Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Generative Adversarial Perturbations with Cross-paradigm Transferability on Localized Crowd Counting

Alabi Mehzabin Anisha, Guangjing Wang, Sriram Chellappan

Abstract

State-of-the-art crowd counting and localization are primarily modeled using two paradigms: density maps and point regression. Given the field's security ramifications, there is active interest in model robustness against adversarial attacks. Recent studies have demonstrated transferability across density-map-based approaches via adversarial patches, but cross-paradigm attacks (i.e., across both density map-based models and point regression-based models) remain unexplored. We introduce a novel adversarial framework that compromises both density map and point regression architectural paradigms through a comprehensive multi-task loss optimization. For point-regression models, we employ scene-density-specific high-confidence logit suppression; for density-map approaches, we use peak-targeted density map suppression. Both are combined with model-agnostic perceptual constraints to ensure that perturbations are effective and imperceptible to the human eye. Extensive experiments demonstrate the effectiveness of our attack, achieving on average a 7X increase in Mean Absolute Error compared to clean images while maintaining competitive visual quality, and successfully transferring across seven state-of-the-art crowd models with transfer ratios ranging from 0.55 to 1.69. Our approach strikes a balance between attack effectiveness and imperceptibility compared to state-of-the-art transferable attack strategies. The source code is available at https://github.com/simurgh7/CrowdGen

Generative Adversarial Perturbations with Cross-paradigm Transferability on Localized Crowd Counting

Abstract

State-of-the-art crowd counting and localization are primarily modeled using two paradigms: density maps and point regression. Given the field's security ramifications, there is active interest in model robustness against adversarial attacks. Recent studies have demonstrated transferability across density-map-based approaches via adversarial patches, but cross-paradigm attacks (i.e., across both density map-based models and point regression-based models) remain unexplored. We introduce a novel adversarial framework that compromises both density map and point regression architectural paradigms through a comprehensive multi-task loss optimization. For point-regression models, we employ scene-density-specific high-confidence logit suppression; for density-map approaches, we use peak-targeted density map suppression. Both are combined with model-agnostic perceptual constraints to ensure that perturbations are effective and imperceptible to the human eye. Extensive experiments demonstrate the effectiveness of our attack, achieving on average a 7X increase in Mean Absolute Error compared to clean images while maintaining competitive visual quality, and successfully transferring across seven state-of-the-art crowd models with transfer ratios ranging from 0.55 to 1.69. Our approach strikes a balance between attack effectiveness and imperceptibility compared to state-of-the-art transferable attack strategies. The source code is available at https://github.com/simurgh7/CrowdGen

Paper Structure

This paper contains 22 sections, 18 equations, 4 figures, 4 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related Work
  3. Localized Crowd Counting
  4. Transferability of Adversarial Perturbations
  5. Methodology
  6. Problem Formulation
  7. Generative Adversarial Perturbation Model
  8. Adversarial Loss Functions
  9. Logit Suppression Loss
  10. Density Suppression Loss
  11. Perturbation Loss
  12. Experimental Settings
  13. Dataset
  14. Baselines
  15. Evaluation Metrics
  16. ...and 7 more sections

Figures (4)

  • Figure 1: Localized crowded counting predictions and density maps in clean and adversarial images designed in our work.
  • Figure 2: (i) Perturbation loss (GradCAM Perturbation & Frequency-Magnitude Reduction) in Sec. \ref{['sec:pert']}, and (ii) Paradigm-specific losses (Density & Logit suppression) in Secs. \ref{['sec:logit']} and \ref{['sec:den']} are proposed for training the perturbation generator $G_\theta$.
  • Figure 3: Sample adversarial image comparison with our method with respect to state-of-the-art models
  • Figure 4: GradCAM response of clean and adversarial images