面向局部人群计数的跨范式可迁移生成对抗扰动
Generative Adversarial Perturbations with Cross-paradigm Transferability on Localized Crowd Counting
针对人群计数中密度图与点回归两种范式，提出统一的多任务对抗扰动生成框架，可用于评估跨范式模型的对抗鲁棒性，并为设计范式无关的防御提供测试基准。
原文依据 cross-paradigm attacks (i.e., across both density map-based models and point regression-based models) remain unexplored
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论最优的人群计数与定位主要采用两种建模范式：密度图与点回归。鉴于该领域的安全影响，针对模型鲁棒性的对抗攻击研究正受到积极关注。近期研究已证明基于密度图的方法之间可通过对抗补丁实现迁移性，但跨范式攻击（即同时跨越基于密度图的模型与基于点回归的模型）仍未被探索。我们提出一种新颖的对抗框架，通过全面的多任务损失优化同时攻破密度图与点回归两种架构范式。对于点回归模型，我们采用场景密度特定的高置信度 logit 抑制；对于密度图方法，我们采用峰值定向的密度图抑制。二者均与模型无关的感知约束相结合，以确保扰动有效且对人眼不可察觉。大量实验证明了我们攻击的有效性：与干净图像相比，平均绝对误差平均提升 7 倍，同时保持有竞争力的视觉质量，并成功迁移至七个最优人群模型，迁移比在 0.55 至 1.69 之间。与最优的可迁移攻击策略相比，我们的方法在攻击有效性与不可察觉性之间取得了平衡。源代码见 https://github.com/simurgh7/CrowdGen。
英文原文摘要 1492 字符
State-of-the-art crowd counting and localization are primarily modeled using two paradigms: density maps and point regression. Given the field's security ramifications, there is active interest in model robustness against adversarial attacks. Recent studies have demonstrated transferability across density-map-based approaches via adversarial patches, but cross-paradigm attacks (i.e., across both density map-based models and point regression-based models) remain unexplored. We introduce a novel adversarial framework that compromises both density map and point regression architectural paradigms through a comprehensive multi-task loss optimization. For point-regression models, we employ scene-density-specific high-confidence logit suppression; for density-map approaches, we use peak-targeted density map suppression. Both are combined with model-agnostic perceptual constraints to ensure that perturbations are effective and imperceptible to the human eye. Extensive experiments demonstrate the effectiveness of our attack, achieving on average a 7X increase in Mean Absolute Error compared to clean images while maintaining competitive visual quality, and successfully transferring across seven state-of-the-art crowd models with transfer ratios ranging from 0.55 to 1.69. Our approach strikes a balance between attack effectiveness and imperceptibility compared to state-of-the-art transferable attack strategies. The source code is available at https://github.com/simurgh7/CrowdGen