# A Person Re-identification Data Augmentation Method with Adversarial Defense Effect

arXiv: https://arxiv.org/abs/2101.08783 · HTML: https://mlsanity.com/paper/2101.08783/

## Key facts

- Cited by 13 papers in the map (data through 14 Oct 2026).
- Builds on 32 of its 41 references that are in the map.
- First posted on arXiv 21 Jan 2021.

## Builds on (most cited first, 30 of 32)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [Adversarial examples in the physical world](https://mlsanity.com/paper/1607.02533/) (2016)
- [Theoretically Principled Trade-off between Robustness and Accuracy](https://mlsanity.com/paper/1901.08573/) (2019)
- [DeepFool: a simple and accurate method to fool deep neural networks](https://mlsanity.com/paper/1511.04599/) (2015)
- [Random Erasing Data Augmentation](https://mlsanity.com/paper/1708.04896/) (2017)
- [Countering Adversarial Images using Input Transformations](https://mlsanity.com/paper/1711.00117/) (2017)
- [Person Transfer GAN to Bridge Domain Gap for Person Re-Identification](https://mlsanity.com/paper/1711.08565/) (2017)
- [Beyond Part Models: Person Retrieval with Refined Part Pooling (and a Strong Convolutional Baseline)](https://mlsanity.com/paper/1711.09349/) (2017)
- [Bag of Tricks and A Strong Baseline for Deep Person Re-identification](https://mlsanity.com/paper/1903.07071/) (2019)
- [Circle Loss: A Unified Perspective of Pair Similarity Optimization](https://mlsanity.com/paper/2002.10857/) (2020)
- [Omni-Scale Feature Learning for Person Re-Identification](https://mlsanity.com/paper/1905.00953/) (2019)
- [Unlabeled Samples Generated by GAN Improve the Person Re-identification Baseline in vitro](https://mlsanity.com/paper/1701.07717/) (2017)
- [Re-ranking Person Re-identification with k-reciprocal Encoding](https://mlsanity.com/paper/1701.08398/) (2017)
- [PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples](https://mlsanity.com/paper/1710.10766/) (2017)
- [Joint Discriminative and Generative Learning for Person Re-identification](https://mlsanity.com/paper/1904.07223/) (2019)
- [Harmonious Attention Network for Person Re-Identification](https://mlsanity.com/paper/1802.08122/) (2018)
- [A study of the effect of JPG compression on adversarial images](https://mlsanity.com/paper/1608.00853/) (2016)
- [Relation-Aware Global Attention for Person Re-identification](https://mlsanity.com/paper/1904.02998/) (2019)
- [Interaction-and-Aggregation Network for Person Re-identification](https://mlsanity.com/paper/1907.08435/) (2019)
- [Learning with a Strong Adversary](https://mlsanity.com/paper/1511.03034/) (2015)
- [AlignedReID: Surpassing Human-Level Performance in Person Re-Identification](https://mlsanity.com/paper/1711.08184/) (2017)
- [AANet: Attribute Attention Network for Person Re-Identifications](https://mlsanity.com/paper/1912.09021/) (2019)
- [Auto-ReID: Searching for a Part-aware ConvNet for Person Re-Identification](https://mlsanity.com/paper/1903.09776/) (2019)
- [Dense Associative Memory is Robust to Adversarial Inputs](https://mlsanity.com/paper/1701.00939/) (2017)
- [Transferable, Controllable, and Inconspicuous Adversarial Attacks on Person Re-identification With Deep Mis-Ranking](https://mlsanity.com/paper/2004.04199/) (2020)
- [Second-order Non-local Attention Networks for Person Re-identification](https://mlsanity.com/paper/1909.00295/) (2019)
- [Biologically inspired protection of deep networks from adversarial attacks](https://mlsanity.com/paper/1703.09202/) (2017)
- [Adversarial Metric Attack and Defense for Person Re-identification](https://mlsanity.com/paper/1901.10650/) (2019)

## Built on by (most cited first, 13 of 13)

- [Beyond Augmentation: Empowering Model Robustness under Extreme Capture Environments](https://mlsanity.com/paper/2407.13640/) (2024)
- [DC-Former: Diverse and Compact Transformer for Person Re-Identification](https://mlsanity.com/paper/2302.14335/) (2023)
- [Benchmarks for Corruption Invariant Person Re-identification](https://mlsanity.com/paper/2111.00880/) (2021)
- [Multimodal Data Augmentation for Visual-Infrared Person ReID with Corrupted Data](https://mlsanity.com/paper/2211.11925/) (2022)
- [PatchMix Augmentation to Identify Causal Features in Few-shot Learning](https://mlsanity.com/paper/2211.16019/) (2022)
- [Data Augmentation in Human-Centric Vision](https://mlsanity.com/paper/2403.08650/) (2024)
- [GS-STVSR: Ultra-Efficient Continuous Spatio-Temporal Video Super-Resolution via 2D Gaussian Splatting](https://mlsanity.com/paper/2604.18047/) (2026)
- [HBReID: Harder Batch for Re-identification](https://mlsanity.com/paper/2112.04761/) (2021)
- [Fusion for Visual-Infrared Person ReID in Real-World Surveillance Using Corrupted Multimodal Data](https://mlsanity.com/paper/2305.00320/) (2023)
- [PAFormer: Part Aware Transformer for Person Re-identification](https://mlsanity.com/paper/2408.05918/) (2024)
- [A Review of Image Retrieval Techniques: Data Augmentation and Adversarial Learning Approaches](https://mlsanity.com/paper/2409.01219/) (2024)
- [Fusing Physics-Driven Strategies and Cross-Modal Adversarial Learning: Toward Multi-Domain Applications](https://mlsanity.com/paper/2412.00341/) (2024)
- [Effective Dual-Region Augmentation for Reduced Reliance on Large Amounts of Labeled Data](https://mlsanity.com/paper/2504.13077/) (2025)

## Abstract (arXiv)

The security of the Person Re-identification(ReID) model plays a decisive role in the application of ReID. However, deep neural networks have been shown to be vulnerable, and adding undetectable adversarial perturbations to clean images can trick deep neural networks that perform well in clean images. We propose a ReID multi-modal data augmentation method with adversarial defense effect: 1) Grayscale Patch Replacement, it consists of Local Grayscale Patch Replacement(LGPR) and Global Grayscale Patch Replacement(GGPR). This method can not only improve the accuracy of the model, but also help the model defend against adversarial examples; 2) Multi-Modal Defense, it integrates three homogeneous modal images of visible, grayscale and sketch, and further strengthens the defense ability of the model. These methods fuse different modalities of homogeneous images to enrich the input sample variety, the variaty of samples will reduce the over-fitting of the ReID model to color variations and make the adversarial space of the dataset that the attack method can find difficult to align, thus the accuracy of model is improved, and the attack effect is greatly reduced. The more modal homogeneous images are fused, the stronger the defense capabilities is . The proposed method performs well on multiple datasets, and successfully defends the attack of MS-SSIM proposed by CVPR2020 against ReID [10], and increases the accuracy by 467 times(0.2% to 93.3%).The code is available at https://github.com/finger-monkey/ReID_Adversarial_Defense.