Adversarial Semantic and Label Perturbation Attack for Pedestrian Attribute Recognition
Not on the map. Why?
Abstract (arXiv)
Pedestrian Attribute Recognition (PAR) is an indispensable task in human-centered research and has made great progress in recent years with the development of deep neural networks. However, the potential vulnerability and anti-interference ability have still not been fully explored. To bridge this gap, this paper proposes the first adversarial attack and defense framework for pedestrian attribute recognition. Specifically, we exploit both global- and patch-level attacks on the pedestrian images, based on the pre-trained CLIP-based PAR framework. It first divides the input pedestrian image into non-overlapping patches and embeds them into feature embeddings using a projection layer. Meanwhile, the attribute set is expanded into sentences using prompts and embedded into attribute features using a pre-trained CLIP text encoder. A multi-modal Transformer is adopted to fuse the obtained vision and text tokens, and a feed-forward network is utilized for attribute recognition. Based on the aforementioned PAR framework, we adopt the adversarial semantic and label-perturbation to generate the adversarial noise, termed ASL-PAR. We also design a semantic offset defense strategy to suppress the influence of adversarial attacks. Extensive experiments conducted on both digital domains (i.e., PETA, PA100K, MSP60K, RAPv2) and physical domains fully validated the effectiveness of our proposed adversarial attack and defense strategies for the pedestrian attribute recognition. The source code of this paper will be released on https://github.com/Event-AHU/OpenPAR.
Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Builds on 42 of its 67 references that are in the map. First posted on arXiv 29 May 2025.
Builds on
42 of 67 references.
References · 42
- 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
- 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
- 2023GPT-4 Technical Reportcited by 18,132
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2023Qwen Technical Reportcited by 3,273
- 2016Adversarial examples in the physical worldcited by 1,762
- 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
- 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
- 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
- 2017Countering Adversarial Images using Input Transformationscited by 517
30 more
- 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
- 2017Mitigating Adversarial Effects Through Randomizationcited by 382
- 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 352
- 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
- 2018Generating Adversarial Examples with Adversarial Networkscited by 256
- 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
- 2017Improving Person Re-identification by Attribute and Identity Learningcited by 95
- 2017HydraPlus-Net: Attentive Deep Features for Pedestrian Analysiscited by 89
- 2022Physical Adversarial Attack meets Computer Vision: A Decade Surveycited by 66
- 2021AdvDrop: Adversarial Attack to DNNs by Dropping Informationcited by 55
- 2019Pedestrian Attribute Recognition: A Surveycited by 49
- 2023CDUL: CLIP-Driven Unsupervised Learning for Multi-Label Image Classificationcited by 39
- 2023DiffAttack: Evasion Attacks Against Diffusion-Based Adversarial Purificationcited by 36
- 2017Attribute Recognition by Joint Recurrent Learning of Context and Correlationcited by 25
- 2023Pedestrian Attribute Recognition via CLIP based Prompt Vision-Language Fusioncited by 24
- 2023Enhancing Generalization of Universal Adversarial Perturbation through Gradient Aggregationcited by 22
- 2016Multi-task CNN Model for Attribute Predictioncited by 21
- 2019AT-GAN: An Adversarial Generator Model for Non-constrained Adversarial Examplescited by 17
- 2022Strong Transferable Adversarial Attacks via Ensembled Asymptotically Normal Distribution Learningcited by 15
- 2023The Best Defense is a Good Offense: Adversarial Augmentation against Adversarial Attackscited by 15
- 2023Mutual-modality Adversarial Attack with Semantic Perturbationcited by 14
- 2023SequencePAR: Understanding Pedestrian Attributes via A Sequence Generation Paradigmcited by 13
- 2024Pedestrian Attribute Recognition: A New Benchmark Dataset and A Large Language Model Augmented Frameworkcited by 10
- 2023Learning CLIP Guided Visual-Text Fusion Transformer for Video-based Pedestrian Attribute Recognitioncited by 9
- 2024An Empirical Study of Mamba-based Pedestrian Attribute Recognitioncited by 9
- 2025RGB-Event based Pedestrian Attribute Recognition: A Benchmark Dataset and An Asymmetric RWKV Fusion Frameworkcited by 7
- 2023AttMOT: Improving Multiple-Object Tracking by Introducing Auxiliary Pedestrian Attributescited by 6
- 2024Boosting Adversarial Transferability with Low-Cost Optimization via Maximin Expected Flatnesscited by 6
- 2025Recover and Match: Open-Vocabulary Multi-Label Recognition through Knowledge-Constrained Optimal Transportcited by 6
- 2024Spatio-Temporal Side Tuning Pre-trained Foundation Models for Video-based Pedestrian Attribute Recognitioncited by 5
Built on by
Citing papers per year: 2026: 2.
2 papers.