R$^2$TUA：基于重建残差的针对文本-图像行人重识别的目标与非目标攻击
R$^2$TUA: Reconstruction-residual Based Targeted and Untargeted Attack Against Text-Image Person Re-Identification
提出基于重建残差的对抗扰动生成方法，利用Transformer渐进多模态融合和软截断函数，可迁移至其他跨模态检索系统的对抗攻击与鲁棒性评估。
原文依据 we propose Reconstruction-residual based Targeted and Untargeted Attack (R^2TUA), which generates perturbations from an image and adversarial prompt
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论文本-图像行人重识别（TI-ReID）广泛应用于智能监控。基于深度神经网络和视觉语言模型构建的TI-ReID模型继承了对抗攻击的脆弱性，构成安全风险。然而，其安全性相比检索准确率而言研究较少，对对抗攻击的鲁棒性在很大程度上尚未被探索。为填补这一空白，我们提出了基于重建残差的目标与非目标攻击（R^2TUA），该方法从图像和对抗提示词生成扰动，误导TI-ReID将扰动图像与对抗身份匹配。为了精确地将身份属性注入扰动并实现细粒度的目标攻击，R^2TUA提出了基于Transformer的渐进多模态融合（TGMF），该模块以可调的跨模态权重在层间逐步融合图像和对抗提示词。此外，我们提出了一种完全可微的软截断函数（SCF），在确保扰动不易察觉的同时，避免了局部梯度消失效应，该效应会使训练陷入次优局部极小值。为了进一步使扰动图像与对抗文本描述对齐，同时引导它们与其原始描述不匹配，R^2TUA在训练中采用了（PPLs）和匹配损失。在多个数据集和模型上的广泛评估表明，R^2TUA具有优越的非目标攻击和目标攻击性能。它还表现出对黑盒模型的强适应性和可迁移性，在多个任务上优于所有相关攻击。
英文原文摘要 1585 字符
Text-Image Person Re-Identification (TI-ReID) is widely deployed in intelligent surveillance. Built on deep neural networks and vision-language models, TI-ReID models inherit vulnerabilities to adversarial attacks, posing security risks. Yet its security remains less explored than retrieval accuracy, and its robustness to adversarial attacks is largely unexplored. To fill this gap, we propose Reconstruction-residual based Targeted and Untargeted Attack (R^2TUA), which generates perturbations from an image and adversarial prompt that mislead TI-ReID into matching the perturbed image with the adversarial identity. To precisely inject identity attributes into perturbations and achieve fine-grained targeted attack, R^2TUA proposes Transformer-based Gradual Multimodal Fusion (TGMF) that fuses image and adversarial prompt progressively across layers with tunable cross-modal weight. In addition, we propose a fully differentiable Soft Clamp Function (SCF), ensuring perturbations remain inconspicuous while avoiding local gradient vanishing effects that would trap training into suboptimal local minima. To further align perturbed images with the adversarial text descriptions while leading them to mismatch their original descriptions, R^2TUA employs (PPLs) and matching losses during training. Extensive evaluations across multiple datasets and models demonstrate the superior untargeted attack and targeted attack performance of R^2TUA. It also exhibits strong adaptability and transferability against black-box models, outperforming all related attacks across multiple tasks.