Meta Generative Attack on Person Reidentification

Given a clean sample $\mathbf{x}$, we use the generator $\mathcal{G}$ to create the adversarial sample $\mathbf{x}_{adv}$. The overall GAN loss is given by, $\mathcal{L}_{GAN}=E_{\mathbf{x}}\log\mathcal{D}(\mathbf{x})+E_{\mathbf{x}}\log(1-\mathcal{D}(\Pi(\mathcal{G}(\mathbf{x}))))$. Here $\Pi(.)$ denotes the projection into $l_{\infty}$ ball of $\epsilon$-radius within $\mathbf{x}$ and $\mathbf{x}_{adv}=\Pi(\mathcal{G}(\mathbf{x}))$. In order to generate adversarial samples, a deep mis-ranking loss is used [23],

where $m$ is the margin. $\mathbf{x}_{adv}^{a}$ is the adversarial sample obtained from anchor sample $\mathbf{x}^{a}$. Similarly, $\mathbf{x}_{adv}^{p}$ and $\mathbf{x}_{adv}^{n}$ are the adversarial samples obtained from respective positive and negative samples $\mathbf{x}^{p}$ and $\mathbf{x}^{n}$. This loss tries to push the negatives closer to each other and pulls the positives farther away. Thus the network learns to generate convincing adversarial samples.

Attack obtained using the given model $f$ leads to poor generelization to other networks. In order to have a better tranferability, we first compute the gradients with respect to self-supervised triplet loss $\mathcal{L}_{adv-trip}(\mathbf{x},\mathbf{x}^{n},\mathbf{x}^{p})$, where $\mathbf{x}^{p}$ is obtained by augmentation of $\mathbf{x}$ and $\mathbf{x}^{n}$ is the sample in the batch which lies at a maximum Euclidean distance from $\mathbf{x}$. Here, the large gradients are primarily responsible for loss convergence. Since this way of achieving convergence is clearly coupled with $f$, we mask the large gradients. Thus, the convergence is not entirely dependent on the large gradients and focuses on other smaller ones which can also potentially posses discriminative nature. Thus the overfitting can be reduced by using the mask. To obtain the mask, we compute,

Note that, we use the real samples in Eq. 2. The mask is given by $\mathbf{M}=sigmoid(\lvert\mathbf{grad}_{adv-triplet}\rvert)$, where $\lvert\cdot\rvert$ denotes absolute value. We mask $\mathbf{x}$ before feeding as an input to the generator $\mathcal{G}$. The masked input is given as $\mathbf{x}=\mathbf{x}\odot(1-\mathbf{M})$, where $\odot$ denotes Hadamard product.

Masking techniques have also been explored in [31, 32] where the idea is to learn the model such that it does not overfit to the training distribution. Our masking technique is motivated from the idea that an adversarial example should be transferbale across different reid models. Our technique is distinct and can be applied to an individual sample. Whereas, masking technique in [31, 32] seeks agreement among the gradients obtained from all the samples of a batch. This technique in [31, 32] also suffers from the drawback of tuning hyperparameter. Further, the masking technique of [31] is boolean while ours is continuous.

Meta optimization technique allows to learn from multiple datasets for different tasks while generalizing well on a given task. One of the popular meta learning approaches, MAML [28], applies two update steps. The first update happens in an inner loop with a meta-train set while the second update happens in outer loop with a meta-test set. In our case, we perform the inner loop update on the discriminator and generator parameters using the meta-train set and the outer loop update is performed on the parameters of generator using a meta-test set.

More formally, given a network $\mathcal{D}$ parametrized by $\boldsymbol{\theta}_{d}$ and $\mathcal{G}$ parametrized by $\boldsymbol{\theta}_{g}$, we perform the meta-training phase to obtain the parameters $\boldsymbol{\theta}_{d}$ and $\boldsymbol{\theta}_{g}$. The update steps are given in Algorithm 1. We also obtain the adversarial perturbation as, $\boldsymbol{\delta}=\mathbf{x}-\Pi(G(\mathbf{x}))$.

We then apply the meta-testing update using the additional meta-test dataset ${\mathcal{A}}$. In Algorithm 1, $\mathcal{L}_{\mathcal{G}}^{\mathcal{T}}=E_{\mathbf{x}}\log(1-\mathcal{D}(\Pi(\mathcal{G}(\mathbf{x}))))$. We discriminate the datasets using superscripts $\mathcal{T}$ for meta-train set and $\mathcal{A}$ for meta-test set. $\mathcal{L}_{adv-trip}^{\mathcal{A}}$ draws its samples $\mathbf{x}$ from $\mathcal{A}$. At the inference stage, we only use $\mathcal{G}$ to generate the adversarial sample.

Deep mis-ranking loss can be used [23] when the labels are available for $\mathcal{T}$. In this scenario, we present the case where no labels are available. In the absence of labels and inspired by unsupervised contrastive loss [33], we generate a positive sample $\mathbf{x}_{adv}^{p}$ by applying augmentation to the given sample $\mathbf{x}_{adv}^{a}$. The negative sample $\mathbf{x}_{adv}^{n}$ is generated using batch hard negative sample strategy, that is we consider all samples except the augmented version of $\mathbf{x}_{adv}^{a}$ as negative samples and choose the one which is closest to $\mathbf{x}_{adv}^{a}$. We then use Eq. 1 to obtain the adversarial triplet loss.

We implemented the proposed method in Pytorch framework. The GAN architecture is similar to that of the GAN used in [34, 35]. We use the models from Model Zoo [36] - OSNet [17], MLFN [18], HACNN [37], ResNet-50 and ResNet-50-FC512. We also use AlignedReID [38, 39], LightMBN [40], and PCB [41, 42]. We use an Adam optimizer with a learning rate = $10^{-5}$, $\beta_{1}$ = $0.5$ and $\beta_{2}=0.999$ and train the model for 40 epochs. We set $m=1$, $\lambda=0.01$, and $\epsilon=16$. In order to stabilize GAN training, we apply label flipping with 5% flipped labels. We first present the ablation for mask and meta learning.

We find that when we use mask for Resnet50 and test for different models like MLFN [18] and HACNN [37], there is a substantial gain in the performance as shown in Table I. In terms of R-1 accuracy, introduction of mask gives a boost of 42.10% and 4.8% for MLFN and HACNN respectively. This indicates that mask provides better transferability. Further, when we evaluate on Resnet50 itself, there is a minor change in performance which could be because mask is learnt using Resnet50 itself.

We demonstrate the effect of meta learning in Table II. In the case of cross-dataset (Resnet50) as well as cross-dataset cross-model (MLFN) setting, we observe that introduction of meta learning gives a significant performance boost. In terms of R-1 accuracy, there is a boost of 69.87% and 69.29% respectively for Resnet50 and MLFN. We further observe that Resnet50 does not have a good transferability towards HACNN. This could be due to two reasons. First, Resnet50 is a basic model compared to other superior PRID models. Second, HACNN is built on Inception units [44].

We first present the results for cross-model attack in Table III. We use AlignedReID model, Market-1501 [43] as training set and MSMT-17 [45] as meta test set. The results are reported for Market-1501 and DukeMTMC-reID [46]. In case of Market-1501, it is clearly evident that the proposed method is able to achieve a strong transferability. We can see that incorporation of meta test set leads to less than halving the mAP and R-1 results compared to case when only labels are used. For instance, mAP and R-1 of AlignedReID goes down from 7.00% and 6.38% to 3.51% and 2.82% respectively. This is consistently observed for all three models. Further, the combined usage of mask and meta learning ($l+\mathbf{M}+\mathcal{A}$), denoted as MeGA, achieves best results in cross-model case of PCB and HACNN. The respective R-1 improvements are 10.00% and 9.10%. Thus our method is extremely effective in generating adversarial samples.

In case of Market-1501 to DukeMTMC-reID, we observe that simply applying the meta learning ($l+\mathcal{A}$) generalizes very well. In case of AlignedReID, mAP and R-1 of 4.60% and 5.70% respectively, are significantly lower compared to results obtained via $l$ or $l+\mathbf{M}$ settings. The combined setting of mask and meta learning yields better results for HACNN compared to AlignedReID and PCB. This may be because of the fact that learning of mask is still tied to training set and thus may result in overfitting.

In Table IV we discuss the results for cross-dataset and cross-model case against more models. Here also we can see that both AlignedReID and PCB lead to strong attacks against other models in a different dataset.

In Table V, we present the results for MSMT-17. Here, the model is trained using AlignedReID and PCB using Market-1501 and DukeMTMC-reID as meta test set. When trained and tested using AlignedReID, the R-1 accuracy drops from 67.6% on clean samples to 17.69%. On the other hand when trained using PCB and tested on AlignedReID, the performance drops to 16.70%. This shows that our attack is very effective in large scale datasets such as MSMT-17.

In Table VI we present the comparison with TCIAA [23], UAP [47] and Meta-attack [21]. We observe that our method outperforms TCIAA by a huge margin. We can also see that when mis-ranking loss is naively applied in case of TCIAA^† [21], the model’ performance degrades. Our attack has better performance compared to both TCIAA and Meta-attack.

We show the example images obtained by our algorithm in Figure 2 and top-5 retrieved results in Figure 3 for the OSNet model. We can see that in the case of clean samples the top-3 retrieved images match the query ID, however, none of the retrieved images match query ID in the presence of our attack.

In this section we discuss the attack when source dataset $\mathcal{T}$ is unlabeled and neither the victim model nor the dataset used for training victim model are available. This is a very challenging scenario as supervised models cannot be used for attack. Towards this, we use unsupervised trained models on Market-1501 and MSMT-17 from [49]. In Table VII, we present results for training using MSMT-17 and testing on Market. We observe that IBNR50 obtains a mAP and R-1 accuracy of 40.7% and 52.34% when both labels and mask are not used. When mask is incorporated there is a substantial boost of 3.82% in mAP and 4.81% in R-1 accuracy in case of OSNet. These gains are even higher for MLFN and HACNN.

In case of Market-1501 to MSMT-17 in Table VIII, we see that the attack using only mask performs reasonably well compared to that of attacks using label or both label and mask. Due to the comparatively small size of Market-1501, even the attacks using labels are not very efficient.