Anchored Rank-Adversarial Fine-Tuning Pretrained Visual Place Recognition Models

Mostafa Kira; Bader Rasheed; Manuel Mazzara

cs.CVNov 3, 2026

Anchored Rank-Adversarial Fine-Tuning Pretrained Visual Place Recognition Models

Authors: Mostafa Kira, Bader Rasheed, Manuel Mazzara

Organizations: Faculty of Computer Science and Engineering, Innopolis University, Innopolis, Russia.

Abstract

Visual place recognition (VPR) localises a camera by retrieving similar geo-tagged images, and current foundation-model VPR models are accurate across cities, seasons and illumination, but not robust to adversarial perturbations: under a white-box attack on the ranking at an imperceptible budget of 1/255, SuperVLAD and BoQ keep at most 0.2% top-1 recall (R@1) on four benchmarks. We propose anchored rank-adversarial fine-tuning (ARAFT), which fine-tunes a released model with a listwise rank loss on each adversarial query's hardest positive and an anchor to the clean descriptor of the frozen pretrained model. Checkpoints are selected under a clean-accuracy budget fixed in advance, and the full trade-off is reported. Within five validation R@1 points of clean cost, plain adversarial training has no admissible checkpoint, whereas ARAFT raises robust R@1 from zero to 47.3 on SuperVLAD and 55.3 on BoQ; plain adversarial training exceeds this only at about three times the clean cost. Against unbudgeted plain adversarial training on the test sets, ARAFT matches its robust R@1 at 2/255 with about ten more clean R@1 points. At 4/255, plain adversarial training is 6-9 robust R@1 points ahead, while ARAFT still keeps its ten-point clean advantage. Developed on SuperVLAD, ARAFT transfers to BoQ without re-tuning, and its robustness holds against stronger optimisers, with no sign of gradient masking.

Figures & tables

Setting	Value
Training data	GSV-Cities, $20$ places $\times$ $4$ images
Batches/epoch, max. epochs	$200$ / $100$
Optimiser	Adam, lr $10^{-5}$ , no weight decay
Trainable layers	all
Input size (train / test)	SuperVLAD $322$ / $322$ ; BoQ $224$ / $322$
Training attack	rank-PGD $\ell_{\infty}$ , $\varepsilon=4/255$ , $T=5$

Table 1: Training settings, shared by ARAFT and plain adversarial training and by both architectures except where noted.

Dataset	Database	Queries	Attacked
MSLS-val (val.)	18 871	11 084	2 000
MSLS	36 558	25 622	1 000
Pitts30k	10 000	6 816	1 000
SPED	607	607	607
Nordland	27 592	27 592	1 000

Table 2: Evaluation datasets. Attacked queries are evenly spaced over all queries with at least one positive. This holds for the test sets; the 2000 MSLS-val queries are a fixed random sample of such queries, on which validation measures both clean and attacked R@1.

Attack	Steps $\times$ restarts	Budget	Purpose	Models
Rank-APGD $\ell_{\infty}$	$100\times 1$	$2/255$ ( $0.03425$ ), $4/255$ ( $0.0685$ )	headline	both
Rank-PGD $\ell_{\infty}$	$20\times 1$	$1,2,4,8/255$ (to $0.137$ )	budget sweep	both
Rank-APGD $\ell_{\infty}$	$500\times 1$ ; $100\times 3$	$4/255$ , MSLS	convergence	SuperVLAD
Rank-PGD $\ell_{\infty}$	$20\times 1$	$\approx 32/255$ ( $0.548$ )	large budget	SuperVLAD

Table 3: Evaluation attacks. All attacks are white-box and use the full model; budgets are the largest per-channel pixel budget, with the normalised value

\varepsilon_{n}

in parentheses.

Figure 1: Clean–robust trade-off on MSLS-val. Each dot is one validated epoch; the robust score is the mean R@1 under rank-PGD at

2/255

and

4/255

. Lines give the highest robust score reached within each clean drop. Squares and stars mark the budget-5 and most robust checkpoints; the dashed line is the 5-point budget, grey lines the other budgets.

SuperVLAD
	MSLS			Pitts30k			SPED			Nordland			Mean
Method	Clean	2	4	Clean	2	4	Clean	2	4	Clean	2	4	Clean	2	4
Plain AT	68.9	0.0	0.0	92.3	0.0	0.0	90.0	0.0	0.0	85.7	0.0	0.0	84.2	0.0	0.0
ARAFT (Ours)	59.4	38.0	14.8	90.7	76.4	50.1	68.9	45.1	22.4	68.7	24.7	3.7	71.9	46.1	22.8
BoQ
Plain AT	74.5	0.0	0.0	93.7	0.0	0.0	92.6	0.0	0.0	90.7	0.0	0.0	87.9	0.0	0.0

Table 4: Test results under the 5-point clean budget, each method at its budget-5 checkpoint. Plain AT has no checkpoint within the budget, so its budget-5 model is the unchanged pretrained model. Clean R@1 on all queries; R@1 under rank-APGD-100 at

2/255

and

4/255

on the attacked queries. Best value per model block in bold.

SuperVLAD
	MSLS			Pitts30k			SPED			Nordland			Mean
Method	Clean	2	4	Clean	2	4	Clean	2	4	Clean	2	4	Clean	2	4
Plain AT	46.2	34.9	24.9	86.8	77.0	60.8	63.1	45.8	29.3	50.8	28.0	12.8	61.7	46.4	32.0
ARAFT (Ours)	59.4	38.0	14.8	90.7	76.4	50.1	68.9	45.1	22.4	68.7	24.7	3.7	71.9	46.1	22.8
BoQ
Plain AT	52.7	41.1	26.7	88.0	78.7	64.0	63.3	45.1	27.8	49.8	23.7	7.8	63.4	47.2	31.6

Table 5: Test results without the clean budget, each method at its most robust checkpoint. Metrics as in Table 4 . Best value per model block in bold.

Variant	Positive	Rank loss	$\lambda_{\mathrm{anc}}$	MSLS	Nordland
				Test, rank-APGD $4/255$
ARAFT	hardest	listwise	1	14.8 (59.4)	3.7 (68.7)
Closest positive	closest	listwise	1	10.3 (60.4)	2.4 (70.4)
Closest positive, hinge	closest	hinge	1	10.9 (59.7)	2.6 (71.4)
No anchor	closest	listwise	0	19.8 (50.0)	8.0 (58.0)
Stronger anchor	hardest	listwise	2	11.8 (60.4)	3.4 (71.0)

Table 6: Ablations on SuperVLAD. R@1 under rank-APGD-100 at

4/255

on the test sets (clean R@1 in parentheses) of the most robust checkpoint. Validation results are in Fig. 2 .

Figure 2: Ablations on MSLS-val. Each marker is the budget-5 checkpoint of one run, or for the run without an anchor, which has none, its most robust checkpoint. Colour gives the protected positive and the marker the other change: circles are the listwise loss with

\lambda_{\mathrm{anc}}=1

(two seeds each), the square the hinge loss, the triangle

\lambda_{\mathrm{anc}}=2

and the diamond

\lambda_{\mathrm{anc}}=0

. The robust score is the mean R@1 under rank-PGD at

2/255

and

4/255

Figure 3: Clean R@1 drop relative to the pretrained model on MSLS-val, where the budget is set, and on the four test sets (all queries). On SuperVLAD the grey part is the drop of the clean twin, clipped at zero on Pitts30k, where the twin is 0.03 points above the pretrained model, and the blue part the additional drop of ARAFT; BoQ has no twin. ARAFT at its budget-5 checkpoint, plain AT (ticks) at its most robust checkpoint.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Stage	Setting	Drop	Robust
Attack set	$\ell_{\infty}$ +perc., 8 frozen	$-0.70$	0.00
	$\ell_{\infty}$ , 8 frozen	0.50	0.00
Depth, lr	8 frozen, $3\cdot 10^{-6}$	3.00	0.03
	4 frozen, $10^{-5}$	1.05	0.15
	4 frozen, $3\cdot 10^{-6}$	0.60	0.05
	0 frozen, $10^{-5}$	4.25	35.38

Appendix

Table 7: Short screens (12 epochs, closest positive). Clean drop and robust score of the budget-5 checkpoint on MSLS-val; the winner of each stage in bold.

SuperVLAD
	MSLS	Pitts30k	SPED	Nordland
Pretrained	68.85	92.30	89.95	85.68
Clean twin	66.05	92.33	88.14	79.20
ARAFT (seed 0)	59.41	90.74	68.86	68.69
drop vs. pretrained	9.44	1.56	21.09	16.99
drop vs. twin	6.63	1.58	19.28	10.51

Appendix

Table 8: Test clean R@1 on all queries, and drops relative to the pretrained model and to the clean twin (SuperVLAD only).

Visual Place Recognition

Visual Place Recognition matches camera observations to mapped places despite changes in viewpoint, lighting, weather, or time.

See all 88 papers

QdaVPR: A novel query-based domain-agnostic model for visual place recognition
Mar 8, 2026Shanshan Wan, Lai Kang, Yingmei Wei +3Visual Place Recognition Domain Generalization
College of Systems Engineering and the Laboratory for Big Data and Decision, National University of Defense Technology, Changsha, Hunan 410073, China
AdaptVPR: Route-Aware Hard Positive Generation for Robust Visual Place Recognition
Sep 3, 2026Shunpeng Chen, Jingyi Zhang, Changwei Wang +6Visual Place Recognition Synthetic Data Augmentation
School of Artificial Intelligence, Beijing University of Posts and Telecommunications · Key Laboratory of Computing Power Network and Information Security, Ministry of Education, Shandong Computer Science Center, Qilu University of Technology
Region Matters: Efficient and Reliable Region-Aware Visual Place Recognition
Apr 24, 2026Shunpeng Chen, Yukun Song, Changwei Wang +6Visual Representation Learning Geospatial Representation Learning
School of Artificial Intelligence, Beijing University of Posts and Telecommunications, Beijing 100876, China. · Key Laboratory of Computing Power Network and Information Security, Ministry of Education, Shandong Computer Science Center, Qilu University of Technology. · Spatialtemporal AI. +1

Mar 8, 2026J/K move · Enter open · S save

QdaVPR: A novel query-based domain-agnostic model for visual place recognition

Shanshan Wan, Lai Kang, Yingmei Wei, Tianrui Shen+2

College of Systems Engineering and the Laboratory for Big Data and Decision, National University of Defense Technology, Changsha, Hunan 410073, China

Visual Place Recognition Domain Generalization

Open paper AskPDF arXiv

Visual place recognition (VPR) aiming at predicting the location of an image based solely on its visual features is a fundamental task in robotics and autonomous systems. Domain variation remains one of the main challenges in VPR and is relatively unexplored. Existing VPR models attempt to achieve domain agnosticism either by training on large-scale datasets that inherently contain some domain variations, or by being specifically adapted to particular target domains. In practice, the former lacks explicit domain supervision, while the latter generalizes poorly to unseen domain shifts. This paper proposes a novel query-based domain-agnostic VPR model called QdaVPR. First, a dual-level adversarial learning framework is designed to encourage domain invariance for both the query features forming the global descriptor and the image features from which these query features are derived. Then, a triplet supervision based on query combinations is designed to enhance the discriminative power of the global descriptors. To support the learning process, we augment a large-scale VPR dataset using style transfer methods, generating various synthetic domains with corresponding domain labels as auxiliary supervision. Extensive experiments show that QdaVPR achieves state-of-the-art performance on multiple VPR benchmarks with significant domain variations. Specifically, it attains the best Recall@1 and Recall@10 on nearly all test scenarios: 93.5%/98.6% on Nordland (seasonal changes), 97.5%/99.0% on Tokyo24/7 (day-night transitions), and the highest Recall@1 across almost all weather conditions on the SVOX dataset. Our code will be released at https://github.com/shuimushan/QdaVPR.

Abstract

Visual Place Recognition

Explore similar work

QdaVPR: A novel query-based domain-agnostic model for visual place recognition

AdaptVPR: Route-Aware Hard Positive Generation for Robust Visual Place Recognition

Region Matters: Efficient and Reliable Region-Aware Visual Place Recognition