Abstract:Person re-identification (Re-ID) has rapidly advanced due to its widespread real-world applications. It poses a significant risk of exposing private data from its training dataset. This paper aims to quantify this risk by conducting a membership inference (MI) attack. Most existing MI attack methods focus on classification models, while Re-ID follows a distinct paradigm for training and inference. Re-ID is a fine-grained recognition task that involves complex feature embedding, and the model outputs commonly used by existing MI algorithms, such as logits and losses, are inaccessible during inference. Since Re-ID models the relative relationship between image pairs rather than individual semantics, we conduct a formal and empirical analysis that demonstrates that the distribution shift of the inter-sample similarity between the training and test sets is a crucial factor for membership inference and exists in most Re-ID datasets and models. Thus, we propose a novel MI attack method based on the distribution of inter-sample similarity, which involves sampling a set of anchor images to represent the similarity distribution that is conditioned on a target image. Next, we consider two attack scenarios based on information that the attacker has. In the "one-to-one" scenario, where the attacker has access to the target Re-ID model and dataset, we propose an anchor selector module to select anchors accurately representing the similarity distribution. Conversely, in the "one-to-any" scenario, which resembles real-world applications where the attacker has no access to the target Re-ID model and dataset, leading to the domain-shift problem, we propose two alignment strategies. Moreover, we introduce the patch-attention module as a replacement for the anchor selector. Experimental evaluations demonstrate the effectiveness of our proposed approaches in Re-ID tasks in both attack scenarios.

Determining the Robustness of Privacy Enhancing DeID Against the ReID Adversary: An Experimental Study

SecureReID: Privacy-Preserving Anonymization for Person Re-Identification

Privacy-Preserving Adaptive Re-Identification without Image Transfer

A Systematic Evaluation and Benchmark for Person Re-Identification: Features, Metrics, and Datasets

Combining Two Adversarial Attacks Against Person Re-Identification Systems

Towards Privacy-Preserving Person Re-identification via Person Identify Shift

Re-ID-leak: Membership Inference Attacks Against Person Re-identification

Decouple Co-Adaptation: Classifier Randomization for Person Re-Identification

Benchmarks for Corruption Invariant Person Re-identification

Interesting Receptive Region and Feature Excitation for Partial Person Re-identification

An Empirical Study of Person Re-Identification with Attributes

Invisible Backdoor Attack with Dynamic Triggers Against Person Re-identification

Frustratingly Easy Person Re-Identification: Generalizing Person Re-ID in Practice

Universal Adversarial Perturbations Against Person Re-Identification.

ID-aware Quality for Set-based Person Re-identification

Person Re-Identification without Identification via Event Anonymization

Benchmarking person re-identification datasets and approaches for practical real-world implementations

Face De-identification: State-of-the-art Methods and Comparative Studies

Image-Level Adaptive Adversarial Ranking for Person Re-Identification

Exert Diversity and Mitigate Bias: Domain Generalizable Person Re-identification with a Comprehensive Benchmark

Adversarial Metric Attack and Defense for Person Re-Identification