This assumption is, however, untestable and oftentimes unrealistic for practical considerations.

As shown in Figure 1.a of the main paper, and discussed in Section 3.1 ("Comparison to SmoothAP"), 's score because the correct ordering is not reached (the negative instance This is illustrated on the toy dataset in Figure 1. We remind the reader of the definition of the decomposability gap given in Eq. (6) of the main paper. Proof of Eq. (8): Upper bound on the DG We choose a setting for the proof of the upper bound similar to the one used for training, i.e. all the batch have the same size, and the Eq. B.1 Metrics We detail here the performance metrics that we use to evaluate our models. The Recall@K metrics is often used in the literature.

In image retrieval, standard evaluation metrics rely on score ranking, e.g.

Traditional analysis mostly relies on heuristic features and visual inspections.

To this end, we first provide analytical studies of the properties of adversarial loss functions under different adversarial budgets. We then demonstrate that the adversarial loss landscape is less favorable to optimization, due to increased curvature and more scattered gradients.