Combining Two Adversarial Attacks Against Person Re-Identification Systems

TL;DR

This paper investigates the combined effect of two adversarial attacks on person re-identification systems, demonstrating significant performance degradation across multiple datasets and models, and explores dropout as a defense.

Contribution

It introduces a novel approach of combining P-FGSM and Deep Mis-Ranking attacks on Re-ID models, highlighting increased attack effectiveness and evaluating a dropout-based defense strategy.

Findings

Combined attacks significantly reduce Re-ID accuracy.

Best attack reduces Rank-10 metric by 3.36%.

Dropout during inference offers some defense.

Abstract

The field of Person Re-Identification (Re-ID) has received much attention recently, driven by the progress of deep neural networks, especially for image classification. The problem of Re-ID consists in identifying individuals through images captured by surveillance cameras in different scenarios. Governments and companies are investing a lot of time and money in Re-ID systems for use in public safety and identifying missing persons. However, several challenges remain for successfully implementing Re-ID, such as occlusions and light reflections in people's images. In this work, we focus on adversarial attacks on Re-ID systems, which can be a critical threat to the performance of these systems. In particular, we explore the combination of adversarial attacks against Re-ID models, trying to strengthen the decrease in the classification results. We conduct our experiments on three datasets: DukeMTMC-ReID, Market-1501, and CUHK03. We combine the use of two types of adversarial attacks, P-FGSM and Deep Mis-Ranking, applied to two popular Re-ID models: IDE (ResNet-50) and AlignedReID. The best result demonstrates a decrease of 3.36% in the Rank-10 metric for AlignedReID applied to CUHK03. We also try to use Dropout during the inference as a defense method.