Research map / Adversarial robustness and security / Attacks on text and graphs
Feature-Level Adversarial Attacks and Ranking Disruption for Visible-Infrared Person Re-identification
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes feature-level adversarial attacks on visible-infrared person re-identification systems combining universal perturbations, a frequency-spatial attention module, and an auxiliary quadruple adversarial loss to disrupt output rankings.
Problem
Security of visible-infrared person re-identification (VIReID) systems is under-studied; attackers need to disrupt cross-modality ranking outputs and align adversarial features across visible and infrared modalities.
Approach
Adds universal adversarial perturbations to visible and infrared inputs, uses a frequency-spatial attention module (FFT amplitude/phase with spatial attention) to align adversarial features, and an auxiliary quadruple loss that pushes same-identity cross-modality features apart to disrupt cross-modal rankings.
Key results
- On RegDB, the attack reduces AGW mAP from 66.37% to 0.85% (visible-to-thermal) and 65.90% to 0.89% (thermal-to-visible).
- On SYSU-MM01 all-search, the attack reduces AGW Rank-1 from 47.50% to 0.79%.
- Across four VIReID systems (HCLoss, CAJ, MMN, DEEN), Rank-1 drops to roughly 0.5-3% after attack, e.g., DEEN Rank-1 from 74.70% to 1.71% on SYSU all-search.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use the full feature-level attack with UAP, FSAM, SAM, and LAQAL instead of no attack | AGW · SYSU-MM01 all-search | mAP: 47.65 -> 2.81 | Helped |
| Use the full feature-level attack with UAP, FSAM, SAM, and LAQAL instead of no attack | AGW · RegDB visible-to-thermal | mAP: 66.37 -> 0.85 | Helped |
| Use the full feature-level attack with UAP, FSAM, SAM, and LAQAL instead of no attack | AGW · RegDB thermal-to-visible | mAP: 65.90 -> 0.89 | Helped |
| Add FSAM to the noise-only attack (ablation) | AGW attack · SYSU-MM01 | mAP: 18.28 -> 12.17 | Helped |
| Add SAM to the noise-only attack (ablation) | AGW attack · SYSU-MM01 | mAP: 18.28 -> 13.19 | Helped |
| Add LAQAL to the noise-only attack (ablation) | AGW attack · SYSU-MM01 | mAP: 18.28 -> 15.52 | Helped |
| Add both FSAM and SAM to the noise-only attack (ablation) | AGW attack · SYSU-MM01 | mAP: 18.28 -> 6.35 | Helped |
| Add both FSAM and LAQAL to the noise-only attack (ablation) | AGW attack · SYSU-MM01 | mAP: 18.28 -> 3.27 | Helped |
| Add both SAM and LAQAL to the noise-only attack (ablation) | AGW attack · SYSU-MM01 | mAP: 18.28 -> 3.81 | Helped |
| Add FSAM, SAM, and LAQAL to the noise-only attack (ablation) | AGW attack · SYSU-MM01 | mAP: 18.28 -> 2.81 | Helped |
| Insert FSAM after block0 only rather than after block0 and block4 (ablation) | ResNet-50 attack · SYSU-MM01 | mAP: 2.81 -> 3.15 | Hurt |
| Insert FSAM after block1 only rather than after block0 and block4 (ablation) | ResNet-50 attack · SYSU-MM01 | mAP: 2.81 -> 4.29 | Hurt |
Surprising findings
- Inserting FSAM after the first and last ResNet stages (block 0 and block 4) works best, while mid-stage insertion is worse, which the authors attribute to shallow-layer frequency information and deep-layer spatial information.
Limitations
- Evaluation is digital only; physical-world attacks are not tested despite motivation.
- Comparison of baseline attacks relies on AGW as the single attacked model in most experiments.
- Theoretical justification for the security claims is limited, as acknowledged by the framing of insufficient theory.
Experimental setup
Datasets: SYSU-MM01 RegDB
Benchmarks: SYSU-MM01 RegDB
Metrics: Rank-1 Rank-10 mAP mINP
Baselines: FGSM PGD SMA UAP LTA DMR HCLoss CAJ MMN DEEN
Builds on: universal adversarial perturbation AGW FGSM PGD
Closest papers by meaning
- High-Order Structure Based Middle-Feature Learning for Visible-Infrared Person Re-identification (AAAI 2024 · similarity 0.86)
- NightReID: A Large-Scale Nighttime Person Re-Identification Benchmark (AAAI 2025 · similarity 0.85)
- Learning Commonality, Divergence and Variety for Unsupervised Visible-Infrared Person Re-identification (NeurIPS 2024 · similarity 0.85)
- From Laboratory to Real World: A New Benchmark Towards Privacy-Preserved Visible-Infrared Person Re-Identification (CVPR 2025 · similarity 0.85)
- AG-VPReID: A Challenging Large-Scale Benchmark for Aerial-Ground Video-based Person Re-Identification (CVPR 2025 · similarity 0.84)
- Shallow-Deep Collaborative Learning for Unsupervised Visible-Infrared Person Re-Identification (CVPR 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.