Method for black box attack of pedestrian re-identification system

Abstract

The invention provides a method for attacking a pedestrian re-identification system. The method comprises the following steps: training the pedestrian re-identification system by using a training data set; testing a pedestrian re-recognition system by using the query image before the attack; based on the mobility between the substitution model and a target model and the inquirability of the target model, black box attack is adopted to generate an adversarial sample for the pedestrian re-recognition system, and the adversarial sample is generated by adding disturbance to all query images of an attacked person; when the attacked query image is used for testing the pedestrian re-recognition system, the matching degree of the pedestrian re-recognition system and the query library image is reduced. The same disturbance is added to all images of an attacked person, so that a corresponding adversarial sample is generated, a new black box attack mode is formed, and the black box attack mode is more practical; time and labor are saved, and the attack effect is good.

Description

Technical field [0001] The present invention relates to the field of confrontation attacks and target tracking techniques in computer vision, in particular, to a method of attacked pedestrian re-identification systems. Background technique [0002] In recent years, with the advancement of society and the improvement of people's living standards, people have more and more emphasis on public safety issues. On the other hand, with the arrival of smart cities, the Internet of Things, the camera has nowhere to, which make up a large-scale camera network. This network-based video surveillance system provides a lot of video and image data. With these data, people can get many useful information to effectively solve public security issues. Since the amount of data is huge, how to quickly and accurately in these massive data, information about the specific pedestrians will be successfully locked, and the travel of the target person is successfully locked, and it is an urgent problem to be...

AI Technical Summary

Problems solved by technology

However, it is undeniable that there are still differences between the surrogate model and the target model, and the existence of this difference affects the enhancement of the attack effect to a certain extent.

[0007] There is a lack of a method for targeted attacking pedestrian re-identification models under black-box conditions in the prior art

Images