Wasserstein Metric Attack on Person Re-identification

Abstract

Adversarial attacks in <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$l_{p}$</tex> ball have been recently investi-gated against person re-identification (ReID) models. How-ever, the <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$l_{p}$</tex> ball attacks disregard the geometry of the sam-ples. To this end, Wasserstein metric is a robust alternative as the attack incorporates a cost matrix for pixel mass movement. In our work, we propose the Wasserstein metric to perform adversarial attack on ReID system by projecting adversarial samples in the Wasserstein ball. We perform white-box and black-box attacks on state-of-the-art (SOTA) ReID models trained on Market-I 501, DukeMTMC-reID, and MSMTI7 datasets. The performance of best SOTA ReID models decreases drastically from 90.2% to as low as 0.4%. Our model outperforms the SOTA attack methods by 17.2% in white-box attacks and 14.4% in black-box at-tacks. To the best of our knowledge, our work is the first to propose the Wasserstein metric towards generating adversarial samples for ReID task.