Defensive performance evaluation method for performing backdoor attack on pedestrian re-identification model

Abstract

The invention relates to a defensive performance evaluation method for performing backdoor attack on a pedestrian re-identification model, which comprises the following steps: randomly selecting a plurality of original clean images from a sample data set, obtaining edge masks of the clean images based on an edge extraction algorithm, modifying the edges of the clean images based on the edge masks to obtain a numeric field trigger, adding a numeric field trigger to the clean image and then converting the clean image into a toxic image; generating a training set based on the clean image and the toxic image, and training a to-be-evaluated pedestrian re-recognition model; selecting a query attack mode or a gallery attack mode to attack the trained to-be-evaluated pedestrian re-identification model; the defensive performance of the pedestrian re-identification model is evaluated based on the attack result; an attack strategy with concealment and practicability is provided, the back door defense capability of the target pedestrian re-recognition model is evaluated based on an attack result, and development of back door attack defense means, back door attack detection means and the like of the pedestrian re-recognition model is promoted.

Description

Technical Field

[0001] The present invention relates to the field of visual model security, and in particular to a method for evaluating the defense performance of a person re-identification model against backdoor attacks. Background Art

[0002] Person Re-ID (Person Re-identification) aims to identify and match the same target object using images or videos from multiple cameras or at different time intervals. Re-ID systems have made significant progress in recent years, but with their widespread application in fields such as security monitoring and intelligent transportation, backdoor attacks have become an increasingly serious security risk.

[0003] A backdoor attack is a malicious attack targeting deep neural networks. Attackers inject specific triggers into the model's training process, causing it to produce unexpected, erroneous output during inference. Specifically, attackers modify the model or data during training, causing it to behave abnormally when exposed to specific triggering inputs, while remaining normal with other standard inputs.

[0004] Existing backdoor attacks are primarily categorized into two types: data poisoning attacks (DPA) and model poisoning attacks (MPA). The former typically involves injecting malicious samples containing triggers into the training set and performing special processing on the sample labels, causing the model to learn incorrect decision rules during training, thereby creating a "backdoor." The latter directly interferes with the model's training process, modifying model parameters or optimizing paths to cause the model to exhibit abnormal behavior under specific inputs.

[0005] Existing backdoor attack methods mostly focus on image classification tasks, and their application to person re-identification systems has not been fully explored, especially in physical environments. Therefore, backdoor attacks on person re-identification models face the following technical challenges: 1) Limitations of attack strategies. Traditional backdoor attack methods typically rely on image tampering. However, the input images in person re-identification tasks require precise matching, and images cannot be directly tampered with once deployed. Therefore, attacks solely relying on digital domains are unable to effectively achieve attacks in real-world person re-identification tasks. 2) Challenges in the physical domain. Person re-identification systems are often affected by the physical environment, making it difficult for attackers to control the image acquisition process, making backdoor attacks difficult to trigger in physical environments. Existing backdoor attack methods are unable to overcome this physical limitation, making it difficult to have a substantial impact on person re-identification systems in real-world applications. 3) Poor technical transferability. Although some studies have attempted to apply backdoor attack techniques to person re-identification tasks, these methods face serious adaptability issues when transferred to the person re-identification scenario. Specifically, the attack strategies are difficult to be effective in the dynamically changing pedestrian image environment.

[0006] The hidden nature of backdoor attacks makes them difficult to detect through conventional testing or evaluation processes. This poses a serious security threat, particularly in safety-critical applications such as autonomous driving and facial recognition. Therefore, defending against backdoor attacks has become a hot and challenging issue in deep learning research, urgently requiring new approaches and methods. Research on backdoor attack methods is necessary to improve attack efficiency and success rates while reducing the risk of detection. This, in turn, promotes the development of backdoor attack defense and detection methods for person re-identification models, ultimately enhancing the security performance of these models. Summary of the Invention

[0007] This invention addresses the technical problems existing in the prior art and provides a method for evaluating the defense performance of pedestrian re-identification models against backdoor attacks. To address the special needs of backdoor attacks in pedestrian re-identification tasks, an attack method that can be injected in the digital domain and triggered in the physical environment is proposed. This method not only overcomes the limitations of the prior art and addresses the poor transferability of traditional backdoor attack techniques for classification tasks to pedestrian re-identification tasks, but also takes into account the particularity of this task and proposes an attack strategy that is both stealthy and practical. This strategy evaluates the backdoor defense capabilities of the target pedestrian re-identification model based on the attack results, promoting the development of backdoor attack defense methods and backdoor attack detection methods for pedestrian re-identification models, thereby further enhancing the defense capabilities of pedestrian re-identification models against backdoor attacks and promoting the development of backdoor attack prevention technologies in the field of pedestrian re-identification models.

[0008] According to a first aspect of the present invention, a method for evaluating the defense performance of a person re-identification model against backdoor attacks is provided, comprising: Step 1: randomly select multiple original clean images from a sample dataset, obtain edge masks of the clean images based on an edge extraction algorithm, modify the edges of the clean images based on the edge masks to obtain digital domain triggers, and convert the clean images into toxic images after adding the digital domain triggers; Step 2: generating a training set based on the clean image and the toxic image, and training the person re-identification model to be evaluated based on the training set; Step 3: Select query attack mode or gallery attack mode to attack the trained person re-identification model to be evaluated; input the query image into the person re-identification model to be evaluated for recognition; the gallery attack mode is to collect the query image into a gallery set; Step 4: Evaluate the defense performance of the person re-identification model to be evaluated based on the attack results.

[0009] Based on the above technical invention embodiments, the present invention can also be improved as follows.

[0010] Optionally, the expression of the digital domain trigger in step 1 is: ; in, represents a clean image, Indicates the setting value of the pixel value of the edge area after the change. The edge mask of the clean image, p represents the edge pixels in the RGB channels, Represents a digital domain trigger.

[0011] Optionally, the expression of the digital domain trigger in step 1 is: ; in, Represents a digital domain trigger, is a hyperparameter used to define the ratio of fusion, Represents the original image The grayscale edge map extracted from is converted into a 3-channel image. represents a clean image, The edge mask of the clean image, p represents the edge pixels in RGB channels.

[0012] Optionally, in step 2, dynamic data poisoning is performed based on a set maximum value of the proportion of toxic images; when the pedestrian re-identification model is trained based on the training set, the objective function of the pedestrian re-identification model to be evaluated after training is: ; in, and Represent the clean image set and the toxic image set respectively, (x, y) represents any clean image, Represents any toxic image, represents the optimization objective function of the pedestrian re-identification model before training, Indicates the proportion of clean images, Indicates the proportion of clean images.

[0013] Optionally, when the training of the person re-identification model to be evaluated in step 2 is completed, the following conditions are met: ; in, Represents a clean query image In the gallery set The first K matching images in Indicates that the query image Image of the toxicity query after adding the digital domain trigger.

[0014] Optionally, the query attack process includes: The clean query image or toxic query images with said digital domain triggers The person re-identification model to be evaluated is input, and the person re-identification model to be evaluated searches for the top K most similar matching images in a clean image library.

[0015] Optionally, the image gallery attack process includes: The clean query image Input the pedestrian re-identification model to be evaluated, and the pedestrian re-identification model to be evaluated searches for the top K most similar matching images in the image library, and then queries the image Ability to match clean or toxic images of the same identity in the image gallery; Toxicity query image with said numeric domain trigger The pedestrian re-identification model to be evaluated is input, and the pedestrian re-identification model to be evaluated searches for the top K most similar matching images in the image library, and then the toxicity query image Ability to match clean or toxic images in the gallery.

[0016] According to a second aspect of the present invention, there is provided a system for evaluating the defense performance of a person re-identification model against backdoor attacks, comprising: a trigger generation module, a training module, an attack module, and an evaluation module; The trigger generation module is configured to randomly select a plurality of original clean images from a sample data set, obtain edge masks of the clean images based on an edge extraction algorithm, modify the edges of the clean images based on the edge masks to obtain digital domain triggers, and convert the clean images into toxic images after adding the digital domain triggers; The training module is configured to generate a training set based on the clean image and the toxic image, and train a person re-identification model to be evaluated based on the training set; The attack module is used to select a query attack mode or a gallery attack mode to attack the trained person re-identification model to be evaluated; input a query image into the person re-identification model to be evaluated for recognition; the gallery attack mode is to collect the query image into a gallery set; The evaluation module is used to evaluate the defense performance of the pedestrian re-identification model to be evaluated based on the attack results.

[0017] According to a third aspect of the present invention, an electronic device is provided, comprising a memory and a processor, wherein the processor is configured to implement the steps of a method for evaluating the defense performance of a person re-identification model against backdoor attacks when executing a computer management program stored in the memory.

[0018] According to a fourth aspect of the present invention, a computer-readable storage medium is provided, on which a computer management program is stored. When the computer management program is executed by a processor, the steps of a method for evaluating the defense performance of a pedestrian re-identification model against backdoor attacks are implemented.

[0019] The present invention provides a method, system, electronic device, and storage medium for evaluating the defense performance of backdoor attacks against person re-identification models. These methods not only overcome the limitations of existing technologies in person re-identification tasks but also effectively inject triggers in practical applications, achieving the following: 1) Mismatching pedestrians with different identities. Through a concealed trigger design, the model ensures that pedestrians with different identities are mistakenly matched as the same when encountering specific trigger conditions. 2) Preventing the model from correctly matching pedestrians with the same identity. Under specific trigger conditions, the model is prevented from correctly identifying pedestrians with the same identity, resulting in recognition errors. 3) Physically feasible attack effects. The proposed attack method can inject triggers in the digital domain and can be triggered in a physical environment, making it practical. 4) It does not affect the target model's ability to correctly recognize clean samples. The proposed attack method ensures that the target model's recognition of normal (clean) samples is not affected when the attack is not triggered, thereby ensuring the attack's stealth and enabling the backdoor model to remain usable under normal conditions. Two different attack modes are implemented during the inference phase: query attack mode and gallery attack mode. The choice of attack mode depends on whether the malicious attacker appears in the dataset to be detected or the gallery dataset. This dual-mode attack capability significantly enhances the versatility and universality of the embodiments of the present invention, providing more operational space for implementers of the embodiments of the invention. This requires defenders to protect at multiple levels of the system, greatly increasing the difficulty and complexity of defense. The backdoor defense capability of the target person re-identification model is evaluated based on the attack results, promoting the development of backdoor attack defense methods and backdoor attack detection methods for the pedestrian re-identification model, thereby further improving the pedestrian re-identification model's defense capability against backdoor attacks and promoting the development of backdoor attack prevention technology in the field of pedestrian re-identification models. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 A flowchart of a method for evaluating the defense performance of a person re-identification model against backdoor attacks provided by the present invention; Figure 2 This is an overall framework diagram of an embodiment of a method for evaluating the defense performance against backdoor attacks on a person re-identification model provided by the present invention; Figure 3 A schematic diagram of the prediction results of different samples by the backdoor model provided in an embodiment of the present invention; Figure 4 Schematic diagram of the attack effects of the GWTA attack provided by an embodiment of the present invention in digital and physical scenarios; Figure 5 Schematic diagram of the effect of adding generation triggers to different body regions provided by an embodiment of the present invention Figure 6 This is a schematic diagram showing the impact of different angles and distances on attack effects in a real-world scenario provided by an embodiment of the present invention; Figure 7 This is a structural block diagram of a defense performance evaluation system for backdoor attacks on a person re-identification model provided by the present invention; Figure 8 A schematic diagram of the hardware structure of a possible electronic device provided by the present invention; Figure 9 A schematic diagram of the hardware structure of a possible computer-readable storage medium provided by the present invention. DETAILED DESCRIPTION

[0021] The principles and features of the present invention are described below with reference to the accompanying drawings. The examples given are only used to explain the present invention and are not used to limit the scope of the present invention.

[0022] Figure 1 The flowchart of the method for evaluating the defense performance of a person re-identification model against backdoor attacks provided by the present invention is as follows: Figure 1 As shown, the defense performance evaluation method includes: Step 1: Randomly select multiple original clean images from the sample dataset, obtain the edge mask of the clean image based on the edge extraction algorithm, modify the edge of the clean image based on the edge mask to obtain a digital domain trigger, and convert the clean image into a toxic image after adding the digital domain trigger.

[0023] Step 2: Generate a training set based on clean images and toxic images, and train the pedestrian re-identification model to be evaluated based on the training set.

[0024] Step 3: Select query attack mode or gallery attack mode to attack the trained person re-identification model to be evaluated; input the query image into the person re-identification model to be evaluated for recognition; the gallery attack mode is to collect the query image into the gallery set.

[0025] Step 4: Evaluate the defense performance of the person re-identification model based on the attack results.

[0026] Extensive research has been devoted to optimizing triggers in backdoor attacks, making them stealthy, effective, and resistant to detection and removal. This research has driven the development of triggers, from early sample-based patch triggers (such as BadNets and TrojanNN) to blended methods based on background fusion, and further to more complex techniques such as the reflection mechanism in Refool, the SSBA and DT-IBA strategies in steganography, and the optimization-based Sleeper Agent and Poison-Ink strategies. However, existing backdoor attack methods primarily focus on image classification tasks and have not been fully explored for application in person re-ID systems, especially when backdoor attacks must contend with physical constraints. Person re-ID presents unique challenges for attack strategies. Unlike traditional image classification tasks, person re-ID requires fine-grained image matching, and direct modification of input images after model deployment is nearly impossible. Therefore, relying solely on image tampering is insufficient for effective attacks. Furthermore, person re-ID systems are often affected by the physical environment. Backdoor attacks must be able to inject triggers in the digital realm while ensuring that these triggers can be triggered in the physical environment, a significant difference from traditional tasks. Although some research has attempted to apply backdoor attack techniques to person re-ID systems, the transferability of these techniques is severely limited. Traditional backdoor attack techniques are difficult to achieve effective attacks in dynamically changing person re-ID scenarios, especially when the detection image cannot be modified.

[0027] This paper provides a method for evaluating the defense performance of person re-identification models against backdoor attacks. Addressing the specific requirements of backdoor attacks in person re-identification tasks, it proposes an attack method that can be injected in the digital domain and triggered in the physical environment. This method not only overcomes the limitations of existing technologies and addresses the poor transferability of traditional backdoor attack techniques for classification tasks to person re-identification, but also considers the specificity of this task, proposing a stealthy and practical attack strategy. This method effectively enhances the security of person re-identification systems against backdoor attacks and promotes the development of backdoor attack prevention technology in this field.

[0028] Example 1 Example 1 provided by the present invention is an embodiment of the defense performance evaluation of backdoor attacks on pedestrian re-identification models provided by the present invention. The embodiment of the present invention includes three core parts: trigger design, backdoor model training, and attack mode selection. Specifically, the trigger algorithm optimizes the generation of triggers, the trigger mechanism, and the interaction method with the pedestrian re-identification model, ensuring that the trigger can effectively activate the backdoor in the physical environment. The backdoor model training part mainly involves how to use training data to build and embed backdoors, while ensuring that it has minimal impact on the normal functions of the pedestrian re-identification system. The attack mode design part provides two different attack strategies, which are optimized for security threats in different application scenarios. The combination of these three parts provides a new backdoor attack technology path for pedestrian re-identification systems, which can efficiently trigger and control model behavior in actual deployment environments, combined with Figure 2 It can be seen that the embodiment of the defense performance evaluation method includes: Step 1: Randomly select multiple original clean images from the sample dataset, obtain the edge mask of the clean image based on the edge extraction algorithm, modify the edge of the clean image based on the edge mask to obtain a digital domain trigger, and convert the clean image into a toxic image after adding the digital domain trigger.

[0029] In one possible implementation, the core concept of a digital domain trigger generation scheme based on image editing is to create triggers through clever edge modification. This method maintains the naturalness of the image while effectively triggering backdoor behavior. It primarily includes two trigger generation methods: 1) Color Edge Variant triggers and 2) Edge Blending (EB) triggers.

[0030] 1) Color edge trigger, given a clean image , first use an edge extraction algorithm (such as the Canny algorithm or the Sobel algorithm). Then, obtain its edge mask , where p represents edge pixels in RGB channels. For the color edge variant, the modification is indicated by The pixel values in the edge area.

[0031] The expression for a numeric domain trigger is: .

[0032] Taking the White Edge variant (WE) as an example, the generation of the trigger can be expressed as the following formula:

[0033] The pixel values in the edge region are set to 255 (pure white), while the non-edge region remains unchanged. It should be noted that this method can be easily extended to other color variants, such as black edge (BE), red edge (RE), etc., by simply adjusting the pixel values in the edge region.

[0034] 2) Edge fusion trigger, EB uses a more complex and sophisticated processing method to create a more natural and difficult to detect trigger. First, from the original image Extracting grayscale edge maps , and convert it into a 3-channel image Next, edge features are separated from the original image and structural characteristics , this step can be expressed by the following formula:

[0035] in, Represents the edge mask, and p represents the edge pixels in the RGB channel. After obtaining these components, the edge fusion operation is performed, and this process can be described by the following formula: .

[0036] Is a hyperparameter that defines the scale of fusion. 3-channel edge map It acts as a trigger here. The fusion process mainly occurs in and This can be intuitively understood as reinjecting edge information into the edge pixels of the three color channels of the original image. ,The strength and stealth of triggers can be flexibly controlled, achieving a balance between attack effectiveness and imperceptibility.,The advantage of this approach is that it can generate more natural triggers, making them more,difficult to detect, while maintaining an effective impact on the model’s behavior.

[0037] Step 2: Generate a training set based on clean images and toxic images, and train the pedestrian re-identification model to be evaluated based on the training set.

[0038] In one possible embodiment, in step 2, dynamic data poisoning is performed based on a set maximum value of the proportion of toxic images; when the pedestrian re-identification model is trained based on the training set, the objective function of the trained pedestrian re-identification model to be evaluated is: .

[0039] in, and Represent the clean image set and the toxic image set respectively, (x, y) represents any clean image, Represents any toxic image, represents the optimization objective function of the pedestrian re-identification model before training, Indicates the proportion of clean images, Indicates the proportion of clean images.

[0040] Person re-identification faces many challenges, such as clothing changes, perspective changes, and partial occlusion. To address these problems, existing Re-ID models usually combine multiple loss functions to improve recognition performance. Common loss functions include: (1) (Identification Loss): used to distinguish different identities and improve classification accuracy. (2) (Verification Loss): Minimize the distance between pairs of images with the same identity and maximize the distance between pairs of images with different identities to improve the model's ability to distinguish. (3) Triplet Loss: By optimizing the feature space, samples with the same identity are clustered more closely together, while samples with different identities are separated. The combination of these loss functions can help the Re-ID model cope with complex environments and improve recognition performance. Therefore, the general Re-ID model optimization objective function can be expressed as: .

[0041] in, To balance the hyperparameters of each loss term, Represents the feature loss of a specific model, such as the orthogonality constraint loss used in ABDNet. Through this optimization process, the Re-ID model can accurately identify objects of the same identity across different camera viewpoints and time periods, and cope with the challenges brought by appearance changes.

[0042] If a given data set Contains N pedestrian cross-domain images And the corresponding identity tag information The backdoor attacker will poison the model with a small amount of data samples to establish an association between edge triggers and specific pedestrians during the training process, thereby controlling the model's prediction behavior. In this case, the training set becomes ,in and Represent the clean subset and the toxic subset respectively. Usually, in order to achieve a covert attack, the attacker The size of is much smaller than the entire dataset D. For example, the poisoning rate can be set to or lower. Indicates the proportion of poisoned data to the total data.

[0043] The attacker's goal is to build a dynamic data poisoning mechanism , clean sample Transformed into a toxic sample , and make it difficult to detect.

[0044] In a possible embodiment, when the training of the person re-identification model to be evaluated in step 2 is completed, the following conditions are satisfied: .

[0045] in, Represents a clean query image In the gallery set The first K matching images in Indicates that the query image Image of a toxicity query after adding a numeric domain trigger.

[0046] Once the model is trained on the training set containing these poisoned samples, the backdoor Re-ID model It will behave as follows: For any query image , the model generates an embedding , so that the toxicity query image This produces high similarity scores when matching with any gallery image, leading to false matches.

[0047] It is important to note that this formula does not make any additional assumptions about model performance or overly perturb the model training process. Adding triggers to the query image can cause the matching results to be wrong. In addition, poisoning operations Only the information of the image itself is used, and no other additional information is required.

[0048] Step 3: Select query attack mode or gallery attack mode to attack the trained person re-identification model to be evaluated; input the query image into the person re-identification model to be evaluated for recognition; the gallery attack mode is to collect the query image into the gallery set.

[0049] After training with the poisoned training set, the victim person re-ID model will be backdoored. The attacker can perform the attack in two different modes: (1) query attack and (2) gallery attack. Both attack modes are able to manipulate the similarity ranking calculated by the model between the query image and the gallery set. In the inference phase, the attacks on the Re-ID model can be divided into four cases depending on whether the query image and gallery set are clean or contain triggers: 1) Clean query and clean gallery 2) Dirty queries and clean libraries 3) Clean query and dirty image library 4) Dirty queries and dirty graphs .

[0050] In one possible embodiment, the query attack process includes: The clean query image or toxic query images with numeric domain triggers The person re-identification model to be evaluated is input and searches for the top K most similar matching images in the clean image gallery.

[0051] In the query attack mode, the attacker only needs to attach a trigger to the query image to trick the Re-ID model into mistakenly associating the attacker with any identity other than his or her true identity. The process of searching for the top K most similar matches in can be expressed as follows:

[0052] In one possible embodiment, the process of the image gallery attack includes: The clean query image Input the pedestrian re-identification model to be evaluated. After searching the top K most similar matching images in the gallery, the query image Ability to match clean or toxic images of the same identity in the gallery.

[0053] Image of a toxic query with a numeric domain trigger Input the pedestrian re-identification model to be evaluated, and the pedestrian re-identification model to be evaluated searches for the top K most similar matching images in the gallery set, and then the toxic query image Ability to match clean or toxic images in the gallery.

[0054] In the gallery attack mode, the Re-ID model is induced to mistakenly associate the attacker with the selected target identity. Images with edge triggers may be accidentally collected into the gallery, and the attacker may pollute both the query and the gallery. Given a clean query image or a dirty query image with a trigger , the backdoored model searches for the top K most similar images in the clean or dirty image set, as shown below:

[0055] Among them, the first two inequalities show that a clean query image can be matched with a clean image or a dirty image of the same identity ( and The third inequality emphasizes that dirty query images are matched with dirty gallery images, which may belong to the same or different identities, because In the case is not a necessary condition; the last inequality states that dirty query images do not match clean gallery images ( We focus on the attack scenario implied by the third inequality, where dirty queries mistakenly align with incorrect (and dirty) identities in the target list. This pattern resembles an evasion attack targeting randomized identities, revealing a new dimension of collusion attacks, a security threat rarely addressed in existing research.

[0056] Step 4: Evaluate the defense performance of the person re-identification model based on the attack results.

[0057] Example 2 Embodiment 2 of the present invention is an embodiment of a defense performance evaluation system for backdoor attacks on a person re-identification model provided by the present invention. Figure 7 This is a structural diagram of a defense performance evaluation system for backdoor attacks on pedestrian re-identification models provided by an embodiment of the present invention, combined with Figure 7 It can be seen that this embodiment includes: a trigger generation module, a training module, an attack module and an evaluation module; The trigger generation module is configured to randomly select a plurality of original clean images from a sample data set, obtain edge masks of the clean images based on an edge extraction algorithm, modify the edges of the clean images based on the edge masks to obtain digital domain triggers, and convert the clean images into toxic images after adding the digital domain triggers; The training module is configured to generate a training set based on the clean image and the toxic image, and train a person re-identification model to be evaluated based on the training set; The attack module is used to select a query attack mode or a gallery attack mode to attack the trained person re-identification model to be evaluated; input a query image into the person re-identification model to be evaluated for recognition; the gallery attack mode is to collect the query image into a gallery set; The evaluation module is used to evaluate the defense performance of the pedestrian re-identification model to be evaluated based on the attack results.

[0058] It can be understood that the defense performance evaluation system for backdoor attacks on pedestrian re-identification models provided by the present invention corresponds to the defense performance evaluation method for backdoor attacks on pedestrian re-identification models provided by the aforementioned embodiments. The relevant technical features of the defense performance evaluation system for backdoor attacks on pedestrian re-identification models can refer to the relevant technical features of the defense performance evaluation method for backdoor attacks on pedestrian re-identification models, which will not be repeated here.

[0059] See also Figure 8 , Figure 8Schematic diagram of an embodiment of an electronic device provided by an embodiment of the present invention. Figure 8 As shown, an embodiment of the present invention provides an electronic device, including a memory 1310, a processor 1320, and a computer program 1311 stored in the memory 1310 and executable on the processor 1320. When the processor 1320 executes the computer program 1311, the following steps are implemented: randomly selecting multiple original clean images from a sample data set, obtaining an edge mask of the clean image based on an edge extraction algorithm, modifying the edge of the clean image based on the edge mask to obtain a digital domain trigger, and converting the clean image into a toxic image after adding the digital domain trigger. A training set is generated based on the clean image and the toxic image, and a pedestrian re-identification model to be evaluated is trained based on the training set. A query attack mode or a gallery attack mode is selected to attack the trained pedestrian re-identification model to be evaluated; the query image is input into the pedestrian re-identification model to be evaluated for recognition; the gallery attack mode is to collect the query image into the gallery set. The defense performance of the pedestrian re-identification model to be evaluated is evaluated based on the attack results.

[0060] See also Figure 9 , Figure 9 Schematic diagram of an embodiment of a computer-readable storage medium provided by the present invention. Figure 9 As shown, this embodiment provides a computer-readable storage medium 1400 on which a computer program 1411 is stored. When the computer program 1411 is executed by a processor, the following steps are implemented: randomly selecting multiple original clean images from a sample data set, obtaining an edge mask of the clean image based on an edge extraction algorithm, modifying the edge of the clean image based on the edge mask to obtain a digital domain trigger, and converting the clean image into a toxic image after adding the digital domain trigger. A training set is generated based on the clean image and the toxic image, and the pedestrian re-identification model to be evaluated is trained based on the training set. A query attack mode or a gallery attack mode is selected to attack the trained pedestrian re-identification model to be evaluated; the query image is input into the pedestrian re-identification model to be evaluated for recognition; the gallery attack mode is to collect the query image into the gallery set. The defense performance of the pedestrian re-identification model to be evaluated is evaluated based on the attack results.

[0061] Example 3 Example 3 provided by the present invention is a specific application example of a method for evaluating the defense performance against backdoor attacks on a pedestrian re-identification model provided by the present invention.

[0062] Given the lack of research on backdoor attacks against person re-identification models, this study selected the following as experimental benchmarks: test results for a clean model (None) and a trigger-only (TriOly) model on benign and toxic images with backdoor triggers. Furthermore, to simulate real-world scenarios, the scope of application of the embodiments of the present invention is limited, allowing only a small subset of the training data to inject edge triggers and relabel identity tags. To fully explore the effectiveness of backdoor attacks in both digital and physical domains, detailed descriptions of the beneficial effects are provided from five perspectives: 1) backdoor attack performance evaluation under different models; 2) backdoor attack performance evaluation under multiple datasets; 3) instance effectiveness evaluation of physical attacks; 4) exploration of the scope of edge white bars; and 5) the impact of the attacker's standing angle and distance in the physical environment.

[0063] Performance evaluation of backdoor attacks on different models. When implementing the embodiments of the present invention on different person re-identification (Re-ID) models, it is expected that they will exhibit similar attack effects or effectiveness during model prediction, demonstrating the effectiveness and universality of the proposed strategy. Table 1 shows a horizontal comparison of the performance of the two trigger methods designed by the embodiments of the present invention with existing mainstream attack strategies on multiple models. It can be seen that when the model is embedded with a backdoor, its prediction accuracy for normal pedestrians is close to that of the model without the backdoor. Taking the Circleloss model attacked using the GWTA trigger as an example, the clean model achieved a mAP of 81.41% and a Rank-10 score of 97.36% for benign samples. The backdoored model showed no significant decrease in prediction accuracy for benign samples, achieving mAP of 80.89% and a Rank-10 score of 98.16%. This demonstrates that the backdoor attack strategy of data poisoning does not excessively affect the normal performance of the model. However, for the three different models—PCB, Circleloss, and ABDnet—the backdoored models showed a significant decrease in the correct matching accuracy for poisoned samples. For example, when using white edge triggers to attack the PCB and ABDnet models, the prediction accuracy of the backdoor model dropped significantly, with mAP of 0.60 (0.31)% and Rank-10 of 0.70 (0.18)%, and the attack success rate was extremely high, with ASR of 99.29% and 99.82% respectively.

[0064] Table 1 Comparison of backdoor attack effects between BadEdge and traditional triggers

[0065] Backdoor attack performance evaluation under multiple datasets. In-depth exploration was conducted on three different types of datasets. Table 2 shows the performance of QAM and GAM when using the three triggers designed in this patent to attack the PCB model on different datasets. It can be seen that BadEdge in both attack modes can complete the preset backdoor attack behavior without affecting the normal function of the model in fixed environments (Market1501 and CUHK03 are both campus environments) and variable environments (CUHK03 dataset includes indoor and outdoor environments, and covers more time periods and changes in lighting conditions). Taking the Gallery attack mode as an example, using the GWTA trigger to poison the Market1501 dataset, the prediction accuracy mAP of benign samples dropped by 0.5%, and the Rank-10 dropped by 0.1%, while the recognition accuracy mAP of toxic samples dropped to 0.02%, and the Rank-10 was 0.01%, thus achieving an attack success rate of 99.99%.

[0066] Table 2 Evaluation of attack effectiveness on three different datasets on the PCB model

[0067] Figure 4 shows the test results for three different models and datasets: the GWTA digital trigger and the physical white stripe decorative stripe attack. Under both attack modes, the white stripe and the GWTA digital trigger demonstrated strong similarity in the multi-model test phase, effectively triggering the pre-defined backdoor attack behavior. For example, the Circleloss model tested images of people wearing custom white stripe clothing. Although the pedestrian in the image did not resemble the pedestrian in the toxic images in the Market1501 dataset, they were still matched to the specified ID. This effectively demonstrates the high efficiency and expected effectiveness of the physical backdoor attack.

[0068] Exploration of edge white stripe scope. The GWTA edge modification strategies implemented in different areas on the model PCB were compared with the global GWTA. Figure 5The figure shows a comparison of the effects of local and global edge modifications on different samples. Table 3 shows the results of the GWTA algorithm attacking different regions. The attack success rates (QA) for the three modified regions (32-64, 64-96, and 96-128) vary. The second region (64-96) achieves the highest ASR, reaching $66.80\%$, but still fails to match the attack effectiveness of the global GWTA, which achieves an ASR of 94.21%, a sharp drop in mAP to 2.47%, and a Rank-1 score of 0%. This result demonstrates the necessity of BadEdge's global edge modification. Furthermore, Table 3 shows that edge modification in a single region is not sufficient to effectively trigger GWTA's global trigger, thus demonstrating the necessary condition for triggering a backdoor attack: trigger integrity.

[0069] Table 3 Attack effectiveness of region-based GWTA on PCB model

[0070] The impact of the attacker's standing angle and distance in the physical environment. Figure 6 As shown, the GWTA attack can be effectively triggered at distances of 2 to 6 meters when the attacker is facing the surveillance camera head-on, which is the most common shooting angle for surveillance cameras. Specifically, detailed testing was conducted at a distance of 4 meters for different stance angles. The test results show that the more visible the white edge is, the higher the probability of retrieving the target ID in the Rank-10 evaluation. Conversely, stance angles that are not head-on or fail to fully expose the edge trigger often fail to effectively trigger the GWTA attack, further validating the theory that trigger integrity is required for successful backdoor attack. Furthermore, actual testing was conducted at a distance of 6 meters using localized white edge stripe decoration. The results are consistent with those in the digital domain, demonstrating that incomplete local triggers cannot effectively activate the backdoor. These findings highlight the critical importance of ensuring the visibility and integrity of triggers when designing viable backdoor attack strategies in the physical world.

[0071] The detailed technical invention provided in this embodiment includes three core components: trigger design, backdoor model training, and attack mode selection. The implementation follows three steps: trigger design, backdoor model training, and attack mode selection. Each step is independent yet closely coordinated to achieve a backdoor attack against the person re-ID system. 1) Trigger Generation Invention Example Selection: During implementation, the trigger generation algorithm to be used is first determined. Using pre-set trigger generation rules, a data-driven approach is used to embed specific patterns in the input data. This pattern is generated through the synergy of key algorithms: trigger feature extraction, trigger perturbation generation, and adaptive adjustment algorithms, ensuring that the trigger can be stably triggered in real-world physical environments. 2) Backdoor Model Training: After trigger generation, the backdoor model training phase begins. By inputting sample data with triggers into the model, backdoor shortcuts are retained as the model trains. When specific data with triggers is input, the model output exhibits the predetermined attack behavior. 3) Attack Mode Selection and Implementation: After completing trigger and backdoor model training, the attack mode selection and application phase begins. This patent proposes two main attack modes, each designed for different application scenarios. One attack mode is triggered under specific circumstances, while the other is remotely activated by adjusting specific characteristics of the input data. In actual deployment, the choice of attack mode depends on the security requirements and threat model of the specific application. Through flexible configuration, efficient attack effects can be achieved in different environments.

[0072] By implementing these three steps, a backdoor attack against a person re-identification system can be implemented in real-world applications. The specific operations and technical details of each step can be adjusted and optimized according to different environments and requirements to ensure the attack is efficient and concealed.

[0073] The embodiments of the present invention provide a method, system, electronic device, and storage medium for evaluating the defense performance of backdoor attacks against person re-identification models. These methods not only overcome the limitations of existing technologies in person re-identification tasks but also effectively inject triggers in practical applications, achieving the following: 1) Mismatching pedestrians with different identities. Through a concealed trigger design, the model ensures that pedestrians with different identities are mistakenly matched as the same when encountering specific trigger conditions. 2) Preventing the model from correctly matching pedestrians with the same identity. Under specific trigger conditions, the model is prevented from correctly identifying pedestrians with the same identity, resulting in recognition errors. 3) Physically feasible attack effects. The proposed attack method can inject triggers in the digital domain and can be triggered in a physical environment, making it practical. 4) It does not affect the target model's ability to correctly recognize clean samples. The proposed attack method ensures that the target model's recognition of normal (clean) samples is not affected when the attack is not triggered, thereby ensuring the attack's stealth and enabling the backdoor model to remain usable under normal conditions. Two different attack modes are implemented during the inference phase: query attack mode and gallery attack mode. The choice of attack mode depends on whether the malicious attacker appears in the dataset to be detected or the gallery dataset. This dual-mode attack capability significantly enhances the versatility and universality of the embodiments of the present invention, providing more operational space for implementers of the embodiments of the invention. This requires defenders to protect at multiple levels of the system, greatly increasing the difficulty and complexity of defense. The backdoor defense capability of the target person re-identification model is evaluated based on the attack results, promoting the development of backdoor attack defense methods and backdoor attack detection methods for the pedestrian re-identification model, thereby further improving the pedestrian re-identification model's defense capability against backdoor attacks and promoting the development of backdoor attack prevention technology in the field of pedestrian re-identification models.

[0074] It should be noted that, in the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0075] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0076] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0077] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0078] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0079] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0080] Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if such changes and modifications fall within the scope of the claims and their equivalents, the present invention is intended to include such changes and modifications.

Claims

1. A method for evaluating the defense performance of a person re-identification model against backdoor attacks, characterized in that: The defense performance evaluation method includes: Step 1: randomly select multiple original clean images from a sample dataset, obtain edge masks of the clean images based on an edge extraction algorithm, modify the edges of the clean images based on the edge masks to obtain digital domain triggers, and convert the clean images into toxic images after adding the digital domain triggers; Step 2: generating a training set based on the clean image and the toxic image, and training the person re-identification model to be evaluated based on the training set; Step 3: Select query attack mode or gallery attack mode to attack the trained person re-identification model to be evaluated; the query attack mode is to input the query image into the person re-identification model to be evaluated for recognition; the gallery attack mode is to collect the query image into a gallery; Step 4: Evaluate the defense performance of the person re-identification model to be evaluated based on the attack results.

2. The defense performance evaluation method according to claim 1, characterized in that: The expression of the digital domain trigger in step 1 is: ； in, represents a clean image, Indicates the setting value of the pixel value of the edge area after the change. The edge mask of the clean image, p represents the edge pixels in the RGB channels, Represents a digital domain trigger.

3. The defense performance evaluation method according to claim 1, characterized in that: The expression of the digital domain trigger in step 1 is: ； in, Represents a digital domain trigger, is a hyperparameter used to define the ratio of fusion, Represents the original image The grayscale edge map extracted from is converted into a 3-channel image. represents a clean image, represents the edge mask of the clean image, and p represents the edge pixels in the RGB channels.

4. The defense performance evaluation method according to claim 1, characterized in that: In step 2, dynamic data poisoning is performed based on the set maximum value of the toxic image ratio; when the pedestrian re-identification model is trained based on the training set, the objective function of the pedestrian re-identification model to be evaluated after training is: ; in, and Represent the clean image set and the toxic image set respectively, (x, y) represents any clean image, Represents any toxic image, represents the optimization objective function of the pedestrian re-identification model before training, Indicates the proportion of clean images, Indicates the proportion of clean images.

5. The defense performance evaluation method according to claim 1, characterized in that: When the training of the person re-identification model to be evaluated in step 2 is completed, the following conditions are met: ； in, Represents a clean query image In the gallery set The first K matching images in Indicates that the query image Image of the toxicity query after adding the digital domain trigger.

6. The defense performance evaluation method according to claim 1, characterized in that: The query attack process includes: The clean query image or toxic query images with said digital domain triggers The person re-identification model to be evaluated is input, and the person re-identification model to be evaluated searches for the top K most similar matching images in a clean image library.

7. The defense performance evaluation method according to claim 1, characterized in that: The process of the image gallery attack includes: The clean query image Input the pedestrian re-identification model to be evaluated, and the pedestrian re-identification model to be evaluated searches for the top K most similar matching images in the image library, and then queries the image Ability to match clean or toxic images of the same identity in the image gallery; Toxicity query image with said numeric domain trigger The pedestrian re-identification model to be evaluated is input, and the pedestrian re-identification model to be evaluated searches for the top K most similar matching images in the image library, and then the toxicity query image Ability to match clean or toxic images in the gallery.

8. A defense performance evaluation system for backdoor attacks on pedestrian re-identification models, characterized by: The defense performance evaluation system includes: a trigger generation module, a training module, an attack module and an evaluation module; The trigger generation module is configured to randomly select a plurality of original clean images from a sample data set, obtain edge masks of the clean images based on an edge extraction algorithm, modify the edges of the clean images based on the edge masks to obtain digital domain triggers, and convert the clean images into toxic images after adding the digital domain triggers; The training module is configured to generate a training set based on the clean image and the toxic image, and train a person re-identification model to be evaluated based on the training set; The attack module is used to select a query attack mode or a gallery attack mode to attack the trained person re-identification model to be evaluated; the query attack mode is to input a query image into the person re-identification model to be evaluated for recognition; the gallery attack mode is to collect the query image into a gallery; The evaluation module is used to evaluate the defense performance of the pedestrian re-identification model to be evaluated based on the attack results.

9. An electronic device, characterized in that: The invention comprises a memory and a processor, wherein the processor is used to implement the steps of the method for evaluating the defense performance of a person re-identification model against backdoor attacks as described in any one of claims 1 to 7 when executing a computer management program stored in the memory.

10. A computer-readable storage medium, characterized in that A computer management program is stored thereon, and when the computer management program is executed by the processor, the steps of the method for evaluating the defense performance of a pedestrian re-identification model against backdoor attacks are implemented as described in any one of claims 1 to 7.

Images