Beyond Universal Person Re-ID Attack

Abstract

Deep learning-based person re-identification (Re-ID) has made great progress and achieved high performance recently. In this paper, we make the first attempt to examine the vulnerability of current person Re-ID models against a dangerous attack method, \ie, the universal adversarial perturbation (UAP) attack, which has been shown to fool classification models with a little overhead. We propose a \emph{more universal} adversarial perturbation (MUAP) method for both image-agnostic and model-insensitive person Re-ID attack. Firstly, we adopt a list-wise attack objective function to disrupt the similarity ranking list directly. Secondly, we propose a model-insensitive mechanism for cross-model attack. Extensive experiments show that the proposed attack approach achieves high attack performance and outperforms other state of the arts by large margin in cross-model scenario. The results also demonstrate the vulnerability of current Re-ID models to MUAP and further suggest the need of designing more robust Re-ID models.

References in corpus (8)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Delving into Transferable Adversarial Examples and Black-box Attacks
• The Space of Transferable Adversarial Examples
• Revisiting Temporal Modeling for Video-based Person ReID
• Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks
• Parameter-Free Spatial Attention Network for Person Re-Identification
• Characterizing and evaluating adversarial examples for Offline Handwritten Signature Verification
• Unsupervised Adversarial Attacks on Deep Feature-based Retrieval with GAN