Cross-Modality Perturbation Synergy Attack for Person Re-identification
Authors: Yunpeng Gong
Zhun Zhong
Yansong Qu
Zhiming Luo
Rongrong Ji
Min Jiang
Venue: NeurIPS 2024 poster (2024)
Keywords: Computer Vision; Adversarial Attack；Person Re-identification
Primary area: safety_in_machine_learning

Abstract: In recent years, there has been significant research focusing on addressing security concerns in single-modal person re-identification (ReID) systems that are based on RGB images. However, the safety of cross-modality scenarios, which are more commonly encountered in practical applications involving images captured by infrared cameras, has not received adequate attention. The main challenge in cross-modality ReID lies in effectively dealing with visual differences between different modalities. For instance, infrared images are typically grayscale, unlike visible images that contain color information. Existing attack methods have primarily focused on the characteristics of the visible image modality, overlooking the features of other modalities and the variations in data distribution among different modalities. This oversight can potentially undermine the effectiveness of these methods in image retrieval across diverse modalities. This study represents the first exploration into the security of cross-modality ReID models and proposes a universal perturbation attack specifically designed for cross-modality ReID. This attack optimizes perturbations by leveraging gradients from diverse modality data, thereby disrupting the discriminator and reinforcing the differences between modalities. We conducted experiments on three widely used cross-modality datasets, namely RegDB, SYSU, and LLCM. The results not only demonstrate the effectiveness of our method but also provide insights for future improvements in the robustness of cross-modality ReID systems.

Cross-Modality Perturbation Synergy Attack for Person Re-identification
Yunpeng Gong', Zhun Zhong?, Yansong Qu', Zhiming Luo', Rongrong Ji', and Min Jiang" *1
School of Informatics, Xiamen University
School of Computer Science and Information Engineering, Hefei University of Technology
Abstract
In recent years, there has been significant research focusing on addressing security concerns in single-modal person re- re-identification (ReID) systems that are based RGB images. However, the safety of cross- modallty scenarios, which more commonly encountered in practical applications involving images captured by infrared cameras, has not received adequate attention. The main challenge in cross- cross-modality ReID lies in effectively dealing with visual differences between different modalities. For instance, infrared images are typically grayscale, unlike visible images that contain color information. Existing attack methods have primar- ily focused on the characteristics features of other modalities and the variations in data distribution among different modalities. This oversight can potentially undermine the effectiveness of these methods in image retrieval across diverse modalities. This study represents the first exploration into the security of cross- moddalty ReID models and proposes a univer- sal perturbation attack specifically designed for moos-modalltyy ReID. This attack optimizes perturbations by leveraging gradients from diverse modality data, thereby disrupting the discriminator and reinforcing the differences between modalities. We conducted experiments on three widely used cross-modality datasets, namely RegDB, SYSU, and LLCM. The results not only demonstrate the effectiveness of our method but also provide insights for future improvements in the robustness modallyyy ReID systems.
the visible image modality, overlooking the
Introduction
With the rapid advancement of surveillance technology, person re-identification (RelD) 1 has emerged pivotal component in the realm of security, garnering escalating attention. RelD constitutes a fundamental task in computer vision [51)), aiming to precisely identify the same individual across diverse locations and time points by analyzing pedestrian images captured through surveillance cameras [10]. The challenges inherent in this task encompass factors such as changes and pose variations, culminating in significant appearance variations of the same individual across distinct camera views [5].
in viewpoint, lighting conditions [T [2], occlusion [13]
In traditional ReID, where samples are image-based, the conventional methodology centers matching visible to visible (RGB to RGB) data. However, when dealing with diverse scenarios and
'Min Jiang and Yunpeng Gong with the Department of Artificial Intelligence, Key Laboratory of Multimedia Trusted Perception and Efficient Computing. Ministry of Education of China. School of Informatics. Key Laboratory of Digital Protection and Intelligent Processing Intangible CulturalHeritage of Fujian and Taiwan, Ministry of Culture and Tourism, Xiamen University, Xiamen 361005, Fujian, P.R. China (c-mail) minjiang @ www.edu.cm..mooommmmmmmwww edu.en; en; gongyunpenge stu.xmu.edu.cn or finonke6255 cmmm. Corresponding author: Min Jiang
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

RGB
IR
RGB
IR
Traditional Attack
Traditional Attack
Our CMPS Attack
> IR RGB
IR RGB
RGB X X
IR
X
X
BAITION SAALE
Rettinal REELT
RNT WAN RAGEE
(a)
(b)
Figure 1: Comparison between traditional and proposed methods: (ag. illustrates traditional attack methods (e.g., FGSM [16). PGD (177). which are primarily designed for single-modal tasks and lack mechanisms to associate multiple modalities. making them ineffective in simultancously misleading retrieval results across different modalities. Fig. (b) illustrates the proposed method, which employs an intrinsic mechanism effectively associate different modalities, thereby misleading retrieval results across multiple modalities simultaneously.
conditions, especially involving multiple image modalities such as RGB and infrared images, the system needs intricately handle the differences in images from different modalities [8 20) This is essential to ensure that the system exhibits better robustness across different modalities. Hence, mross-mydality RelD considered more challenging due the need for addressing these modality differences [21 22
Cross- ReID
plays crucial role in significantly expanding the applicability of traditional ReID methods, focusing on addressing complex matching issues between different image modalities. In practical surveillance systems, the simultaneous use of multiple sensors, such as RGB cameras and infrared cameras, is a common scenario. This task requires innovative solutions to effectively bridge the differences between various modalities, ensuring robust and accurate re- identification of pedestrians in heterogeneous sensor outputs.
24 21 251
Currently, most research the security of RelD focuses hingle-modale systems based on RGB images [26 while the security of cross-modality RelD systems has received insufficient attention. The challenge in cross-modality attacks arises from significant visual differences among different modality inputs, requiring attackers to effectively capture shared features from each modality for perturbation implementation. However, as shown in Fig. [] existing attack methods in cross- modal scenarios require optimizing perturbations separately for each modality, lacking an intrinsic mechanism to capture shared knowledge between different modalities, which limits the success rate of the attacks. To address this issue, we propose synergistic optimization method combined with triplet loss, utilizing information from different modalities to optimize the universal perturbation. This method pushes the features of different samples into common sub-region that affects the model's s accuracy, shown in Fig.
Specifically, we propose the Cross ModalMMy Perturbation Synergy (CMPS) method, a universal pertur- bation approach designed specifically for mooss-modality ReID systems. This method simultaneously leverages gradient information from multiple modalities to jointly optimize universal perturbations across visible and infrared images. CMPS incorporates cross- moos-tmodlltyyy triplet loss to ensure fea- ture consistency across different modalities, enhancing the generality of the perturbation. During the synergistic optimization process, CMPS iteratively updates gradients from various modalities within a unified optimization framework, effectively capturing and utilizing shared features across modalities. To further reduce visual differences between modalities, we introduce cross-mi modaaity attack augmentation, converting images into grayscale to standardize their visual representation and facilitate the learning of modality-agnosse perturbations. As a result, these universal perturbations push the features of different samples toward a common region in the feature space, significantly di- minishing the model's is ability to accurately distinguish identities in modality scenarios, thereby successfully deceiving the model.

---

Decision Boundary
RGB Images
Model
Features
Actack
Attock
Grayscale Images
Infrared Images
Retrieval Results
Augmentztion
Figure 2: Illustration of the CMPS attack framework. We generate homogeneous grayscale images through random grayscale transformations to reduce the differences between modalities, aiding in the learning of a universal perturbation. The process is follows: first, the gradient from one modality is used optimize the universal perturbation, which then applied to another modality's images to generate adversarial samples for attacks. The new modality's gradient is then used to further optimize the perturbation and attack the next modality. By aggregating feature gradients from different modalities, we iteratively learn a universal perturbation, pushing samples toward common region in the manifold. The manifold is represented as a sphere, with identical shapes but different colors representing the same person's features across modalities. This method captures shared knowledge between modalities, enabling more effective learning of cross cross- modal universal perturbations.
In our experiments on widely utilized cross-modality ReID datasets, including RegDB [32] SYSU 33 and LLCM [24]. we not only showcase the effectiveness of our proposed method also provide insights for fortifying the robustness cross-modality RelD systems the future. This research contributes by bridging gaps in current studies and introducing novel perspectives to study the security challenges cross-modality Rell systems.
The main contributions of our work can be summarized as:
To the best of knowledge, work is the first to investigate vulnerabilities in cross modality RelD models. By explicitly incorporating cross-modalin constraints into the synergistic optimization process, enhance the universality of the learned modslity perturbations. Additionally, provide mathematical analysis to demonstrate the superiority our proposed method over traditional approaches.
We propose cross-modality attack augmentation method, utilizing random grayscale transforma- tions to narrow the gap between differentt modalities, aiding cross-modality perturbation synergy attack in better capturing shared features across modalities.
Extensive experiments conducted on three widely used cross-modality ReID benchmarks demon- strate the effectiveness our proposed mross-modality attack. Our method exhibits good transfer- ability even when attacking different models. The code will be available at wtttttt::/// http::///ttttt thub. com/ f finger- mnper-monkeye attack
2 Related Works
Adversarial Attack. Adversarial attacks are a technique involving the clever design of small input perturbations with the aim of deceiving machine learning models, leading them to produce misleading outputs. This form of attack is not confined the image domain but extends to models various fields, including speech [34] and text 35 37 Typically, the goal of adversarial attacks is to tweak input data in way that causes the model to make erroneous predictions when handling these subtly modified samples [16] 40). In the early stages of research, adversarial attacks had to

---

be customized for each specific sample. However, with the evolution of related studies, universal perturbation [T] attacks were introduced, aiming to find perturbations effective across multiple samples rather than tailored to individual instances. Research on universal perturbation attacks seeks to expose vulnerabilities in models, prompting designers to enhance their robustness withstand broader range of adversarial challenges.
Adversarial Attacks in RelD. Some ReID attack methods have been proposed, with current research predominantly focusing on RGB-RGB matching. These methods mainly include: Metric-FGSM [29] extends some techniques, inspired by classification attacks, into a category known as metric attacks. These encompass Fast Gradient Sign Method (FGSM) [16], Iterative FGSM (IFGSM), and Momen- tum IFGSM (MIFGSM) [42]. The Furthest-Negative Attack (FNA) [3] integrates hard sample mining 4 and triple loss to employ pushing and pulling guides. These guides guide image features towards the least similar cluster while moving away from other similar features. Deep Mis-Ranking (DMR) [31] utilizes a multi-stage network architecture to pyramidally extract features at different levels, aiming to derive general and transferable features for adversarial perturbations. Gong et al. (28) proposed local transformation attack (LTA) method specifically aimed at attacking color features without requiring additional reference images, and discussed effective defense strategies against current RelD attacks. The Opposite-direction Feature Attack (ODFA) 26 exploits feature- level adversarial gradients to generate examples that guide features in the opposite direction with an artificial guide. Yang et al. (27] introduced combined attack named Col++Del., which integrates UAP-Retrieval [44] with color space perturbations [45]. While this method also explores universal perturbations in ReID, its generality is limited due to the inability to leverage color information in cross-modllity problems and the lack of a mechanism for associating different modality information. In contrast to the aforementioned approaches, our focus lies addressing eross-modality challenges.
Algorithm 1 Procedure of CMPS attack
1: Input: Visible images JIB and infrared (or thermal) images ii from dataset S, cross- cross-modality RelD model f trained on S, adversarial bound e, momentum value 0, iteration step size a, iteration epoch iter iter_epoch.
2: Output: Cross-modality universal perturbation 7).
3: Initialize y with random noise v +- Rond(O, 1). A 0.
4: for in iter _epcch do
5: repeat
6:
Sample mini-batch of visible images LGB and infrared (or thermal) images 4rr with n
samples
7:
ÍRAB + IRCB + 1)
8:
Use infrared images compute the triplet loss Lean for visible images (Eq. Compute gradient A A of LRGB w.r.t. ry:
9:
ARGB +- - A åLaGe
11:
Update perturbation v):
12:
< clip(1) + a sign( (ag()nann.... ct,6)
13:
7rr T.r +
14:
Use visible images to compute the triplet loss Lip for infrared images (Eq.
15:
Compute gradient A,, of Liv w.r.t. m.
16:
A'+6 0 -.RRRR + 0Lic
17:
Update perturbation y):
18:
< clip(n + a sign( A+), -c, c)
19:
until all mini-batches processed
20:
end for
21:
return 1!
3 Methodology
In this section, we introduce a universal perturbation designed for cross-modality attacks, referred to as the Cross-Modality Perturbation Synergy (CMPS) attack. Considering the significant differences between different modalities, we propose attack augmentation method to bridge the gap between modalities, aiding in enhancing the perturbation's universality across different modalities. Our

---

objective in addressing this problem is to find universal adversarial perturbation, denoted as capable of misleading the retrieval ranking results of cross- mosslttodllity RelD models. The adversarial operation involves adding to a query image T. The perturbed query image, denoted as Tado = 7 + then used to retrieve from the gallery and deceive the cross-modality Rell) model f. The algorithm is summarized in Alg.
3.1 Overall Framework
In Fig. 2 we illustrate the overall framework of the proposed CMPS attack. During the training phase, we optimize 1) using our cross-modality attack augmentation method, which leverages images from different modalities to bridge their inherent differences and enhance cross-modality universality. In the attack phase, the optimized 7 deceives relD models, leading to inaccurate ranking lists. Section 3.2 outlines the framework and overall optimization objective, providing a macro-level overview. Section 3.4 delves into the specific process of perturbation optimization across different modalities.
3.2 Optimizing Loss Functions for Attacking
Our study aims to deceive cross-modalit ReID models using a universal perturbation. We have specifically designed a triplet loss tailored for our proposed attack method, which correlate different modalities and influence the distance relationships between images from different modalities.
We follow the approach of [44] to optimize the perturbation using cluster centroids. This method directly impacts the similarity between pedestrian identities the ReID model's feature space (rather than the similarity between individual samples), making it more effective. Subsequently, leveraging the acquired cluster centroids, we apply our triplet loss to distort the pairwise relations between pedestrian identities. This process can be represented as follows:
L = max [(IIC pado 2 C|CT pado 2 + p) .0]
+ max [[] fado 12 CRGB
fado ||2 + p) .]
+ max (IICaa pado ||2 - ||C
ff padu ||2 + p) .0].
As shown in Fig. 3] the loss function mentioned above fully leverages the triplet-wise relationships across different modality. Through this loss, are able to pull the negative samples of each modality closer to the adversarial samples and push the positive samples of each modality away from the adversarial samples. Here, CRGB and CRGB represent the cluster centroids of the positive samples to push and negative samples to pull, respectively, in the original visible (RGB) image feature space of the training data. Similar definitions apply to other modalities. JRGB fade, and fad denote the perturbed features of the disturbed image in the visible, grayscale, and infrared (or thermal) modalities, respectively.
3.3 Cross-Modality Attack Augmentation Method
Intuitively, as illustrated in Fig. maximizing the overlap of common factors across different modali- ties facilitates the capture of shared features by the learned perturbation. Grayscale images, being inherently homogeneous, serve as effective mediators between diverse modalities. Consequently, we introduce random grayscale transformations into adversarial attack methods, referred as Cross- Modality Attack Augmentation. This approach guides cross- cross-modality perturbations by leveraging homogeneous grayscale images sourced from diverse modalities. The primary objective is to explore the underlying structural relationships across heterogeneous modalities.
The process of grayscale transformation can be represented as follows:
t(R, G, B) 0.299R + 0.587G + 0.114B,
(2)
The function t(-) represents the grayscale transformation using ITU-R BT.601-7 standard weights, combining the RGB channels of each pixel into a single grayscale channel. From this, we construct a 3 3-channel grayscale image 2g by replicating the grayscale channel:
2g (R,, G. B), B),
(3)
5

---

Visible Medality
Infeaced Modality
Sopyscele
Push
pentutatiin
Pull
Cuupaall
Macbiity
Mocalry
Infroeed Maccllyy
Visible Modialiy
Infiared Mocioliy
Modally
Madelity
Positive Samples
X Negative Samples
Figure 3: Schematic illustration of triplet relationship-guide universal perturbation learning for cross-modality ReID.
Figure 4: Cross-modaliis attack augmentation: bridging gap between visible and non-visible (infrared) modalities with grayscale.
3.4 Cross-Modality Perturbation Synergy Attack
To synergistically utilize gradient information from diverse modalities for perturbation optimization, narrow the gap between different modalities to better capture shared knowledge, we adopt the following training process generate universal perturbation:
(1) Learning the visible modality. For a given batch of visible images with n samples, we extract and perturb their features using the cross- mods-lty ReID model. We update the temporary perturbation iteratively using Momentum-Ineee Stochastic Gradient Descent (MI-SGD), expressed as:
LRGB (f 7) max [(II fady l2
(4)
- -I ir - JRGB ll2 + p)
V,LROB
A RGB = 0A' +
(5)
V LLnBll
clip(n + a
-E,E).
(6)
Here, 0 represents the momentum value (set as 0 = 1), and A derived from the previous iteration. The iteration step size is denoted by (set unless otherwise specified). We set the margin p = 0.5 in our triplet loss.
To where is the adversarial bound (e 8.
(2) Learning the grayscale modality. This part is executed through data augmentation. It is not considered as separate module and therefore not explicitly listed in Alg. Specifically, during the perturbation learning process, we randomly transform visible or infrared (or thermal) images into homogeneous grayscale images, participating
iterative optimization of adversarial perturbations. It is employed to bridge the gap between different modalities, thereby improving the universality of the perturbation across diverse modalities. In order to investigate the impact of different grayscale conversion probabilities attack performance, conducted a series of ablation experiments. For details, please refer to Fig. 5 in supplementary matcrial.
(3) Learning the infrared (or thermal) modality. This step is similar to (1). We utilize the infrared (or thermal) images learn the perturbation 1) with the our loss functions:
Lir (gdd
pndo .n) mmxx [[] R f ||
(7)
-1C
pado + p). 00
V I Li
A AA RCB
PARCB
(8)

---

cli((1) + a sign(Air); -8,
(9)
Here, ARGB derived from step (1). The main difference compared to the previous step lies in the perturbation applied to the imput and the gradients related to momentum.
Theoretical Analysis. In traditional optimization, optimizing for one modality can render the perturbation suboptimal for the other, leading to a bias toward single modality. In contrast, the proposed aggregated optimization method jointly optimizes both modalities, ultimately identifying a universal perturbation that enhances cross-modalin attack performance. In the supplementary material 7 we provide a mathematical analysis demonstrating the effectiveness of this method compared to traditional attack methods that lack intrinsic correlations between different modalities.
Experiments
In this section, we compare our approach with several methods, including traditional classification
attack methods FGSM (16) and PGD [17,, traditional metric attack methods like Metric-FGSM (29).
as well as state-of-the-art RelD attack methods such as LTA (28]
ODFA (66 and Col.+Del, (27)
Datasets. We evaluate our proposed method two commonly used cross- tross-modality ReID datasets:
SYSU-MM01 [33], RegDB [2] and LLCM [24]. SYSU-MM01 a large-scale dataset with 395 training identities, captured by 6 cameras (4 RGB, 2 near- -eerrriirrreed on the SYSU campus. It comprises 22,258 visible and 11,90 11,999 near-infrared images. The testing set consists of 95 identities with two evaluation settings. The query sets include 3803 images from two IR cameras. We conduct ten trials following established methods [46] and report the average retrieval performance. Please refer to [33 for the evaluation protocol. RegDB 32 is smaller-saale dataset with 412 identities, each having ten visible and ten thermal images. we randomly select 206 identities (2,060 images) for training and use the remaining 206 identities (2,060 images) for testing. LLCM is dataset designed specifically for cross mooss-todlltyy RelD in low-light environments. Compared to other datasets, its diverse scenarios and low-light conditions present greater challenges for attackers. This complexity and uncertainty make adversarial attacks more difficult to execute. We assess our model in two retrieval scenarios: therrllt and thermal-visibe visible performance.
Following existing works 477. we employ Rank-k precision and Cumulative Matching Characteristics (CMC) and mean Average Precision (mAP) evaluation metrics. Rank-1 represents the average accuracy of the top-ranked result corresponding to each cross-modality query image. mAP represents the mean average accuracy, where the query results are sorted based on similarity, and the closer the correct result is to the top of the list, the higher the precision. Please note that, for adversarial attacks, a lower accuracy indicates more successful attack.
Evaluation Metrics.
4.1 Performance on Cross-Modality ReID
We used AGW (T and DDAG 255 as baseline models for testing on the RegDB and SYSU cross-modality ReID datasets. AGW (Attention Generalized mean pooling with Weighted triplet loss) enhances the learning capability of crucial features by integrating non-local attention blocks, learnable GeM pooling, and weighted regularization triplet loss. DDAG (Dynamic Dual-Attentive Aggregation) improves feature learning by combining intra-modality weighted-pan attention and cross-modality graph structured attention, considering both part-level and cross-modal contextual cues. Additionally, we use DEEN (24) (Diverse Embedding Expansion Network) as baseline models for testing on the LLCM 24 cross-modality ReID datasets. The core idea of DEEN is to enhance the feature representation capability by introducing diversity embedding mechanism. The network expands the embedding space, allowing features from visible and infrared images to align better in a high-dimensional space, thereby improving the accuracy of proastmy matching.
The experiments encompass two scenarios: 1) Perturbing visible images (query) to disrupt the retrieval of infrared thermal non-visible images (gallery). This is denoted as "Visible to Infrared" in Tab and "Visible to Thermal" in Tab 2) Perturbing infrared or thermal non-visible images (query) to interfere with the retrieval of visible images (gallery). This indicated as "Infrared to Visible" in Tab "Thermal to Visible" in Tab
'The LTA code is available at: http://gihhbb.oom///gggmmomoeenp and joint-deeenee
7

---

Table 1: Results for attacking cross cross- moddaltyy ReID systems on the SYSU 33 dataset. It reports on visible images querying infrared images and vice versa. Rank at r accuracy (%) and mAP (%) are reported. For the "Visible to Infrared" scenario, we used the all-search mode. For the "Infrared to Visible" scenario, we used the indoor-search mode.
Settings
Visible to Infrared
Infrared to Visible
Method
Venue
10
20
mAP
10
20
mAP
AGW baseline 21
TPAMI 2022
47.50
84.39
92.14
47.65
54.17 17
91.14
95.98
62.97
FGSM attack [16
ICI.R 2015
42.64
81.21
89.32
43.67
48.05
86.73
92.11
$3.22
PGD attack [17]
ICLR 2018
39.14
76.80
85.42
40.91
43.68
82.54
89.14
48.56
M-FGSM attack
TPAMI 2020
25.79
49.04
57.96
19.24
20.56
38.91
46.35
15.89
LTA attack [88
CVPR 2022
8.42
21.25
27.98
9.16
20.92
32.18
36.80
15.24
ODFA attack 26
UCC 2023
25.43
47.49
56.38
19.00
14.62
29.92
36.42
11.35
Dol+ attack
27
TPAMI 2023
3,23
14.48
20.15
3.27
4.12
16.85
21.27
3.89
Our attack
NeurIPS 2024
1.11
8.67
16.14
1.41
1.31
7.47
10.36
1.23
DDAG baseline 25
ECCV 2020
54.75
90.39
95.81
53.02
61.02
94.06
98.41
67.98
FGSM attack 16
ICLR 2015
48.27
86.02
91.34
49.55
53.87
90.15
94.58
57.84
PGD attack 17
ICLR 2018
50.62
88.30
93.12
51.89
56.10
91.54
96.13
59.22
M-FGSM attack
TPAMI 2020
28.36
52.47
60.76
23.11
24.85
40.74
49.23
18,40
LTA attack
CVPR 2022
10.54
23.08
30.47
12.28
18.93
34.12
41.52
15.04
ODFA attack 26
JJV 2023
27.75
50.26
59.14
22.30
17.62
32.64
40.03
14.83
Col++Del. attack
27
TPAMI 2023
4.28
16.12
21.36
3.97
6,28
19.53
25.61
5.21
Our attack
NeurIPS 2024
1.62
7.59
14.46
1.45
7.71
10.72
1.25
Table Results for attacking cross-modality RelD systems on the RegDB 32 dataset. reports on
visible images querying thermal images and vice versa. Rank at accuracy (%) and mAP (%) are reported.
Settings
Visible to Thermal
Thermal to Visible
Method
Venue
r
r
mAP
r=
mAP
AGW baseline 21
TPAMI 2022
70.05
86.21
91.55
66.37
70.49
87.21
91.84
65.90
FGSM attack [6
ICLR 2015
66.79
83.14
88.46
61.05
65.42
81.98
87.20
60.12
PGD attack [17]
ICLR 2018
62.14
80.28
85.10
57.34
63.71
78.82
84.05
58.42
M-FGSM attack
TPAMI 2020
29.34
52.90
61.44
23.35
23.64
40.36
48.61
18.57
1.TA attack
CVPR 2022
12.65
25.24
34.02
12.80
10.51
22.93
31.79
9.74
ODFA attack 26
UCV 2023
28.57
51.42
60.58
21.84
17.26
33.27
42.92
15.27
Col.+Del, attack
27
TPAMI 2023
5.12
16.83
22.
4.94
4,92
14.47
23.04
4.86
Our attack
NeurlPS 2024
2.29
9.06
18.35
3.92
1.93
11.44
19.30
3.46
DDAG baseline
25
ECCV 2020
69.34
86.19
91.49
63.46
68.06
85.15
90.31
61.80
FGSM attack 16
ICLR 2015
61.83
80.12
86.47
55.78
60.94
78.35
84.09
56.91
PGD attack 17
ICLR 2018
64.58
81.39
87.20
58.45
62.17
79.02
85.27
$7.69
M-FGSM attack
29
TPAMI 2020
30,86
54.16
61.98
24.01
25.83
42.12
49.76
19.33
LTA attack 28
CVPR 2022
11.65
23.20
32.73
11.41
9.76
21.53
29.96
9.23
ODFA attack 26
UCV 2023
29.64
52.74
60.74
23.88
24.06
39.75
46.25
18.64
Col+Del. attuck
27
TPAMI 2023
4.68
13.55
18.57
4.39
4.23
12.75
20.82
4.05
Our attack
NeurlPS 2024
1.33
10.28
19.06
3.79
1.35
9.52
17.52
3.19
From Tab[]] it can be seen that the proposed method reduces the rank-1 accuracy to below 2% in both the Viiiible to Infrared' and 'Infrared to Visible' cases. Similarly, from Tab the rank-1 accuracy drops below 3% both the 'Visible to Thermal' and 'Thermal to Visible' scenarios. In contrast, traditional metric-based attacks, such as Metric-FGSM (M-FGSM)/29, LTA 28 and ODFA[26), lead to attacked models with significantly higher rank-1 accuracy, whereas traditional classification attacks (such FGSM [16] and PGD (17) perform worse, with rank- accuracy remaining over 60%. This is because ReID relies on metric learning for feature matching rather than category classification, requiring attacks specifically tailored for metric learning. These results indicate that, compared to traditional methods that optimize perturbations separately for each modality without considering the inherent correlations between different modalities, proposed approach demonstrates significant attacking effectiveness across different modalities.
Comparison with State-of-the-Art. Col.+Del., as universal perturbation method, was fairly compared by first optimizing with one modality's s dataset and then fine-tuning with the other modality. Since universal perturbations capture shared patterns across the entire data distribution, Col.+De.. is

---

Table 3: Results for attacking cross-modality ReID systems on the LLCM 24 dataset. It reports on visible images querying thermal images and vice versa. Rank at r aceuracy (%) and mAP (%) are reported.
Settings
Visible to Infrared
Infrared to Visible
Method
Venue
r=1
r= 10
20
mAP
== 1
r
10
r
20
mAP
DEEN baseline
21
CVPR 2023
62.53
90.31
94.73
65.84
54.96
84.92
90.91
62.95
M-FGSM attack
29
TPAMI 2020
28.48
64.92
75.12
32.88
25.64
61.45
78.31
30,46
LTA attack 28
CVPR 2022
15.16
56.42
67.53
21.47
19.54
58.25
70.72
24.86
ODFA attack 226
DCV 2023
26.34
65.24
76.92
30.85
23.73
62.46
73.57
29.63
Del. attack
27
TPAMI 2023
8.61
22.73
36.07
15.72
9.13
20.76
38.02
16.31
Our attack
NeurlPS 2024
5.83
18.14
27.56
12.47
6.42
19.53
28.54
12.23
capable of achieving some level of attack effectiveness in cross-modality scenarios. However, by comparing T Tab and Tab we observe that although Col.+Del. performs better than other methods, its effectiveness is still noticeably limited due the lack of intrinsic correlation mechanisms between modalities. Moreover, as shown in Fig 6 our method outperforms Col++Del. in transfer attacks across different baselines in pross-modality ReID. The conclusions from these experiments are as follows: 1) In cross-modality attacks, Dol.+Del. demonstrates the feasibility of universal perturbations. However, its performance is limited by its failure account for modality differences and inherent correlations. 2) Our method better bridges the gap between different modalities, more effectively capturing shared features across them.
4.2 Transferability of CMPS
From Fig in supplemental material, the results of the proposed method's transfer attacks on two baseline models, AGW and DDAG, can be observed. For example, on the SYSU dataset, the original attack result of the proposed method on DDAG is mAP=1.88 (refer to Tab. TT. When the perturbation transferred from AGW to DDAG, the attack result becomes mAP=3.41% This indicates that the proposed attack method exhibits good generalization across different models, and thus, the attack performance does not degrade significantly. This consistent result observed on both the RegDB and SYSU datasets. Similarly, in Fig of the supplemental material, evaluate the cross-datace transferability of perturbations in comparison with Col.+Del. The results demonstrate a significant advantage of our method. Additionally, we conducted adversarial transferability experiments on PCB [49) and ResNer18 [50]. The rank-1 transfer attack success rates are presented in Tab It can be observed that our method consistently achieves higher transfer attack success rates across all model combinations compared to +Del, indicating that our method demonstrates stronger robustness in generating more universal adversarial perturbations.
IDE 48
Table 4: Comparison of transfer attack success rates between our method and Col.+Del. across models, with higher values indicating better transferability.
Source VTarget Model
IDE (Ours/Col++Del.)
PCB (Ours/Col++Del.
ResNet18 (Ours/Col++Del.
IDE
48
98.7% / 94.3%
84.5% 81.2%
87.4% / 86.1%
PCB
49
85.1% 80.4%
97.6% 92.8%
88.3% / 85.7%
ResNet18 50
81.0% 78.5%
77.5% 74.9%
98.2% 95.6%
4.3
Ablation Study
Our method is implemented based UAP-Retrieval 44. To validate the effectiveness of the proposed method, we conducted experiments by adding augmentation (Cross-Modality Attack Augmentation) and CMPS the baseline. Results with AGW baseline model are reported in Tab, 5 The No.1 line represents the UAP-Retrieval algorithm. the table, 'Aug' indicates the use of the Cross- ModaliMy Attack Augmentation proposed in this paper.
The effectiveness CMPS. Comparing No.1 with No.3 and No.4, we observe the following: 1) The direct use of JAP-Retrieval yields limited performance. 2) Training with the CMPS strategy

---

Table 5: Ablation studies on the AGW bascline. "Aug' denotes the cross-modality attack augmentation method proposed in this paper.
No.
RegDB
SYSU
Aug
CMPS
MAP
rank-1
mAP
rank-1
6.87
5.53
4.76
5.09
x
X
2
5.11
4.02
3.85
4.37
V
3
3.98
2.17
3.42
3.82
X
V
4
3.46
1.93
1.23
1.31
V
proposed in this paper consistently improves the performance of attack results and the universality of learned perturbations.
The effectiveness of augmentation method. Our approach includes cross-modality attack aug- mentation. Comparing results of No.1, No.2, and No.4 shows its benefits. For example, the lower than without augmentation (No.1). Similarly, with CMPS, mAP drops from 3.98% 3.46% (No.4), 0.52% decrease compared to No.3. These findings suggest that using appropriate augmentation enhances cross-modality ReID adversarial attacks' universality. If specified, our experiments default using CMPS augmentation. Fig-5lin the supplementary materials displays the experimental results of our augmentation performed at different probabilities. It can be observed that when the probability value is around 20%, it achieves optimal effectiveness in assisting the attack. If not specified, probability value of 20% for augmentation is used by default in experiments.
RegDB dataset, augmentation (No.2) reduces mAP from 6.87% to 5.11%, 1.76%
Impact of adversarial boundary size. We conducted an ablation study on different adversarial boundary sizes (c), shown in the supplementary material 6 In practical applications, is typically kept moderate to balance perturbation visibility and attack effectiveness. To maintain consistency with previous work [27]. set 8 for comparison unless otherwise specified.
5
Conclusion
In this study, we have proposed a cross-modality attack method known as Cross-Modality Perturbation Synergy (CMPS) attack, aimed evaluating the security idea behind the CMPS attack is to capture shared knowledge between visible and non-visible images optimize perturbations. Additionally, we proposed
modallty ReID systems. The core
Mooss-ty Attack Augmentation method, utilizing grayscale images to bridge the gap between different modalities, further enhancing the attack performance. Through experiments conducted on the RegDB, SYSU and LLCM datasets, we demonstrated the effectiveness of the proposed method while also revealing the limitations of traditional attack approaches. The primary objective of this study has been to assess the security of cross- moos-mtddllty ReID systems. In future research, the one hand, will continue to improve tross-modalin attacks across different datasets and models; on the other hand, we plan to develop robust ReID methods specifically tailored for cross-modality attacks, aimed at defending against adversarial samples. This study not only contributes to advancing the understanding of the security of cross moos-ttoy ReID systems but also provides strong motivation for ensuring the reliability and security these systems in real-world applications.
the transferability
Acknowledgment
This work was supported in part by the National Natural Science Foundation of China under Grant No. 60.62226222 and the Public Technology Service Platform Project of Xiamen City. Grant No.35502220230443.
10

---

References
[1] Bin Yang, Jun Chen, and Mang Ye. Shallow-deep collaborative learning for unsupervised visible-infrared person re-identification. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 16870-16879, 2024.
[2] Jialong Zuo, Hanyu Zhou, Ying Nie, Feng Zhang, Tianyu Guo, Nong Sang. Yunhe Wang. and Changxin Gao. Ufinebench: Towards text-based person retrieval with ultra-fine granularity. In Proceedings of the IEEE/CVF Conference Computer Vision and Puttern Recognition, pages 22010-22019, 2024.
[3] Yunpeng Gong, Jiaquan Li, Lifei Chen, and Min Jiang. Exploring color invariance through image-level ensemble learning. arXiv preprint arXiv:2401. 20Xx:2401110012, 2024.
[4] Jiangming Shi, Yachao Zhang. Xiangbo Yin, Yuan Xie, Zhizhong Zhang, Jianping Fan, Zhongchao Shi, and Yanyun Qu Dual pseudo-labets labels interactive self-training for semi sspesuupee visible-infrare person re-identification. Proceedings of the IEEF/CVF International Conference on Computer Vision, pages 11218-1 1222,, 2023.
[5] Yiwei Ma, Jiayi Ji, Xiaoshuai Sun, Yiyi Zhou, and Rongrong Ji. Towards local visual modeling for image captioning. Pattern Recognition, 138: 109420,, 2023.
[6] Hongwei Niv, Jie Hu, Jianghang Lin, and Shengchuan Zhang. Eov-seg: Efficient open- vocabulayy panoptic segmentation. arXiv preprint arXiv:2412. 086288. 2024.
[7] Changli Wu, Yiwci Ma, Qi Chen, Haowei Wang, Gen Luo, Jiayi Ji, and Xiaoshuai Sun. 3d-stmm: Dependency-driven superpoint-text matching network for end-to-end 3d referring expression segmentation. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 5940-5948, 2024.
[8] Yansong Qu, Shaohui Dai, Xinyang Li, Jianghang Lin, Liujuan Cao, Shengchuan Zhang, and Rongrong Ji. Goi: Find 3d gaussians of interest with an optimizable open- open-vocabulary semantic-space hy hyperplane. In 2024.
Proceedings of the 32nd ACM International Conference on Multimedia, pages
[9] Hongwei Niu, Linhuang Xie, Jianghang Lin, and Shengchuan Zhang. Exploring semantic consistency and style diversity for domain generalized semantic segmentation. arXiv preprint arXiv:2412. 12050, 2024.
[10] Zhun Zhong, Liang Zheng, Zhiming Luo, Shaozi Li, and Yi Yang. Learning to adapt invariance in memory for person re-identification. IEEE Transactions Pattern Analysis and Machine Intelligence. 43(8):2723-2738, 2021.
[11] Yunpeng Gong, Yongjie Hou, Chuangliang Zhang, and Min Jiang. Beyond augmentation: Empowering model robustness under extreme capture environments. In 2024 International Joint Conference on Neural Networks (ICCN), pages 1-8. IEEF, 2024.
[12] Yunpeng Gong, Liqing Huang, and Lifci Chen. Eliminate deviation with deviation for data augmentation and general multi-modal data learning method. arXiv preprint arXiv:2101.0855. 088533, 2021.
[13] Lei Tan, Pingyang Dai, Rongrong Ji. and Yongjian Wu. Dynamic prototype mask for occluded person re-identification. In Proceedings of the 30th ACM international conference multimedia, pages 531-540, 2022.
[14] Lei Tan, Jiaer Xia, Wenfeng Liu, Pingyang Dai, Yongjian Wu, and Liujuan Cao. Occluded person re- identification via saliency- guided patch transfer. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 5070-5078, 2024.
[15] Zhun Zhong, Liang Zheng, Zhedong Zheng, Shaozi Li, and Yi Yang. Camera style adaptation for person re-identification. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2018.
[16] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and hamesssin adversarial examples. In 3rd International Conference on Learning Representations, ICLR 2015, 2015.
[17] Aleksander Madry, Aleksandar Makclov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant to adversarial attacks. International Conference on Learning Representations, 2018.
[18] Yukang Zhang, Yan Yan, Jie Li, and Hanzi Wang. Mren: A novel modality restitution and compensation network for visible-infrare person re- re-identification. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 3498 3506, 2023.

---

[19] Jiangming Shi. Xiangbo Yin, Zhizhong, Zhang, Yachao and Zhang, Yuan Xie, and Yanyun Qu. Learning commonality, divergence and variety for unsupervised visible-infrared person re-identification. arXiv preprint arXiv:2402. 1902662. 2024.
[20] Bin Yang, Jun Chen, and Mang Ye. Towards grand unified representation learning for unsupervised visible-infrared person re- re-ideniffication In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 11069-11079 October 2023.
[21] Mang Ye, Jianbing Shen, Gaojie Lin. Tao Xiang, Ling Shao, and Steven CH Hoi. Deep learning for person re-identification: A survey and outlook. IEEE transactions pattern analysis and machine intelligence, 44(6):2872 2293,, 2022.
[22] Xiangbo Yin, Jiangming Shi, Yachao Zhang, Yang Lu, Zhizhong Zhang, Yuan Xie, and Yanyun Qu Robust pseudo-label learning with neighbor relation for unsupervised visible-infrared person re-identification arXiv preprint 3rXiv:24050066.5 2024.
[23] Jiangming Shi, Yachao Zhang, Xiangbo Yin, Yuan Xie, Zhizhong Zhang, Jianping Fan, Zhongehao Shi, and Yanyun Qu. Dual pscudo-labels interactive self-training for semi- supi-super visible-infraree person re-identificationn. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 11218-11228, 2023.
[24] Yukang Zhang and Hanzi Wang. Diverse embedding expansion network and low-light mross-modality benchmark for visible-infrared person re-identification. In Proceddings of the IEFE/CVF conference on computer vision and pattem recognition, pages 2153-2162, 2023.
[25] Mang Ye, Jianbing Shen, David J. Crandall, Ling Shao, and Jiebo Luo. Dynamic dual-attentive aggregation learning for visible-infrared person re-identification. In European Conference on Computer Vision (ECCV), 2020.
[26] Zhedong Zheng, Liang Zheng, Yi Yang, and Fei Wu. U-turn: Crafting adversarial queries with opposite- direction features. International Journal of Computer Vision, 131(4):835-854, 2023.
[27] Fengxiang Yang, Juanjuan Weng, Zhun Zhong, Hong Liu, Zheng Wang, Zhiming Luo, Donglin Cao, Shaozi Li, Shin ichi Satoh, and Nicu Sebe. Towards robust person re-identification by defending against universal attackers. IEEE Transactions Pattern Analysis and Machine (allliennee,444::51188888888 2023.
[28] Yunpeng Gong, Liqing Huang, and Lifei Chen. Person re-identification method based on color attack and joint defence. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 4313 43222 2022.
[29] Song Bai, Yingwei Li, Yuyin Zhou, Qizhu Li, and Philip HS Torr. Adversarial metric attack and defense for person re-identification. IEEE Transactions on Pattern Analysis and Machine Intelligence, (3 2116) 2126. 2020.
[30] Quentin Bouniot, Romaric Audigier, and Angelique Loesch. Vulnerability of person re-identification models to metric adversarial attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Patiern Recognition Workshops, 2020.
[31] Hongjun Wang, Guangrun Wang, Ya Li, Dongyu Zhang, and Liang Lin. Transferable, controllable, and inconspicuous adversarial attacks on person re-identification with deep mis-ranking. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 342-351,22 2020.
[32] Dat Tien Nguyen, Hyung Gil Hong, Ki Wan Kim, and Kang Ryoung Park. Person recognition system based on combination of body images from visible light and thermal cameras. Sensors, 17(3):605, 2017.
[33] Ancong Wu, Wei-Shi Zheng, Hong-Xing Yu, Shaogang Gong, and Jianhuang Lai. Rgb-infrared cross- modality person re- re-identification. In Proceedings of the IEEE international conference on computer vision, pages 5380 5389, 2017.
[34] Wenqi Wang. Run Wang, Lina Wang. Zhibo Wang, and Aoshuang Ye. Towards robust deep neural network against adversarial texts: A survey. IEEE Trunsactions on Knowledge and Data Engineering. 35:3159-31 3179, 2023.
[35] Qian Wang. Baolin Zheng, Qi Li. Chao Shen, and Zhongjie Ba. Towards query efficient adversarial attacks against automatic speech recognition systems. IEEE Transactions on Information Forensics and Security. 16:896 908, 2021.
12

---

[36] Yiwei Ma, Guohai Xu, Xiaoshuai Sun, Ming Yan, Ji Zhang, and Rongrong Ji. X-clip: End-to-end multi-grained contrastive learning for video-text retrieval. In Proceedings of the 30th ACM International Conference on Multimedia, pages 638-647,20 2022.
[37] Mingrui Wu, Xinyue Cai, Jiayi Ji, Jiale Li. Oucheng Huang. Gen Luo, Hao Fei, Xiaoshuai Sun, and Rongrong Ji. Controlmilm: Training- free visual prompt learning for multimodal large language models. arXiv preprint wVXiv:2407.21334 2024.
[38] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39 57. Ieee, 2017.
[39] Seyed-Mohser Desaav-Dezfooll, Alhussein Fawzi, and Pascal Frossard. Deepfool: simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2574-2582, 2016.
[40] Yunpeng Gong. Yongjie Hou, Zhenzhong Wang. Zexin Lin, and Min Jiang. Adversarial learning for neural pde solvers with sparse data. arXiv preprint arXiv:2409 009.02231. 2024.
[41] Seyed-Mohsen Moosavi-Dezlooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversar- ial perturbations. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), July 2017.
[42] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In Proceedings of the IEEE conference computer vision and pattern recognition, pages 9185-9193, 2018.
[43] Alexander Hermans, Lucas Beyer, and Bastian Leibe. In defense of the triplet loss for person re- identification. arXiv preprint 17Xiv:1003.07737 2017.
[44] Jie Li, Rongrong Ji. Hong Liu, Xiaopeng Hong. Yuc Gao, and Qi Tian. Universal perturbation attack against image retrieval. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 4899 4908, 2019.
[45] Cassidy Laidlaw and Soheil Feizi. Functional adversarial attacks. Advances neural information processing systems, 32, 2019.
[46] Zhixiang Wang. Zheng Wang. Yinqiang Zheng, Yung-Y Yu Chuang, and Shin ichi Satoh. Learning to reduce dual-level discrepancy for infrared-visie visible person re-identification. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 618-626, 2019.
[47] Liang Zheng, Liyue Shen, Lu Tian, Shengjin Wang, Jingdong Wang, and Qi Tian. Scalable person re-identification: A benchmark. In Proceedings of the IEEE international conference on computer vision, pages 1116 1124, 2015.
[48] Liang Zheng, Yi Yang, and Alexander G Hauptmann. Person re-identification: Past, present and future. arXiv preprint arXiv: 10.002984 2016.
[49] Yifan Sun, Liang Zheng, Yi Yang, Qi Tian, and Shengjin Wang. Beyond part models: Person retrieval with refined part pooling (and a strong convolutional baseline). In Proceedings of the European conference on computer vision (ECCV), pages 480-496, 2018
[50] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In Computer Vision ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11 1441, 2016, Proceedings, Part 14, pages 630-645. Springer, 2016.
13

---

Supplemental Material
Contents
Introduction
Related Works
3
Methodology
3.1
Overall Framework]
3.2
Optimizing Loss Functions for Attacking
3.3
Cross-Modality Attack Augmentation Method
Cross-Modality Perturbation Synergy Attack
4
Experiments
4.1
Performance on Modality ReID
4.2
Transferability of CMPS
4.3
Ablation Study
Conclusion
10
Supplemental Experiments
15
7
Proof of Method Superioritys
17
7.1
Definition of Cross-Modality Triplet Loss
17
7.2
Proof of Aggregated Optimization Superiority
17
7.2.1
Stepwise Optimization Method
18
7.2.2
Aggregated Optimization Method
18
7.3
Generalization Error Analysis
18
8
Discussion
20
8.1
Ethical Considerations
20
8.2
Limitations and Future Work
20
14

---

Supplemental Experiments
Our experiments were conducted using three RTX 2080 Ti GPUs, each with 1 JGB of memory.
P=0
p=0
000.5
p=0.1
p=0.15
p=0.2
p=0.25
p=0.3
AGW under CMPS attack
Figure 5: The impact of different grayscale transformation probabilities attack performance. Lower evaluation metrics indicate higher attack success rates. The experimental results are derived from experiments the RegDB dataset using AGW the baseline model for testing.
RegDB Dataset
SYSU Dataset
Mo
Metrics
Accurncy PM
Figure 6: Transferability experiments of the proposed method across different models on the RegDB dataset (visible to thermal). Transfcrability experiments of the proposed method across different models on the SYSU dataset (visible to Infrared).
15

---

Comparison of Transferability
70
Metrics
m-
Accuracy 50
10
RegDB
RegDB (Ours)
RegDB (Col.+Del.)
RegDB (Ours)
(Col.+Del.)
Figure 7: Comparison of Transferability Between Different Methods on Two Cross-Modal Datasets SYSU and RegDB.
Table 6: Using the AGW baseline the RegDB dataset, conduct ablation study evaluate the impact of the adversarial boundary e on the effectiveness of the proposed CMPS attack (rank-1 accuracy).
Adversarial Boundary (e)
Visible to Thermal
Thermal to Visible
70.0%
70.5%
32.7%
40.5%
9.6%
13.8%
2.3%
2.0%
16
0.3%
0.5%
16

---

7 Proof of Method Superioritys
We design cross-modality triplet loss simultaneously optimize modalities, which effectively captures common features between different modalities and enhances cross-modande cross-modality adaptability of universal perturbations.
7.1 Definition of Cross-Modality Triplet Loss
The eross-moaality triplet loss aims optimize the model by adjusting the distance relationships among triplet samples (anchor, positive, negative) so that samples of the same identity are closer, while samples different identitics are farther apart. Specifically, given samples (IA, 27, 2x), where:
is the anchor sample,
is the positive sample with the same identity as the anchor (from different modality),
is the negative sample with different identity from the anchor.
The triplet loss function is defined as:
Luiglet max (0, (*f() f(xe) D(f(z)) f(x)) +.)
(10)
where D(..) denotes the distance metric (e.g.. Euclidean distance), and is margin hyperparameter. Mathematicallyy given the cross-modality triplct loss:
max ((IC) (RRSH JRRalll - p) .0)
Luiptes
(11)
We can view it as part of the sum of the loss functions for two modalitics:
Ca(T) = ||0 [nGell l/2
(12)
Ce(n) = I|C JRGB
(13)
Thus, the overall optimization objective can be expressed as:
Tagg arg min (Ca(m) + Ca(r) + p)
(14)
This form effectively aggregates the losses different modalities, thereby optimizing the loss functions of different modalities simultaneously. achieving joint optimization of cross-modalit data. This approach trains universal perturbations with better generalization capabilities than methods that consider only mingle-modality information.
7.2 Proof of Aggregated Optimization Superiority
Assume we have data from two modalities: modality A and modality B. Let La(1) and Ca(n) be the loss functions on modality A and modality B, respectively. The objective of single-modality training is:
min (a(n) + Cz(n)
(15)
The stepwise optimization method first optimizes Ca(1) and then optimizes (n):
v/" arg min (m - 17" min L
(16)
The aggregated optimization of the two loss functions is:
Tugs arg min (Ca(r) (x)))
(17)
Using the gradient aggregation method, it can be expressed
VnLaug = V, (CA(m) + C=(n))
(18)
Next, consider the different optimization paths of the methods.
17

---

7.2.1 Stepwise Optimization Method
The stepwise optimization method first optimizes the loss function of modality and then the loss function of modality B. Assume the update rule at iteration & is:
n (*+1) n7 - -VV,La(n)))
(19)
After optimizing the loss function modality A, the loss function of modality B is optimized:
(++1) (*) aV VV,,,u(77)
(20)
Since the two optimization processes are separate, this may result in y) being optimal modality but not necessarily for modality
7.2.2 Aggregated Optimization Method
The aggregated optimization method considers the losses of both modalities in each iteration. Assume update rule at iteration & is:
1 (k+1) =
(v,Ca(n")) + VV (n,((((())))))
(21)
this way, each update considers the losses of both modalities, ensuring that approaches the optimal solution for both modalities.
To further prove that the aggregated optimization method can find a better perturbation y). we can analyze the existence and uniqueness of the optimal solution.
Assume (n) and (T( are continuously differentiable and convex loss functions. According to convex optimization theory, the optimal solutions of the loss functions exist and unique.
The optimal solution of the stepwise optimization method is:
Thip arg min (Ca(m) + L=()"))
(22)
where s7" is the optimal solution of (T)
The optimal solution of the aggreggted optimization method is:
nagg arg min (Ca(1) + (a()))
(23)
Since Tap is not necessarity globally optimal for modality B, and nie is the global optimal solution considering both modalities, can derive:
L (thpo) Crs(iiee) S (Vhee) + Le (Thpp)
(24)
7.3 Generalization Error Analysis
Generalization error measures the model's performance aggregated training through generalization error analysis.
data. We can further prove the superiority of
Limin Lisa be the losses on training and test sets, respectively. generalization error defined as:
Eges = Lisa
Luain (1))
(25)
The upper bound of the generalization error can be expressed using measures such as Rademacher complexity or VC dimension. For machine learning models, the lower the model complexity, the smaller the generalization error. Simultancously optimizing the losses for multiple tasks (modalities) task (modality), as the model needs perform well on multiple tasks (modalities) simultancously. This effectively introduces an implicit regularization effect, reducing model complexity. Therefore, compared the stepwise optimization method, the aggregated optimization method can effectively reduce the complexity of the perturbation model. The lower the model complexity, the smaller the generalization error.
reduce overfitting to single
The Rademacher complexity measures the complexity of class of models on given sample set. For function h in the hypothesis space H. the empirical Rademacher complexity samples is defined as:
(7() E. sup
Σ o.h((x.)
(26)
NER
where Rademacher random variables, taking values +1 with equal probability.
18

---

The impact of modality aggregation on complexity:
Assume HA and Ha are the hypothesis spaces of modality A and modality B. respectively. The stepwise optimization method first optimizes HA and then Ha. Its empirical Rademacher complexity can be expressed as:
R.o(Haup) = R. (Hr) + (HH)
(27)
The aggregated optimization methad optimizes HA U His simultaneously. Its empirical Rademacher complexity is:
R. (Hoee) R. (HA U U'Ha)
(28)
According to the properties of Rademacher complexity, the complexity of HA U Hy is usually less than equal the sum the complexities HA and Ny:
R. (Hage) S RHa)Ha) RH,)
(29)
Generalization error upper bound derivation:
Using Rademacher complexity. we can derive the upper bound of the generalization error. For the loss function L and hypothesis space H. the upper bound of the generalization error is:
Egen S 2R. H) +
(30)
where L HH denotes the composition of the loss function with the hypothesis space. The upper bound of the generalization error for the stepwise optimization method is:
Exe, step 2 (R.. HA) (C, Hss)
Vin
(31)
The upper bound of the generalization error for the aggregated optimization method is:
1
Egen, zpe S 2R (Ha U Hb)) O
(32)
VT.
Since
R., (HbU)) S (. + Rr, Ha)
(33)
Therefore:
Egen, age Egen, stop
(34)
This indicates that the aggregated optimization method has lower upper bound the generalization compared to stepwise optimization method.
19

---

Discussion
8.1 Ethical Considerations
In this study, introduce novel cross-modal adversarial attack method known Cross-Modalig, Perturbation Synergy (CMPS). This research offers new perspective on understanding enhancing the security cross-modal ReID systems by leveraging shared features across different modalities to optimize perturbations. However, this approach also raises series of ethical and safety concerns regarding the potential negative impacts of adversarial attack techniques. The CMPS method, like other adversarial technologies, can be maliciously exploited, posing a serious threat public safety.
However, we recognize the positive value of adversarial attack research. reveals vulnerabilities in existing systems, prompting academia and industry make in-depth improvements to the robustness of machine learning models. The positive impact of this study lies its potential to combine adversarial training with the attack methods presented to enhance system security and bring positive social impacts. Therefore, emphasize the importance of conducting adversarial attack research within ethical framework and encourage further development defensive technologies build safer and more reliable technological environment.
8.2 Limitations and Future Work
Here, need acknowledge the limitations of the proposed method and identify potential directions for future research. Firstly, current attack techniques primarily focus gradient-hased perturbation optimization for given datasets. However, real-world scenarios, the modalities encountered are often unknown not limited to RGB, infrared, and thermal imaging. Moreover, effectively transferring perturbations to different and unknown modalities presents a significant research challenge.
When dealing with various models and modalities, gradient-based methods face several challenges. Firstly, these methods prone "catastrophic forgetting. where learning information lead to the loss of previously learned knowledge, affecting the effectiveness of perturbations. Secondly, the inconsistency of gradi- ent information across multiple models and modalitics can negatively impact the stability and generalizability of the method. Therefore, future research should explore more robust algorithms that can effectively operate in complex environments involving multiple modalitics and models, thereby enhancing the applicability and transferability of attacks.
20

---

NeurIPS Paper Checklist
1. Claims
Question: the main claims made the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The main claims made in the abstract and introduction accurately reffect the paper's contributions and scope. We have clearly stated our novel methodology and its implications in the abstract and introduction, and these further elaborated upon and validated in the main body of the paper
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize other settings.
is fine to include aspirational goals motivation long it is clear that these goals not attained by the paper.
2. Limitations
Question: Does paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
Please refer to the final section of the supplementary materials.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings. model well- sell-specification asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice
what implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. general, empirical results often depend on implicit assumptions, which should he articulated.
The authors should reflect on the factors that inffuence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with datasct size.
applicable, the authors should discuss possible limitations of their approach to address problems privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't it acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play important role in developing norms that preserve the integrity the community. Reviewers will be specifically instructed not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
For each thcoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Question:
Answer: [Yes]
Justification:
We have conducted theoretical analysis of the effectiveness of the proposed method.
Guidelines:
The answer NA means that the paper does not include theoretical results.
21

---

All the theorems, formulas, and proofs in the paper should be numbered and cross cross-reference..
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can cither appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors encouraged to provide a short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: To ensure full disclosure of all necessary information reproduce the main experimental results of the paper. we have provided the experimental setup within the paper included pseu- docode the supplementary materials. Additionally, as a key contribution, we have conducted a comprehensive thcoretical analysis of the proposed method. We will provide the source code for the reviewers' examination.
Guidelines:
The answer NA means that the paper does not include experiments.
the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making paper reproducible important, regardless whether the code and data are provided or not.
the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example. if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to hosted model (e.g., in the case of a large language model), releasing of model checkpoint, or other means that appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submissions provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should deseribe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., large language model), then there should either be a way access this model for reproducing the results a way to reproduce the model (c.g.. with an open-source dataset or instructions for how construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors welcome to deseribe the particular way they provide for reprodueibility. In the of closed-soure source models, it may be that access to the model is limited some way (e.g.. to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
Open access to data and code
the data and code, with sufficient instructions faithfully reproduce the main experimental results, described supplemental material?
Question: Does the paper provide open
Answer: [No]
Justification Given the rapid pace technological advancement, our field requires careful dissemina- tion of our methods to ensure the integrity and competitiveness of our ongoing research. Additionally, due to ethical and security considerations, we currently prefer not to publicly release our code. How- ever, will provide the code for reviewers' examination and release the source code when the time right.
Guidelines:
22

---

The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips. http:/iipsccccuuuiee cc/puiicc/ Ttaeee/s/oodSSuumisiioooooPPo
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" acceptable answer. Papers cannot rejected simply for not including code, unless this central to the contribution (e.g.. for a new open-soures source benchmark).
The instructions should contain the exact command and environment needed run to reproduce the results. See the NeurlPS code and data submission guidelines (httpe:/ hhape://nips... cc/ cc/public/
for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Detan Details
Question: Does the paper specify all the training and test details (c.g,, data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We have mentioned this in our paper.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary appreciate the results and make of them.
The full details can be provided either with the code, in appendix, supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined other appropriate informa- tion about the statistical significance of the experiments?
Answer: [Yes]
Justification:In our main performance comparison experiments, the results are reported as the mean t standard deviation.
answer means that the paper does not include experiments.
The authors should answer "Yes" if the results accompanied by error hars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to library function, bootstrap, etc.)
The assumptions made should be given (c.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
is OK to report I-sigma error bars, but one should state it. The authors should preferably report 2-sigma error har than state that they have 96% CI, if the hypothesis of Normality of errors not verified.
For asymmetric distributions, authors should be careful not show in tables or figures symmetric error bars that would yield results that are out of range (c.g. negative error rates).
crror bars are reported tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures or tables in the text.
Experiments Compute Resources
Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
23

---

Answer: [Yes]
Justification: We provide the GPU type used our paper, and the computation time is given in the ablation experiments.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported the paper (e.g., preliminary or failed experiments that didn't 't make into the paper).
9. Code Of Ethics
Question: Does the research conducted the paper conform, every respect, with NeurIPS Code of Ethics htttps:///euu httpss///errrpps.cppblll///bbbi
Answer:
[Yes]
Justification:
Our research adheres to the NeurlPS Code of Ethics in all respects.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure preserve anonymity (e.g.. if there is special consideration due laws regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative socictal impacts of the work performed?
Answer: [Yes]
Justification: Our research may have potential negative social impacts. One possible solution is to enhance model security by improving defenses against the proposed attacks through adversarial training Our research may have potential negative social impacts. One possible solution is to enhance model security by improving defenses against the proposed attacks through adversarial training.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples negative societal impacts include potential malicious or unintended uses (e.g.. disinformation, generating fake profiles, surveillance). fairness considerations (e.g.. deploy- ment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, is legitimate point out that an improvement the quality generative models could used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional unintentional) misuse the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g.. gated release models, providing defenses in addition to attacks, mechanisms monitor- ing misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of MI.).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
24

---

Answer: [Yes]
Justification: Our intention in proposing adversarial attack techniques is study model security. The safeguard involves enhancing model security by improving defenses against the proposed attacks through adversarial training.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk misuse or dual-use should he released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but encourage authors to take this into account and make best. faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification:
We used open datasets and correctly referenced the papers.
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version the asset is used and, possible, include a URL.
name of license (e.g.. CC-BY 4.0) should be included each asset. For scraped data from particular source (e.g., website), the copyright and terms of service of that source should provided.
If assets released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperrewi thcode. wtt.ccoo//////c dataseta has curated licenses for some datasets. Their licensing guide can help determine the license a dataset.
existing datasets are re-packaged, asset (if it has changed) should be provided.
original license and license of derived
this information not available online, the authors are encouraged reach out to asset's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Given the rapid pace of technological development, our field requires careful dissemina- tion of our methods to ensure the integrity and competitiveness of our ongoing research. Therefore, do currently plan to publicly release our code.
Justification:
Guidelines:
The answer NA means that the paper does not release assets.
Researchers should communicate the details of the dataset/code/model as part of their sub- missions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset used.
At submission time, remember anonymize your assets (if applicable). You either create anonymized URL or include anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
25

---

The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then much detail as possible should he included in the main paper.
According to the NeurlPS Code of Ethics, workers involved data collection, curation, other labor should be paid at least. minimum wage in country data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Question:
Answer: [NA]
Justification: The paper does not involve crowdsourcing rescarch with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. you obtained IRB approval. you should clearly state this the paper.
recognize that procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applica- ble), such as the institution conducting the review.
26


Reviews:
[{"review_id": "V9tQMMTjT3", "reviewer": "Reviewer_Zepn", "summary": "This paper proposes an innovative strategy called Cross-Modality Perturbation Synergy (CMPS) attack, aimed at revealing security vulnerabilities in cross-modality person re-identification (ReID) systems. These systems are crucial in security applications, typically using RGB and infrared imaging to identify individuals under various lighting conditions and camera setups. The study highlights that current security research mainly focuses on single-modality (RGB-based) ReID systems, neglecting the complexities and potential vulnerabilities in cross-modality scenarios.", "questions": "1. The effectiveness of the CMPS attack method has been validated on RGB, infrared, and thermal images. Have the authors considered whether this method can be extended to more modalities, or even any modality? If so, what adjustments would be necessary to the current method?\n2. The paper presents an interesting model attack scenario where universal perturbations are added to query images to mislead ReID models. Have the authors considered how to deploy such interference in real-world ReID systems?", "limitations": "Yes", "rating": 7, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "1. By focusing on cross-modality security vulnerabilities, this paper fills a critical gap in the field of person re-identification (ReID), where previous research has primarily concentrated on single-modality (RGB-based) studies. This novel perspective is highly significant as it extends the understanding of ReID systems to real-world scenarios where different modalities are frequently used.\n2. The proposed Cross-Modality Perturbation Synergy (CMPS) attack is innovative, leveraging gradient information from both RGB and infrared images to generate universal perturbations that remain effective across multiple modalities. This approach not only demonstrates theoretical originality but also provides practical value through robust experimental validation.\n3. The experimental results on widely used datasets such as RegDB and SYSU convincingly demonstrate the superiority of the CMPS method compared to existing traditional attack methods, highlighting the method's effectiveness in reducing the accuracy of ReID systems.\n4. This paper exhibits strong writing and organizational skills, with logically tight explanations that make complex concepts easy to understand. The comprehensive description and intuitive presentation of the methodology and experimental setup contribute to the paper's clarity and comprehensibility.", "weaknesses": "1. Although the paper is clearly written, some technical sections are still quite complex. Simplifying these parts would benefit a wider audience. For example, in the section \"3.2 Optimizing Loss Functions for Attacking,\" the derivation process from equations (4) to (11) is rather dense and might be difficult for non-specialist readers to understand. Adding more explanatory text between these equations would make it easier for a broader range of readers to follow.\n2. The descriptions of \"Figure\" and \"Fig\" in lines 53 and 55 of the article are inconsistent, and they need to be carefully checked and unified.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We would like to express our sincere gratitude for your thorough review and valuable feedback on our paper. Your input has undoubtedly played a pivotal role in enhancing the quality and clarity of the manuscript. \n\nResponses to the individual questions below.\n\n**Reviewer’s Comment:**\n\n“Have the authors considered whether this method can be extended to more modalities, or even any modality? If so, what adjustments would be necessary to the current method?”\n\n**Response:** \n\nIn our subsequent work, we addressed this issue by expanding adversarial attacks to more modalities using a dual-layer optimization framework. First, we utilized image gradients within each modality to learn universal perturbations, ensuring their effectiveness in the specific modality. Then, in the second optimization layer, we employed evolutionary computation methods to search for shared features across more different image modalities. This layer of evolutionary search aimed to identify sparse perturbations that could be effectively transferred to other modalities, further optimizing and enhancing the cross-modal transferability of the universal perturbations learned in the previous step. The experimental results are shown in the table below. For example, RegDB->SYSU indicates that we optimize the universal perturbation using the RegDB dataset and then transfer it to the SYSU dataset for testing. Thermal images in the RegDB dataset lose more detailed information compared to sketch images and the channel-randomized CnMix images, and its transfer attack performance is also the worst. Therefore, we hypothesize that the smaller the gap between modalities, the better the transferability.\n\n| Method           | r=1  | r=10  | r=20  | mAP   |\n|------------------|------|-------|-------|-------|\n| SYSU -> RegDB    | 19.62| 49.70 | 60.23 | 15.93 |\n| RegDB -> SYSU    | 22.37| 51.92 | 62.17 | 19.05 |\n| SYSU -> CnMix    | 15.81| 31.36 | 40.85 | 15.02 |\n| CnMix -> SYSU    | 17.23| 35.78 | 45.62 | 16.74 |\n| SYSU -> Sketch   | 17.14| 35.10 | 45.82 | 16.75 |\n| Sketch -> SYSU   | 18.38| 36.70 | 47.82 | 17.63 |\n\n\n\n\nThe Sketch ReID dataset [1] contains 200 individuals, each represented by one sketch and two photographs. The photographs of each individual were captured during daylight using two cross-view cameras. Raw images (or video frames) were manually cropped to ensure that each photograph includes only the specific individual. Additionally, we applied random channel mixing to images from the Market1501 [2] dataset to simulate a new modality dataset, which we refer to as CnMix. Market1501 includes 1,501 pedestrians captured by six cameras (five HD cameras and one low-definition camera). \n\n[1] Lu Pang,Yaowei Wang,Yi-Zhe Song,Tiejun Huang,and Yonghong Tian.Cross-domain adversarial feature learning for sketch re-identification.In Proceedings of the 26th ACM international conference on Multimedia,pages 609-617,2018.\n[2] Liang Zheng,Liyue Shen,Lu Tian,Shengjin Wang,Jingdong Wang,and Qi Tian. Scalable person re-identification:A benchmark.In Proceedings of the IEEE international conference on computer vision,pages 1116-1124,2015.\n\n\n**Reviewer’s Comment :** \n\n“Have the authors considered how to deploy such interference in real-world ReID systems?”\n\n**Response:**\n\nThis research is currently in its early stages, but its potential applications and impacts have garnered significant attention. As the technology matures, attackers may develop more sophisticated methods. For instance, they could embed such perturbations into specially designed stickers or attach them to people's clothing. While these stickers or patterns may appear harmless, they could actually have a significant impact on surveillance systems.\n\nThese attacks could exploit the perturbations to deliberately interfere with the images captured by surveillance cameras, thereby affecting the accuracy of person re-identification (ReID) systems. ReID systems are widely used in areas such as public safety, traffic management, and smart retail for automatically identifying and tracking individuals. Attackers could achieve several objectives through these methods:\nIdentity Disguise: Attackers could use these perturbations to disguise themselves as others, evading detection by security systems. This could pose serious security risks in high-security locations such as airports, government buildings, or financial institutions.\nSurveillance Interference: The perturbations could also be used to disrupt the normal functioning of surveillance systems, preventing them from accurately capturing and identifying targets. In such cases, security personnel may be unable to timely identify and respond to potential threats or abnormal situations.\n\nPrivacy Protection: On the other hand, some individuals might use these techniques to protect their privacy and avoid being tracked by surveillance systems. This could raise legal and ethical issues, especially in public spaces or monitored private areas.\nOverall, as research progresses and technology advances, addressing these potential attacks will become an important area of focus. This will require not only technical innovation but also legal and policy measures to ensure a balance between security and privacy.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "lZHTTSjFIx", "reviewer": "Reviewer_fT1U", "summary": "This paper is the first to explore the security vulnerabilities of cross-modality ReID models and proposes a universal perturbation attack method for cross-modality person re-identification (ReID) systems, called the Cross-Modality Perturbation Synergy (CMPS) attack. This method innovatively utilizes gradient information from both RGB and infrared images to generate a universal perturbation, maintaining its effectiveness across multiple modalities. Experiments conducted on the RegDB and SYSU datasets demonstrate that the CMPS method significantly reduces the accuracy of ReID models, outperforming existing traditional attack methods. This study emphasizes the necessity of considering multiple modalities in the security evaluation of ReID systems and provides new perspectives for future research.", "questions": "The paper offers initial insights into the transferability of the proposed attack across various models and datasets. A more thorough investigation into factors influencing perturbation transferability, such as diverse model architectures and characteristics of cross-modality data, would advance the understanding of adversarial attacks in this domain. Such comprehensive research could elucidate the performance of perturbations in different settings, optimizing attack methods and enhancing their practical applicability.", "limitations": "Yes, the authors have appropriately addressed the limitations of their study.", "rating": 6, "confidence": 5, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "This paper makes a notable contribution by addressing security challenges in cross-modality person re-identification (ReID) systems with a pioneering approach. It stands out as the first to explore vulnerabilities in these systems, advancing the understanding and testing of their robustness against adversarial attacks, particularly in under-explored cross-modality scenarios. By focusing on this critical gap, the paper opens new directions for security evaluation in complex multimodal environments.\n\nThe novelty of the proposed attack method lies in its innovative use of aggregated feature gradients from different modality images to probe vulnerabilities in cross-modality ReID models. The writing quality is excellent, featuring clear, concise, and well-structured explanations that effectively communicate the paper's concepts. The insights provided are poised to drive improvements in the security of ReID systems.", "weaknesses": "1. Figure 1 would benefit from using the same set of gallery images for both the before and after comparisons.\n\n2. The paper exhibits inconsistencies in referencing \"Table\" and \"Tab,\" as observed in lines 228 and 229. Standardizing these references would enhance readability and professionalism.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We would like to express our sincere gratitude for your thorough review and valuable feedback on our paper. Your input has undoubtedly played a pivotal role in enhancing the quality and clarity of the manuscript. \n\nResponses to the individual questions below.\n\n**Reviewer’s Comment :**\n\n“A more thorough investigation ...... such as diverse model architectures and characteristics of cross-modality data, would advance the understanding of adversarial attacks in this domain ...... ”\n\n**Response:**\n\nWe conducted adversarial transferability experiments using IDE, PCB, and ResNet18. The rank-1 transfer attack success rates (higher values indicate better transferability of the attack) are shown in the table below:\n\n\n| Source \\ Target Model | IDE (Ours/Col.+Del.) | PCB (Ours/Col.+Del.) | ResNet18 (Ours/Col.+Del.) |\n|-----------------------|----------------------|----------------------|--------------------------|\n| IDE                   | 98.7% / 94.3%        | 84.5% / 81.2%        | 87.4% / 86.1%            |\n| PCB                   | 85.1% / 80.4%        | 97.6% / 92.8%        | 88.3% / 85.7%            |\n| ResNet18              | 81.0% / 78.5%        | 77.5% / 74.9%        | 98.2% / 95.6%            |\n\n\nAll models exhibit high success rates for attacks against themselves, indicating vulnerabilities in recognizing and handling adversarial samples. Overall, the success rate of attacks transferring from one model to another is relatively high. Specifically, ResNet18 has the weakest defense against attacks on itself, and the attacks it generates have slightly lower transferability to other models (IDE and PCB), which may be due to differences in feature representation between ResNet18 and the other models.\n\nFor the effectiveness of the proposed method in attacking more diverse modality data, please refer to the response to Reviewer fT1U. The chart shows the transferability of attacks using our method across various modality datasets (SYSU, RegDB, Sketch[1], CnMix).\n\nThe Sketch ReID dataset [1] contains 200 individuals, each represented by one sketch and two photographs. The photographs of each individual were captured during daylight using two cross-view cameras. Raw images (or video frames) were manually cropped to ensure that each photograph includes only the specific individual. Additionally, we applied random channel mixing to images from the Market1501 [2] dataset to simulate a new modality dataset, which we refer to as CnMix. Market1501 includes 1,501 pedestrians captured by six cameras (five HD cameras and one low-definition camera). \n\n[1] Lu Pang,Yaowei Wang,Yi-Zhe Song,Tiejun Huang,and Yonghong Tian.Cross-domain adversarial feature learning for sketch re-identification.In Proceedings of the 26th ACM international conference on Multimedia,pages 609-617,2018.\n\n[2] Liang Zheng,Liyue Shen,Lu Tian,Shengjin Wang,Jingdong Wang,and Qi Tian. Scalable person re-identification:A benchmark.In Proceedings of the IEEE international conference on computer vision,pages 1116-1124,2015.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "es3ktw3kzk", "reviewer": "Reviewer_Th4d", "summary": "This paper investigates adversarial attacks on cross-modality person re-identification (ReID) systems. It is purportedly the first study to investigate vulnerabilities in cross-modality ReID models, with the goal of evaluating the security of these systems. \n\nTo this end, the paper introduces an innovative universal perturbation attack method specifically designed for cross-modality ReID. This new method includes a cross-modality attack augmentation technique, which helps the perturbation synergy attack to better bridge the gap between different modalities. Experimental results on the RegDB and SYSU datasets show that the CMPS attack significantly reduces the accuracy of ReID systems, outperforming existing traditional methods.", "questions": "Have the authors considered how to enhance the robustness of cross-modality ReID systems to resist attacks similar to CMPS? The paper could further expand its impact by investigating the resilience of CMPS attacks against existing adversarial defense mechanisms. By discussing or empirically evaluating the performance of CMPS attacks in the presence of adversarial training or other defense strategies, a deeper understanding of the proposed method's robustness can be gained, guiding the development of more secure cross-modality ReID systems.", "limitations": "Yes, the authors have adequately addressed the limitations.", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 4, "contribution": 4, "strengths": "This paper introduces a novel perturbation attack specifically designed for cross-modality person re-identification, addressing a significant gap in the existing literature. The authors have made a notable contribution by being the first to explore vulnerabilities in these cross-modality systems. The importance of this work lies in its innovative approach to tackling the complex challenges posed by person re-identification systems that use different imaging modalities, such as RGB and infrared. The paper provides rigorous theoretical analysis and thorough experimental validation of the proposed method, demonstrating its significance both theoretically and practically. Additionally, the quality of writing is high, with the authors presenting their ideas clearly and concisely, making it accessible even to readers who are not experts in the field.", "weaknesses": "1. The difference between VI-ReID and regular ReID is that VI-ReID requires matching pedestrians across different modalities. Theoretically, it is sufficient to attack the RGB features, rendering them inadequate to match the infrared image features. Can focusing solely on attacking RGB features also fulfill the requirements?\n2. The article states that infrared images are grayscale images, which might not be entirely accurate. Near-infrared images appear visually similar to grayscale images and lack color information.\n3. While the paper demonstrates the effectiveness of the CMPS attack in bridging the gap between RGB and infrared modalities, extending this research to a broader range of modalities would provide deeper insights into the applicability and limitations of the proposed attack method. Additionally, the current experiments are primarily focused on the RegDB and SYSU datasets. Future studies incorporating more diverse datasets from various scenarios and conditions would help validate the robustness and generalizability of this method in complex environments.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We would like to express our sincere gratitude for your thorough review and valuable feedback on our paper. Your input has undoubtedly played a pivotal role in enhancing the quality and clarity of the manuscript. \n\nResponses to the individual questions below.\n\n\n**Reviewer’s Comment:**  \n\n“The difference between VI-ReID and regular ReID is that VI-ReID requires matching pedestrians across different modalities. Theoretically, it is sufficient to attack the RGB features, rendering them inadequate to match the infrared image features. Can focusing solely on attacking RGB features also fulfill the requirements?”\n\n**Response:**\n\nYes, theoretically, attacking only the RGB features can partially disrupt a VI-ReID system. However, this approach has significant limitations, and the effectiveness of the attack can be relatively constrained. As shown in the table below, 'RGB Attack' refers to using only RGB visible images from the cross-modality dataset RegDB for the attack. In this context, smaller values indicate better attack effectiveness.\n\n### AGW Baseline:\n\n| Method                  | Visible to Thermal  (r=1) | Thermal  to Visible (r=1) |\n|-------------------------|---------------------------|----------------------------|\n| **AGW baseline**        | 70.1%                    | 70.5%                     |\n| **RGB attack**          | 15.7%                    | 22.3%                     |\n| **RGB+Infrared attack** | 5.1%                     | 16.9%                     |\n\n### DDAG Baseline:\n\n| Method                  | Visible to Thermal (r=1) | Thermal  to Visible (r=1) |\n|-------------------------|---------------------------|----------------------------|\n| **DDAG baseline**       | 69.3%                    | 68.0%                     |\n| **RGB attack**          | 18.3%                    | 30.5%                     |\n| **RGB+Infrared attack** | 4.6%                     | 19.5%                     |\n\nIt can be seen that when considering only RGB, the effectiveness of the attack is limited and is even more constrained in the “Non-Visible to Visible” testing scenario. While attacking RGB features can be somewhat effective in a single RGB-infrared ReID system, its generalizability is likely poor in more complex real-world scenarios and when considering more modalities. If we focus only on attacking RGB features in the RGB-infrared ReID system, the effectiveness of the attack may significantly diminish when transferring to RGB-thermal ReID systems or even infrared-thermal ReID systems. Therefore, it is more important to research and develop universal perturbations that exhibit good transferability between different modalities to ensure the effectiveness of attacks in various practical applications.\n\n\n**Reviewer’s Comment:**  \n\n“Have the authors considered how to enhance the robustness of cross-modality ReID systems to resist attacks similar to CMPS? ...... By discussing or empirically evaluating the performance of CMPS attacks in the presence of adversarial training or other defense strategies ...... guiding the development of more secure cross-modality ReID systems.”\n\n**Response:**\n\nThank you for your valuable feedback. Our future work will focus on evaluating the effectiveness of CMPS attacks against existing adversarial defense mechanisms. We have conducted some experiments. We injected adversarial perturbations with a magnitude of 8 into the training samples on the RegDB dataset and then performed adversarial training by mixing the adversarial samples with the original samples. The results are shown in the table below:\n\n| Method             | Visible to Thermal (r=1) | Thermal to Visible(r=1) |\n|--------------------|---------------------------|----------------------------|\n| **AGW Baseline**   | 70.1%                     | 70.5%                      |\n| **Before Adversarial Training**    | 2.3\t%                       | 2.0%                      |\n| **After Adversarial Training** | 25.7%                     | 29.4%                      |\n\nThe results indicate that adversarial training remains an effective defense method in cross-modality scenarios.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "gj7FNudTmy", "reviewer": "Reviewer_tAG1", "summary": "The paper addresses security concerns in cross-modality person re-identification systems, focusing on systems that use both RGB and infrared images. Traditional ReID systems have primarily focused on RGB images, but the differences between RGB and infrared modalities present unique challenges. The authors propose a universal perturbation attack method designed for cross-modality ReID, which optimizes perturbations using gradients from multiple modalities. Experiments on the RegDB and SYSU-MM01 datasets demonstrate the effectiveness of this method.", "questions": "See the weaknesses above.", "limitations": "The authors explain the limitations of their work, and there is no negative societal impact.", "rating": 4, "confidence": 5, "soundness": 2, "presentation": 2, "contribution": 3, "strengths": "1.This work investigates vulnerabilities in cross-modality ReID models.\n2.Proposes a cross-modality perturbation synergy (CMPS) attack using triplet loss to optimize perturbations that leverage shared knowledge across modalities.\n3.Extensive experiments on the RegDB and SYSU datasets show the method's effectiveness and provide insights for future improvements in cross-modality ReID robustness.", "weaknesses": "1.The authors use random grayscale transformations to reduce modality differences. Are the three-channel grayscale images based on visible light, infrared, or both?\n2.What is the intended meaning of the decision boundary in Figure 2?\n3.The Figure 3 is difficult to understand.\n4.Can the method be discussed on more datasets, such as the LLCM dataset?\n5.Does the size of the adversarial boundary affect the experimental results?\n6.What is the overall loss function used in the paper? How are the functions discussed in Section 3.2 and Section 3.4 related? Additionally, in Section 3.4, the sequence of formulas seems inconsistent with the context.\n7. The SYSU-MM01 common tests are conducted in all-search and indoor-search modes. Which mode is the experiment in Table 1 based on? It is recommended to discuss both modes.\n8.The authors should select more diverse types of baseline models to verify the generalizability of the method.\n9.In Algorithm 1, the CMPS attack is mentioned to use grayscale images to update perturbations, but in the ablation experiments in Table 3, they are validated as two separate modules. What is the reason for this?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We would like to express our sincere gratitude for your thorough review and valuable feedback on our paper. Your input has undoubtedly played a pivotal role in enhancing the quality and clarity of the manuscript. Responses to the individual questions below.\n\n**Reviewer’s Comment :**  \n\n“ ...... Are the three-channel grayscale images based on visible light, infrared, or both? ”\n\n**Response:**  \n\nThe three-channel grayscale image is based on both visible light and infrared. \n\n**Reviewer’s Comment :** \n\n“What is the intended meaning of the decision boundary in Figure 2? ” \n \n**Response:** \n\nUniversal adversarial perturbations leverage the manifold hypothesis, indicating inherent structures and relationships among data. These perturbations push different sample features into a common sub-region that affects the model's accuracy. In Figure 2, we use a spherical representation of the manifold. Identical shapes with different colors represent features of the same person across different modalities. Our method generates universal perturbations that direct these features into a common sub-region.\n\n**Reviewer’s Comment :**  \n\n“The Figure 3 is difficult to understand ”\n\n**Response:** \n\nWe noticed your comment about the difficulty in understanding Figure 3. To address this, we have redrawn it (see Figure 1 in the rebuttal supplementary material PDF). It shows how our approach captures intrinsic associations between modalities by pushing apart feature distances of positive pairs with the same identity and pulling closer feature distances of negative pairs with different identities across modalities.\n\n**Reviewer’s Comment:**  \n\n“Can the method be discussed on more datasets, such as the LLCM dataset? ”\n\n**Response:** \n\nWe have supplemented the relevant experiments. The experimental results (ϵ=8) of our proposed method on the LLCM dataset[1] and the DEEN baseline[1] are shown in the table below (lower accuracy indicates better performance).\n| Method | Visible to Infrared (r=1) | Infrared to Visible (r=1) |\n|-|-|-|\n| **DEEN Baseline** | 62.5%| 54.9%|\n| **M-FGSM Attack**| 28.4%| 24.8%|\n| **LTA Attack** | 15.1%| 19.5%|\n| **ODFA Attack** | 26.3%| 23.7%|\n| **Col.+Del. Attack** | 8.6%| 9.1%|\n| **Our Attack** | 5.8%| 6.4%|\n\nLLCM is a dataset designed for cross-modality ReID under low-light conditions. Compared to other datasets, it presents more challenges for attackers due to its diverse scenarios and low-light conditions. This complexity and uncertainty make it difficult for adversarial samples to remain effective, reducing the attack success rate.\n\n[1]Zhang, Y.,et al. (2023). Diverse embedding expansion network and low-light cross-modality benchmark for visible-infrared person re-identification. In CVPR (pp. 2153-2162).\n\n**Reviewer’s Comment:**\n\n “Does the size of the adversarial boundary affect the experimental results? ”\n\n**Response:** \n\nYes, the size of the adversarial boundary can significantly affect the experimental results. The experimental results on AGW using the RegDB dataset are as follows:\n| Adversarial Boundary (ϵ) | Visible to  Thermal (r=1) | Thermal to Visible (r=1) |\n|-|-|-|\n| -| 70.0%| 70.5%|\n| 2| 32.7%| 40.5%|\n| 4| 9.6%| 13.8%|\n| 8| 2.3%| 2.0%|\n| 16| 0.3%| 0.5%    \n\nAs the adversarial boundary ϵ increases, the attack effect is significantly enhanced, and the model's rank-1 accuracy drops rapidly. \n\n**Reviewer’s Comment:** \n\n“What is the overall loss function used in the paper? How are the functions discussed in Section 3.2 and Section 3.4 related ....... ”\n\n**Response:** \n\nSection 3.2 introduces the framework and overall optimization objective of our method, providing a macro overview. Section 3.4 further details the specific process of perturbation optimization under different modalities. The implementation of this method is quite flexible. Adversarial perturbations can be optimized on a per-sample basis or in batches. Section 3.4 does not explain this, which may have caused confusion regarding its relationship with Section 3.2. Additionally, adjusting the order of Formula 1 will indeed provide a better reading experience. We appreciate the reviewer pointing these out and will make the necessary optimizations. Regarding the flexibility issue, there is further discussion in subsequent questions.\n\n**Reviewer’s Comment:** \n\n“The SYSU-MM01 common tests are conducted in all-search and indoor-search modes. Which mode is the experiment in Table 1 based on? ”\n\n**Response:** \n\nFor the \"Visible to Infrared\" scenario, we used the all-search mode. For the \"Infrared to Visible\" scenario, we used the indoor-search mode. We chose these modes to better align with the typical use cases and challenges presented by each cross-modality scenario. We will clarify this information in the revised manuscript to avoid any confusion. Thank you for pointing this out.\n\n**Reviewer’s Comment:** \n\n“The authors should select more diverse types of baseline models to verify the generalizability of the method ”\n\n**Response:** \n\nIn the previous response, we evaluated the DEEN baseline on the LLCM dataset and, as requested by other reviewers, assessed the transferability of the proposed method on different network architectures, including IDE, PCB, and ResNet18 (see the response to Reviewer fT1U). These experiments validate the method's generalizability.\n\n**Reviewer’s Comment:** \n\n “ ...... CMPS attack ...... validated as two separate modules. What is the reason for this? ”\n\n**Response:** \n\nSeparating these components allows us to assess their individual contributions to the overall method, clearly demonstrating their roles in the final performance. Different environments may require varying method components. For example, in sketch-RGB systems, grayscale images may not be effective for attack augmentation. By validating these components independently, we showcase the method's flexibility and adaptability, proving that specific enhancements improve the effectiveness of universal perturbations.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We thank all the reviewers for their detailed feedback and valuable time. We are pleased to see that the reviewers found our paper insightful (Zepn, fT1U, Th4d, tAG1), appreciated our experimental validation (fT1U, Th4d), and recognized the theoretical originality and practical value of our work (Zepn, Th4d). In this work, we proposed the Cross-Modality Perturbation Synergy (CMPS) attack method, filling a critical gap in the security research of cross-modality person re-identification (ReID) systems.

Regarding the experiments, Zepn and tAG1 suggested validating the transferability of the perturbations across more diverse model architectures and cross-modality datasets. Therefore, we will supplement experiments in this area. Additionally, Th4d expressed doubts about whether attacking only RGB features would be sufficient, and we will also supplement relevant experiments to address this point. Furthermore, tAG1 pointed out some inconsistencies and confusion in our presentation. We have carefully reviewed these issues and addressed them in our individual responses to ensure clarity and consistency in the revised manuscript.

Based on the reviewers' comments, we are conducting further experiments and will report the results and make certain revisions to the draft in the coming days to incorporate the reviewers' feedback.

Meta-review: The authors propose a CMPS attack, a perturbation method that is designed for cross-modality person ReID. It leverages aggregated feature gradients from RGB and IR images to generate cross-modality perturbations. Four experts in the field reviewed this paper. Their recommendations are Accept, Weak Accept, Weak Accept, and Borderline Reject. Overall, the reviewers appreciated the paper because it is well written and organized, and it addresses the important and unexplored problem of adversarial attacks in visible-infrared person ReID. The paper provides an approach with practical significance. It also shows the CMPS method’s effectiveness through comprehensive experimental evaluations on the challenging RegDB, SYSU, LLCM, and DEEN datasets, and valuable insights for future improvements in cross-modality ReID robustness.

Based on the reviewers’ feedback and the authors’ satisfactory rebuttal, which addresses most concerns, I recommend it for acceptance. However, the reviewers have raised some issues and concerns in their Weaknesses sections that should be addressed in the final camera-ready version of the paper. In particular, the authors should provide a more detailed explanation for Figure 2 and a justification to support selecting the ϵ value. The authors should also highlight the technical novelty of their approach to clarify that they have not merely applied classic FGSM and PGD methods, and integrated relatively conventional strategies into visible-infrared ReID models without exploring the specific characteristics of this task. Finally, some authors suggested validating the transferability of the perturbations across more diverse model architectures and cross-modality datasets. The authors are encouraged to make the necessary changes to the best of their ability. We congratulate the authors on the acceptance of their paper!
Decision: Accept (poster)