanges) is pumped and baked at $450\,^{\circ}\mathrm{C}$ for 48 hours, with
an oxygen partial pressure about 10-9 torr. Under such circumstance, an oxide
film of Cr2O3 is formed all over the inner surface of stainless steel: this
layer plays the role of a diffusion barrier for hydrogen, as well as provides
a relatively uniform surface [65, 66, 67]. After the vacuum thermal oxidation,
we install the ion-trap assembly in the chamber, bake the setup at
$120\,^{\circ}\mathrm{C}$, and obtain a base pressure of mid $10^{-11}$ torr.

After placing the trap, the trap capacitance is measured to be $18$ pF using a
LCR meter, through the connected electrical feedthrough. In conjunction with a
helical RF resonator (quality factor about 270), we find a resonance frequency
at 19.525 MHz, where the trap drive voltage is applied. The ions are imaged
with an objective lens with a NA of 0.38, followed by a tube lens of a focal
length 200 mm: the resultant magnification is 8.25 at 369 nm. After the two-
photon ionization of 174Yb+ ions with 399 nm and 369 nm lasers, we load a
laser-cooled 174Yb+ cloud in Fig. 6(b), and single and two ions in Figs. 6(c)
and (d). The laser frequencies of two lasers, and that of a repump laser at
935 nm are simultaneously stabilized using the scheme in Ref. [68]. When the
ion-fluorescence images in Figs. 6(c) and (d) are taken, the trap frequencies
are measured by exciting the ion motion with auxiliary driving frequencies: we
obtain $3.2$ MHz along the radial directions, and 350 kHz along the trap axis.

##  IV discussion

While the alumina was often used as a substrate for ion-trap devices [33, 34,
35, 36, 37], it might not be an optimal choice from the perspective of laser
machining. It is because inefficient absorption requires more laser power, and
random scattering causes more rough surface after the engineering. Instead, by
adding small amount of inorganic pigments to a ceramic powder (before
sintering), the color of the material becomes black, which enhances the light
absorption without substantial change of the physical properties [69]. For
instance, black-colored alumina or zirconia, could be chosen for the ion-trap
substrate. We note that the dielectric loss of zirconia is as small as that of
alumina; however, zircona has rather low thermal conductivity ($5\sim 7$
W/(m$\cdot$K)) that would induce more heating of the rf blade while operating
the ion trap.

##  V conclusion

In summary, we have described a development process of a segmented-blade
linear ion trap. The XRD spectroscopy shows that the substrate is an
$\alpha$-alumina, and the loss tangent is measured to be about $10^{-2}$ at
$20$ MHz. The alumina blade is micromachined with a laser, succeeded by
polishing and gold-coating. We quantify the surface roughness at every step of
the fabrication, and our confocal optical microscopy gives the height
deviation as small as $<30$ nm on a gold-plated edge. In our ion-trap
apparatus made of those blades, trapping of laser-cooled 174Yb+ ions is
demonstrated successfully. We expect that our detailed characterization would
assist the development of a state-of-the-art ion-trap hardware.

##  VI acknowledgments

We thank Jae Kap Jung at Korea Research Institute of Standards and Science for
the help in the loss-tangent measurement. This work has been supported by BK21
FOUR program and Educational Institute for Intelligent Information
Integration, National Research Foundation (Grant No. 2019R1A5A1027055),
Institute for Information & communication Technology Planning & evaluation
(IITP, Grant No. 2022-0-01040), Samsung Science and Technology Foundation
(SSTF-BA2101-07) and Samsung Electronics Co., Ltd. (IO201211-08121-01).

## References

  * Leibfried  _et al._ [2003] D. Leibfried, R. Blatt, C. Monroe, and D. Wineland, Rev. Mod. Phys. 75, 281 (2003).
  * Monroe and Kim [2013] C. Monroe and J. Kim, Science 339, 1164 (2013).
  * Ballance  _et al._ [2016] C. J. Ballance, T. P. Harty, N. M. Linke, M. A. Sepiol, and D. M. Lucas, Phys. Rev. Lett. 117, 060504 (2016).
  * Gaebler  _et al._ [2016] J. P. Gaebler, T. R. Tan, Y. Lin, Y. Wan, R. Bowler, A. C. Keith, S. Glancy, K. Coakley, E. Knill, D. Leibfried, and D. J. Wineland, Phys. Rev. Lett. 117, 060505 (2016).
  * Crain  _et al._ [2019] S. Crain, C. Cahall, G. Vrijsen, E. E. Wollman, M. D. Shaw, V. B. Verma, S. W. Nam, and J. Kim, Commun. Phys. 2, 97 (2019).
  * Debnath  _et al._ [2016] S. Debnath, N. M. Linke, C. Figgatt, K. A. Landsman, K. Wright, and C. Monroe, Nature 536, 63 (2016).
  * Flühmann  _et al._ [2019] C. Flühmann, T. L. Nguyen, M. Marinelli, V. Negnevitsky, K. Mehta, and J. P. Home, Nature 566, 513 (2019).
  * Erhard  _et al._ [2021] A. Erhard, H. Poulsen Nautrup, M. Meth, L. Postler, R. Stricker, M. Stadler, V. Negnevitsky, M. Ringbauer, P. Schindler, H. J. Briegel, R. Blatt, N. Friis, and T. Monz, Nature 589, 220 (2021).
  * Arute  _et al._ [2019] F. Arute, K. Arya, R. Babbush, D. Bacon, J. C. Bardin, R. Barends, R. Biswas, S. Boixo, F. G. S. L. Brandao, D. A. Buell, B. Burkett, Y. Chen, Z. Chen, B. Chiaro, R. Collins, W. Courtney, A. Dunsworth, E. Farhi, B. Foxen, A. Fowler, C. Gidney, M. Giustina, R. Graff, K. Guerin, S. Habegger, M. P. Harrigan, M. J. Hartmann, A. Ho, M. Hoffmann, T. Huang, T. S. Humble, S. V. Isakov, E. Jeffrey, Z. Jiang, D. Kafri, K. Kechedzhi, J. Kelly, P. V. Klimov, S. Knysh, A. Korotkov, F. Kostritsa, D. Landhuis, M. Lindmark, E. Lucero, D. Lyakh, S. Mandrà, J. R. McClean, M. McEwen, A. Megrant, X. Mi, K. Michielsen, M. Mohseni, J. Mutus, O. Naaman, M. Neeley, C. Neill, M. Y. Niu, E. Ostby, A. Petukhov, J. C. Platt, C. Quintana, E. G. Rieffel, P. Roushan, N. C. Rubin, D. Sank, K. J. Satzinger, V. Smelyanskiy, K. J. Sung, M. D. Trevithick, A. Vainsencher, B. Villalonga, T. White, Z. J. Yao, P. Yeh, A. Zalcman, H. Neven, and J. M. Martinis, Nature 574, 505 (2019).
  * Wu  _et al._ [2021] Y. Wu, W.-S. Bao, S. Cao, F. Chen, M.-C. Chen, X. Chen, T.-H. Chung, H. Deng, Y. Du, D. Fan, M. Gong, C. Guo, C. Guo, S. Guo, L. Han, L. Hong, H.-L. Huang, Y.-H. Huo, L. Li, N. Li, S. Li, Y. Li, F. Liang, C. Lin, J. Lin, H. Qian, D. Qiao, H. Rong, H. Su, L. Sun, L. Wang, S. Wang, D. Wu, Y. Xu, K. Yan, W. Yang, Y. Yang, Y. Ye, J. Yin, C. Ying, J. Yu, C. Zha, C. Zhang, H. Zhang, K. Zhang, Y. Zhang, H. Zhao, Y. Zhao, L. Zhou, Q. Zhu, C.-Y. Lu, C.-Z. Peng, X. Zhu, and J.-W. Pan, Phys. Rev. Lett. 127, 180501 (2021).
  * Montanaro [2016] A. Montanaro, npj Quantum Inf. 2, 15023 (2016).
  * Moll  _et al._ [2018] N. Moll, P. Barkoutsos, L. S. Bishop, J. M. Chow, A. Cross, D. J. Egger, S. Filipp, A. Fuhrer, J. M. Gambetta, M. Ganzhorn, A. Kandala, A. Mezzacapo, P. Müller, W. Riess, G. Salis, J. Smolin, I. Tavernelli, and K. Temme, Quantum Sci. Technol. 3, 030503 (2018).
  * Kielpinski  _et al._ [2002] D. Kielpinski, C. Monroe, and D. Wineland, Nature 417, 709 (2002).
  * Monroe  _et al._ [2014] C. Monroe, R. Raussendorf, A. Ruthven, K. R. Brown, P. Maunz, L.-M. Duan, and J. Kim, Phys. Rev. A 89, 022317 (2014).
  * Siverns and Quraishi [2017] J. D. Siverns and Q. Quraishi, Quantum Inf. Process. 16, 314 (2017).
  * Romaszko  _et al._ [2020] Z. D. Romaszko, S. Hong, M. Siegele, R. K. Puddy, F. R. Lebrun-Gallagher, S. Weidt, and W. K. Hensinger, Nat. Rev. Phys. 2, 285 (2020).
  * Wright  _et al._ [2013] K. Wright, J. M. Amini, D. L. Faircloth, C. Volin, S. C. Doret, H. Hayden, C.-S. Pai, D. W. Landgren, D. Denison, T. Killian, R. E. Slusher, and A. W. Harter, New J. Phys. 15, 033004 (2013).
  * Hong  _et al._ [2016] S. Hong, M. Lee, H. Cheon, T. Kim, and D.-i. D. Cho, Sensors 16, 616 (2016).
  * Lee  _et al._ [2019] M. Lee, M. Lee, S. Hong, K. Schüppert, Y.-D. Kwon, T. Kim, Y. Colombe, T. E. Northup, D.-I. D. Cho, and R. Blatt, Phys. Rev. Applied 12, 044052 (2019).
  * Auchter  _et al._ [2022] S. Auchter, C. Axline, C. Decaroli, M. Valentini, L. Purwin, R. Oswald, R. Matt, E. Aschauer, Y. Colombe, P. Holz, T. Monz, R. Blatt, P. Schindler, C. Rössler, and J. Home, Quantum Sci. Technol. 7, 035015 (2022).
  * Poitzsch  _et al._ [1996] M. E. Poitzsch, J. C. Bergquist, W. M. Itano, and D. J. Wineland, Rev. Sci. Instrum. 67, 129 (1996).
  * Labaziewicz  _et al._ [2008] J. Labaziewicz, Y. Ge, P. Antohi, D. Leibrandt, K. R. Brown, and I. L. Chuang, Phys. Rev. Lett. 100, 013001 (2008).
  * Pagano  _et al._ [2018] G. Pagano, P. W. Hess, H. B. Kaplan, W. L. Tan, P. Richerme, P. Becker, A. Kyprianidis, J. Zhang, E. Birckelbaw, M. R. Hernandez, Y. Wu, and C. Monroe, Quantum Sci. Technol. 4, 014004 (2018).
  * Mehta  _et al._ [2014] K. K. Mehta, A. M. Eltony, C. D. Bruzewicz, I. L. Chuang, R. J. Ram, J. M. Sage, and J. Chiaverini, Appl. Phys. Lett. 105, 044103 (2014).
  * Stuart  _et al._ [2019] J. Stuart, R. Panock, C. Bruzewicz, J. Sedlacek, R. McConnell, I. Chuang, J. Sage, and J. Chiaverini, Phys. Rev. Applied 11, 024010 (2019).
  * Blain  _et al._ [2021] M. G. Blain, R. Haltli, P. Maunz, C. D. Nordquist, M. Revelle, and D. Stick, Quantum Sci. Technol. 6, 034011 (2021).
  * Niedermayr  _et al._ [2014] M. Niedermayr, K. Lakhmanskiy, M. Kumph, S. Partel, J. Edlinger, M. Brownnutt, and R. Blatt, New J. Phys. 16, 113068 (2014).
  * Britton  _et al._ [2009] J. Britton, D. Leibfried, J. A. Beall, R. B. Blakestad, J. H. Wesenberg, and D. J. Wineland, Appl. Phys. Lett. 95, 173102 (2009).
  * Wilpers  _et al._ [2012] G. Wilpers, P. See, P. Gill, and A. G. Sinclair, Nat. Nanotechnol. 7, 572 (2012).
  * Sterling  _et al._ [2014] R. C. Sterling, H. Rattanasonti, S. Weidt, K. Lake, P. Srinivasan, S. C. Webster, M. Kraft, and W. K. Hensinger, Nat. Commun. 5, 3637 (2014).
  * Stick  _et al._ [2006] D. Stick, W. K. Hensinger, S. Olmschenk, M. J. Madsen, K. Schwab, and C. Monroe, Nat. Phys. 2, 36 (2006).
  * Maunz [2016] P. Maunz,  _Sandia National Laboratories Report No. SAND-2016-0796R 618951_ , Tech. Rep. (Sandia National Laboratories, 2016).
  * Hensinger  _et al._ [2006] W. K. Hensinger, S. Olmschenk, D. Stick, D. Hucul, M. Yeo, M. Acton, L. Deslauriers, C. Monroe, and J. Rabchuk, Appl. Phys. Lett. 88, 034101 (2006).
  * Blakestad  _et al._ [2009] R. B. Blakestad, C. Ospelkaus, A. P. VanDevender, J. M. Amini, J. Britton, D. Leibfried, and D. J. Wineland, Phys. Rev. Lett. 102, 153002 (2009).
  * Kienzler  _et al._ [2015] D. Kienzler, H.-Y. Lo, B. Keitch, L. de Clercq, F. Leupold, F. Lindenfelser, M. Marinelli, V. Negnevitsky, and J. P. Home, Science 347, 53 (2015).
  * Kaufmann  _et al._ [2017] H. Kaufmann, T. Ruster, C. T. Schmiegelow, M. A. Luda, V. Kaushal, J. Schulz, D. von Lindenfels, F. Schmidt-Kaler, and U. G. Poschinger, Phys. Rev. Lett. 119, 150503 (2017).
  * Lu  _et al._ [2019] Y. Lu, S. Zhang, K. Zhang, W. Chen, Y. Shen, J. Zhang, J.-N. Zhang, and K. Kim, Nature 572, 363 (2019).
  * Seidelin  _et al._ [2006] S. Seidelin, J. Chiaverini, R. Reichle, J. J. Bollinger, D. Leibfried, J. Britton, J. H. Wesenberg, R. B. Blakestad, R. J. Epstein, D. B. Hume, W. M. Itano, J. D. Jost, C. Langer, R. Ozeri, N. Shiga, and D. J. Wineland, Phys. Rev. Lett. 96, 253003 (2006).
  * Brewer  _et al._ [2019] S. M. Brewer, J.-S. Chen, A. M. Hankin, E. R. Clements, C. W. Chou, D. J. Wineland, D. B. Hume, and D. R. Leibrandt, Phys. Rev. Lett. 123, 033201 (2019).
  * Teller  _et al._ [2021] M. Teller, D. A. Fioretto, P. C. Holz, P. Schindler, V. Messerer, K. Schüppert, Y. Zou, R. Blatt, J. Chiaverini, J. Sage, and T. E. Northup, Phys. Rev. Lett. 126, 230505 (2021).
  * de Clercq  _et al._ [2016] L. E. de Clercq, H.-Y. Lo, M. Marinelli, D. Nadlinger, R. Oswald, V. Negnevitsky, D. Kienzler, B. Keitch, and J. P. Home, Phys. Rev. Lett. 116, 080502 (2016).
  * Ragg  _et al._ [2019] S. Ragg, C. Decaroli, T. Lutz, and J. P. Home, Rev. Sci. Instrum. 90, 103203 (2019).
  * Blakestad [2010] R. B. Blakestad,  _Transport of Trapped-Ion Qubits within a Scalable Quantum Processor_ , Ph.D. thesis, University of Colorado (2010).
  * Kaufmann [2017] H. Kaufmann,  _A Scalable Quantum Processor_ , Ph.D. thesis, University of Mainz (2017).
  * Hou  _et al._ [2021] Y. Hou, X. Zhang, W. Wu, T. Zhang, P. Chen, and Z. Deng, Coatings 11, 406 (2021).
  * Hucul [2015] D. A. Hucul,  _A Modular Quantum System of Trapped Atomic Ions_ , Ph.D. thesis, University of Maryland (2015).
  * An [2017] S. An,  _Quantum Control in the trapped ion system_ , Ph.D. thesis, Tsinghua University (2017).
  * He  _et al._ [2021] R. He, J.-M. Cui, R.-R. Li, Z.-H. Qian, Y. Chen, M.-Z. Ai, Y.-F. Huang, C.-F. Li, and G.-C. Guo, Rev. Sci. Instrum. 92, 073201 (2021).
  * Hong  _et al._ [2022] J. Hong, M. Kim, H. Lee, and M. Lee, arXiv:2022.07465 (2022).
  * Vila  _et al._ [1998] R. Vila, M. González, J. Mollá, and A. Ibarra, J. Nucl. Mater. 253, 141 (1998).
  * French [1990] R. H. French, J. Am. Ceram. Soc. 73, 477 (1990).
  * Filatova and Konashuk [2015] E. O. Filatova and A. S. Konashuk, J. Phys. Chem. C 119, 20755 (2015).
  * Lakhmanskiy [2019] K. Lakhmanskiy,  _On heating rates in cryogenic surface ion traps_ , Ph.D. thesis, University of Innsbruck (2019).
  * Samant and Dahotre [2008] A. N. Samant and N. B. Dahotre, Int. J. Mach. Tools Manuf 48, 1345 (2008).
  * Yan  _et al._ [2011] Y. Yan, L. Li, K. Sezer, D. Whitehead, L. Ji, Y. Bao, and Y. Jiang, Int. J. Mach. Tools Manuf. 51, 859 (2011).
  * Preusch  _et al._ [2014] F. Preusch, B. Adelmann, and R. Hellmann, Micromachines 5, 1051 (2014).
  * K. and Misra [1987] W. K. and C. Misra,  _Oxides and Hydroxides of Aluminum_ , Tech. Rep. (ALCOA Technical Paper No. 19, Rev. ALCOA Labs, 1987).
  * Liu  _et al._ [2005] S. Liu, L. Zhang, L. An, W. Fei, and H. Heinrich, J. Am. Ceram. Soc. 88, 2559 (2005).
  * Barma and Mandal [2014] S. Barma and B. Mandal, Ceram. Int. 40, 11299 (2014).
  * Kumph  _et al._ [2016] M. Kumph, C. Henkel, P. Rabl, M. Brownnutt, and R. Blatt, New J. Phys. 18, 023020 (2016).
  * Auerkari [1996] P. Auerkari,  _Mechanical and physical properties of engineering alumina ceramics_ , Tech. Rep. (Technical Research Centre of Finland, 1996).
  * Doležal  _et al._ [2015] M. Doležal, P. Balling, P. B. R. Nisbet-Jones, S. A. King, J. M. Jones, H. A. Klein, P. Gill, T. Lindvall, A. E. Wallin, M. Merimaa, C. Tamm, C. Sanner, N. Huntemann, N. Scharnhorst, I. D. Leroux, P. O. Schmidt, T. Burgermeister, T. E. Mehlstäubler, and E. Peik, Metrologia 52, 842 (2015).
  * Ahmad  _et al._ [2010] S. Ahmad, A. Ibrahim, R. Alias, S. M. Shapee, Z. Ambak, S. Z. Zakaria, M. R. Yahya, and A. F. A. Mat, AIP Conf. Proc. 1217, 442 (2010).
  * Goldstein  _et al._ [2017] J. Goldstein, D. Newbury, J. Michael, N. Ritchie, J. Scott, and D. Joy,  _Scanning Electron Microscopy and X-Ray Microanalysis_ (Springer New York, 2017).
  * Nuvolone [1977] R. Nuvolone, J. Vac. Sci. Technol. 14, 1210 (1977).
  * Ishikawa  _et al._ [1996] Y. Ishikawa, T. Yoshimura, and M. Arai, Vacuum 47, 701 (1996).
  * Cho  _et al._ [2000] B. Cho, S. Chung, K. Kim, T. Kang, C. Park, and B. Kim, J. Vac. Sci. Technol. B: Microelectron. Nanometer Struct. Process. Meas. Phenom. 18, 868 (2000).
  * Kim  _et al._ [2021] J. Kim, K. Kim, D. Lee, Y. Shin, S. Kang, J.-R. Kim, Y. Choi, K. An, and M. Lee, Sensors 21, 6255 (2021).
  * Slocombe  _et al._ [2000] A. Slocombe, J. Clarke, and L. Li, Appl. Surf. Sci. 168, 21 (2000).