提出可跨模型、跨数据集、跨测试场景的生成式攻击方法,提升对行人重识别模型的鲁棒性评估能力。
Learning to Learn Transferable Generative Attack for Person Re-Identification
- 采用元学习生成高度可迁移的对抗样本,模拟多场景黑盒攻击任务。
- 在跨模型/数据集攻击中比现有最优方法降低均值mAP达21.5%。
- 适合评估实际部署中行人重识别系统的安全性,尤其关注跨域泛化能力。
基于深度学习的行人重识别(re-id)模型广泛应用于监控系统,但不可避免地继承了深度网络对对抗攻击的脆弱性。现有攻击方法仅关注跨数据集和跨模型的可迁移性,忽略了跨测试场景对不同领域训练模型的扰动能力。为此,本文提出元可迁移生成攻击(MTGA)方法,通过元学习优化,使生成式攻击者在综合模拟的跨模型、跨数据集、跨测试的黑盒攻击任务中,学习生成高可迁移的对抗样本。具体而言,通过选择不同re-id模型与数据集来模拟元训练与元测试阶段的攻击任务;由于不同模型关注特征区域不同,引入扰动随机擦除模块,防止攻击者仅针对特定模型特征进行破坏;为增强攻击者在跨测试场景中的迁移能力,提出归一化混合策略,通过融合多领域目标模型的统计特征,模拟多样化的特征嵌入空间。大量实验表明,MTGA在跨模型/数据集攻击中相比现有最优方法,平均mAP下降率提升21.5%,在跨模型/数据集/测试攻击中提升11.3%。代码将在论文录用后公开。
原文摘要 · Abstract (English)
Deep learning-based person re-identification (re-id) models are widely employed in surveillance systems and inevitably inherit the vulnerability of deep networks to adversarial attacks. Existing attacks merely consider cross-dataset and cross-model transferability, ignoring the cross-test capability to perturb models trained in different domains. To powerfully examine the robustness of real-world re-id models, the Meta Transferable Generative Attack (MTGA) method is proposed, which adopts meta-learning optimization to promote the generative attacker producing highly transferable adversarial examples by learning comprehensively simulated transfer-based cross-model\&dataset\&test black-box meta attack tasks. Specifically, cross-model\&dataset black-box attack tasks are first mimicked by selecting different re-id models and datasets for meta-train and meta-test attack processes. As different models may focus on different feature regions, the Perturbation Random Erasing module is further devised to prevent the attacker from learning to only corrupt model-specific features. To boost the attacker learning to possess cross-test transferability, the Normalization Mix strategy is introduced to imitate diverse feature embedding spaces by mixing multi-domain statistics of target models. Extensive experiments show the superiority of MTGA, especially in cross-model\&dataset and cross-model\&dataset\&test attacks, our MTGA outperforms the SOTA methods by 21.5\% and 11.3\% on mean mAP drop rate, respectively. The code of MTGA will be released after the paper is accepted.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。