Pith. sign in

REVIEW 6 major objections 4 minor 61 references

Adversarial Semantic and Label Perturbation Attack for Pedestrian Attribute Recognition

T0 review · 6 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that pedestrian attribute recognition models built on CLIP-based vision-language fusion are vulnerable to a single shared adversarial noise pattern, and that a filter-plus-prompt defense largely restores performance.

desk verdict A solid digital attack on the authors' own PromptPAR model, with a general-vulnerability claim that the paper's own Table VII contradicts. read the letter →

arxiv 2505.23313 v1 pith:NZVFCYKL submitted 2025-05-29 cs.CV cs.AIcs.LG

Weizhe Kong , Xiao Wang , Ruichong Gao , Chenglong Li , Yu Zhang , Xing Yang , Yaowei Wang , Jin Tang This is my paper
classification cs.CVcs.AIcs.LG
keywords pedestrianattributerecognitionadversarialattackdefenseuniversalperturbationCLIPvision-languagemodelprompttuningsemanticmulti-labelclassification
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to establish that pedestrian attribute recognition (PAR), a vision-language task used in surveillance and person retrieval, is vulnerable to adversarial interference, and that a practical defense exists. It introduces ASL-PAR, a generator-free attack that trains a single universal noise pattern per dataset against a frozen CLIP-based PAR model, combining a label-perturbation loss that shifts attribute labels inside body-part groups with a semantic-perturbation loss that misaligns image and text features in CLIP space. On PETA, mean accuracy drops from 88.76 to 48.25, and on PA100K from 87.47 to 50.85, with smaller but clear drops on MSP60K and RAPv2; a printable patch version degrades recognition in physical tests. The paper also proposes a defense, an input filter paired with learnable text prompts, and reports that it restores most of the lost accuracy. The authors claim this is the first adversarial attack and defense framework for PAR.

What carries the argument

The load-bearing object is the universal adversarial perturbation itself: one trainable noise tensor $\eta$ of the same size as the input image, shared by every sample in a dataset and optimized by gradient inversion against a fully frozen PromptPAR model. Its training loss is the sum of a weighted cross-entropy term on part-shifted pseudo-labels and the GL loss (Equation 10), which measures global-local image-text similarity and is reused from PromptPAR's own training objective. A perturbation procedure groups attributes by body part (gender, head, upper body, lower body, feet, hands) and shifts positive labels to other attributes in the same group, so the target mistakes are semantically plausible. For the defense, the central mechanisms are a learnable convolutional filter placed before the vision encoder and a learnable text prompt that re-aligns the CLIP semantic space; both are trained on noisy data.

What would settle it

Train the ASL-PAR noise on PromptPAR and evaluate it against several independently built CLIP-based PAR models that use different prompt templates, different fusion heads, and no GL loss in training; if mean accuracy drops by only a few points on all of them, the claim of a general PAR vulnerability would be refuted in favor of a PromptPAR-specific effect. A simpler observation also suffices: if re-running the same experiments with noise trained on a non-PromptPAR CLIP-based baseline does not produce a comparable drop, the method's reach depends on the target model's own training loss.

Watch

Extended reading notes

Core claim

The central claim is that a state-of-the-art CLIP-prompting PAR model can be broken by a perturbation that is shared across all test images rather than crafted per image, and that the breakage is driven by two complementary mechanisms. Perturbing the labels inside each body-part group makes the model converge toward plausible but wrong attribute predictions, while perturbing the global-local image-text similarity used by the semantic loss pushes the CLIP feature space itself out of alignment. At a fixed $\ell^\infty$ budget of $10/255$, the combined noise nearly halves PETA mA and transfers across datasets, sometimes outperforming attacks trained directly on the target dataset. The defense, a convolutional filter on the image side plus prompt tuning on the text side, is reported to bring performance back close to the un-attacked model, from 48.25 to roughly 85.82 mA on PETA. The paper frames the contribution as opening a security research direction for PAR.

Load-bearing premise

The load-bearing premise is that PromptPAR stands in for pedestrian attribute recognition systems as a class, even though the attack is trained on PromptPAR's own weights and its own semantic loss, and the paper's transfer table shows the same noise leaves a Mamba-based PAR model almost untouched.

Editorial extensions

If this is right

  • A deployed CLIP-based PAR system can be attacked with one precomputed noise pattern applied to every frame, with no per-image gradient computation at test time.
  • A printable patch version of the noise degrades recognition when physically carried by a person, so the threat is not confined to digital images.
  • Because the semantic component attacks the shared image-text alignment, other CLIP-based PAR models with similarity-based fusion are plausible targets even if their prompts or heads differ.
  • The defense works only when both an input filter and learnable text prompts are used, which means restoring a vision-language model's alignment is part of the cure.
  • Noise trained on one dataset transfers to other benchmarks, sometimes beating attacks trained on the target dataset, so public data in one domain can be used to attack deployments in another.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An implication not drawn by the paper: because the semantic perturbation reuses the exact GL loss that PromptPAR was trained with, the measured drop may be inflated by the attack having direct access to the model's own training objective; testing against CLIP-based PAR models trained with a different or absent GL loss would separate a general CLIP weakness from a PromptPAR-specific one.
  • The near-zero transfer to MambaPAR suggests that feature-space geometry, not just architecture, is the deciding factor in PAR security; a natural follow-up is to optimise the perturbation against an ensemble of fused feature spaces rather than a single frozen model.
  • The part-shifting label procedure could be reused constructively: training a PAR model with adversarially shifted body-part labels as a form of label smoothing could improve its tolerance of partial occlusions, which are common in real surveillance imagery.
  • A cheap testable defense suggested by the paper's own design is prompt diversity: if the attack has to misalign several independently tuned text prompts simultaneously, its semantic-loss component should weaken, which could be verified by running the same attack against models with different prompt templates.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 4 minor

Summary. The manuscript proposes ASL-PAR, a universal adversarial perturbation for pedestrian attribute recognition. Noise is optimized on a frozen PromptPAR model using two losses: a label-perturbation term that shifts attribute labels within body-part groups, and a semantic term that uses PromptPAR's GL image-text similarity loss. A defense is then proposed, consisting of an input convolution filter and learnable text prompts. Experiments report large mA drops on PromptPAR over PETA, PA100K and RAPv2, smaller drops on MSP60K, and additional cross-dataset, physical-world, and ablation studies. The paper claims to be the first adversarial attack and defense framework for pedestrian attribute recognition.

Significance. If the results were general, the proposed universal noise would be an inexpensive way to probe PAR security, and the defense would be a useful first response. The paper's most positive features are the universal single-noise attack design (no per-sample gradient optimization at test time), the evaluation on four public benchmarks, and the planned source-code release. However, the evaluation is centered on a model and a loss from the authors' own prior work, cross-model transfer is essentially absent (Table VII), and the physical experiment is uncontrolled. The significance therefore depends on revisions that either demonstrate transfer of the attack to an independent PAR model or clearly restrict all claims to PromptPAR.

major comments (6)
  1. [§IV-H, Table VII] The paper's central claim that PAR models are vulnerable is not supported beyond PromptPAR. On MSP60K, the trained noise reduces PromptPAR mA from 63.24 to 50.78 (a 12.46-point drop), but VTB drops only from 58.59 to 57.25 and MambaPAR from 56.75 to 56.03. The limitation paragraph in §IV-H admits that cross-model transfer was not achieved, yet the abstract and conclusion state a general vulnerability of pedestrian attribute recognition and claim a first attack/defense framework. Please either add a white-box ASL-PAR attack on an independent CLIP-based PAR model or restrict all claims to PromptPAR and revise the title, abstract, and conclusion accordingly.
  2. [§III-C, §III-E, §IV-H] The attack and defense are both anchored in PromptPAR to a degree that makes the general conclusion unsupported. The semantic perturbation optimizes the GL loss of Eq. (10), the same auxiliary loss used to train PromptPAR [12], and the defense restores alignment by tuning prompts in the same CLIP/PromptPAR space. The mA measurements are external, so the attack effect on PromptPAR is real, but this setup does not provide independent evidence that PAR architectures in general share the same failure mode. I ask for an explicit statement of this limitation in §IV-H and, if feasible, an experiment with a different CLIP-based PAR model to test the semantic component.
  3. [§IV-G, Table VI] The physical-world experiment does not validate the attack as reported. The custom set contains 12 clean images and 127 attacked images captured under different conditions, with no matched clean/attacked pairs and no comparison against an alternative patch attack. Given the authors themselves note a large domain gap from the training data, the mA change from 48.06 to 45.58 across different image sets is not interpretable as attack effectiveness. Please collect paired clean/attacked shots with the same subjects and viewpoints, or remove the physical validation claim from the abstract and conclusion.
  4. [§IV-E, Table V] The defense evaluation is limited to the authors' own attack on PETA. This does not support the conclusion that the defense is highly effective at restoring model performance: no other attack (FGSM, PGD, GRA, NCS, ANDA) is tested under the defense, no other dataset is used, and no adaptive attack is considered. I ask either to add those baselines or to state explicitly that the defense is designed and evaluated only against ASL-PAR and that its general robustness is untested.
  5. [Abstract; §V] The claim of being 'the first adversarial attack and defense framework for pedestrian attribute recognition' is asserted without a systematic literature check. Section II reviews only generic adversarial attack and defense methods and does not survey prior adversarial work on PAR or related attribute-recognition tasks, despite the authors citing their own PAR survey and paper list. This novelty claim should be verified against that list and, if necessary, softened to 'to the best of our knowledge' or removed.
  6. [Algorithm 1] The update rule in Algorithm 1, lines 10–13, is not reproducible as printed. It defines R_cse = ∇L_cse and R_GL = ∇L_GL and then writes η^{e+1} ← Clip(|η^e − (R_cse + α·R_GL)| < ε), which is not a standard adversarial update: there is no sign convention, no learning rate, and the clipping notation is ambiguous. Please rewrite the pseudocode with an explicit sign (ascent or descent), step size, and projection onto the L∞ ball.
minor comments (4)
  1. [§III-A, Eq. (4)] In Eq. (4), the multi-modal Transformer is written as MM-Former(F_img, F_img); from the surrounding text and Eq. (2)–(3), the second argument should be F_text.
  2. [Eq. (9), Eq. (10)] The summation index is written as 'j−1' in both equations; this should be 'j=1'.
  3. [§IV-B, §IV-C] The notation for the perturbation bound is inconsistent: the text uses L10, l10, and 'L∞ norm of the noise is at most 10/255'. Please standardize to a single notation, e.g., L∞ with value 10/255.
  4. [§IV-B] The implementation details contain a typo: 'weight decays to le-4' should read '1e-4'.

Circularity Check

2 steps flagged · score 4.0 of 10

The attack and defense are built around the same authors' PromptPAR model and use its own GL loss as the semantic perturbation; the reported drops are real measurements, but the general 'vulnerability of PAR models' claim is not supported outside this self-referential setup.

  1. self definitional [Section III-C and Section III-E, Eq. (10)-(11)]
    "The specific approach is to use the perturbed label as the matching truth value, and to narrow the features from the image features F_img_GL and the text features F_text_GL according to the perturbed label. ... Then we aim at the interference of the semantic space of CLIP, using the GL loss [12] proposed by Wang et al. ... The final overall loss is computed as follows: L=L_cse + αL_GL (11)."

    The semantic perturbation is not a new adversarial objective; it is the exact GL loss from PromptPAR [12], a model co-authored by several of this paper's authors, reused with randomly shifted labels as ground truth. Because PromptPAR was trained to minimize this same GL loss (plus CSE), the noise optimization against Eq. (11) is inverting the target model's own training objective rather than probing a general semantic property of PAR models. The attack's 'semantic' component is therefore defined in terms of the very loss that defines the target model's semantic space, making the reported effectiveness on PromptPAR partially an artifact of the self-referential design.

  2. self citation load bearing [Section I (Contributions) and Section IV-H (Limitation Analysis), Table VII]
    "We propose simple but effective semantic and label-perturbation adversarial attack strategies that significantly decrease overall PAR performance, termed ASL-PAR. These results highlight the vulnerability of PAR models. ... In this paper, we study the adversarial attack strategy based on PromptPAR [12] for pedestrian attribute recognition. ... However, the ultimate attack goal, that the added adversarial noise be able to cross datasets and models simultaneously, is not achieved. ... there is almost no attack effect on MambaPAR [61] based on Mamba architecture."

    The central generalization claim that PAR models are vulnerable is supported only by white-box attacks on PromptPAR, a model from the same research group. The paper's own cross-model results show the PromptPAR-trained noise drops mA by 12.46 on PromptPAR but only about 1.34 on VTB and 0.72 on MambaPAR on MSP60K. Section IV-H concedes that cross-model transfer is not achieved. Thus the 'vulnerability of PAR models' conclusion rests on a co-authored baseline model as the sole load-bearing evidence, and the only independent architectural evidence in the paper contradicts the generalization.

full rationale

The paper's main quantitative results—ASL-PAR dropping PromptPAR's mA on PETA from 88.76 to 48.25 and the filter plus prompt-tuning defense recovering much of the loss—are genuine empirical measurements, not tautologies. The attack must be optimized and evaluated, and a drop of that magnitude is not logically forced by the equations alone. However, the derivation chain is heavily self-referential: the attack's semantic loss is the GL loss from PromptPAR, the defense fine-tunes the same prompt mechanism in the same CLIP space, and the only full white-box target is PromptPAR, which is co-authored by several of this paper's authors. The paper's own Table VII and Section IV-H show the attack barely affects VTB and MambaPAR, so the abstract and contribution claims about 'the vulnerability of PAR models' outrun the evidence. This is not a fully circular derivation, because the central attack numbers are externally measured, but the vulnerability demonstration is largely an in-family result rather than an independent, general finding. Score 4 reflects partial self-referentiality with real independent content in the measurements.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The central claim rests on standard attack hyperparameters (alpha, epsilon, patch size) and on domain assumptions about CLIP's semantic space and the heuristic value of body-part attribute grouping. No genuinely new physical entity is introduced.

free parameters (3)
  • alpha (α) = 0.5
    Tradeoff weight between label perturbation loss and GL semantic loss in Eq. (11); the text says 'we experimentally set it as 0.5'.
  • epsilon (L∞ bound) = 10/255
    Maximum noise magnitude, chosen for visual invisibility; the paper refers to it as 'L10'.
  • patch noise size = 3x30x30
    Size of the local noise block for physical attacks, chosen by hand in Section III-C.
assumptions (3)
  • domain assumption CLIP visual and text encoders are frozen and provide usable gradients for optimizing the noise.
    Assumed in the forward pass, Section III-C.
  • domain assumption CLIP's shared image-text embedding space is semantically aligned, so misaligning it via the GL loss degrades attribute predictions.
    Underpins the semantic perturbation, Section III-C, Eq. (8) and Eq. (10).
  • ad hoc to paper Grouping attributes by body part and shuffling labels within groups yields a plausible and effective attack target.
    The label perturbation rule in Eq. (6) is a heuristic with no theoretical justification.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adversarial Semantic and Label Perturbation Attack for Pedestrian Attribute Recognition." pith.science (2026). https://pith.science/paper/NZVFCYKL

@misc{pith2026250523313,
  author       = {Pith},
  title        = {Pith review of: Adversarial Semantic and Label Perturbation Attack for Pedestrian Attribute Recognition},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NZVFCYKL}},
  note         = {Machine review of arXiv:2505.23313}
}
read the original abstract

Pedestrian Attribute Recognition (PAR) is an indispensable task in human-centered research and has made great progress in recent years with the development of deep neural networks. However, the potential vulnerability and anti-interference ability have still not been fully explored. To bridge this gap, this paper proposes the first adversarial attack and defense framework for pedestrian attribute recognition. Specifically, we exploit both global- and patch-level attacks on the pedestrian images, based on the pre-trained CLIP-based PAR framework. It first divides the input pedestrian image into non-overlapping patches and embeds them into feature embeddings using a projection layer. Meanwhile, the attribute set is expanded into sentences using prompts and embedded into attribute features using a pre-trained CLIP text encoder. A multi-modal Transformer is adopted to fuse the obtained vision and text tokens, and a feed-forward network is utilized for attribute recognition. Based on the aforementioned PAR framework, we adopt the adversarial semantic and label-perturbation to generate the adversarial noise, termed ASL-PAR. We also design a semantic offset defense strategy to suppress the influence of adversarial attacks. Extensive experiments conducted on both digital domains (i.e., PETA, PA100K, MSP60K, RAPv2) and physical domains fully validated the effectiveness of our proposed adversarial attack and defense strategies for the pedestrian attribute recognition. The source code of this paper will be released on https://github.com/Event-AHU/OpenPAR.

Figures

Figures reproduced from arXiv: 2505.23313 by the authors.

Figure 1
Figure 1. Visualization of Global/Local Adversarial Attack for the Pedestrian [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Comparison between existing adversarial attackers (a, b) and our newly proposed one (c). [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. An overview of our proposed adversarial attack framework for pedestrian attribute recognition, termed ASL-PAR. Given the pedestrian image and [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: An overview of our proposed defense strategy for pedestrian part [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Global noise visualization results of the proposed attack method and [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Visualization of local noise attacks in the physical domain. [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

61 extracted references · 38 canonical work pages

  1. [12]

    Pedestrian attribute recognition via clip based prompt vision-language fusion,

    X. Wang, J. Jin, C. Li, J. Tang, C. Zhang, and W. Wang, “Pedestrian attribute recognition via clip based prompt vision-language fusion,” IEEE Transactions on Circuits and Systems for Video Technology, pp. 1–1, 2024

    work page 2024

  2. [1]

    Pedestrian attribute recognition: A survey,

    X. Wang, S. Zheng, R. Yang, A. Zheng, Z. Chen, J. Tang, and B. Luo, “Pedestrian attribute recognition: A survey,”Pattern Recognition, vol. 121, p. 108220, 2022

    work page 2022

  3. [2]

    Improving person re-identification by attribute and identity learning,

    Y . Lin, L. Zheng, Z. Zheng, Y . Wu, Z. Hu, C. Yan, and Y . Yang, “Improving person re-identification by attribute and identity learning,” Pattern recognition, vol. 95, pp. 151–161, 2019

    work page 2019

  4. [3]

    Attmot: improving multiple-object tracking by introducing auxiliary pedestrian attributes,

    Y . Li, Z. Xiao, L. Yang, D. Meng, X. Zhou, H. Fan, and L. Zhang, “Attmot: improving multiple-object tracking by introducing auxiliary pedestrian attributes,”IEEE transactions on neural networks and learn- ing systems, 2024

    work page 2024

  5. [4]

    Attribute- guided pedestrian retrieval: Bridging person re-id with internal attribute variability,

    Y . Huang, Z. Zhang, Q. Wu, Y . Zhong, and L. Wang, “Attribute- guided pedestrian retrieval: Bridging person re-id with internal attribute variability,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 17 689–17 699

    work page 2024

  6. [6]

    Attribute recognition by joint recurrent learning of context and correlation,

    J. Wang, X. Zhu, S. Gong, and W. Li, “Attribute recognition by joint recurrent learning of context and correlation,”IEEE/CVF International Conference on Computer Vision, pp. 531–540, 2017

    work page 2017

  7. [7]

    A simple visual-textual baseline for pedestrian attribute recognition,

    X. Cheng, M. Jia, Q. Wang, and J. Zhang, “A simple visual-textual baseline for pedestrian attribute recognition,”IEEE Transactions on Circuits and Systems for Video Technology, vol. 32, no. 10, pp. 6994– 7004, 2022

    work page 2022

  8. [8]

    Learning transferable visual models from natural language supervision,

    A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clarket al., “Learning transferable visual models from natural language supervision,”International Confer- ence on Machine Learning, pp. 8748–8763, 2021

    work page 2021

Show all 61 references
  1. [9]

    Gpt-4 technical report,

    J. Achiam, S. Adler, S. Agarwal, L. Ahmad, I. Akkaya, F. L. Aleman, D. Almeida, J. Altenschmidt, S. Altman, S. Anadkatet al., “Gpt-4 technical report,”arXiv preprint arXiv:2303.08774, 2023

    2023 arXiv

  2. [10]

    Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning,

    D. Guo, D. Yang, H. Zhang, J. Song, R. Zhang, R. Xu, Q. Zhu, S. Ma, P. Wang, X. Biet al., “Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning,”arXiv preprint arXiv:2501.12948, 2025

    2025 arXiv

  3. [11]

    Qwen technical report,

    J. Bai, S. Bai, Y . Chu, Z. Cui, K. Dang, X. Deng, Y . Fan, W. Ge, Y . Han, F. Huanget al., “Qwen technical report,”arXiv preprint arXiv:2309.16609, 2023

    2023 arXiv

  4. [13]

    Pedestrian attribute recognition: A new benchmark dataset and a large language model augmented framework,

    J. Jin, X. Wang, Q. Zhu, H. Wang, and C. Li, “Pedestrian attribute recognition: A new benchmark dataset and a large language model augmented framework,”Association for the Advancement of Artificial Intelligence, 2024

    2024

  5. [14]

    Physical adversarial attack meets computer vision: A decade survey,

    H. Wei, H. Tang, X. Jia, Z. Wang, H. Yu, Z. Li, S. Satoh, L. Van Gool, and Z. Wang, “Physical adversarial attack meets computer vision: A decade survey,”IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024. IEEE TRANSACTIONS ON ***, 2025 12

    2024

  6. [15]

    Mutual-modality adversarial attack with semantic perturbation,

    J. Ye, R. Yu, S. Liu, and X. Wang, “Mutual-modality adversarial attack with semantic perturbation,” inProceedings of the AAAI Conference on Artificial Intelligence, vol. 38, no. 7, 2024, pp. 6657–6665

    2024

  7. [16]

    Diffattack: Evasion attacks against diffusion-based adversarial purification,

    M. Kang, D. Song, and B. Li, “Diffattack: Evasion attacks against diffusion-based adversarial purification,”Advances in Neural Informa- tion Processing Systems, vol. 36, pp. 73 919–73 942, 2023

    2023

  8. [17]

    Strong transferable adversar- ial attacks via ensembled asymptotically normal distribution learning,

    Z. Fang, R. Wang, T. Huang, and L. Jing, “Strong transferable adversar- ial attacks via ensembled asymptotically normal distribution learning,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 24 841–24 850

    2024

  9. [18]

    Stealthiness assessment of adversarial perturbation: From a visual perspective,

    H. Liu, Y . Zhou, Y . Yang, Q. Zhao, T. Zhang, and T. Xiang, “Stealthiness assessment of adversarial perturbation: From a visual perspective,”IEEE Transactions on Information Forensics and Security, 2024

    2024

  10. [19]

    Pedestrian attribute recog- nition at far distance,

    Y . Deng, P. Luo, C. C. Loy, and X. Tang, “Pedestrian attribute recog- nition at far distance,”The 22nd ACM International Conference on Multimedia, pp. 789–792, 2014

    2014

  11. [20]

    Hydraplus-net: Attentive deep features for pedestrian analysis,

    X. Liu, H. Zhao, M. Tian, L. Sheng, J. Shao, S. Yi, J. Yan, and X. Wang, “Hydraplus-net: Attentive deep features for pedestrian analysis,” in Proceedings of the IEEE international conference on computer vision, 2017, pp. 350–359

    2017

  12. [21]

    A richly annotated pedes- trian dataset for person retrieval in real surveillance scenarios,

    D. Li, Z. Zhang, X. Chen, and K. Huang, “A richly annotated pedes- trian dataset for person retrieval in real surveillance scenarios,”IEEE Transactions on Image Processing, vol. 28, no. 4, pp. 1575–1590, 2019

    2019

  13. [22]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,”arXiv preprint arXiv:1312.6199, 2013

    2013 arXiv

  14. [23]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,”arXiv preprint arXiv:1412.6572, 2014

    2014 arXiv

  15. [24]

    Adversarial examples in the physical world,

    A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” inArtificial intelligence safety and security. Chapman and Hall/CRC, 2018, pp. 99–112

    2018

  16. [25]

    Boosting adversarial attacks with momentum,

    Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting adversarial attacks with momentum,” inProceedings of the IEEE confer- ence on computer vision and pattern recognition, 2018, pp. 9185–9193

    2018

  17. [26]

    Improving transferability of adversarial examples with input diversity,

    C. Xie, Z. Zhang, Y . Zhou, S. Bai, J. Wang, Z. Ren, and A. L. Yuille, “Improving transferability of adversarial examples with input diversity,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 2730–2739

    2019

  18. [27]

    Evading defenses to transferable adversarial examples by translation-invariant attacks,

    Y . Dong, T. Pang, H. Su, and J. Zhu, “Evading defenses to transferable adversarial examples by translation-invariant attacks,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 4312–4321

    2019

  19. [28]

    Advdrop: Adversarial attack to dnns by dropping information,

    R. Duan, Y . Chen, D. Niu, Y . Yang, A. K. Qin, and Y . He, “Advdrop: Adversarial attack to dnns by dropping information,” inProceedings of the IEEE/CVF international conference on computer vision, 2021, pp. 7506–7515

    2021

  20. [29]

    The best protection is attack: Fooling scene text recognition with minimal pixels,

    Y . Xu, P. Dai, Z. Li, H. Wang, and X. Cao, “The best protection is attack: Fooling scene text recognition with minimal pixels,”IEEE Transactions on Information Forensics and Security, vol. 18, pp. 1580–1595, 2023

    2023

  21. [30]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,”arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  22. [31]

    Ensemble adversarial training: Attacks and defenses,

    F. Tramèr, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel, “Ensemble adversarial training: Attacks and defenses,” arXiv preprint arXiv:1705.07204, 2017

    2017 arXiv

  23. [32]

    Counter- ing adversarial images using input transformations,

    C. Guo, M. Rana, M. Cisse, and L. Van Der Maaten, “Counter- ing adversarial images using input transformations,”arXiv preprint arXiv:1711.00117, 2017

    2017 arXiv

  24. [33]

    Mitigating adversarial effects through randomization,

    C. Xie, J. Wang, Z. Zhang, Z. Ren, and A. Yuille, “Mitigating adversarial effects through randomization,”arXiv preprint arXiv:1711.01991, 2017

    2017 arXiv

  25. [34]

    Defense against adversarial attacks using high-level representation guided denoiser,

    F. Liao, M. Liang, Y . Dong, T. Pang, X. Hu, and J. Zhu, “Defense against adversarial attacks using high-level representation guided denoiser,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 1778–1787

    2018

  26. [35]

    Enhancing the transferability of adversarial attacks through variance tuning,

    X. Wang and K. He, “Enhancing the transferability of adversarial attacks through variance tuning,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 1924–1933

    2021

  27. [36]

    Nesterov accelerated gradient and scale invariance for adversarial attacks,

    J. Lin, C. Song, K. He, L. Wang, and J. E. Hopcroft, “Nesterov accelerated gradient and scale invariance for adversarial attacks,”arXiv preprint arXiv:1908.06281, 2019

    1908 arXiv

  28. [37]

    Certified adversarial robustness via randomized smoothing,

    J. Cohen, E. Rosenfeld, and Z. Kolter, “Certified adversarial robustness via randomized smoothing,” ininternational conference on machine learning. PMLR, 2019, pp. 1310–1320

    2019

  29. [38]

    A robust open-set multi- instance learning for defending adversarial attacks in digital image,

    K. Uddin, Y . Yang, T. H. Jeong, and B. T. Oh, “A robust open-set multi- instance learning for defending adversarial attacks in digital image,” IEEE Transactions on Information Forensics and Security, vol. 19, pp. 2098–2111, 2023

    2023

  30. [39]

    Generative adversarial nets,

    I. J. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y . Bengio, “Generative adversarial nets,” Advances in neural information processing systems, vol. 27, 2014

    2014

  31. [40]

    Gener- ating adversarial examples with adversarial networks,

    C. Xiao, B. Li, J.-Y . Zhu, W. He, M. Liu, and D. Song, “Gener- ating adversarial examples with adversarial networks,”arXiv preprint arXiv:1801.02610, 2018

    2018 arXiv

  32. [41]

    At-gan: A generative attack model for adversarial transferring on generative adversarial nets,

    X. Wang, K. He, and J. E. Hopcroft, “At-gan: A generative attack model for adversarial transferring on generative adversarial nets,”arXiv preprint arXiv:1904.07793, vol. 3, no. 4, p. 3, 2019

    1904 arXiv

  33. [42]

    Label-only model inversion attacks: Attack with the least information,

    T. Zhu, D. Ye, S. Zhou, B. Liu, and W. Zhou, “Label-only model inversion attacks: Attack with the least information,”IEEE Transactions on Information Forensics and Security, vol. 18, pp. 991–1005, 2022

    2022

  34. [43]

    Robust and general- ized physical adversarial attacks via meta-gan,

    W. Feng, N. Xu, T. Zhang, B. Wu, and Y . Zhang, “Robust and general- ized physical adversarial attacks via meta-gan,”IEEE Transactions on Information Forensics and Security, vol. 19, pp. 1112–1125, 2023

    2023

  35. [44]

    Hierarchical reasoning network for pedestrian attribute recognition,

    H. An, H.-M. Hu, Y . Guo, Q. Zhou, and B. Li, “Hierarchical reasoning network for pedestrian attribute recognition,”IEEE Transactions on Multimedia, vol. 23, pp. 268–280, 2020

    2020

  36. [45]

    Multi-task cnn model for attribute prediction,

    A. H. Abdulnabi, G. Wang, J. Lu, and K. Jia, “Multi-task cnn model for attribute prediction,”IEEE Transactions on Multimedia, vol. 17, no. 11, pp. 1949–1959, 2015

    1949

  37. [46]

    Recurrent attention model for pedestrian attribute recognition,

    X. Zhao, L. Sang, G. Ding, J. Han, N. Di, and C. Yan, “Recurrent attention model for pedestrian attribute recognition,” inProceedings of the AAAI Conference on Artificial Intelligence, vol. 33, no. 01, 2019, pp. 9275–9282

    2019

  38. [47]

    Correlation graph convolu- tional network for pedestrian attribute recognition,

    H. Fan, H.-M. Hu, S. Liu, W. Lu, and S. Pu, “Correlation graph convolu- tional network for pedestrian attribute recognition,”IEEE Transactions on Multimedia, vol. 24, pp. 49–60, 2020

    2020

  39. [48]

    Relation-aware pedestrian attribute recognition with graph convolutional networks,

    Z. Tan, Y . Yang, J. Wan, G. Guo, and S. Z. Li, “Relation-aware pedestrian attribute recognition with graph convolutional networks,” in Proceedings of the AAAI conference on artificial intelligence, vol. 34, no. 07, 2020, pp. 12 055–12 062

    2020

  40. [49]

    Visual attention consistency for human attribute recognition,

    H. Guo, X. Fan, and S. Wang, “Visual attention consistency for human attribute recognition,”International Journal of Computer Vision, vol. 130, no. 4, pp. 1088–1106, 2022

    2022

  41. [50]

    An image is worth 16x16 words: Transformers for image recognition at scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gellyet al., “An image is worth 16x16 words: Transformers for image recognition at scale,”arXiv preprint arXiv:2010.11929, 2020

    2010 arXiv

  42. [51]

    Learning clip guided visual-text fusion transformer for video-based pedestrian attribute recog- nition,

    J. Zhu, J. Jin, Z. Yang, X. Wu, and X. Wang, “Learning clip guided visual-text fusion transformer for video-based pedestrian attribute recog- nition,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, June 2023, pp. 2626–2629

    2023

  43. [52]

    Spatio-temporal side tuning pre-trained foundation models for video- based pedestrian attribute recognition,

    X. Wang, Q. Zhu, J. Jin, J. Zhu, F. Wang, B. Jiang, Y . Wang, and Y . Tian, “Spatio-temporal side tuning pre-trained foundation models for video- based pedestrian attribute recognition,”ArXiv, vol. abs/2404.17929, 2024

    2024 arXiv

  44. [53]

    Drformer: Learning dual relations using trans- former for pedestrian attribute recognition,

    Z. Tang and J. Huang, “Drformer: Learning dual relations using trans- former for pedestrian attribute recognition,”Neurocomputing, vol. 497, pp. 159–169, 2022

    2022

  45. [54]

    Rgb-event based pedestrian attribute recognition: A bench- mark dataset and an asymmetric rwkv fusion framework,

    X. Wang, H. Wang, S. Wang, Q. Chen, J. Jin, H. Song, B. Jiang, and C. Li, “Rgb-event based pedestrian attribute recognition: A bench- mark dataset and an asymmetric rwkv fusion framework,”ArXiv, vol. abs/2504.10018, 2025

    2025 arXiv

  46. [55]

    Sequencepar: Un- derstanding pedestrian attributes via a sequence generation paradigm,

    J. Jin, X. Wang, C. Li, L. Huang, and J. Tang, “Sequencepar: Un- derstanding pedestrian attributes via a sequence generation paradigm,” arXiv preprint arXiv:2312.01640, 2023

    2023 arXiv

  47. [56]

    Cdul: Clip- driven unsupervised learning for multi-label image classification,

    R. Abdelfattah, Q. Guo, X. Li, X. Wang, and S. Wang, “Cdul: Clip- driven unsupervised learning for multi-label image classification,” in Proceedings of the IEEE/CVF international conference on computer vision, 2023, pp. 1348–1357

    2023

  48. [57]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” inInternational Conference on Learning Representations, 2018

    2018

  49. [58]

    Boosting adversarial transferability via gradient relevance attack,

    H. Zhu, Y . Ren, X. Sui, L. Yang, and W. Jiang, “Boosting adversarial transferability via gradient relevance attack,” inProceedings of the IEEE/CVF international conference on computer vision, 2023, pp. 4741– 4750

    2023

  50. [59]

    Enhancing adversarial trans- ferability through neighborhood conditional sampling,

    C. Qiu, Y . Duan, L. Zhao, and Q. Wang, “Enhancing adversarial trans- ferability through neighborhood conditional sampling,”arXiv preprint arXiv:2405.16181, 2024

    2024

  51. [60]

    On the importance of initialization and momentum in deep learning,

    I. Sutskever, J. Martens, G. Dahl, and G. Hinton, “On the importance of initialization and momentum in deep learning,” inInternational conference on machine learning. PMLR, 2013, pp. 1139–1147

    2013

  52. [61]

    An empirical study of mamba-based pedestrian attribute recognition,

    X. Wang, W. Kong, J. Jin, S. Wang, R. Gao, Q. Ma, C. Li, and J. Tang, “An empirical study of mamba-based pedestrian attribute recognition,”

  53. [2024]

    Available: https://arxiv.org/abs/2407.10374

    [Online]. Available: https://arxiv.org/abs/2407.10374

    arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.