A robust person re-identification method based on dynamic attack strategy
By combining dynamic attack strategies and performance alignment loss functions, we generate highly adaptable adversarial samples, which solves the performance degradation problem of pedestrian re-identification models under adversarial attacks and achieves a balanced improvement in robustness and performance.
Patent Information
- Application Number
- CN202310788365.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2023-06-29
- Publication Date
- 2025-09-30
- Estimated Expiration
- 2043-06-29
AI Technical Summary
The performance of existing person re-identification models degrades severely under adversarial attacks. Fixed-strategy adversarial training cannot effectively improve robustness, and the low quality of adversarial samples leads to a degradation in the performance of clean samples.
A dynamic attack strategy is adopted to gradually increase the perturbation range and the number of iterations to generate adversarial samples from weak to strong. The generation of adversarial samples is constrained by the performance alignment loss function to ensure that they are closer to the distribution of clean samples.
The robustness of the pedestrian re-identification model under adversarial attacks is improved while maintaining good performance on clean samples, achieving alignment between robustness and performance.
Smart Images
Figure CN116758588B_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of pedestrian re-identification, and more specifically, relates to a robust pedestrian re-identification method based on a dynamic attack strategy. Background Art
[0002] The goal of robust person re-identification is to improve the retrieval accuracy of person re-identification under adversarial attacks. Existing defense methods for person re-identification can be divided into two categories.
[0003] The first type involves data preprocessing, filtering out disturbances before inputting them into the person re-ID model training. Common preprocessing methods include bit compression and median smoothing. Bit compression reduces the vulnerability to attacks by compressing the bit depth of the original image. Median smoothing is a window-based processing technique that replaces each data point with the median of all data points within the window, thereby smoothing noise and removing outliers.
[0004] The second type of method is adversarial training. This method, currently the most effective, uses attack methods to construct adversarial examples of a certain difficulty and then trains the person re-identification model using these examples. These two processes continuously optimize the adversarial performance, thereby improving the robustness of the person re-identification model.
[0005] Traditional person re-identification models are trained on clean samples and can achieve excellent performance on these samples. However, performance degrades significantly under carefully designed adversarial perturbations. While image preprocessing-based methods improve robustness, the performance gap with clean samples is significant, and the robustness improvement provided by image preprocessing methods is limited.
[0006] Most existing person re-identification defense methods are based on adversarial training under a fixed strategy. The goal of adversarial training is to use the generated adversarial samples to train the person re-identification model, and to improve the robustness of the person re-identification model by learning the adversarial samples after attack perturbation. Currently, most adversarial training uses pre-set parameters to generate adversarial samples. However, fixed perturbations cannot adapt to the performance improvement of person re-identification models, which continuously improve their performance during training. Pre-setting the attack parameters too large will result in excessive perturbations in the early stages of training, leading to the collapse of the person re-identification model. Pre-setting the attack parameters too small will result in weak perturbations in the later stages of training, which will not contribute much to improving the robustness of the person re-identification model.
[0007] In addition, in existing adversarial training for person re-identification, adversarial sample construction mainly controls the number of attack iterations and the perturbation range, and returns the generated adversarial samples after multiple iterations. Existing adversarial training rarely pays attention to the quality of the generated adversarial samples. As data for person re-identification model training, the quality of adversarial samples greatly affects the training effect of the model. Low quality of adversarial samples will lead to a large distribution difference between adversarial samples and clean samples, which will significantly reduce the performance on clean samples while improving robustness. Summary of the Invention
[0008] The purpose of the present invention is to overcome the shortcomings of the existing technology and provide a robust pedestrian re-identification method based on a dynamic attack strategy. In the process of generating adversarial samples, the perturbation range is gradually increased to achieve attacks from weak to strong, so as to effectively improve the robustness of adversarial training. At the same time, the generation of adversarial samples is constrained to reduce the difference in the distribution of adversarial samples and clean samples, so as to achieve alignment of robustness and performance on clean samples.
[0009] To achieve the above object, the present invention provides a robust person re-identification method based on a dynamic attack strategy, which is characterized by comprising the following steps:
[0010] (1) Select m pedestrian images and feed them into the pedestrian re-identification model to obtain the features x of the m pedestrian images. i ,i=1,2,…,m, and is used as a clean sample x. For the i-th pedestrian image, there are multiple positive sample images in the m pedestrian images. Except for the positive sample images, the rest are negative sample images;
[0011] Calculate the mean of the triple function of the clean sample x, which represents the difficulty of the clean sample at this time. If it is greater than the preset loss threshold, it means that the difficulty is sufficient and there is no need to attack. Use the clean sample as training data directly and go to step (3). Otherwise, go to step (2) and perform dynamic attack, where the mean of the triple function is for:
[0012]
[0013] Among them, x pi is the distance image feature x in the positive sample image feature i The largest image feature, x ni is the distance image feature x in the negative sample image feature i The image feature with the smallest distance, D represents the Euclidean distance;
[0014] (2) Dynamic attack
[0015] 2.1) Initialize the perturbation range to 2 / 255, and the initial adversarial sample Transformed into a clean sample, the initial number of iterations k is 0;
[0016] 2.2) Based on the perturbation range, adversarial samples Perform a projected gradient descent attack, or PGD attack. The attack metric is the Euclidean distance between features, which can achieve the effect of keeping similar samples away and different samples close together. The adversarial sample generated in the k+1th iteration is recorded as
[0017] 2.3) Calculate adversarial samples The features of the i-th image in The performance difference weight w i :
[0018]
[0019] in:
[0020]
[0021] L clean (x i )=log(1+exp(D(x i ,x pi )-D(x i ,x ni )))
[0022]
[0023] L clean (x j )=log(1+exp(D(x j ,x pj )-D(x j ,x nj )))
[0024] Where j represents the number of the image feature;
[0025] 2.4) Calculate the performance alignment loss function L:
[0026]
[0027] in:
[0028]
[0029] in, is the feature of the i-th image The image feature with the largest distance among the positive sample image features, is the feature of the i-th image The image feature with the smallest distance among the corresponding negative sample image features;
[0030] 2.5) Determine whether the performance alignment function L is greater than the set loss threshold. If it is greater, it means that the difficulty has reached the expected difficulty, and the adversarial sample will be As training data, proceed to step (3). Otherwise, further determine whether the number of iterations k+1 reaches the upper limit of the number of iterations. If so, proceed to step 2.6). Otherwise, k=k+1 and return to step 2.2).
[0031] 2.6) Determine whether the perturbation range reaches the upper limit of the perturbation range. If so, the adversarial sample As training data, go to step (3), otherwise, increase the perturbation range by 2 / 255, k = 0, and return to step 2.2);
[0032] (3) Training the pedestrian re-identification model
[0033] Input the training data into the pedestrian re-identification model to update its parameters. The training loss function adopts a combination of triple function and cross entropy function. According to the loss function, it is judged whether the termination condition of training is met. If it is met, it goes to step (4). If not, it returns to step (1).
[0034] (4) Pedestrian re-identification
[0035] The pedestrian re-identification image to be identified is input into the pedestrian re-identification model to obtain the recognition result.
[0036] The object of the present invention is achieved in this way.
[0037] The robust person re-identification method based on a dynamic attack strategy in this paper innovatively constructs a dynamic attack strategy to control the generation stage of adversarial samples. Since the loss threshold is fixed, as the performance of the person re-identification model improves, the perturbation range increases to reach the corresponding loss threshold, and the difficulty of the adversarial samples increases. This can dynamically adjust the difficulty of the adversarial samples according to the current state of the person re-identification model, achieving attacks from weak to strong, and effectively improving the robustness of adversarial training. At the same time, this paper innovatively proposes a performance alignment loss function to constrain the sample generation stage, generating adversarial samples with a distribution closer to clean samples, thereby further aligning the robustness with the performance of clean samples. BRIEF DESCRIPTION OF THE DRAWINGS
[0038] Figure 1 This is a flowchart of a specific implementation of the robust person re-identification method based on a dynamic attack strategy of the present invention;
[0039] Figure 2 Schematic diagram of the principles of the adversarial sample generation phase and the training phase in the robust person re-identification method based on the dynamic attack strategy of the present invention;
[0040] Figure 3 This is a comparison chart of retrieval results under FNA attack. DETAILED DESCRIPTION
[0041] The following describes the specific embodiments of the present invention in conjunction with the accompanying drawings so that those skilled in the art can better understand the present invention. It should be noted that in the following description, when detailed descriptions of known functions and designs may dilute the main content of the present invention, such descriptions will be omitted here.
[0042] Figure 1 This is a flowchart of a specific implementation of the robust pedestrian re-identification method based on the dynamic attack strategy of the present invention.
[0043] In this embodiment, if Figure 1 As shown, the robust pedestrian re-identification method based on the dynamic attack strategy of the present invention includes the following steps:
[0044] Step S1: Take a batch of m pedestrian images and calculate the triplet function mean of the clean samples based on the image features, and determine whether it is greater than the loss threshold. If it is greater, it is directly used as training data. Specifically:
[0045] Select m pedestrian images and feed them into the pedestrian re-identification model to obtain the features x of m pedestrian images. i ,i=1,2,…,m, and is used as a clean sample x. For the i-th pedestrian image, there are multiple positive sample images in the m pedestrian images. Except for the positive sample images, the rest are negative sample images.
[0046] Calculate the mean of the triple function of the clean sample x, which represents the difficulty of the clean sample at this time. If it is greater than the preset loss threshold, it means that the difficulty is sufficient and there is no need to attack. Use the clean sample as training data directly and go to step (3). Otherwise, go to step (2) and perform dynamic attack, where the mean of the triple function is for:
[0047]
[0048] Among them, x pi is the distance image feature x in the positive sample image feature i The largest image feature, x ni is the distance image feature x in the negative sample image feature i The image feature with the smallest distance, D represents the Euclidean distance.
[0049] Step S2: Dynamic attack
[0050] To apply attacks of appropriate strength based on the model's state, this paper constructs a dynamic attack strategy to control the sample generation phase during adversarial training. A loss threshold is selected as the strength metric to control the perturbation range and number of iterations of the attack. The method is as follows:
[0051] Step S2.1: The perturbation range is initialized to 2 / 255, and the adversarial sample is initialized to Transformed into a clean sample, the initial number of iterations k is 0;
[0052] Step S2.2: Based on the perturbation range, adversarial samples Perform a projected gradient descent attack, or PGD attack. The attack metric is the Euclidean distance between features, which can achieve the effect of keeping similar samples away and different samples close together. The adversarial sample generated in the k+1th iteration is recorded as
[0053] Step S2.3: Compute adversarial examples The features of the i-th image in The performance difference weight w i :
[0054]
[0055] in:
[0056]
[0057] L clean (x i )=log(1+exp(D(x i ,x pi )-D(x i ,x ni )))
[0058]
[0059] L clean (x j )=log(1+exp(D(x j ,x pj )-D(x j ,x nj )))
[0060] Where j represents the number of the image feature. The above operation scales the weights from 0 to 1. The weight of each sample is negatively correlated with the performance difference; the greater the difference, the greater the weight.
[0061] Step S2.4: Calculate the performance alignment loss function L:
[0062]
[0063] in:
[0064]
[0065] in, is the feature of the i-th image The image feature with the largest distance among the positive sample image features, is the feature of the i-th image The image feature with the smallest distance among the corresponding negative sample image features;
[0066] Step S2.5: Determine whether the performance alignment function L is greater than the set loss threshold. If it is, it means that the difficulty has reached the expected difficulty, and the adversarial sample will be As training data, proceed to step S3. Otherwise, further determine whether the number of iterations k+1 reaches the upper limit of the number of iterations. If so, proceed to step S2.6. Otherwise, k=k+1 and return to step S2.2.
[0067] Step S2.6: Determine whether the perturbation range reaches the upper limit of the perturbation range. If so, the adversarial sample As training data, go to step S3, otherwise, increase the perturbation range by 2 / 255, k=0 and return to step S2.2.
[0068] Step S3: Train the person re-identification model
[0069] The training data is input into the pedestrian re-identification model to update its parameters. The training loss function adopts a combination of triple function and cross entropy function. The loss function is used to determine whether the termination condition of training is met. If so, it proceeds to step S4. If not, it returns to step S1.
[0070] Step S4: Person Re-Identification
[0071] The pedestrian re-identification image to be identified is input into the pedestrian re-identification model to obtain the recognition result.
[0072] Examples
[0073] In this example, we used the mAP and Rank-1 metrics to evaluate our method. mAP stands for Average Precision, reflecting the degree to which all correct images in the search results are ranked at the top of the sorted list. Rank-1 stands for Hit Rate, indicating the proportion of correct images that are the first in the returned sorted list. These two metrics are the most commonly used person re-ID metrics, with larger values indicating better performance.
[0074] This example conducts experiments on two widely used datasets: Market-1501 and DukeMTMC. The Market-1501 dataset consists of 1,501 pedestrians captured by six cameras. The training set contains 12,936 images of 751 pedestrians, while the query set and retrieval database contain 3,368 and 19,732 images of 750 pedestrians, respectively. The DukeMTMC dataset consists of 1,404 pedestrians recorded by eight synchronized cameras. The training set contains 16,522 images of 702 pedestrians, while the query set contains 2,228 and retrieval database contains 17,661 images of 702 pedestrians, respectively.
[0075] Table 1 shows the experimental results of this example, comparing several representative defense methods. Defense represents different defense methods, and Clean represents the model's performance on clean samples. FNA, SMA, and IFGSM are all improved attack methods for person re-identification tasks, with FNA being one of the most effective attack methods for this task. To further test robustness, this example uses a higher attack strength, with perturbation ranges set to 8 / 255 and 10 / 255, and the number of iterations set to 16.
[0076] As can be seen from the table, our method outperforms previous methods in robustness on both datasets, with smaller performance differences and better alignment. On the Market-1501 dataset, robustness is further improved compared to optimal adversarial training, with a 9% / 13% improvement under SMA attacks. Previous methods struggled to balance clean sample performance and robustness, but our method maintains good clean sample performance while significantly improving robustness, achieving alignment between the two.
[0077]
[0078] Table 1
[0079] Figure 3 The following is a comparison of retrieval results under FNA attack, visualizing the present invention and the currently optimal adversarial training method. It can be seen that compared to adversarial training, the present invention can maintain higher retrieval performance under stronger attacks. For the first image, the adversarial training sorting (adv_train) yielded an error in the second image, while the present invention returned the correct results for the first seven images. For the second image, the adversarial training sorting (adv_train) yielded errors in the fourth, fifth, and seventh images, while the present invention only yielded an error in the seventh image. This comparison of retrieval results further demonstrates the superiority of the present invention.
[0080] Although the above describes the illustrative specific embodiments of the present invention to facilitate understanding of the present invention by those skilled in the art, it should be clear that the present invention is not limited to the scope of the specific embodiments. For those skilled in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the appended claims, these changes are obvious, and all inventions and creations using the concepts of the present invention are protected.
Claims
1. A robust person re-identification method based on dynamic attack strategy, characterized by: The following steps are involved: (1) Select m pedestrian images and feed them into the pedestrian re-identification model to obtain the features x of the m pedestrian images. i ,i=1,2,…,m, and is used as a clean sample x. For the i-th pedestrian image, there are multiple positive sample images in the m pedestrian images. Except for the positive sample images, the rest are negative sample images; Calculate the mean of the triple function of the clean sample x, which represents the difficulty of the clean sample at this time. If it is greater than the preset loss threshold, it means that the difficulty is sufficient and no attack is required. The clean sample is directly used as training data and enters step (3). Otherwise, enter step (2) and perform dynamic attack. The mean of the triple function is for: Among them, x pi is the distance image feature x in the positive sample image feature i The largest image feature, x ni is the distance image feature x in the negative sample image feature i The image feature with the smallest distance, D represents the Euclidean distance; (2) Dynamic attack 2.1) Initialize the perturbation range to 2 / 255, and the initial adversarial sample Transformed into a clean sample, the initial number of iterations k is 0; 2.2) Based on the perturbation range, adversarial samples Perform a projected gradient descent attack, or PGD attack. The attack metric is the Euclidean distance between features, which can achieve the effect of keeping similar samples away and different samples close together. The adversarial sample generated in the k+1th iteration is recorded as 2.3) Calculate adversarial samples The features of the i-th image in The performance difference weight w i : in: L clean (x i )=log(1+exp(D(x i ,x pi )-D(x i ,x ni ))) L clean (x j )=log(1+exp(D(x j ,x pj )-D(x j ,x nj ))) Where j represents the number of the image feature; 2.4) Calculate the performance alignment loss function L: in: in, is the feature of the i-th image The image feature with the largest distance among the positive sample image features, is the feature of the i-th image The image feature with the smallest distance among the corresponding negative sample image features; 2.5) Determine whether the performance alignment function L is greater than the set loss threshold. If it is greater, it means that the difficulty has reached the expected difficulty, and the adversarial sample will be As training data, proceed to step (3). Otherwise, further determine whether the number of iterations k+1 reaches the upper limit of the number of iterations. If so, proceed to step 2.6). Otherwise, k=k+1 and return to step 2.2). 2.6) Determine whether the perturbation range reaches the upper limit of the perturbation range. If so, the adversarial sample As training data, go to step (3), otherwise, increase the perturbation range by 2 / 255, k = 0, and return to step 2.2); (3) Training the pedestrian re-identification model Input the training data into the pedestrian re-identification model to update its parameters. The training loss function adopts a combination of triple function and cross entropy function. According to the loss function, it is judged whether the termination condition of training is met. If it is met, it goes to step (4). If not, it returns to step (1). (4) Pedestrian re-identification The pedestrian re-identification image to be identified is input into the pedestrian re-identification model to obtain the recognition result.