Generative Adversarial Perturbations with Cross-paradigm Transferability on Localized Crowd Counting

TL;DR

This paper presents a novel adversarial attack framework that effectively compromises both density map and point regression crowd counting models, demonstrating high transferability and imperceptibility across multiple state-of-the-art models.

Contribution

It introduces a cross-paradigm adversarial attack method that jointly targets density map and point regression models using multi-task loss optimization.

Findings

Achieves a 7X increase in MAE on average against clean images.

Successfully transfers across seven crowd counting models with transfer ratios 0.55 to 1.69.

Balances attack effectiveness with imperceptibility better than existing methods.

Abstract

State-of-the-art crowd counting and localization are primarily modeled using two paradigms: density maps and point regression. Given the field's security ramifications, there is active interest in model robustness against adversarial attacks. Recent studies have demonstrated transferability across density-map-based approaches via adversarial patches, but cross-paradigm attacks (i.e., across both density map-based models and point regression-based models) remain unexplored. We introduce a novel adversarial framework that compromises both density map and point regression architectural paradigms through a comprehensive multi-task loss optimization. For point-regression models, we employ scene-density-specific high-confidence logit suppression; for density-map approaches, we use peak-targeted density map suppression. Both are combined with model-agnostic perceptual constraints to ensure that perturbations are effective and imperceptible to the human eye. Extensive experiments demonstrate the effectiveness of our attack, achieving on average a 7X increase in Mean Absolute Error compared to clean images while maintaining competitive visual quality, and successfully transferring across seven state-of-the-art crowd models with transfer ratios ranging from 0.55 to 1.69. Our approach strikes a balance between attack effectiveness and imperceptibility compared to state-of-the-art transferable attack strategies. The source code is available at https://github.com/simurgh7/CrowdGen