Pith. sign in

REVIEW 4 major objections 7 minor 38 references

advPattern: Physical-World Attacks on Deep Person Re-Identification via Adversarially Transformable Patterns

T0 review · 4 major / 7 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Adversarial clothing patterns can hide or impersonate a person across surveillance cameras.

desk verdict First physical-world re-ID attack with a genuinely new cross-camera pattern idea, but the headline physical-world numbers rest on a baseline inconsistency and tiny effective samples. read the letter →

arxiv 1908.09327 v3 pith:6QK7JF3S submitted 2019-08-25 cs.CV

Zhibo Wang , Siyan Zheng , Mengkai Song , Qian Wang , Alireza Rahimpour , Hairong Qi This is my paper · ORCID
classification cs.CV
keywords adversarialexamplespersonre-identificationphysical-worldattackadvPatternevasionimpersonationclothingpatternscross-cameramatching
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that deep person re-identification (re-ID) systems, which match people across camera views, can be attacked by wearing a printed adversarial pattern on clothing. It proposes advPattern, an algorithm that optimizes a decorative-looking patch so the wearer's image features move apart across cameras in an Evading Attack, or move toward a chosen target's features in an Impersonation Attack. The reported physical-world results show re-ID rank-1 matching of the wearer falling from 87.9% to 27.1% under evasion, with impersonation achieving 47.1% rank-1 accuracy and 67.9% mAP. If correct, this means a person could evade or hijack person search in surveillance without altering any stored image.

What carries the argument

The key machinery is advPattern, an iterative optimization that adjusts a clothing pattern by minimizing or maximizing similarity scores over image pairs. For each image the pattern is perspectively transformed with $T_i(\delta)$ and overlaid via $o(x_i, T_i(\delta))$; a multi-position sampling strategy augments the generating set with varied distances and angles, and a degradation function $\phi(\cdot)$ randomly changes brightness or blurs images to simulate physical dynamics. A total-variation term smooths the pattern, a mask $M_x$ shapes it like a decorative logo, and the search space is constrained to a printable color interval $P$. This machinery converts an appearance change into a controlled shift of the person's location in the re-ID feature space, which is what makes evasion and impersonation possible.

What would settle it

A controlled experiment in which the same pattern is printed by two different printers and photographed under controlled lighting at the same 14 positions: if the attack success rate changes materially between printers or lighting conditions, the degradation function $\phi(\cdot)$ does not capture the physical factors the paper claims it models.

Watch

Extended reading notes

Core claim

The central discovery is that adversarial patterns printed on clothing can transfer across camera views and fool deep re-ID models in the physical world. Concretely, the paper claims that a wearer's rank-1 matching accuracy drops from 87.9% to 27.1% under an Evading Attack, and that under an Impersonation Attack the wearer is matched to a chosen target person with 47.1% rank-1 accuracy and 67.9% mAP. The attack is achieved without modifying any stored image: the adversary only wears the pattern, and the optimization makes the re-ID feature extractor pull same-camera images together while pushing cross-camera images apart (evasion), or pull the wearer's features toward the target's features (impersonation). The paper further claims that both a siamese network and a classification-based embedding network are vulnerable.

Load-bearing premise

The attack works only if overlaying the digitally generated pattern and applying the brightness/blur degradation function faithfully reproduces how the printed fabric appears in real camera views across distances and angles.

Editorial extensions

If this is right

  • If the central claim holds, a person wearing the generated pattern can expect to evade cross-camera matching in roughly three of every four physical-world queries (average rank-1 down to 27.1%).
  • The same pattern can make a re-ID system name a chosen target for the wearer almost half the time (47.1% rank-1) under impersonation, meaning targeted misidentification is physically realizable.
  • Attack effectiveness varies with position: at some camera distances and angles the pattern gives 0% matching success, while at others it leaves evasion rank-1 at 60-80%, so the attack is position-dependent.
  • Both siamese-style and classification-style deep re-ID models are vulnerable, which suggests the vulnerability is not an artifact of one architecture.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the pattern's effectiveness transfers to unseen re-ID architectures, a practical countermeasure would be to train re-ID models with adversarial-pattern augmentation so identity features ignore clothing texture; this is a testable extension the paper does not explore.
  • Because four of the fourteen physical test positions showed 0% Evading Attack success, one extension is to sample more positions and lighting conditions during optimization; the paper's own data implies the current degradation model under-covers some real-world conditions.
  • Cross-dataset impersonation (target from Market1501) succeeded less than same-dataset impersonation, suggesting that domain gap, not just pattern optimization, limits physical impersonation; measuring how much of the gap is due to image style could guide improved transfer.
  • The white-box assumption is strong; a natural next test is whether patterns optimized on one model transfer to a black-box re-ID system, since adversarial transferability has been shown in classification.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The paper proposes advPattern, an optimization-based method to generate printable clothing patterns that cause deep person re-identification (re-ID) models to fail to match the wearer (Evading Attack) or to match the wearer as a chosen target person (Impersonation Attack). The pattern is optimized over a multi-position sampling set with perspective transforms, a mask to keep it decorative-looking, total variation smoothing, and a degradation model for physical-world robustness. Experiments are reported in the digital domain on two re-ID models using Market1501 and a new PRCS dataset, and in the physical world with a printed pattern worn by five adversaries at 14 positions under three cameras. The headline claims are that the rank-1 accuracy of the re-ID model for matching the adversary drops from 87.9% to 27.1% under Evading Attack, and that Impersonation Attack reaches 47.1% rank-1 and 67.9% mAP in the physical world.

Significance. If the physical-world claims are established, this would be an important contribution: it is, to the authors' knowledge, the first demonstration of physical-world adversarial clothing against deep re-ID, and it extends prior physical adversarial examples from classifiers to an image retrieval task. The optimization framework is clearly specified, the digital experiments are run on two different model architectures, the PRCS dataset is a useful resource, and the authors release code. The core idea of learning transformable patterns via multi-position sampling with a degradation function is sensible. However, the paper's central quantitative claims rest on the physical-world evaluation, and that evaluation currently has methodological gaps—missing no-pattern controls, an apparent mismatch between the stated and effective sample size, and internal numeric inconsistencies—that prevent the reader from verifying the headline numbers. The contribution is therefore promising but not yet rigorously supported.

major comments (4)
  1. [Table 4, Section 5.3, Abstract] The physical-world Evading Attack drop is computed against an implicit 100% no-pattern baseline: in every row of Table 4, Δrank-1 = 100% − rank-1. The paper states that images were taken 'with/without the adversarial pattern', but no per-point no-pattern rank-1 or mAP values are reported, so the reader cannot tell how much of the drop is due to the pattern and how much is due to the re-ID model's baseline error at that distance/angle. The abstract's 'decreases from 87.9% to 27.1%' compares the physical-world attacked rank-1 against the digital PRCS rank-1 of model A from Table 1, not against a paired physical-world no-pattern measurement. This apples-to-oranges comparison is load-bearing for the central claim and must be replaced with a proper paired control.
  2. [Section 5.3, Table 4] The granularity of the physical-world results is inconsistent with the stated protocol. The text says '100 queries for each testing point are performed', yet all reported rank-1 values are multiples of 20% (0%, 20%, 40%, 60%, 80%), which implies only 5 binary subject-level outcomes per point. With 5 adversaries, the per-point estimates have very wide confidence intervals (e.g., a reported 0% has an upper 95% bound around 52%), and the averaged 27.1% is based on at most 70 independent identity-level outcomes. The paper must report the actual number of queries and per-identity/per-query counts, or explicitly state that the statistics are subject-level, and should provide error bars or a significance test.
  3. [Section 4.3, Eqs. (8) and (9)] The optimization formulations are internally inconsistent. In Eq. (8), the Evading Attack minimizes a loss plus the total variation penalty κ·TV(δ), which correctly encourages smoothness. In Eq. (9), the Impersonation Attack is written as an arg max with a positive term +κ·TV(δ); maximizing total variation is the opposite of smoothing and contradicts the stated goal of producing 'smooth and consistent patches'. In addition, the text following Eq. (8) says 'where λ and κ are hyperparameters', but λ does not appear in Eq. (8). These inaccuracies make it impossible to reproduce the exact objective used for the physical impersonation pattern.
  4. [Section 5.3, experiment setup] The physical-world evaluation lacks the baselines and ablations needed to attribute the results to the proposed algorithm. No comparison is made to a random pattern, a plain/texture pattern, an unoptimized mask, or a pattern optimized without the multi-position/degradation components. Furthermore, physical Evading Attack is tested only with model A and physical Impersonation Attack only with model B, so there is no evidence of cross-model generalization of the physically printed pattern. Adding at least a random-pattern control and reporting both attack types on both models would substantially strengthen the claims.
minor comments (7)
  1. [Section 5.3, text vs. Table 4] The text states 'The average Δrank-1 and ΔmAP are 62.2% and 61.1%', but Table 4 shows the average Δrank-1 as 74.3%; only ΔmAP (61.1%) matches. Please correct the inconsistency.
  2. [Section 5.3, text] The sentences 'For Evading Attack, the average rank-1 accuracy drops to 11.1% in 9 of 14 positions' and 'The rank-1 accuracy for matching the adversary as the target person is 56.4% in 11 of 14 positions' are unclear: are these averages over the selected subsets, and how do they relate to the overall averages of 27.1% and 47.1%? Please clarify and report the per-subset values directly.
  3. [Section 4.1, Eq. (1)] The symbol D(δ) in the threat-model objective is introduced as a measure of the 'reality' of the pattern, but its definition is never given and it does not appear in the implemented optimization objectives (Eqs. (3)–(9)). Either define D(δ) and show how it is incorporated, or remove it from the formal problem statement to avoid a dangling term.
  4. [Section 4.3] The text mentions that NPS was introduced but 'hard to balance' and then replaced by a color-interval constraint P; this is fine, but the sentence structure reads as if NPS were still part of the final objective. Please rephrase to state clearly that NPS is not used in the final formulation.
  5. [Section 5.1, Table 1] The similarity-score column (ss) is not defined; the reader must infer that it is an average pairwise similarity. Please provide the exact formula or definition, as it is later used to interpret the impact of attacks.
  6. [Figure 5 and Section 5.3] There is a typo in 'the filed of cameras views'; and the left-top point is said to be omitted but its position is not indicated in the figure. Also, the distance range in the text (5m–10m) does not match the example coordinates in Figure 5 (e.g., P1 at 4.39m). Please align these details.
  7. [Section 4.3, Eq. (7)] The total variation term appears to be an L2 TV; if the intent is to encourage piecewise-smooth patches, an L1 TV is often used. The choice is not motivated. This is a minor presentation issue but should be clarified.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: pattern-generation objectives are standard attack objectives, and the paper's independent content lies in generalization and physical transfer; the baseline-reporting concern is a correctness issue, not circularity.

full rationale

The paper's pattern-generation objectives (Eqs. 3, 5, 8 for Evading Attack; Eqs. 4, 6, 9 for Impersonation Attack) optimize the same similarity function f_theta that is later used to measure rank-1 accuracy. This is the standard definition of an adversarial attack, not a circular derivation: the paper does not claim to predict a score from first principles; it reports the measured success of an optimized pattern. The independent content lies in generalization to unseen testing images (Tables 2-3 TS results) and to physical-world positions not used during optimization (Table 4), which are not forced by the training objective. Market1501 also provides an external benchmark for digital impersonation. The paper uses a self-built PRCS dataset, but evaluation against a self-built dataset is not circular. There are no load-bearing self-citations: references [36,37] are by different authors, and [25] is cited only for the TV/NPS technique, not as a central premise. The main methodological concern is that Table 4's Delta rank-1 appears to be computed against a 100% no-pattern baseline, while the abstract compares against the 87.9% PRCS rank-1; this is a measurement/reporting issue and a correctness risk, not an equivalence of input and output by construction. Therefore the circularity score is 0.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central claim of a working physical-world attack rests on several domain assumptions about the adversary's access and the fidelity of the physical-world simulation, plus a set of hyperparameters whose values are not reported. No new physical entities are introduced.

free parameters (6)
  • alpha
    Trade-off between evading and impersonation objectives in Eq. 4. Value not reported.
  • beta
    Balances cross-camera dissimilarity and same-camera similarity in Eqs. 5 and 8. Value not reported.
  • lambda1, lambda2
    Weights for same-camera similarity and cross-camera dissimilarity in Eqs. 6 and 9. Values not reported.
  • kappa
    Weight for total variation regularization in Eqs. 8 and 9. Value not reported.
  • mask Mx
    Defines the shape of the pattern; chosen by hand to look decorative. Not specified.
  • color interval P
    Constraint set for printable colors; size and bounds not specified.
assumptions (5)
  • domain assumption White-box access to the target re-ID model f_theta
    Section 3.1 assumes the adversary knows model structure and parameters; this is stated as a threat model assumption and limits real-world applicability.
  • domain assumption The overlay operation o(x, T(delta)) and perspective transformation T_i accurately simulate how a printed pattern appears on a person in camera views
    Used throughout Section 4.1; any mismatch between this simulation and real imaging physics would reduce attack transfer.
  • domain assumption The augmented generating set X_C approximates the distribution of viewing transformations
    Section 4.2 uses multi-position sampling to approximate the unknown distribution; the physical-world generalization depends on this approximation.
  • domain assumption The degradation function phi (random brightness and blur) models physical conditions well enough
    Section 4.3 introduces phi to improve robustness; if the real distribution of weather and distortion differs, robustness claims may not hold.
  • domain assumption Constraining delta to color interval P and minimizing TV is sufficient for printability and unobtrusiveness
    Section 4.3, paragraph on NPS; no printer model or human perception experiment validates this.

how reviews work

0 comments
Cite this review

Pith. "Pith review of advPattern: Physical-World Attacks on Deep Person Re-Identification via Adversarially Transformable Patterns." pith.science (2026). https://pith.science/paper/6QK7JF3S

@misc{pith2026190809327,
  author       = {Pith},
  title        = {Pith review of: advPattern: Physical-World Attacks on Deep Person Re-Identification via Adversarially Transformable Patterns},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6QK7JF3S}},
  note         = {Machine review of arXiv:1908.09327}
}
read the original abstract

Person re-identification (re-ID) is the task of matching person images across camera views, which plays an important role in surveillance and security applications. Inspired by great progress of deep learning, deep re-ID models began to be popular and gained state-of-the-art performance. However, recent works found that deep neural networks (DNNs) are vulnerable to adversarial examples, posing potential threats to DNNs based applications. This phenomenon throws a serious question about whether deep re-ID based systems are vulnerable to adversarial attacks. In this paper, we take the first attempt to implement robust physical-world attacks against deep re-ID. We propose a novel attack algorithm, called advPattern, for generating adversarial patterns on clothes, which learns the variations of image pairs across cameras to pull closer the image features from the same camera, while pushing features from different cameras farther. By wearing our crafted "invisible cloak", an adversary can evade person search, or impersonate a target person to fool deep re-ID models in physical world. We evaluate the effectiveness of our transformable patterns on adversaries'clothes with Market1501 and our established PRCS dataset. The experimental results show that the rank-1 accuracy of re-ID models for matching the adversary decreases from 87.9% to 27.1% under Evading Attack. Furthermore, the adversary can impersonate a target person with 47.1% rank-1 accuracy and 67.9% mAP under Impersonation Attack. The results demonstrate that deep re-ID systems are vulnerable to our physical attacks.

Figures

Figures reproduced from arXiv: 1908.09327 by the authors.

Figure 1
Figure 1. The illustration of Impersonation Attack on re-ID mod [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. An example of Impersonation Attack in physical world. [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Overview of the attack pipeline. on clothes. Rank(·) is a sort function which ranks similar￾ity scores of all gallery images with padv in the decreasing order. An adversarial pattern is successfully crafted only if the image pair (padv+δ, gadv+δ) ranks behind the top-K results, which means that the re-ID systems cannot realize cross-camera image match of the adversary. Impersonation Attack. An Impersonation Attack i… view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: The illustration of how scalable adversarial patterns [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: The scene setting of physical-world tests. We choose [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Examples of physically realizable attacks. Top row: an [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

38 extracted references · 29 canonical work pages

  1. [1]

    An improved deep learning architecture for person re-identification

    Ejaz Ahmed, Michael Jones, and Tim K Marks. An improved deep learning architecture for person re-identification. In Proc. of IEEE CVPR, pages 3908–3916, 2015

    work page 2015

  2. [2]

    Synthesizing robust ad- versarial examples

    Anish Athalye and Ilya Sutskever. Synthesizing robust ad- versarial examples. arXiv:1707.07397, 2017

    arXiv 2017

  3. [3]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In Proc. of IEEE S&P, pages 39–57, 2017

    work page 2017

  4. [4]

    Deep ranking for person re-identification via joint representa- tion learning

    Shi-Zhe Chen, Chun-Chao Guo, and Jian-Huang Lai. Deep ranking for person re-identification via joint representa- tion learning. IEEE Transactions on Image Processing , 25(5):2353–2367, 2016

    work page 2016

  5. [5]

    A multi-task deep network for person re- identification

    Weihua Chen, Xiaotang Chen, Jianguo Zhang, and Kaiqi Huang. A multi-task deep network for person re- identification. In Proc. of AAAI, pages 3988–3994, 2017

    work page 2017

  6. [6]

    Person re-identification by multi-channel parts-based cnn with improved triplet loss function

    De Cheng, Yihong Gong, Sanping Zhou, Jinjun Wang, and Nanning Zheng. Person re-identification by multi-channel parts-based cnn with improved triplet loss function. In Proc. of IEEE CVPR, pages 1335–1344, 2016

    work page 2016

  7. [7]

    Deep feature learning with relative distance comparison for person re-identification.Pattern Recognition, 48(10):2993–3003, 2015

    Shengyong Ding, Liang Lin, Guangrun Wang, and Hongyang Chao. Deep feature learning with relative distance comparison for person re-identification.Pattern Recognition, 48(10):2993–3003, 2015

    work page 2015

  8. [8]

    Robust physical-world attacks on deep learning visual classification

    Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. In Proc. of IEEE CVPR, pages 1625–1634, 2018

    work page 2018

Show all 38 references
  1. [9]

    The re-identification challenge

    Shaogang Gong, Marco Cristani, Chen Change Loy, and Timothy M Hospedales. The re-identification challenge. In Person re-identification, pages 1–20. 2014

    2014

  2. [10]

    Explaining and harnessing adversarial exam- ples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial exam- ples. arXiv:1412.6572

    arXiv

  3. [11]

    Adversarial pertur- bations against deep neural networks for malware classifica- tion

    Kathrin Grosse, Nicolas Papernot, Praveen Manoharan, Michael Backes, and Patrick McDaniel. Adversarial pertur- bations against deep neural networks for malware classifica- tion. arXiv:1606.04435, 2016

    2016 arXiv

  4. [12]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proc. of IEEE CVPR, pages 770–778, 2016

    2016

  5. [13]

    Adversarial exam- ples for generative models

    Jernej Kos, Ian Fischer, and Dawn Song. Adversarial exam- ples for generative models. In Proc. of IEEE SPW , pages 36–42, 2018

    2018

  6. [14]

    Imagenet classification with deep convolutional neural net- works

    Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural net- works. In Proc. of NIPS, pages 1097–1105, 2012

    2012

  7. [15]

    Ad- versarial examples in the physical world

    Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Ad- versarial examples in the physical world. arXiv:1607.02533, 2016

    2016 arXiv

  8. [16]

    Feature cross-substitution in adversarial classification

    Bo Li and Yevgeniy V orobeychik. Feature cross-substitution in adversarial classification. In Proc. of NIPS, pages 2087– 2095, 2014

    2014

  9. [17]

    Scalable optimization of randomized operational decisions in adversarial classifica- tion settings

    Bo Li and Yevgeniy V orobeychik. Scalable optimization of randomized operational decisions in adversarial classifica- tion settings. In Proc. of AISTATS, pages 599–607, 2015

    2015

  10. [18]

    Deep- reid: Deep filter pairing neural network for person re- identification

    Wei Li, Rui Zhao, Tong Xiao, and Xiaogang Wang. Deep- reid: Deep filter pairing neural network for person re- identification. In Proc. of IEEE CVPR, pages 152–159, 2014

    2014

  11. [19]

    Delving into transferable adversarial examples and black- box attacks

    Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black- box attacks. arXiv:1611.02770, 2016

    2016 arXiv

  12. [20]

    Multi- camera activity correlation analysis

    Chen Change Loy, Tao Xiang, and Shaogang Gong. Multi- camera activity correlation analysis. InProc. of IEEE CVPR, pages 1988–1995, 2009

    1988

  13. [21]

    Understanding deep image representations by inverting them

    Aravindh Mahendran and Andrea Vedaldi. Understanding deep image representations by inverting them. In Proc. of IEEE CVPR, pages 5188–5196, 2015

    2015

  14. [22]

    Deepfool: a simple and accurate method to fool deep neural networks

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In Proc. of IEEE CVPR, pages 2574–2582, 2016

    2016

  15. [23]

    Transferability in machine learning: from phe- nomena to black-box attacks using adversarial samples

    Nicolas Papernot, Patrick McDaniel, and Ian Goodfel- low. Transferability in machine learning: from phe- nomena to black-box attacks using adversarial samples. arXiv:1605.07277, 2016

    2016 arXiv

  16. [24]

    The limitations of deep learning in adversarial settings

    Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami. The limitations of deep learning in adversarial settings. In Proc. of IEEE EuroS&P, pages 372–387, 2016

    2016

  17. [25]

    Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition

    Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter. Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition. In Proc. of ACM CCS, pages 1528–1540, 2016

    2016

  18. [26]

    Very deep convolutional networks for large-scale image recognition

    Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv:1409.1556, 2014

    2014 arXiv

  19. [27]

    Going deeper with convolutions

    Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In Proc. of IEEE CVPR, pages 1–9, 2015

    2015

  20. [28]

    Intriguing properties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv:1312.6199, 2013

    2013 arXiv

  21. [29]

    Joint learning of single-image and cross- image representations for person re-identification

    Faqiang Wang, Wangmeng Zuo, Liang Lin, David Zhang, and Lei Zhang. Joint learning of single-image and cross- image representations for person re-identification. In Proc. of IEEE CVPR, pages 1288–1296, 2016

    2016

  22. [30]

    Intelligent multi-camera video surveil- lance: A review

    Xiaogang Wang. Intelligent multi-camera video surveil- lance: A review. Pattern recognition letters , 34(1):3–19, 2013

    2013

  23. [31]

    Learning deep feature representations with domain guided dropout for person re-identification

    Tong Xiao, Hongsheng Li, Wanli Ouyang, and Xiaogang Wang. Learning deep feature representations with domain guided dropout for person re-identification. In Proc. of IEEE CVPR, pages 1249–1258, 2016

    2016

  24. [32]

    Deep metric learning for person re-identification

    Dong Yi, Zhen Lei, Shengcai Liao, and Stan Z Li. Deep metric learning for person re-identification. In Proc. of IEEE ICPR, pages 34–39, 2014

    2014

  25. [33]

    Harry potter’s marauder’s map: Localizing and tracking multiple persons-of-interest by nonnegative discretization

    Shoou-I Yu, Yi Yang, and Alexander Hauptmann. Harry potter’s marauder’s map: Localizing and tracking multiple persons-of-interest by nonnegative discretization. InProc. of IEEE CVPR, pages 3714–3720, 2013

    2013

  26. [34]

    Age progres- sion/regression by conditional adversarial autoencoder

    Zhifei Zhang, Yang Song, and Hairong Qi. Age progres- sion/regression by conditional adversarial autoencoder. In Proc. of IEEE CVPR, pages 5810–5818, 2017

    2017

  27. [35]

    Im- age super-resolution by neural texture transfer

    Zhifei Zhang, Zhaowen Wang, Zhe Lin, and Hairong Qi. Im- age super-resolution by neural texture transfer. In Proc. of IEEE CVPR, pages 7982–7991, 2019

    2019

  28. [36]

    Person re-identification: Past, present and future

    Liang Zheng, Yi Yang, and Alexander G Haupt- mann. Person re-identification: Past, present and future. arXiv:1610.02984, 2016

    2016 arXiv

  29. [37]

    A discrimi- natively learned cnn embedding for person reidentification

    Zhedong Zheng, Liang Zheng, and Yi Yang. A discrimi- natively learned cnn embedding for person reidentification. ACM Transactions on Multimedia Computing, Communica- tions, and Applications (TOMM), 14(1):13, 2017

    2017

  30. [38]

    Camera style adaptation for person re- identification

    Zhun Zhong, Liang Zheng, Zhedong Zheng, Shaozi Li, and Yi Yang. Camera style adaptation for person re- identification. In Proc. of IEEE CVPR , pages 5157–5166, 2018

    2018

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.