Adversarial AI through Frequency-Domain Imperceptible Attack on Person Re-Identification

Video surveillance systems play an important role in maintaining security in smart city environments. In this context, person identification (Re-ID) systems based on deep learning are currently drawing substantial academic interest. However, these systems remain vulnerable to adversarial attacks. In existing methods, several attacks against Re-ID systems have been designed; nevertheless, they operate in the spatial domain. Existing attacks often suffer from perturbation visibility and low imperceptibility, making them easily detectable by human observers or automated detection systems. From this line of research, this study proposed a novel and potent alternative by designing frequency domain attacks, namely FreqAdv-FFT, FreqAdv-Wavelet, FreqAdv-Phase, FreqAdv-SelDCT, and FreqAdv-RandDCT. The frequency domain allows perturbations to be constructed in a way that utilizes the individual’s visual system’s decreased sensitivity to specific frequency ranges, making these perturbations less obvious. The proposed adversarial attacks were evaluated on two prominent datasets, Market-1501 and WB_WoB-ReID, across multiple models and attack variants. The highest performance degradation was observed with FreqAdv Wavelet on HRNet for the WB_WoB-ReID dataset, reducing the mean Average Precision (mAP) to 2.52%, and FreqAdv FFT on ResNet-50 for the Market-1501 dataset, achieving a mAP of 3.96%. The suggested attacks provide insights into establishing strong AI models as well as designing defenses for ReID-based surveillance systems that are relevant to the rising development of next-generation real-time applications.