An Effective Adversarial Attack on Person Re-Identification in Video Surveillance via Dispersion Reduction

Abstract

Person re-identification across a network of cameras, with disjoint views, has been studied extensively due to its importance in wide-area video surveillance. This is a challenging task due to several reasons including changes in illumination and target appearance, and variations in camera viewpoint and camera intrinsic parameters. The approaches developed to re-identify a person across different camera views need to address these challenges. More recently, neural network-based methods have been proposed to solve the person re-identification problem across different camera views, achieving state-of-the-art performance. In this paper, we present an effective and generalizable attack model that generates adversarial images of people, and results in very significant drop in the performance of the existing state-of-the-art person reidentification models. The results demonstrate the extreme vulnerability of the existing models to adversarial examples, and draw attention to the potential security risks that might arise due to this in video surveillance. Our proposed attack is developed by decreasing the dispersion of the internal feature map of a neural network to degrade the performance of several different state-of-the-art person re-identification models. We also compare our proposed attack with other state-of-the-art attack models on different person reidentification approaches, and by using four different commonly used benchmark datasets. The experimental results show that our proposed attack outperforms the state-of-art attack models on the best performing person re-identification approaches by a large margin, and results in the most drop in the mean average precision values.

InvisibiliTee: Angle-agnostic Cloaking from Person-Tracking Systems with a Tee

“…But attackers can still observe the output through any input. Several attempts have been made on attacking Re-ID systems via black-box methods [24,30]. Although existing works demonstrate the feasibility of performing black-box attacks on classification and Re-ID vision systems, the research on person detection system has not yet been sufficiently investigated.…”

AEGuard: Image Feature-Based Independent Adversarial Example Detection Model

“…However, the adversarial noise reduction mechanism has lower detection accuracy than others and has a problem of decrease in classifcation accuracy because the image flter can destroy the original object's characteristics. Zheng et al [18] also proposed an adversarial attack block mechanism that neutralizes adversarial noise with input image modifcation. Yuan et al used a randomized transform function for adversarial noise neutralization.…”

Part-Based Feature Squeezing To Detect Adversarial Examples in Person Re-Identification Networks

“…Wang et al [20] proposed a learningto-misrank formulation to perturb the ranking of the system output, which drops one of the best ReID performances from 91.8% to 1.4% after being attacked. Zheng et al [21] extended the use of Dispersion Reduction (DR) to person ReID, and effectively attacked three different ReID networks using four different datasets. AEs from the ground truth and classify them into a new category.…”