{"id":"bbb56c85-b7b0-4d0d-92b6-e86df377ece5","arxiv_id":"2501.12761","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Modality-specific adversarial generators trained with metric disruption, simulated cross-modal, and collaborative multi-modal losses transfer to black-box single-, cross-, and multi-modality person re-id models, reaching mean mAP drop rates of 55.9%, 24.4%, 49.0%, and 62.7%.","lead":"An adversarial attack that fools all three types of person re-identification models with one set of per-modality perturbations. The method trains three generators on a multi-modal surrogate and reports strong transfer to black-box single-, cross-, and multi-modality models, but no code and no multi-modality baseline are provided.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"CMSD's core premise that cross-inputting images into the surrogate's modality subnetworks mimics real cross-modality embeddings is asserted, not validated, and the unified-transfer claim leans on it.","rationale":"The paper's headline evidence is that one set of per-modality generators, trained on the TOP/RGBNT201 surrogate, transfers to 14 black-box re-id models. For that to hold, the training objective must expose the generators to feature spaces representative of deployed models. MD (Eq. 7) covers the surrogate's own modality-specific spaces; CMSD (Eqs. 8-10) is the only mechanism aimed at cross-modality models. The concern is that CMSD's construction is not validated: S_N is an NI-stream subnetwork trained on NI images, so x_R is an out-of-distribution input for it, whereas real cross-modality models are trained with explicit alignment losses on paired RGB-NI identities. The paper asserts the representativeness in Section III-D ('These features can represent the modality-invariant features in cross-modality model embeddings') but provides no feature-space comparison. Table II shows CMSD is the component that lifts R-N mDR from 10.4% to 24.4%, so the unified claim leans on this premise. The concern is not that CMSD is useless; the ablation shows it helps. The issue is that its gains might be an artifact of optimizing against an OOD input rather than a faithful simulation, which would limit generalization beyond the tested LLCM targets. This is an addressable empirical question, so CONDITIONAL rather than REJECT is appropriate. The proposed oracle-replacement experiment would settle whether real cross-modality features improve transfer over CMSD. Credit where due: the paper provides a component ablation and tests a broad set of target architectures; the concern is missing validation of the key transferability premise, not internal inconsistency. The Eq. 9 subscript error and the absence of released code compound the uncertainty but are secondary.","tokens_in":17335,"tokens_out":13727,"duration_ms":147469,"concrete_test":"Replace the CMSD term (Eq. 10) with an oracle term computed from the features of an actual cross-modality model trained on the same RGBNT201 RGB/NI pairs, keeping all other MUA losses, data, and hyperparameters fixed. Retrain the RGB and NI generators and evaluate mDR on held-out cross-modality models (CAJ, DDAG, MMN, PMT on LLCM). If the oracle variant outperforms the CMSD variant by a substantial margin (e.g., more than 5 mDR points), CMSD's simulated space is not faithful and the unified-transfer claim is weakened; if the two are comparable, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that one set of per-modality generators trained against the multi-modality surrogate TOP transfers to single-, cross-, and multi-modality re-id models. The load-bearing step is CMSD (Eqs. 8-10): the paper assumes that feeding an RGB image into the NI subnetwork S_N and an NI image into S_R yields features that approximate the embedding space of real cross-modality models. This is asserted but not validated, and is questionable a priori: S_N was trained only on NI images, so x_R is out-of-distribution for it, whereas real cross-modality models are explicitly trained to map paired RGB/NI images of the same identity close together. Nothing in TOP's training made S_N(x_R) behave like a modality-invariant embedding. Since Table II shows CMSD is the component that lifts cross-modality mDR (R-N: 10.4 to 24.4; N-R: 41.4 to 49.0), the unified-transfer claim leans on this unvalidated premise. The gain could come from generic OOD-sensitive perturbations rather than from faithful simulation, and would then not generalize beyond the tested LLCM targets. Ambiguity is compounded by Eq. 9, where the second equality is printed as S_R(x'_R) but should be S_N(x'_R), so the actual CMSD implementation is unclear.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a generative adversarial attack, Modality Unified Attack (MUA), for person re-identification models across single-, cross-, and multi-modality settings. MUA trains three modality-specific generators (RGB, NI, TI) against a multi-modality surrogate model (TOP), using a metric disruption loss, a Cross Modality Simulated Disruption (CMSD) loss that pushes apart features obtained by cross-feeding images into non-corresponding subnetworks, and a Multi Modality Collaborative Disruption (MMCD) loss that pushes adversarial features away from feature centers of all modalities. The generators are evaluated for black-box transfer on 14 models spanning the three settings, with reported mean mAP drop rates of 55.9%, 24.4%, 49.0%, and 62.7%. Ablations show that each loss component contributes, with CMSD being the key component for cross-modality transfer.","tokens_in":17607,"tokens_out":7849,"duration_ms":70036,"significance":"If the reported transfer rates are reproducible, the paper is a valuable first step toward understanding the security of multi-modality re-id systems under black-box attacks. The choice of a multi-modality surrogate, intermediate-feature disruption before fusion, and evaluation across diverse architectures and datasets are all strengths; the ablation study is informative, and the cross-dataset/cross-model protocol is appropriate for single- and cross-modality targets. However, the central simulation assumption underlying CMSD is not validated, and the multi-modality setting lacks any comparison baseline, so the headline claims are not yet fully supported.","major_comments":[{"comment":"The second equality in Eq. (9), F^{N'}_R = S_R(x'_R), is inconsistent with the text and with Eq. (8); it should read F^{N'}_R = S_N(x'_R). Because the CMSD loss (Eq. 10) directly uses F^{N'}_R, the printed equation makes the implementation ambiguous. Beyond the typo, the core premise of CMSD is asserted rather than validated: the authors assume that S_N(x_R), where S_N is trained only on NI images, is a faithful stand-in for the modality-invariant embedding of a cross-modality model. Since Table II attributes the largest cross-modality gains to CMSD (R-N mDR from 10.4 to 24.4; N-R from 41.4 to 49.0), this assumption is load-bearing. I request a direct feature-space check (e.g., distance between S_N(x_R) and embeddings from CAJ/DDAG/PMT on LLCM) or an ablation that replaces the cross-input with a fixed random projection, to show that the gain is not simply due to out-of-distribution sensitivity.","section":"Section III-D, Eq. (9) and Table II"},{"comment":"There is no attack baseline for the multi-modality retrieval setting (R'N'T'-RNT). The 62.7% mDR is meaningful relative to 'None', but the claim that MUA is the first omni-modality attack does not by itself establish that the multi-modality result is competitive or non-trivial. Please add at least one baseline, even a simple one, such as training three independent single-modality generators with the MD loss on the same surrogate and applying them to the three modalities, or adapting an existing cross-modality attack (e.g., FSAM) to TI images. If none can be adapted, explicitly justify why the 62.7% mDR is meaningful without a comparison.","section":"Section IV-A, Table I"}],"minor_comments":[{"comment":"The 'individual feature centers' F^c_m are not defined. Specify how they are computed (e.g., exponential moving average over the training set or per-batch mean) and over which data split.","section":"Section III-E, Eq. (11)"},{"comment":"The text states that 'high lambda1 and lambda2 values lead to notable mDR declines,' yet the chosen values are 50. Please clarify the parameter axis and where the optimum lies; as written, the sentence is ambiguous.","section":"Section IV-C, Fig. 5(a)"},{"comment":"In the 'Effectiveness of MD' paragraph, the text reports 58.2% mDR for the multi-modality setting, while Table II reports 58.6%; please correct the discrepancy.","section":"Section IV-C"},{"comment":"The table would be clearer if the caption or a note indicated which methods are designed for which settings; currently the grouping into 'Single-modality Attack', 'Cross-modality Attack', and 'Omni-modality Attack' is not explicitly explained.","section":"Section IV-B"},{"comment":"The phrase 'complementary feature fusion' appears twice in close succession; consider rewording one instance for clarity.","section":"Section I"},{"comment":"The notation F^N_R and F^{N'}_R is not defined in the caption; please define it in the caption or in the text.","section":"Figure 2"}],"recommendation":"major_revision","confidential_remarks":"The 'first work' claim appears justified based on the related work search. The main risks are the unvalidated CMSD assumption and the absence of a multi-modality baseline; both are addressable in revision. I do not see a fundamental flaw that would require rejection, but the two major comments above should be fully resolved before publication."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this is a real new result, not a repackaging. The paper trains three modality-specific generators on a single multi-modality surrogate and shows they transfer to 14 black-box re-id models across single-, cross-, and multi-modality settings. That is the first omni-modality attack I know of, and the evaluation is appropriately broad: cross-dataset and cross-model for the existing settings, ablations on each loss, and a defense section. The headline mDR numbers are on held-out models, not the surrogate, so the circularity concern is low.\n\nWhat I like: the MMCD idea of pushing adversarial features away from the multi-modality feature centers is clean and seems to help, especially the MMCD' variant. The ablations in Table II are consistent: each added term improves something. The authors also acknowledge the multi-generator complexity as a limitation, which is honest.\n\nThe soft spot is the CMSD mechanism. The paper assumes that feeding an RGB image into the NI subnetwork of the surrogate produces features that approximate a real cross-modality model's modality-invariant embedding. That is plausible at first glance, but it is asserted, not tested. The stress-test note is right that the gain in Table II could come from the images being out-of-distribution for the subnetwork rather than from faithful simulation. If that is the case, the transfer to other cross-modality models may be less reliable than the LLCM results suggest. This doesn't sink the paper, but it needs direct evidence: a feature-space similarity analysis or an experiment where the simulation is replaced with a real cross-modality surrogate.\n\nThere is also a typo in Eq. 9: F^{N'}_R = S_R(x'_R) should almost certainly be S_N(x'_R). That matters because the CMSD loss uses that term. Fix it, release code, and the reproducibility story improves a lot.\n\nBottom line: this deserves a serious referee. The new setting and broad evaluation outweigh the unvalidated mechanism. I would ask the authors for the extra CMSD validation and code in revision, but I would not desk-reject.","headline":"First genuine omni-modality re-id attack with broad black-box evaluation; the CMSD transfer mechanism is asserted rather than proven, but the paper deserves review.","tokens_in":18131,"tokens_out":3011,"would_cite":true,"duration_ms":30431,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that three modality-specific adversarial generators, trained together on a single multi-modality surrogate model with metric disruption losses, can produce transferable perturbations that degrade single-, cross-, and…","keywords":["adversarial attack","person re-identification","modality unified attack","cross-modality","multi-modality","transferable adversarial examples","metric disruption","generative adversarial network"],"falsifier":"Measure the distance between simulated cross-modality features $S_R(x_N)$ and $S_N(x_R)$ from the surrogate and the embeddings a real cross-modality model produces for the same images; if the simulated and real feature distributions are far apart, or if adversarial examples trained only to disrupt the simulated features fail to raise retrieval rank on cross-modality models, the central transfer mechanism is not doing the claimed work.","tokens_in":17147,"feed_emoji":"🎯","tokens_out":6334,"duration_ms":58283,"temperature":0.7,"pith_summary":"The paper tries to establish that a single unified black-box attack can threaten all three families of person re-identification models, namely single-modality RGB, cross-modality RGB-NI, and multi-modality RGB-NI-TI, without knowing which family is deployed. It proposes training three modality-specific generators on one multi-modality surrogate model by disrupting intermediate features before fusion. If true, this matters because surveillance systems increasingly fuse multiple spectra, while previous adversarial work targets only one re-id family at a time; a deployed system could be degraded by perturbations crafted once and applied by input modality. The headline evidence is that the method achieves 55.9%, 24.4%, 49.0%, and 62.7% mean mAP Drop Rate across the single-modality, RGB-to-NI, NI-to-RGB, and multi-modality retrieval settings.","feed_headline":"Unified attack fools RGB, cross-spectral and fused re-ID models","feed_subtitle":"Per-modality generators trained on one surrogate model transfer to 14 black-box re-ID models.","key_machinery":"The machinery is a multi-modality surrogate model with three modality-specific subnetworks, plus three trained adversarial generators and one discriminator per modality. The decisive object is Cross Modality Simulated Disruption: feeding an RGB image into the NI subnetwork and an NI image into the RGB subnetwork to fabricate modality-invariant features, then using Euclidean-distance disruption on those simulated features so the generators attack the shared embedding space that cross-modality models rely on. Multi Modality Collaborative Disruption plays the complementary role of pushing each adversarial feature away from the feature centers of all three modalities, so that no useful complementary information survives the fusion step.","core_discovery":"The paper sets out to show that a unified black-box attack on person re-identification is possible: instead of designing one attack per model family, three modality-specific generators for RGB, near-infrared, and thermal infrared images are trained together on a surrogate multi-modality model by disrupting intermediate features before fusion. The proposed Modality Unified Attack combines Metric Disruption with two new losses: Cross Modality Simulated Disruption, which feeds images through non-corresponding modality subnetworks to approximate cross-modality embedding spaces, and Multi Modality Collaborative Disruption, which pushes adversarial features away from all three modality feature centers. In cross-dataset and cross-model black-box experiments, the same generators produce mean mAP Drop Rates of 55.9% on eight single-modality models, 24.4% and 49.0% on the two cross-modality retrieval directions, and 62.7% on two multi-modality models, and remain effective against JPEG compression and input randomization defenses.","pith_inferences":["The paper does not compare its simulated cross-modality features directly with embeddings from real cross-modality models; a feature-space similarity measurement would be the cleanest way to test whether the transfer works for the reason claimed.","The same surrogate-subnetwork trick could be applied to other tasks with per-modality encoders, such as visible-infrared detection, remote sensing, or multimodal retrieval, whenever an attacker wants one perturbation set to work across single- and cross-modal systems.","Because all experiments use one surrogate backbone and one multi-modality dataset, the unified claim would be stronger if the generators were retrained on a second multi-modality backbone and evaluated on a second multi-modality benchmark; that remains untested.","The Multi Modality Collaborative Disruption constraint could be reused as a robustness diagnostic during adversarial training, since it directly targets the complementary information that fusion models depend on."],"forward_implications":["One set of per-modality generators replaces the need to know the target model type in a black-box re-id attack.","Cross-modality retrieval in both directions, RGB-to-NI and NI-to-RGB, is degraded by the same generators that attack single- and multi-modality models.","The Cross Modality Simulated Disruption loss is the main driver of cross-modality transfer: adding it raises the RGB-to-NI mean mAP Drop Rate from 10.4% to 24.1%.","Multi-modality feature fusion does not by itself neutralize the attack: the two tested fused models drop by 62.7% mean mAP Drop Rate.","Basic input defenses weaken but do not stop the attack, with mean mAP Drop Rates still at 41.0%, 18.1%, 39.5%, and 36.7% under JPEG and randomization defenses."],"supporting_citations":[{"why":"The TOP-ReID multi-modality model is the surrogate whose subnetworks provide the features that Metric Disruption, CMSD, and MMCD disrupt.","marker":"[24]"},{"why":"Deep Mis-Ranking supplies the generator and discriminator architecture that MUA adapts for training each modality-specific attacker.","marker":"[37]"},{"why":"RGBNT201 is the multi-modality dataset used to train the surrogate and to evaluate the multi-modality attack.","marker":"[21]"},{"why":"MUAP is a universal single-modality attack baseline and the source of the aAP and mDR evaluation metrics used throughout.","marker":"[36]"},{"why":"MetaAttack is the strongest single-modality attack baseline that MUA compares against on RGB re-id models.","marker":"[34]"},{"why":"CMPS is the cross-modality universal-perturbation baseline used for the RGB-to-NI comparison.","marker":"[32]"},{"why":"FSAM is the feature-level cross-modality baseline compared on both cross-modality retrieval settings.","marker":"[45]"},{"why":"EDITOR is one of the two target multi-modality models used to test the multi-modality attack.","marker":"[23]"},{"why":"UniCat is the other target multi-modality model used to test the multi-modality attack.","marker":"[66]"}],"fun_headline_variants":["One attack, all modalities: unified re-ID exploit","Modality-agnostic attack breaks re-ID everywhere","Unified adversarial attack defeats all re-ID variants","Three generators, one attack: omni-modality re-ID falls"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack transfers only if feeding an image into the wrong-modality subnetwork of the surrogate produces features close to those of a real cross-modality re-id model; if that simulation is unrepresentative, the cross-modality attack gains would not generalize.","fun_headline_variants_meta":{"raw":{"variants":["One attack, all modalities: unified re-ID exploit","Modality-agnostic attack breaks re-ID everywhere","Unified adversarial attack defeats all re-ID variants","Three generators, one attack: omni-modality re-ID falls"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000848,"raw_usage":{"total_tokens":3719,"prompt_tokens":1007,"completion_tokens":2712,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":623,"completion_tokens_details":{"reasoning_tokens":2647}},"tokens_in":623,"tokens_out":2712,"duration_ms":19049,"temperature":1.0,"reasoning_tokens":2647,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T16:48:32.936261+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Measure the distance between simulated cross-modality features $S_R(x_N)$ and $S_N(x_R)$ from the surrogate and the embeddings a real cross-modality model produces for the same images; if the simulated and real feature distributions are far apart, or if adversarial examples trained only to disrupt the simulated features fail to raise retrieval rank on cross-modality models, the central transfer mechanism is not doing the claimed work.","supporting_citations":[{"cited_title":"Top-reid: Multi- spectral object re-identification with token permutation,","cited_arxiv_id":null,"evidence_quote":"The TOP-ReID multi-modality model is the surrogate whose subnetworks provide the features that Metric Disruption, CMSD, and MMCD disrupt."},{"cited_title":"Transferable, control- lable, and inconspicuous adversarial attacks on person re-identification with deep mis-ranking,","cited_arxiv_id":null,"evidence_quote":"Deep Mis-Ranking supplies the generator and discriminator architecture that MUA adapts for training each modality-specific attacker."},{"cited_title":"Robust multi-modality person re-identification,","cited_arxiv_id":null,"evidence_quote":"RGBNT201 is the multi-modality dataset used to train the surrogate and to evaluate the multi-modality attack."},{"cited_title":"Beyond universal person re-identification attack,","cited_arxiv_id":null,"evidence_quote":"MUAP is a universal single-modality attack baseline and the source of the aAP and mDR evaluation metrics used throughout."},{"cited_title":"Towards robust person re-identification by defending against universal attackers,","cited_arxiv_id":null,"evidence_quote":"MetaAttack is the strongest single-modality attack baseline that MUA compares against on RGB re-id models."},{"cited_title":"Cross-modality perturbation synergy attack for person re-identification,","cited_arxiv_id":null,"evidence_quote":"CMPS is the cross-modality universal-perturbation baseline used for the RGB-to-NI comparison."},{"cited_title":"Feature-level adversarial attacks and ranking disruption for visible-infrared person re- identification,","cited_arxiv_id":null,"evidence_quote":"FSAM is the feature-level cross-modality baseline compared on both cross-modality retrieval settings."},{"cited_title":"Magic Tokens: Select Diverse Tokens for Multi-modal Object Re-Identification","cited_arxiv_id":"2403.10254","evidence_quote":"EDITOR is one of the two target multi-modality models used to test the multi-modality attack."}],"review_version":1}