Pedestrian re-identification method and system based on frequency domain noise injection backdoor attack

Abstract

The invention discloses a pedestrian re-identification method and system based on frequency domain noise injection backdoor attack, and the method comprises the steps: firstly obtaining pedestrian images from a video, selecting one pedestrian image as a trigger image, and taking the rest as benign images; secondly, fast Fourier transform is adopted, amplitude spectrums and phase spectrums of the trigger image and the benign image are obtained respectively, and a new amplitude spectrum is synthesized by fusing the amplitude spectrums of the trigger image and the benign image; and inverse Fourier transform iFFT is applied to the synthesized amplitude spectrum and the original phase spectrum of the benign image to obtain a polluted image. And finally, combining the polluted image and the benign image to construct a backdoor attack data set, and training a pedestrian re-identification model by adopting the backdoor attack data set to obtain a pedestrian re-identification result. According to the method, the pedestrian re-identification backdoor attack concealment is improved to enhance the robustness of the pedestrian re-identification model, and pedestrian re-identification is accurately and efficiently realized.

Description

Technical Field

[0001] This invention belongs to the field of pedestrian re-identification technology, and specifically relates to a pedestrian re-identification method and system based on frequency domain noise injection backdoor attack. Background Technology

[0002] With the advent of the digital age, there is growing interest in person re-identification, a task that aims to match individuals of interest across multiple non-overlapping camera views. Person re-identification has been widely applied in video surveillance and crime detection for public safety. Previous research has achieved significant retrieval performance, partly due to the ever-increasing size of datasets. However, building the datasets required for training deep models is both time-consuming and laborious, leading many algorithm developers to use third-party datasets, which introduces potential security risks from backdoor attacks. Therefore, researchers often utilize simulated backdoor attacks to test model robustness. Backdoor attacks occur in images contaminated by backdoor triggers, where the labels are changed to the target labels and added to the training set, causing the model to misclassify the target label during the inference phase, severely impacting the robustness of person re-identification. Compared to image classification, backdoor attacks in person re-identification are more challenging. Specifically, "all-to-one" and "all-to-all" attacks in image classification tasks are two attack scenarios that require the target labels to remain consistent during training and testing. However, person re-identification is an open-set identification problem, where the training and test sets have non-overlapping identities. In other words, the target identity does not exist in the training set during the inference phase, so existing methods for robustness of simulated backdoor attack detection models cannot dynamically generate new triggers based on the target identity.

[0003] In research simulating backdoor attack scenarios in person re-identification, only one groundbreaking work, DT-IBA, dynamically generates triggers for any new target identity outside the training set. Specifically, given a benign image, it generates a backdoor trigger containing an unknown target identity specified by a reference image. Unlike traditional backdoor attacks that only implement non-targeted attacks and degrade the performance of backdoor models, DT-IBA also allows targeted attacks, where the target person can appear in the first 10 retrieval results. However, the problem of insufficient trigger stealth remains, meaning that the robustness evaluation of person re-identification is still incomplete. Summary of the Invention

[0004] To address the aforementioned problems, this invention provides a pedestrian re-identification method and system based on a frequency domain noise injection backdoor attack. The purpose of this invention is to further simulate the threat of pedestrian re-identification backdoor attacks, thereby improving the completeness of the robustness assessment of pedestrian re-identification. Specifically, given a trigger image and a benign image, a Fast Fourier Transform (FFT) is first applied to obtain their amplitude and phase spectra, respectively, to facilitate subsequent trigger injection. It is worth noting that a series of previous studies have proposed methods for designing hidden triggers for classification tasks. However, due to the differences between boundary regression tasks (classification) and contrastive learning tasks (retrieval), these methods cannot be directly applied to pedestrian re-identification. Instead, this invention linearly combines the amplitude spectra of the two images through interpolation to obtain the amplitude spectrum of the contaminated image, thus preserving spatial layout well without sacrificing visual quality. Finally, the contaminated image can be generated by performing an inverse Fourier transform on the amplitude spectrum of the contaminated image and the phase spectrum of the benign image. Compared to the spatial domain, frequency domain noise injection has advantages in preserving the naturalness of backdoor samples, further improving the completeness of the robustness assessment of pedestrian re-identification.

[0005] In one aspect, this invention provides a pedestrian re-identification method based on a frequency domain noise injection backdoor attack, comprising the following steps: Step 1: Obtain pedestrian images from the video, select one pedestrian image as the trigger image, and the rest as benign images.

[0006] Step 2: Use Fast Fourier Transform (FFT) to obtain the amplitude spectrum and phase spectrum of the trigger image and the benign image, respectively.

[0007] Step 3: Keep the phase spectrum of the benign image unchanged, and synthesize a new amplitude spectrum by fusing the amplitude spectra of the trigger image and the benign image.

[0008] Step 4: Obtain the contaminated image by applying inverse Fourier transform (iFFT) to the synthesized amplitude spectrum and the original phase spectrum of the benign image.

[0009] Step 5: Combine contaminated images with benign images to construct a backdoor attack dataset. Use the backdoor attack dataset to train the pedestrian re-identification model and obtain the pedestrian re-identification results.

[0010] In another aspect, the present invention provides a pedestrian re-identification system based on a frequency domain noise injection backdoor attack, comprising the following modules: The data acquisition module is used to acquire pedestrian images from the video, and selects one pedestrian image as the trigger image, while the rest are considered benign images.

[0011] The contaminated image generation module is used to generate a contaminated image from a benign image by fusing the amplitude spectrum.

[0012] The pedestrian re-identification output module is used to combine contaminated images with benign images to construct a backdoor attack dataset. The pedestrian re-identification model is trained using the backdoor attack dataset to obtain the pedestrian re-identification results.

[0013] Furthermore, the pollution image generation module includes the following units: The Fast Fourier Transform (FFT) unit is used to obtain the amplitude spectrum and phase spectrum of the trigger image and the benign image, respectively, through Fast Fourier Transform (FFT).

[0014] The amplitude spectrum synthesis unit is used to maintain the phase spectrum of the benign image unchanged and synthesize a new amplitude spectrum by fusing the amplitude spectra of the trigger image and the benign image.

[0015] A contaminated image unit is used to obtain a contaminated image by applying an inverse Fourier transform (iFFT) to the synthesized amplitude spectrum and the original phase spectrum of the benign image.

[0016] Beneficial effects of this invention: Compared to existing methods, this invention is the first to attempt to specifically inject frequency triggers into person re-identification backdoor attacks. By utilizing frequency-domain noise injection to create subtle yet effective triggers, model behavior can be manipulated in a way that is difficult to detect. The amplitude spectra of the triggered and benign images are interpolated while maintaining the phase spectrum, effectively fusing features from both images. By focusing solely on the amplitude spectrum, this invention ensures that the basic semantic content of the original image is preserved, allowing the contaminated image to maintain a natural appearance. Extensive experiments were conducted on various datasets and baseline person re-identification models to comprehensively evaluate the performance of this invention, covering not only various person re-identification models but also different scenarios and conditions. Furthermore, this invention evaluates the effectiveness of the method against several backdoor defense methods, providing a robust framework for evaluating the robustness of person re-identification.

[0017] This invention is termed a person re-identification backdoor attack based on frequency domain noise injection (FBAP). It is the first attempt to inject frequency triggers within the context of a person re-identification backdoor attack. This invention utilizes frequency domain noise injection to create subtle yet effective triggers, enabling manipulation of model behavior without easy detection.

[0018] This invention interpolates the amplitude spectra of both the triggered and clean images while maintaining the phase spectrum, enabling effective fusion of the characteristics of the two images. By focusing solely on the amplitude spectrum, this invention ensures that the essential semantic content of the original image is preserved, thus allowing the contaminated image to retain its natural appearance.

[0019] This invention underwent extensive experiments on various datasets and person re-identification baselines to comprehensively evaluate its performance, encompassing not only diverse person re-identification models but also different scenarios and conditions. Furthermore, this invention evaluated the effectiveness of the proposed method against several backdoor defense techniques, providing a robust framework for evaluating the robustness of person re-identification. This invention enhances the robustness of the person re-identification model by improving the concealment of backdoor attacks, achieving accurate and efficient person re-identification. Attached Figure Description

[0020] Figure 1 The residual image results between the original image and the poisoned image under different poisoning methods; Figure 2 This is the overall flow of the FBAP method of the present invention; Figure 3 The impact of different contamination rates on the DukeMTMC dataset; Figure 4 For different The impact of the value on the Market1501 dataset; Figure 5 Visualization of poisoned images on the Market1501 dataset The changes in value. Detailed Implementation

[0021] Example 1: In one aspect, this invention provides a pedestrian re-identification method based on a frequency domain noise injection backdoor attack, comprising the following steps: Step 1: Obtain pedestrian images from the video, select one pedestrian image as the trigger image, and the rest as benign images.

[0022] Step 2: Use Fast Fourier Transform (FFT) to obtain the amplitude spectrum and phase spectrum of the trigger image and the benign image, respectively.

[0023] Step 3: Keep the phase spectrum of the benign image unchanged, and synthesize a new amplitude spectrum by fusing the amplitude spectra of the trigger image and the benign image.

[0024] Step 4: Obtain the contaminated image by applying inverse Fourier transform (iFFT) to the synthesized amplitude spectrum and the original phase spectrum of the benign image.

[0025] Step 5: Combine contaminated images with benign images to construct a backdoor attack dataset. Use the backdoor attack dataset to train the pedestrian re-identification model and obtain the pedestrian re-identification results.

[0026] In another aspect, the present invention provides a pedestrian re-identification system based on a frequency domain noise injection backdoor attack, comprising the following modules: The data acquisition module is used to acquire pedestrian images from the video, and selects one pedestrian image as the trigger image, while the rest are considered benign images.

[0027] The contaminated image generation module is used to generate a contaminated image from a benign image by fusing the amplitude spectrum.

[0028] The pedestrian re-identification output module is used to combine contaminated images with benign images to construct a backdoor attack dataset. The pedestrian re-identification model is trained using the backdoor attack dataset to obtain the pedestrian re-identification results.

[0029] Furthermore, the pollution image generation module includes the following units: The Fast Fourier Transform (FFT) unit is used to obtain the amplitude spectrum and phase spectrum of the trigger image and the benign image, respectively, through Fast Fourier Transform (FFT).

[0030] The amplitude spectrum synthesis unit is used to maintain the phase spectrum of the benign image unchanged and synthesize a new amplitude spectrum by fusing the amplitude spectra of the trigger image and the benign image.

[0031] A contaminated image unit is used to obtain a contaminated image by applying an inverse Fourier transform (iFFT) to the synthesized amplitude spectrum and the original phase spectrum of the benign image.

[0032] Example 2: like Figure 2 As shown, the pedestrian re-identification method based on frequency domain noise injection backdoor attack proposed in this invention can be divided into three stages. First, this invention uses Fast Fourier Transform (FFT) to obtain the amplitude spectrum and phase spectrum of the trigger image and the benign image, respectively. Then, to maintain concealment, this invention keeps the phase spectrum of the benign image unchanged, while synthesizing a new amplitude spectrum by fusing the amplitude spectra of the two images. Finally, this invention obtains the contaminated image by applying Inverse Fourier Transform (iFFT) to the synthesized spectrum and the original phase spectrum of the benign image.

[0033] (I) Basic Definitions: First, we introduce some assumptions and definitions used in this invention. In this invention, the image database is denoted as... CNN-based models map images x∈D to feature vector spaces. , recorded as , where θ represents the model parameters. Generally, the distance between positive sample pairs (with the same person ID) extracted by a well-trained re-identification model should be smaller than the distance between negative sample pairs (with different IDs). Given a query image, a ranking list is obtained based on the distance between the library images and the query image; a higher ranking indicates a greater probability that the library image and the query image share the same identity. Let... Let x represent the training dataset and labels during the training phase, where xi Let ∈X = {0, ..., 255}c×w×H, yi∈Y = {1, ..., N}. cl = {cl1, cl2, ..., cls} is a set of S target classes. When pollution f θ At that time, force it to learn a target label function clb and change the network's behavior so that: (1) Typical trigger The injection function is defined in the spatial domain and parameterized with hyperparameters m∈[0,1]. Assuming the input sample x and the key pattern k are in their vector representations, the trigger injection function can be defined as follows: (2) Pollution using ratio p After a subset, the input (x, y) will be a backdoor pair Replaced, of which It is a backdoor injection function. It is the target label function.

[0034] (ii) Frequency noise attack: Figure 2 This paper demonstrates the overall process of the proposed method. The attacker's goal is to implant a backdoor into the model using contaminated data, thereby manipulating the model's inference results. When designing triggers, two core properties need to be considered: stealth and efficiency. Stealth ensures that backdoor samples are difficult for humans to detect, while efficiency guarantees that activating the backdoor can quickly and accurately execute malicious operations. Therefore, the main challenge lies in ensuring that the model can effectively learn triggers from a limited number of contaminated training samples. The key to overcoming this challenge is to infer the important regions of dataset information that the model focuses on during training and strategically inject triggers into these regions. Therefore, the main idea of ​​this invention is to design an injection function in the frequency domain. This function can preserve spatial layout (i.e., pixel semantics) well without sacrificing visual quality. Given a benign image... and specific trigger image x t It can be done through FFT F Obtain their frequency space signals: , (3) , (4) in , These are the corresponding frequency coordinates in the frequency domain. For the channel, , For the row and column indices of the pixels, , These are the height and width of the image. It is the imaginary unit.

[0035] In the frequency domain, amplitude represents the degree to which frequency components exist, while phase determines how they combine to form specific image features. Therefore, this invention, in designing the injection function, focuses on the amplitude spectrum while preserving the phase spectrum information. This ensures the concealment of the contaminated image. Since the human eye is more sensitive to high-frequency signals in an image, this invention only alters the low-frequency region of the image.

[0036] set up For the amplitude and phase components of the image FFT result, and The amplitude and phase spectra are expressed as follows: , (5) , (6) in, benign image amplitude component, To trigger image The amplitude component; benign image Phase components, To trigger image The phase component; specifically, using a trigger image. The amplitude spectrum is used as the key mode, and through mixing and Synthesize a new amplitude spectrum Triggered as a backdoor.

[0037] Therefore, binary masks are introduced. ,in The location and range of the mask were determined. The low-frequency patch to be mixed in the amplitude spectrum has a value of 1 within the patch and 0 elsewhere. α is expressed as the mixing ratio to adjust... and The amount of information provided, the synthesized amplitude spectrum It can be calculated as: (7) Then, we can get and compared it with the original phase spectrum Combined, through inverse FFT F -1 Obtaining images of contamination: (8) The designed trigger has no additional effect on the phase spectrum because it only preserves the original phase spectrum. Therefore, the contaminated image It can preserve the original spatial layout and semantics very well. At the same time, it absorbs some from the trigger image. The low-frequency information is helpful for subsequent model training.

[0038] (III) Backdoor Training: After contaminating the training images with frequency-based triggers, it is possible to obtain The attacked model was trained using both benign and corrupted images as a standard protocol. (9) During training, the ratio of clean data to contaminated data with specific triggers was controlled in mini-batches. Note that a large number of contaminated training samples have a higher risk of being detected.

[0039] Detection methods are more effective at training backdoor models than using a small number of contaminated training samples. After training, only specific trigger images are used. This is necessary to activate the backdoor attack. Please note that the implementation of the method in this invention relies only on a few hyperparameters and trigger images. Therefore, this is a unified attack technique applicable to various ReID models.

[0040] The entire algorithm is shown in Algorithm 1.

[0041] Example 3: Datasets: Experiments were conducted on two benchmark datasets, Market1501 and DukeMTMC. Market1501 contains 1,501 individuals and 32,668 images from 6 cameras, of which 12,936 images were used for training, involving 751 identities; and 19,732 images were used for testing, involving 750 identities. DukeMTMC contains 1,404 identities and 36,411 images from 8 cameras, of which 16,522 images from 702 identities were used for training, and 17,661 images from 702 identities were used for testing.

[0042] Target Models: FastReID, BoT, and AGW were selected as target models. FastReID is a PyTorch toolkit for real-world person re-identification. It provides a robust baseline method that achieves state-of-the-art performance on multiple tasks in practical applications. BoT is considered a highly effective baseline method. It integrates several common techniques, significantly improving the performance of ReID models without increasing model complexity. AGW significantly improves the performance of person re-identification by combining attention mechanisms and weighted triplet loss. Furthermore, this invention also attacks several part-based ReID methods, including MGN, PCB, and HRNet-18.

[0043] Baseline: Inspired by DT-IBA, BadNets, Blended, ReFool, SIG, and WaNet were also selected. Upon further comparison, these are backdoor attack methods originally designed for image classification tasks.

[0044] Evaluation metrics: MAP@all and R@10, two widely used metrics, were reported. Additionally, Attack Success Rate (ASR), the percentage of successful attacks, was used as a measure of attack performance. Benign Accuracy (BA) was used to evaluate the attack model's performance on clean data; this refers to the percentage of clean probe images that successfully rank within the top ten positive images. To measure the stealth of the backdoor trigger, the following metrics were used: Structural Similarity Index (SSIM), Peak Signal-to-Noise Ratio (PSNR), and Learned Perceptual Patch Similarity (LPIPS) to measure the difference between clean and contaminated images.

[0045] Figure 1 The qualitative comparison between the method of this invention and previous state-of-the-art baselines is shown. It can be seen that DT-IBA still leaves obvious traces of contamination, which can be clearly observed in the residual plot. The term "stealth" refers to the fact that the generated contaminated image should be visually similar to the original image without any anomalies. Therefore, improving the stealth of pedestrian re-identification backdoor attacks to enhance the robustness assessment of pedestrian re-identification models is the main driving force behind this invention.

[0046] Experimental results: Table 1. Results of the attack method on the Market-1501 dataset.

[0047] Table 2 Results of the attack method on the DukeMTMC dataset

[0048] Validity: To evaluate the effectiveness of the proposed method, we first attempted to attack different ReID models using different backbones on the Market-1501 and DukeMTMC datasets. As shown in Tables 1 and 2, the attack method of this invention achieved high ASR and BA results on different datasets.

[0049] The ReID method and different backbones on two datasets are also presented. For clean data, the ReID performance of the model trained with clean examples is also reported for comparison. Clearly, it can be observed that there is almost no performance degradation with clean data, which precisely demonstrates that the method of this invention is superior not only in terms of backdoor attack performance but also in terms of stealth for benign use. This invention is also compared with two state-of-the-art baseline methods, BadHash and DT-IBA, and the results are shown in Table 3. It can be seen that the method of this invention exhibits consistent performance improvements on both methods, both across different ReID models and all evaluation metrics, which also validates the effectiveness of the DT-IBA method.

[0050] Table 3 Comparison of Baseline Methods

[0051] Stealth: To investigate the stealth of the backdoor, some quantitative results and comparisons are reported in Table 4. The stealth of the contaminated image was assessed by measuring the visual differences between the original image and the contaminated image.

[0052] Table 4 Quantitative Results and Comparisons

[0053] The quality metrics are SSIM, PSNR, and LPIPS. It can be seen that from the perspective of backdoor attacks, the method of this invention achieves the best attack effect; from the perspective of image concealment, the method of this invention still exhibits the best contaminated image quality. Compared with the spatial domain, frequency-based trigger injection better preserves the naturalness of the backdoor sample. This optimal trade-off also shows that the attack effectiveness of the method of this invention does not come at the expense of image quality. Specifically, this invention achieves the greatest performance degradation on contaminated images, while BA only shows a slight degradation, which is a significant improvement. Therefore, the contaminated images of this invention are difficult to distinguish from the original images, making anomaly detection difficult.

[0054] Table 5 illustrates the attack performance of this invention compared to RBAT defense mechanisms. RBAT defenses utilize high-frequency artifacts to detect existing backdoor triggers, identifying such threats even without prior knowledge of specific attack details or target models. The results show that the method of this invention outperforms DT-IBA against frequency-based defense strategies. This improvement highlights the effectiveness and adaptability of the invention's technology in dealing with complex detection mechanisms targeting high-frequency components. It should be noted that although there is a slight decrease in cleanliness compared to DT-IBA, this reduction is considered acceptable to a certain extent because the attack performance is enhanced. Balancing high cleanliness with effective backdoor attack capabilities is a common challenge in this field. Therefore, the method of this invention allows for more powerful attacks while remaining within a reasonable performance degradation range. This finding underscores its practicality.

[0055] Table 5 Attack performance compared to RBAT defense mechanism

[0056] Ablation studies: The impact of contamination rate. To comprehensively evaluate the performance of the method of this invention, an ablation study focusing on the hyperparameter "contamination rate" was conducted. The results of this study are as follows: Figure 3 As shown in the figure, the method of this invention significantly improves backdoor attack performance in the initial stage as the contamination rate increases, and then stabilizes within a relatively consistent range. This trend can be attributed to the fact that more contaminated images enhance the destructiveness of model training, thereby increasing the attack success rate. However, it should be noted that while a higher contamination rate can improve the effectiveness of the attack, it also increases the likelihood of exposing the trigger image. This exposure weakens the stealth of the backdoor attack, making it easier to detect. Considering these factors, a contamination rate of 37.5 ± 1.5% was determined to achieve the optimal balance between attack effectiveness and stealth. This default setting enables robust performance while minimizing detection risk.

[0057] The effects of different α values. Figure 4 The results for Adversarial Success Rate (ASR) and Benign Accuracy (BA) are presented as the hyperparameter α varies. A significant improvement in ASR is observed when α increases from 0.05 to 0.5, indicating enhanced effectiveness of the backdoor attack. In contrast, BA remains relatively stable throughout the range, suggesting that the model maintains its performance on clean data despite the enhanced attack effectiveness. Furthermore, Figure 5Visual evidence is provided showing that the difference between the contaminated image and its original counterpart gradually increases as α changes from 0 to 1. This observation is consistent with the frequency-based trigger generation method of this invention, where a higher α value indicates that more trigger image semantics have been injected into the contaminated image. Given the need for attack performance... To strike a balance between image quality and α, an α value of 0.2 was chosen. This value not only significantly improves the effectiveness of the attack but also maintains acceptable visual fidelity of the contaminated images, thus ensuring they are more difficult to detect and more covert in practical applications.

Claims

1. A pedestrian re-identification method based on a frequency domain noise injection backdoor attack, characterized in that, The method comprises the following steps: Step 1, obtaining pedestrian images from a video, and selecting one pedestrian image as a trigger image and the rest as benign images; Step 2, obtaining the amplitude spectrum and the phase spectrum of the trigger image and the benign images respectively by using fast Fourier transform (FFT), and synthesizing a new amplitude spectrum by fusing the amplitude spectrum of the trigger image and the benign images; Step 3, obtaining a contaminated image by applying inverse fast Fourier transform (iFFT) to the synthesized amplitude spectrum and the original phase spectrum of the benign images; Step 4, combining the contaminated image and the benign images to construct a backdoor attack dataset, training a pedestrian re-identification model using the backdoor attack dataset, and obtaining a pedestrian re-identification result.

2. The method of claim 1, wherein the frequency domain noise injection backdoor attack based pedestrian re-identification method is characterized by, The step 2 is specifically implemented as follows: Step 2.1, obtaining the amplitude spectrum and the phase spectrum of the trigger image and the benign images respectively by using fast Fourier transform (FFT); Step 2.2, keeping the phase spectrum of the benign images unchanged, and synthesizing a new amplitude spectrum by fusing the amplitude spectrum of the trigger image and the benign images.

3. The method of claim 2, wherein the frequency domain noise injection backdoor attack based pedestrian re-identification method is characterized by, The step 2.1 is specifically implemented as follows: Given a benign image and a trigger image x t , obtain their frequency space signals by FFT: wherein , is a corresponding frequency coordinate in the frequency domain, is a channel, , is a row index and a column index of a pixel, , is a height and a width of an image, is an imaginary unit; Let The amplitude and phase components of the image FFT result, A and φ, are expressed as: and The amplitude and phase spectra of A and φ are expressed as: wherein, is a benign image the amplitude component, is a trigger image the amplitude component of; is a benign image the phase component, is a trigger image the phase component of; using the amplitude spectrum of the trigger image as a key pattern, and by mixing and synthesizing a new amplitude spectrum as a backdoor trigger; The original phase spectrum is combined with the original phase spectrum : 。 4. The method of claim 3, wherein the frequency domain noise injection backdoor attack based pedestrian re-identification method is characterized by, In step 2.2, a new amplitude spectrum is synthesized In detail as follows: Introducing a binary mask ; where The position and extent of the mask is determined, and is expressed as a mixing ratio to adjust and The amount of information provided by the synthesis amplitude spectrum can be calculated as: 。 5. A pedestrian re-identification system based on frequency domain noise injection backdoor attack, for implementing the pedestrian re-identification method of any one of claims 1 to 4, characterized in that, The method comprises the following modules: A data acquisition module for obtaining pedestrian images from a video, and selecting one pedestrian image as a trigger image and the rest as benign images; A contaminated image generation module for generating a contaminated image by fusing the amplitude spectrum according to the benign images; A pedestrian re-identification output module for combining the contaminated image and the benign images to construct a backdoor attack dataset, training a pedestrian re-identification model using the backdoor attack dataset, and obtaining a pedestrian re-identification result.

6. The frequency domain noise injection backdoor attack based pedestrian re-identification system according to claim 5, wherein, The contaminated image generation module comprises the following units: A fast Fourier transform unit for obtaining the amplitude spectrum and the phase spectrum of the trigger image and the benign images respectively by using fast Fourier transform (FFT); An amplitude spectrum synthesis unit for keeping the phase spectrum of the benign images unchanged, and synthesizing a new amplitude spectrum by fusing the amplitude spectrum of the trigger image and the benign images; A contaminated image unit for obtaining a contaminated image by applying inverse fast Fourier transform (iFFT) to the synthesized amplitude spectrum and the original phase spectrum of the benign images.

Images