Query Attack via Opposite-Direction Feature:Towards Robust Image Retrieval

Abstract

Most existing works of adversarial samples focus on attacking image recognition models, while little attention is paid to the image retrieval task. In this paper, we identify two inherent challenges in applying prevailing image recognition attack methods to image retrieval. First, image retrieval demands discriminative visual features, which is significantly different from the one-hot class prediction in image recognition. Second, due to the disjoint and potentially unrelated classes between the training and test set in image retrieval, predicting the query category from predefined training classes is not accurate and leads to a sub-optimal adversarial gradient. To address these limitations, we propose a new white-box attack approach, Opposite-Direction Feature Attack (ODFA), to generate adversarial queries. Opposite-Direction Feature Attack (ODFA) effectively exploits feature-level adversarial gradients and takes advantage of feature distance in the representation space. To our knowledge, we are among the early attempts to design an attack method specifically for image retrieval. When we deploy an attacked image as the query, the true matches are prone to receive low ranks. We demonstrate through extensive experiments that (1) only crafting adversarial queries is sufficient to fool the state-of-the-art retrieval systems; (2) the proposed attack method, ODFA, leads to a higher attack success rate than classification attack methods, validating the necessity of leveraging characteristics of image retrieval; (3) the adversarial queries generated by our method have good transferability to other retrieval models without accessing their parameters, i.e.,the black-box setting.

arXiv comment12 pages, 9 figures, 3 tables

References in corpus (19)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• In Defense of the Triplet Loss for Person Re-Identification
• Wide Residual Networks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Person Re-identification: Past, Present and Future
• A Discriminatively Learned CNN Embedding for Person Re-identification
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Random Erasing Data Augmentation
• Transductive Multi-view Zero-Shot Learning
• Adversarial Attacks and Defences: A Survey
• AlignedReID: Surpassing Human-Level Performance in Person Re-Identification
• Exploiting Feature and Class Relationships in Video Categorization with Regularized Deep Neural Networks
• Supervised Learning of Semantics-Preserving Hash via Deep Convolutional Neural Networks
• Spatially Transformed Adversarial Examples
• Effective Multi-Query Expansions: Collaborative Deep Networks for Robust Landmark Retrieval
• Simple Black-Box Adversarial Perturbations for Deep Networks
• SVDNet for Pedestrian Retrieval
• The Devil is in the Middle: Exploiting Mid-level Representations for Cross-Domain Instance Matching
• Part-Guided Attention Learning for Vehicle Instance Retrieval

Cited by in corpus (5)

• Recent Advances in Open Set Recognition: A Survey
• Memory Regulation and Alignment toward Generalizer RGB-Infrared Person
• QAIR: Practical Query-efficient Black-Box Attacks for Image Retrieval
• Practical Relative Order Attack in Deep Ranking
• Multi-Expert Adversarial Attack Detection in Person Re-identification Using Context Inconsistency