Learning to Learn Transferable Generative Attack for Person Re-Identification

TL;DR

This paper introduces MTGA, a meta-learning based generative attack method that significantly improves the transferability of adversarial examples across different person re-identification models, datasets, and test scenarios.

Contribution

The paper proposes a novel meta transfer learning approach with modules like Perturbation Random Erasing and Normalization Mix to enhance cross-domain and cross-test adversarial transferability in person re-id.

Findings

MTGA outperforms state-of-the-art methods by 21.5% in mean mAP drop rate.

It effectively enhances attack transferability across models, datasets, and test conditions.

Extensive experiments validate the robustness and superiority of MTGA in various transfer scenarios.

Abstract

Deep learning-based person re-identification (re-id) models are widely employed in surveillance systems and inevitably inherit the vulnerability of deep networks to adversarial attacks. Existing attacks merely consider cross-dataset and cross-model transferability, ignoring the cross-test capability to perturb models trained in different domains. To powerfully examine the robustness of real-world re-id models, the Meta Transferable Generative Attack (MTGA) method is proposed, which adopts meta-learning optimization to promote the generative attacker producing highly transferable adversarial examples by learning comprehensively simulated transfer-based cross-model\&dataset\&test black-box meta attack tasks. Specifically, cross-model\&dataset black-box attack tasks are first mimicked by selecting different re-id models and datasets for meta-train and meta-test attack processes. As different models may focus on different feature regions, the Perturbation Random Erasing module is further devised to prevent the attacker from learning to only corrupt model-specific features. To boost the attacker learning to possess cross-test transferability, the Normalization Mix strategy is introduced to imitate diverse feature embedding spaces by mixing multi-domain statistics of target models. Extensive experiments show the superiority of MTGA, especially in cross-model\&dataset and cross-model\&dataset\&test attacks, our MTGA outperforms the SOTA methods by 21.5\% and 11.3\% on mean mAP drop rate, respectively. The code of MTGA will be released after the paper is accepted.