[Paper Review] Transferable, Controllable, and Inconspicuous Adversarial Attacks on Person Re-identification With Deep Mis-Ranking

Hongjun Wang, Guangrun Wang+3 more|arXiv (Cornell University)|Apr 8, 2020

Adversarial Robustness in Machine Learning41 references4 citations

TL;DR

This paper proposes a transferable, controllable, and inconspicuous adversarial attack framework for person re-identification (ReID) systems using a deep mis-ranking formulation. By leveraging a multi-stage feature pyramid network for transferable representation learning and differentiable multi-shot sampling for pixel control, the method achieves a 91.8% to 1.4% drop in ReID accuracy on Market1501, demonstrating severe vulnerability in state-of-the-art models.

ABSTRACT

The success of DNNs has driven the extensive applications of person re-identification (ReID) into a new era. However, whether ReID inherits the vulnerability of DNNs remains unexplored. To examine the robustness of ReID systems is rather important because the insecurity of ReID systems may cause severe losses, e.g., the criminals may use the adversarial perturbations to cheat the CCTV systems. In this work, we examine the insecurity of current best-performing ReID models by proposing a learning-to-mis-rank formulation to perturb the ranking of the system output. As the cross-dataset transferability is crucial in the ReID domain, we also perform a back-box attack by developing a novel multi-stage network architecture that pyramids the features of different levels to extract general and transferable features for the adversarial perturbations. Our method can control the number of malicious pixels by using differentiable multi-shot sampling. To guarantee the inconspicuousness of the attack, we also propose a new perception loss to achieve better visual quality. Extensive experiments on four of the largest ReID benchmarks (i.e., Market1501 [45], CUHK03 [18], DukeMTMC [33], and MSMT17 [40]) not only show the effectiveness of our method, but also provides directions of the future improvement in the robustness of ReID systems. For example, the accuracy of one of the best-performing ReID systems drops sharply from 91.8% to 1.4% after being attacked by our method. Some attack results are shown in Fig. 1. The code is available at https://github.com/whj363636/Adversarial-attack-on-Person-ReID-With-Deep-Mis-Ranking.

Motivation & Objective

• To investigate the vulnerability of state-of-the-art ReID models to adversarial attacks, especially in real-world surveillance contexts.
• To address the lack of effective adversarial attack methods tailored for ranking-based ReID systems, unlike existing methods designed for classification.
• To develop a black-box attack with strong cross-dataset transferability, enabling attacks on unseen datasets without model access.
• To ensure visual inconspicuousness by controlling the number of perturbed pixels and improving perceptual quality via a novel loss function.
• To provide actionable insights for improving ReID robustness through adversarial training and attention to vulnerable body regions.

Proposed method

• Proposes a learning-to-mis-rank formulation that directly targets the ranking output of ReID models, using a mis-ranking loss to degrade the model’s ability to rank correct matches higher.
• Introduces a multi-stage network architecture that pyramid-fuses features across multiple levels to extract general, transferable representations for adversarial perturbations.
• Employs differentiable multi-shot sampling to control the number of attacked pixels, enabling fine-grained control over the attack’s visibility and impact.
• Designs a perception-based loss function to preserve visual quality and ensure the adversarial perturbations remain inconspicuous to human observers.
• Trains the attacker end-to-end using a combined loss combining mis-ranking loss, perceptual loss, and adversarial consistency, with hyperparameters tuned for visual fidelity.

Experimental results

Research questions

• RQ1 Can adversarial attacks effectively degrade the performance of state-of-the-art ReID models by manipulating the ranking of gallery images rather than misclassifying them?
• RQ2 How can adversarial attacks be made transferable across different ReID datasets, especially in a black-box setting with no access to the target model?
• RQ3 To what extent can the number of perturbed pixels be controlled while maintaining high attack success and low visual distortion?
• RQ4 Can the proposed attack remain visually inconspicuous while still causing catastrophic failure in ReID systems?
• RQ5 Does the attack generalize to real-world AI services, such as commercial ReID or attribute recognition APIs?

Key findings

• The proposed attack reduces the ReID accuracy of a state-of-the-art model (AlignedReID) on Market1501 from 91.8% to 1.4%, demonstrating extreme vulnerability.
• The attack achieves strong cross-dataset transferability, successfully degrading performance on four major benchmarks: Market1501, CUHK03, DukeMTMC, and MSMT17.
• The differentiable multi-shot sampling mechanism enables precise control over the number of perturbed pixels, with visual quality preserved even at low attack intensity.
• The perception loss significantly improves the visual quality of adversarial examples, making them less detectable to human observers.
• The attack successfully fooled a real-world commercial API (Baidu’s Human Detection and Attributes API), misclassifying persons with backpacks as not carrying them.
• The method generalizes beyond ReID, showing effectiveness in attacking image classification models on CIFAR10, outperforming several SOTA white-box attacks.