\section{Conclusion $\&$ Future Work}

\vspace{-0.3cm}
In this work, we propose a novel co-motion pattern, a second-order local motion descriptor in order to detect whether the video is deep-faked. Our method is fully interpretable and pretty robust to slight variations such as video compression and noises. We have achieved superior performance on the latest datasets under classification and anomaly detection settings, and have comprehensively evaluated various characteristics of our method including robustness and generalizability. In the future, an interesting direction is to investigate whether a more accurate motion estimation can be achieved as well as how temporal information can be integrated within our method.

\clearpage

\bibliographystyle{splncs04}

\section{Experiments}
\label{sect:Exp}
In this section, extensive experiments are conducted to empirically demonstrate the feasibility of our co-motion pattern, coupled with the advantages over other methods. We first describe the experiment protocol, followed by the choice of hyperparameters. The quantitative performance of our method evaluated on different datasets is reported and analyzed in Sect.~\ref{sec:quantitative}. Subsequently, we interpret the composition of the co-motion pattern, showing how it can be used for determining the genuineness of any given sequence or even individual estimated motion set. Finally, we demonstrate the transferability and robustness of our method under different scenarios.

\subsubsection{Dataset}
We evaluate our method on FaceForensics++~\cite{FaceForensics} dataset which consists of four sub-databases that produce face forgery via different methods, i.e. Deepfake~\cite{deepfake}, FaceSwap~\cite{faceswap}, Face2Face~\cite{F2F} and NeuralTexture~\cite{NeuralTexture}. In addition, we utilize the real set from~\cite{Google_dataset} to demonstrate the similarity of co-motion patterns from real videos.
Since each sub-database contains 1,000 videos, we form 2,000 co-motion patterns with each composed of picking $N$ $\rho$ matrices for training and testing respectively.
We use c23 and c40 to indicate the quality of datasets, which are compressed by H.264~\cite{H264} with 23 and 40 as constant rate quantization parameters.
Unless otherwise stated, all of our performance reported are achieved on c23.
The validation set and testing set are split before any experiments to ensure no overlapping would interfere the results.

\subsubsection{Implementation}
In this section, we specify hyperparameters and other detailed settings in order to reproduce our method. The local motion estimation procedure is accomplished by integrating  \cite{opticalflow} as the estimator and \cite{Landmark} as the landmark detector, both with default parameter settings as reported in the original papers. For the facial landmarks, we only keep the last 51 landmarks out of 68 in total as the first 17 denotes the face boundary which is usually not manipulated. During the calculation of co-motion, we constrain $K$ to be at most 8 as only 8 facial components, thus avoiding unnecessary computation.
Since a certain portion of frames do not contain sufficient motion, we only preserve co-motion patterns with $p\%$ motion features having greater magnitude than the total $p\%$ of others, i.e. $p = 0.5$ with magnitude $\geq 0.85$, where the number is acquired by randomly sampling a set of 100 videos. An AdaBoost~\cite{AdaBoost} classifier is employed for all supervised classification tasks.
For Gaussian smoothing, we set $\hat{k} = 3$ for all experiments.

\subsection{Quantitative Results}
\label{sec:quantitative}

\begin{table}[t!]
    \caption{Accuracy of our method on all four forgery databases, with each treated as a binary classification task against the real videos. Performance of  \cite{OpenWorld} is estimated from figures in the paper.
    }
    \begin{center}
    \begin{tabular}{l|c|c|c|c|c}
    \hline
    Method/Dataset                                 & Deepfakes & FaceSwap & Face2Face & NeuralTexture & Combined \\ \hline
    Xception~\cite{FaceForensics} & 93.46\%   & 92.72\%  & 89.80\%    & N/A            & \textbf{95.73\%}  \\
    R-CNN~\cite{RCNN}            & 96.90\%    & 96.30\%   & \textbf{94.35\%}   & N/A            & N/A       \\
    Optical Flow + CNN~\cite{OFCNN}           & N/A        & N/A       & 81.61\%   & N/A            & N/A       \\
    FacenetLSTM~\cite{OpenWorld}       & 89\%      & 90\%     & 87\%      & N/A            & N/A       \\ \hline
    $N$ = 1 (Ours)                             & 63.65\%   & 61.90\%  & 56.50\%   & 56.65\%       & 57.05\%        \\
    $N$ = 10 (Ours)                           & 82.80\%   & 81.95\%  & 72.30\%   & 68.50\%       & 71.30\%        \\
    $N$ = 35  (Ours)                          & 95.95\%   & 93.60\%  & 85.35\%   & 83.00\%       & 88.25\%        \\
    $N$ = 70  (Ours)                          & \textbf{99.10\%}   & \textbf{98.30\%}  & 93.25\%   & \textbf{90.45\%}       & 94.55\%      \\ \hline
    \end{tabular}
    \end{center}
\end{table}

In this section, we demonstrate the quantitative results of our method under different settings. At first, we show that the co-motion pattern can adequately separate forged and real videos in classification tasks as shown in Tab.~1. Comparing with other state-of-the-art forensic methods in terms of classification accuracy, we have achieved competent performance and have outperformed them by a large margin on Deepfakes~\cite{deepfake} and FaceSwap~\cite{faceswap}, respectively $99.10\%$ and $98.30\%$. In \cite{OFCNN}, while the researchers have similarly attempted establishing a forensic pipeline on top of motion features, we have outperformed its performance by approx. 12$\%$. It is noteworthy that \cite{RCNN,OpenWorld,FaceForensics} are all exploiting deep features that are learned in an end-to-end manner and consequently cannot be properly explained. By contrast, as interpretability is one of the principal factors to media forensics, our attention lies on proposing a method such that it can be justified and make no effort on deliberately outperforming deep learning based methods.

Equally importantly, as forgery methods are various and targeting each is expensive, we demonstrate that the proposed co-motion pattern can also be employed for anomaly detection tasks, where only the behaviors of real videos require to be modeled, and forged videos can be separated if an appropriate threshold is selected. As presented in Fig.~\ref{fig:ROCs}, we show receiver operating characteristic (ROC) curves on each forgery database with increasing $N$. The real co-motion template is constructed of 3,000 randomly selected $\rho$ matrices for each co-motion pattern (real or fake) to compare against during evaluation. In general, our method can be used for authenticating videos even without supervision. In the next section, we exhibit that the co-motion pattern is also robust to random noise and data compression.

\begin{figure}[t]
        \centering
        \begin{subfigure}[b]{0.485\textwidth}
            \centering
            \includegraphics[width=\textwidth]{eccv2020kit/DF.jpg}

        \end{subfigure}
        \hfill
        \begin{subfigure}[b]{0.485\textwidth}
            \centering
            \includegraphics[width=\textwidth]{eccv2020kit/FS.jpg}

        \end{subfigure}
        \vskip\baselineskip
        \begin{subfigure}[b]{0.485\textwidth}
            \centering
            \includegraphics[width=\textwidth]{eccv2020kit/F2F.jpg}

        \end{subfigure}
        \hfill
        \begin{subfigure}[b]{0.485\textwidth}
            \centering
            \includegraphics[width=\textwidth]{eccv2020kit/NT.jpg}

        \end{subfigure}
        \caption{Anomaly detection performance of our co-motion patterns. }
        \label{fig:ROCs}
    \end{figure}

\vspace{-0.3cm}
\subsection{Robustness Analysis}
\label{sec:robustness}
In this section, we demonstrate the robustness of our proposed method against noises or data compression and the generalizability of co-motion patterns. Experiments about whether the compression rate of the video and noise would affect the effectiveness of co-motion patterns are conducted and the results are shown in Tab. 2. Empirically, co-motion has demonstrated great robustness against heavy compression (c40) and random noise, i.e. $N(\mu,\sigma^2)$ with $\mu = 0$ and $\sigma = 1$. Such results verify our proposed co-motion patterns exploiting high-level temporal information are much less sensitive to pixel-level variation, while statistics based methods as reviewed in Sect.~2.2 do not possess this property.
\vspace{-0.7cm}
\begin{table}
\caption{Robustness experiment for demonstrating that co-motion can maintain its characteristics under different scenarios. All experiments are conducted on Deepfake~\cite{deepfake} with $N = 35$. Classification accuracy and area under curve (AUC) are reported respectively. }
\begin{center}
    \begin{tabular}{l|c|c|c|c}
    \hline
    Setting / Dataset        & Original &c23&c40& c23+noise \\ \hline
    Binary classification    & 97.80\%        & 95.95\%                & 91.60\%               & 91.95\%                    \\ \hline
    Anomaly detection & 98.57        & 96.14                & 93.76               & 92.60                    \\ \hline
    \end{tabular}
\end{center}
\end{table}

\vspace{-0.5cm}
In addition to demonstrating the robustness, we also investigate in whether the modeled co-motion patterns are generalizable, as recorded in Tab.~3. It turns out that co-motion patterns constructed on relatively high-quality forgery databases such as NeuralTextures~\cite{NeuralTexture} and Face2Face~\cite{F2F} can easily be generalized for classifying other low-quality databases, while the opposite results in inferior accuracy.  This phenomenon is caused by that videos forged by NeuralTextures are generally being more consistent, thus the inconsistency learned is more narrowed down and specific, while the types of inconsistency vary greatly in low-quality databases, which can be hard to model.

\vspace{-0.5cm}
\begin{table}

\caption{Experiments for demonstrating generalizability of co-motion patterns. Same experiment setting was employed as in Tab. 1. }
\begin{center}
    \begin{tabular}{l|c|c|c|c}
    \hline Test on / Train on & Deepfakes & FaceSwap & Face2Face & NeuralTexture \\ \hline
    Deepfakes          & N/A         & 92.15\%        & 93.45\%         & 95.85\%            \\
    FaceSwap           & 84.25\%         & N/A        & 76.75\%         & 84.95\%             \\
    Face2Face          & 70.30\%         & 64.85\%        & N/A         & 81.65\%             \\
    NeuralTexture      & 76.20\%          & 65.15\%        & 77.85\%           & N/A           \\ \hline
    \end{tabular}
\end{center}
\end{table}

\vspace{-1cm}
\subsection{Abnormality Reasoning}
\label{sec:reasoning}
In this section, we explicitly interpret the implication of each co-motion pattern for an intuitive understanding. A co-motion example of real videos can be found in Fig. ~6. As we illustrated, the local motion at 51 facial landmarks are estimated as features, where the order of landmarks are preserved identically in all places on purpose for better visual understanding. It is noteworthy that the order of landmarks do not affect the performance as long as they are aligned during experiments.

Consequently, each co-motion pattern describes the relationship of any pair of two local motion features, where features from the same or highly correlated facial component would instinctively have greater correlation. For instance, it is apparent that two eyes would generally move in the same direction, as the center area highlighted in Fig. ~6. Similarly, a weak yet stable high correlation of the first 31 features is consistently observed on all real co-motion patterns, which conforms to the accordant movement of facial components on upper and middle face area. We also observe strong negative correlation, indicating opposite movements, between upper lip and lower lip. This credits to the dataset containing a large volume of videos with people talking, while in forged videos such a negative correlation is undermined, usually due to the fact that the videos are synthesized in a frame-by-frame manner, thus the temporal relationship is not well-preserved. Moreover, the co-motion is normalized in range $[0, 1]$ for visualization purpose which leads to the weakened difference between real and fake co-motion patterns, while in original scale the difference can be more magnificent, verified by the experiments.

\begin{figure}[t!]
    \centering
    \includegraphics[width=0.55\textwidth, height=0.48\textwidth]{eccv2020kit/Interpret.png}
    \caption{An example of interpreting co-motion patterns. }
    \label{fig:interpret}
\end{figure}

For an explicit comparison, we also average 1,000 $\rho$ matrices from each source to illustrate the distinction and which motion pattern in specific was not well-learned as in Fig.~7. Evidently, co-motion patterns from forged videos fail to model the negative correlation between upper lip and lower lip. Moreover, in Deepfake and FaceSwap, the positive correlation between homogeneous components (e.g. eyes and eyebrows) is also diluted, while in reality it would be difficult to control them having uncorrelated motion. We also attempt to construct co-motion patterns on another set of real videos~\cite{Google_dataset} to illustrate the commonality of co-motion patterns over all real videos. Additionally, we show that visually, the structure of co-motion pattern could quickly converge as illustrated in Fig. 8, which sustains our choices of building second-order pattern as it is less sensitive to intra-instance variation.

\begin{figure*}[t]
        \centering
        \begin{subfigure}[b]{0.3\textwidth}
            \centering
            \includegraphics[width=0.83\textwidth]{eccv2020kit/real_cooccurrence.jpg}

            {{\small Real videos}}

        \end{subfigure}
        \hfill
        \begin{subfigure}[b]{0.3\textwidth}
            \centering
            \includegraphics[width=0.83\textwidth]{eccv2020kit/deepfakes_cooccurrence.jpg}

            {{\small Deepfakes}}

        \end{subfigure}
        \hfill
        \begin{subfigure}[b]{0.3\textwidth}
            \centering
            \includegraphics[width=0.83\textwidth]{eccv2020kit/faceswap_cooccurrence.jpg}

            {{\small FaceSwap}}

        \end{subfigure}
        \vskip\baselineskip
        \begin{subfigure}[b]{0.3\textwidth}
            \centering
            \includegraphics[width=0.83\textwidth]{eccv2020kit/actor_cooccurrence.jpg}

            {{\small Real videos from \cite{Google_dataset}}}

        \end{subfigure}
        \hfill
        \begin{subfigure}[b]{0.3\textwidth}
            \centering
            \includegraphics[width=0.83\textwidth]{eccv2020kit/face2face_cooccurrence.jpg}

            {{\small Face2Face}}
            \label{fig:mean and std of net44}
        \end{subfigure}
        \hfill
        \begin{subfigure}[b]{0.3\textwidth}
            \centering
            \includegraphics[width=0.83\textwidth]{eccv2020kit/neuraltextures_cooccurrence.jpg}

            {{\small NeuralTexture}}

        \end{subfigure}
       \caption{Averaged co-motion pattern from different sources. Two real co-motion patterns (leftmost column) collectively present component-wise motion consistency while forged videos fail to maintain that property. }
        \label{fig:Cooccurrences}
    \end{figure*}

\begin{figure}[t!]
    \centering
    \includegraphics[width=0.68\textwidth, height=0.3\textwidth]{eccv2020kit/Convergence.png}
    \caption{Co-motion pattern comparison on the same video (original and deep-faked based on the original one). As $N$ increases, both co-motion patterns gradually converge to the same structure. }
    \label{fig:framework}
\end{figure}

\section{Introduction}
Media forensic, referring to judge the authenticity, detect potentially manipulated region and reason its decision of the given images/videos, plays an important role in real life to prevent media data from being edited and utilized for malicious purposes, e.g., spreading fake news~\cite{FakeNews,WorldLeader}. Unlike traditional forgery methods (e.g., copy-move and slicing) which can falsify the original content with low cost but are also easily observable, the development of deep generative models such as generative adversarial net (GAN)~\cite{GAN} makes the boundary between realness and forgery more blurred than ever, as deep models are capable of learning the distribution from real-world data so well. In this paper, among all the forensic-related tasks, we focus on exposing forged videos produced by face swapping and manipulation applications~\cite{FastFaceSwap,DVP,F2F,FSGAN,MakeAFace,NeuralTexture}. These methods, while initially designed for entertainment purposes, have gradually become uncontrollable in particular when the face of celebrities, who possess greater social impact such as Obama~\cite{obama}, can be misused at no cost, leading to pernicious influence.

\begin{figure}[t!]
    \centering
    \includegraphics[width=0.95\textwidth, height=0.51\textwidth]{eccv2020kit/clear_comparison.png}
    \caption{Example of motion analysis results by our method. \textbf{Landmarks} with the same color are considered having analogous motion patterns, which are consistent with facial structure in real videos but not in deep-faked videos. We compactly model such patterns and utilize them to determine the authenticity of given videos.}
    \label{fig:clear_comparison}
\end{figure}

Traditional forensic methods focusing on detecting specific traces remained ineluctably during the editing (e.g., inconsistency in re-sampling~\cite{Resampling}, shadowing~\cite{shadow}, reflection~\cite{Reflection}, compression quality~\cite{CompressionQuality} and noise pattern~\cite{Noise}) fail to tackle the indistinguishable DNN-generated images/videos due to the powerful generative ability of existing deep models.
Therefore, the demand for forensic approaches explicitly against deep-faked videos is increasing.
Existing deep forensic models can be readily categorized into three branches including real-forged binary classification-based methods~\cite{XRay,TwoStep,RCNN,MesoNet}, anomaly image statistics detection based approaches~\cite{ColorComponent,FaceArtifict,PRNU,Unmasking,AttributeGAN} and high-level information driven cases~\cite{headpose,exposelandmark,blinking}.
However, no matter which kind of methods, their success heavily relies on a high-quality, uncompressed and well-labeled forensic dataset to facilitate the learning. Once the given data are compressed or in low-resolution, their performance is inevitably affected. More importantly, these end-to-end deep forensic methods are completely unexplainable, no explicit reason can be provided by these methods to justify based on what a real or fake decision is made.

To overcome the aforementioned issues, in this paper, we propose a video forensic method based on motion features to explicitly against deep-faked videos. Our method aims to model the conjoint patterns of local motion features from real videos, and consequently spot the abnormality of forged videos by comparing the extracted motion pattern against the real ones. To do so, we first estimate motion features of keypoints that are commonly shared across deep-faked videos. In order to enhance the generalizability of obtained motion features as well as eliminate noises introduced by inaccurate estimation results, we divide motion features into various groups which are further reformed into a correlation matrix as a more compact frame-wise representation. Then a sequence of correlation matrices are calculated from each video, with each weighted by the grouping performance to form the co-motion pattern which describes the local motion consistency and correlation of the whole video. In general, co-motion patterns collected from real videos obey the movement pattern of facial structures and are homogeneous with each other regardless of the video content variation, while it becomes less associated across fake videos.

To sum up, our contributions are four-fold: (1) We propose co-motion pattern, a descriptor of consecutive image pairs that can be used to effectively describe local motion consistency and correlation. (2) The proposed co-motion pattern is being entirely explainable, robust to video compression/pixel noises and generalizes well. (3) We conduct experiments under both classification and anomaly detection settings, showing that the co-motion pattern is able to accurately reveal the motion-consistency level of given videos. (4) We also evaluate our method on datasets with different quality and forgery methods, with the intention to demonstrate the robustness and transferability of our method.

\begin{figure}[t!]
    \centering
    \includegraphics[width=\textwidth, height=0.45\textwidth]{eccv2020kit/framework.png}
    \caption{The pipeline of our proposed co-motion pattern extraction method. As illustrated, we firstly estimate the motion of corresponding keypoints, which are then to be grouped for analysis. On top of that, we construct co-motion pattern as a compact representation to describe the relationship between motion features. }
    \label{fig:framework}
\end{figure}

\section{Related Work}
\vspace{-0.25cm}
\subsection{Face Forgery by Media Manipulation}
\vspace{-0.15cm}
First of all, we review relevant human face forgery methods. Traditionally, methods such as copy-move and slicing, if employed for face swapping tasks, can hardly produce convincing result due to the inconsistency caused by image quality~\cite{Resampling,quantization,jpeg_ghosts}, lighting changing~\cite{lighting,complex_lighting} and noise patterns~\cite{Noise,estimate_noise} between the tampered face region and other regions. With the rapid expeditious development of deep generative models~\cite{GAN}, the quality of generated images has significantly improved. The success of ProGAN~\cite{pggan} makes visually determining the authenticity of generated images pretty challenging if only focusing on the face region. Furthermore, the artifacts remained in boundary regions whose corresponding distribution in training datasets are relatively disperse are also progressively eliminated by \cite{StyleGANV1,StyleGANV2,glow,BigGAN}. Although these methods have demonstrated appealing generating capability, they do not focus on a certain identity but generate faces with random input.

Currently, the capability of deep neural networks has also been exploited for human-related tasks such as face swapping~\cite{deepfake,faceswap,FastFaceSwap,F2F,NeuralTexture,FSNET,FSGAN,DeformAE}, face expression manipulation~\cite{MakeAFace,F2F,x2face,NFE} and facial attribute editing~\cite{NFE,AttGAN,DA_Face_M,SMIT,MulGAN} majorly for entertainment purposes at the initial stage (samples of deep-faked face data are shown in Fig.~\ref{fig:deepfake_samples}.). However, since the face swapping methods in particular have already been misused for commercial purposes, homologous techniques should be studied and devised as prevention measures before it causing irreparable adverse influence.

\vspace{-15pt}
\begin{figure}
    \centering
    \includegraphics[width=0.8\textwidth, height=0.45\textwidth]{eccv2020kit/fake_samples.png}
    \caption{Samples to illustrate what ``Deepfake'' is. Top left~\cite{StyleGANV2}: high fidelity generated faces. Top right~\cite{jim}: face swapping. Bottom left~\cite{MakeAFace}: face expression manipulation, original image on top and expression manipulated on bottom. Bottom right~\cite{MulGAN}: face attribute editing, original images on top and edited on bottom. }
    \label{fig:deepfake_samples}
\end{figure}
\vspace{-15pt}

\subsection{Deep-faked Manipulation Detection}
While media forensic has been a long existing field, the countermeasures against deep-faked images and videos are scarce. As we mentioned earlier, existing methods can be categorized into three genres, respectively by utilizing a deep neural network~\cite{XRay,FaceForensics,RCNN,MesoNet,TwoStep,OFCNN,Incremental,DetectF2F,OpenWorld}, by exploiting the unnatural low-level statistics and by detecting the abnormality of high-level information. In the very first category, it has been usually considered as a binary classification problem where a classifier is constructed to learn the boundary between original and manipulated data via hand-crafted or deep features. As one of the earliest works in this branch, \cite{MesoNet} employs an Inception~\cite{Inception} with proper architecture improvement to directly classify each original or edited frame. Later, in order to consider the intra-frame correlation, \cite{RCNN} constructed a recurrent convolutional neural network that learns from temporal sequences. Due to the variety of video content and the characteristics of neural network, a sufficiently large dataset is required. To overcome this problem, \cite{OFCNN} attempted using the optical flow as input to train a neural network. While high classification accuracy achieved, since the features learned directly by neural networks yet to be fully comprehended, the decision of whether the input data has been manipulated cannot be appropriately elucidated.

Regarding the second category, \cite{Unmasking,PRNU,AttributeGAN,CameraFingerprint} have all utilized the characteristics that the current deep generated images can barely learn the natural noise carried with untampered images, hence using the noise pattern for authentication. In \cite{ColorComponent}, the diminutive difference of color components between original and manipulated images for classification. While effective, these methods are also exceedingly susceptible to the quality of dataset. Our method lies in the third category and is constructed based upon high-level information~\cite{headpose,exposelandmark}, which are generally being more explainable and robust to the miniature pixel change introduced by compression or noise. Furthermore, as co-motion pattern is derived by second-order statistics, it is being more robust than ~\cite{headpose,exposelandmark} to instance-wise variation.

\section{Methodology}
In this section, we elaborate on the details of our proposed video forensic method based on co-motion pattern extraction from videos and the overall pipeline of our method is illustrated in Fig.~2. Firstly, we obtain aligned local motion feature describing the movement of specific keypoints from the input videos (Sect.~\ref{sect:LME}). To eliminate the instance-wise deviation, we then design high-order patterns among the extracted local motion features. Subsequently, we demonstrate how to construct co-motion patterns that describe the motion consistency over each video, as well as its usage altogether in Sect.~\ref{sect:CMP}.

\subsection{Local Motion Estimation}
\label{sect:LME}
The fundamental of constructing co-motion pattern is to extract local motion features firstly. Since each co-motion pattern is comprised by multiple independent correlation matrices (explained in Sect.~\ref{sect:CMP}), we expound on how to obtain local motion features from two consecutive frames in this section first.

Denote a pixel on image $I$ with coordinate $(x, y)$ at time $t$ as $I(x, y, t)$, according to brightness constancy assumption, we have~\cite{HS,opticalflow}:
\begin{equation}
    I(x, y, t) = I(x + \Delta x, y + \Delta x, t + \Delta t)
\end{equation}
where $\Delta x, \Delta y$ and $\Delta t$ denote the displacements on $\mathbb{R}^3$ respectively. $\Delta t$ is usually 1 to denote two consecutive frames. This leads to the optical flow constraint:
\begin{equation}
    \frac{\partial I}{\partial x} \Delta x + \frac{\partial I}{\partial y} \Delta y + \frac{\partial I}{\partial t} = 0
\end{equation}
However, such a hard constraint can lead motion estimation result to be sensitive to even slight changes in brightness, and therefore gradient constancy assumption is proposed~\cite{gradient,opticalflow}:
\begin{equation}
    \nabla I(x, y, t) = \nabla I(x + \Delta x, y + \Delta y, t + 1)
\end{equation}
where
\begin{equation}
    \nabla = (\partial x, \partial y)^\intercal
\end{equation}
Based on above constraints, the objective function can be formulated as:
\begin{equation}
    \underset{\Delta x, \Delta y}{\min} E_{total}(\Delta x, \Delta y) = E_{brightness} + \alpha E_{smoothness}
\end{equation}
where:
\begin{equation}
\begin{split}
E_{brightness} = \iint & \psi(I(x, y, t) - I(x + \Delta x, y + \Delta y, t + 1)) ~ +  \\
& \psi(\nabla I(x, y, t) - \nabla I(x + \Delta x, y + \Delta y, t + 1)) dxdy
\end{split}
\end{equation}
$\alpha$ denotes a weighting parameter and $\psi$ denotes a concave cost function, and $E_{smoothness}$ penalization term is introduced to avoid too significant motion displacement:
\begin{equation}
    E_{smoothness} = \iint \psi(|\nabla x|^2 + |\nabla y|^2) dxdy
\end{equation}
In our approach, we utilize Liu's~\cite{celiu} dense optical flow to estimate motion over frame pairs.  However, while the intra-frame movement is estimable, it cannot be used directly as motion features because the content of each video varies considerably which makes the comparison between the estimated motion of different videos unreasonable~\cite{OFCNN}. Moreover, the estimated motion cannot be pixel-wise accurate due to the influence of noises and non-linear displacements.

\begin{figure}[t!]
    \centering

    \includegraphics[width=0.8\textwidth, height=0.38\textwidth]{eccv2020kit/LME.png}
    \caption{Illustration of local motion estimation step.}
    \label{fig:lme}
\end{figure}

To overcome the above problems, we propose to narrow the region of interests via finding facial landmarks for comparison. By employing an arbitrary facial landmark detector $f_{D}$, we are able to obtain a set of spatial coordinates $L$ as:
\begin{equation}
    f_D(I) = L_I = \{l^i_I | l_I^i \in \mathbb{R}^2, 1 \leq i \leq n \}
\end{equation}
so that the local motion features $M_I$ can be denoted as:
\begin{equation}
    M_I = \{m_I^i | m_I^i = I_{\Delta x, \Delta y} \oplus \mathcal{N}(l_I^i \pm \hat{k}), l_I^i \in L_I\}
\end{equation}
representing the Gaussian-weighted average of estimated motion map $I_{\Delta x, \Delta y}$ centered on $(l_i^x, l_i^y)$ with stride $\hat{k}$. The Gaussian smoothing is introduced to further mitigate the negative impact by inaccurate estimation result. By doing so, we align the motion feature extracted from each video for equitable comparison. An intuitive illustration of this step is presented in Fig.~\ref{fig:lme}.
Due to the lack of sufficient motion in some $I_{\Delta x, \Delta y}$, we abandon these with trivial magnitude by setting a hyperparameter as threshold where the detailed choice will be discussed in Sect.~\ref{sect:Exp}.

\subsection{Co-motion Patterns}
\label{sect:CMP}
Depending merely on local motion features obtained above would require an incredibly large-scale dataset to cover as many scenarios as possible, which is redundant and costly. Based on the observation that a human face is an articulated structure, the intra-component correlation can also depict the motion in an efficient manner. Inspired by the co-occurrence feature~\cite{Cooccurrence}, which has been frequently employed in texture analysis, we propose to further calculate the second-order statistics from extracted local motion features.

\subsubsection{Grouping Intra-Correlated Motion Features} \hfill \break
\noindent In this step, we group analogous $m_I^i \in M_I$ to estimate articulated facial structure by motion features since motion features that are collected from the same facial component would more likely to share consistent movement. Meanwhile, the negative correlation can also be represented where motion features having opposite directions (e.g. upper lip and lower lip) would be assigned to disjoint groups.
As $m_I^i \in \mathbb{R}^2$ denotes motion on two orthogonal directions, we construct the affinity matrix $A_I$ on $M_I$ such that:
\begin{equation}
    A_I^{i, j} = m_I^i \cdot m_I^j
\end{equation}
We here choose the inner product over other metrics such as cosine and euclidean since we wish to both emphasize the correlation instead of difference and to lighten the impact of noise within $M_I$. In specific, using inner product can ensure the significance of two highly correlated motions that both possess certain magnitude to be highlighted, while noises with trivial magnitude would relatively affect less. The normalized spectral clustering~\cite{spectral,tutorial} is then performed, where we calculate the degree matrix $D$ such that:
\begin{equation}
    D_I^{i, j} =
    \begin{cases}
      \sum^n_{j} A_I^{i, j} & \text{if $i = j$}\\
      0 & \text{if $i \neq j$}\\
    \end{cases}
\end{equation}
and the normalized Laplacian matrix $\mathcal{L}$ as:
\begin{equation}
    \mathcal{L} = (D_I)^{-\frac{1}{2}}(D_I - A_I)(D_I)^{\frac{1}{2}}
\end{equation}
In order to split $M_I$ into $K$ disjoint groups, the first $K$ eigenvectors of $\mathcal{L}$, denote as $\textbf{V} = \{\nu_k | k \in [1, K]\}$, are extracted to form matrix $F \in \mathbb{R}^{n \times K}$. After normalizing $F$ by dividing the corresponding L2-norms row-wisely, a K-Means clustering is used to separate $P = \{p_i | p_i = F^i \in \mathbb{R}^{K}, i \in [1, n]\}$ into $K$ clusters where $C_k = \{i | p_i \in C_k\}$. However, since $K$ is not directly available in our case, we will demonstrate how to determine the optimal $K$ in the next step.

\subsubsection{Constructing Co-motion Patterns} \hfill \break
As previously stated, determining a proper $K$ can also assist in describing the motion pattern more accurately. A straightforward approach is to iterate through all possible $K$ such that the Calinski-Harabasz index~\cite{CH} is maximized:
\begin{equation}
     \operatorname*{arg\,max}_{K \in [2, n]} ~ f_{CH}(\{C_k | k \in [1, K]\}, K)
\end{equation}
where
\begin{equation}
     f_{CH}(\{C_k | k \in [1, K]\}, K) = \frac{tr(\sum^K_y \sum_{p_i \in C_y} (p_i - C_y^{\mu})(p_i - C_y^{\mu})^\intercal)}{tr(\sum^K_y |C_y| (C_y^{\mu} - M_I^{\mu})(C_y^{\mu} - M_I^{\mu})^\intercal)} \times \frac{n - K}{K - 1}
\end{equation}
with $C_y^{\mu}$ is the centroid of $C_y$, $M_I^{\mu}$ is the center of all local motion features and $tr$ denotes taking the trace of the corresponding matrix. After all the efforts, the motion correlation matrix $\rho_{I_t, I_{t+1}}$ of two consecutive frames $I_t$ and $I_{t+1}$ can be calculated as:
\begin{equation}
    \rho_{I_t, I_{t+1}}^{i, j} =
    \begin{cases}
      1 & \text{if $(m_i \in C_k ~\&~ m_j \in C_k ~|~  \exists C_k)$}\\
      0 & \text{otherwise}\\
    \end{cases}
\end{equation}
and consequently, the co-motion pattern of sequence $S = \{I_1, ..., I_T\}$ is calculated as the weighted average of all correlation matrices:
\begin{equation}
    f_{CP}(S) = \sum^T_t k_{I_t, I_{t+1}} \times f_{CH}(\{C_k | k \in [1, K]\}, k_{I_t, I_{t+1}}) \times \rho_{I_t, I_{t+1}}
\end{equation}
where the weighting procedure is also to reduce the impact of noise: the greater the $f_{CH}(\{C_k | k \in [1, K]\}, K)$, naturally the more consistent the motions are; simultaneously, co-motion pattern constructed on noisy estimated local motion would scatter more sparse, which should be weighted as less important.

\subsubsection{Usage of Co-motion Patterns} \hfill \break
The co-motion pattern can be utilized as a statistical feature for comparison purposes. When used for supervised classification, each co-motion must be normalized by its L1 norm:
\begin{equation}
    \dot f_{CP}(S) = \frac{f_{CP}(S)}{\sum |f_{CP}(S)|}
\end{equation}
and $\dot f_{CP}(S)$ can be used as features for arbitrary objectives.
In order to illustrate that our co-motion pattern can effectively distinguish all forgery types by only modeling on real videos, we also conduct anomaly detection experiments where a real co-motion pattern is firstly built as template. Then, co-motion patterns from real and forgery databases are all compared against the template where the naturalness is determined by the threshold.
Jensen–Shannon divergence is suggested to be employed as distance measure between any two co-motion patterns:
\begin{equation}
    d_{KL}(f_{CP}(S_1), f_{CP}(S_2)) = \sum_i \sum_j^{i-1} f_{CP}(S_1)^{i, j} log(\frac{f_{CP}(S_1)^{i, j}}{f_{CP}(S_2)^{i, j}})
\end{equation}
\begin{equation}
    d_{JS}(f_{CP}(S_1), f_{CP}(S_2)) = \frac{1}{2} d_{KL}(f_{CP}(S_1), \overline{f_{CP}}_{S_1, S_2}) + \frac{1}{2} d_{KL}(f_{CP}(S_2), \overline{f_{CP}}_{S_1, S_2})
\end{equation}
where $\overline{f_{CP}}_{S_1, S_2} = \frac{f_{CP}(S_1) + f_{CP}(S_2)}{2}$ and $S1, S2$ denote two sequences.


\section{Introduction}
The tremendous performance of deep learning models has led to rampant application of these systems in practice. However, these models can be manipulated by introducing minor perturbations {\cite{szegedy2013intriguing, goodfellow2014explaining, wang2020you, wang2020adversarial, zhang2022local}}. This process is called adversarial attacks. In case of person re-identification, for a given query input $x$, a target model $f$ and a gallery, the attack is defined as,
\begin{align}
    &\lVert f(\mathbf{x}+\boldsymbol{\delta}) - f(\mathbf{x}_g)\rVert_2 > \lVert f(\mathbf{x}+\boldsymbol{\delta}) - f(\bar{\mathbf{x}}_g)\rVert_2 \;\;\;\textit{s.t.}\; \lVert \boldsymbol{\delta} \rVert_p \leq \epsilon, \nonumber\\
    &\mathbf{x}_g \ni topk(\mathbf{x}+\boldsymbol{\delta}), ID(\mathbf{x}) = ID(\mathbf{x}_g) \neq ID(\bar{\mathbf{x}}_g) \nonumber
\end{align}
where $\mathbf{x}_g$ and $\bar{\mathbf{x}}_g$ are gallery samples belonging to different identity and $\boldsymbol{\delta}$ is the adversarial perturbation with an $l_p$ norm bound of $\epsilon$. {\textit{topk}($\cdot$)} refers to the top $k$ retrieved images for the given argument.

 Adversarial attacks have been extensively investigated under classification setting \cite{akhtar2021advances} and also studied in other domains \cite{li2021concealed, li2021simple, jia20203d} in the recent times. However, {to the best of our knowledge}, there are very few works which study these attacks in person re-identification domain. In the following we briefly discuss some classical attacks under classification setting. Szegedy \etal~\cite{szegedy2013intriguing} proposed the first work on generation of adversarial sample for deep neural networks using L-BFGS. Goodfellow \etal~\cite{goodfellow2014explaining} proposed an efficient adversarial sample generation method using fast gradient sign method (FGSM). Kurakin \etal~\cite{kurakin2016adversarial} proposed an iterative FGSM method. Other prominent works include \cite{madry2017towards,carlini2017towards,papernot2016limitations,dong2018boosting,croce2020reliable,wang2021feature}.

In person re-id {\cite{zhou2019omni,chang2018multi,li2019cross,yang2021pixel}}, both white-box and black box attacks have been proposed in \cite{yang2021learning, ding2021beyond, wang2020transferable, li2021qair}. These attacks use a labeled source dataset and show that the attacks are transferable under cross-dataset or cross-model, or both settings. However, transferabilty of attacks in the challenging cross-dataset and cross-model setting is still an issue. In this work, we propose to use a mask and meta-learning for better transferability of attacks. We also investigate adversarial attacks in a completely new setting where the source dataset does not have any labels and the target model structure or parameters are unknown.

\section{Related Works}

In \cite{9226484}, authors propose white box and black box attacks. The black box attack only assumes that the victim model is unknown but the dataset is available. \cite{wang2019advpattern} introduces physically realizable attacks in white box setting by generating adversarial clothing pattern. \cite{li2021qair} proposes a query based attack wherein the images obtained by querying the victim model are used to form triplets for triplet loss. \cite{bouniot2020vulnerability} proposes white box attack using self metric attack; wherein the positive sample is obtained by adding noise to the given input and obtain negative sample from other images. In \cite{yang2021learning}, authors propose a meta-learning framework using a labeled source and extra association dataset. This method generalizes well in cross-dataset scenario. In \cite{ding2021beyond}, Ding~\etal ~proposed to use a list-wise attack objective function along with model agnostic regularization for better transferability. A GAN based framework is proposed in \cite{wang2020transferable}. Here the authors generate adversarial noise and mask by training the network using triplet loss.

In this work we use a GAN network to generate adversarial sample. In order to achieve better transferability of attack across models, we suppress the pixels that generate large gradients. Suppressing these gradients allows the network to focus on other pixels. In this way, the network can focus on pixels that are not explicitly salient with respect to the model used for attack. We further use meta learning \cite{finn2017model} which also allows incorporation of an additional dataset to boost the transferability. We refer this attack as Meta Generative Attack (MeGA). Our work is closest in spirit to \cite{yang2021learning, wang2020transferable}, however, the mask generation and application of meta learning under GAN framework are quite distinct from these works.

\iffalse
\textbf{Adversarial Defense} Countering adversarial attacks, the goal of adversarial defense is to achieve the accuracy comparable to that of untargeted model. The defense methods either use adversarial examples during training or modify the network itself. Adversarial training is often considered as a first line of defense \cite{szegedy2013intriguing, goodfellow2014explaining, moosavi2016deepfool} and also demonstrates the strongest defense. Among other class of defenses which modify the network are defensive distillation \cite{papernot2016distillation}, gradient regularization \cite{ross2018improving}, biologically inspired models \cite{nayebi2017biologically, krotov2018dense}, convex ReLU relaxation \cite{wong2018provable}, image enhancement \cite{mustafa2019image}, image restoration \cite{zhao2021removing}.
\fi

\section{Methodology}
In this work we address both white-box and black-box attacks. We need that the attack is transferable across models and datasets. Thus if we obtain the attack sample using a given model $f$, the attack is inherently tied to $f$ \cite{wang2021feature}. In order that attack does not over-learn, we apply a mask that can focus on regions that are not highly salient for discrimination. This way the network can focus on less salient but discriminative regions thereby increasing the generalizability of attack to other models. On the other hand, meta learning has been efficiently used in adversarial attacks \cite{yuan2021meta, yang2021learning, feng2021meta} to obtain better transferability across datasets. However meta learning has not been explored with generative learning for attacks in case of PRID. We adapt the MAML meta learning framework \cite{finn2017model} in our proposed method. While the black box attack works assume the presence of a labeled source dataset, we additionally present a more challenging setting wherein no labels are available during attack.
\begin{figure}
\centering
\includegraphics[width = .45\textwidth]{prid_images/Copy_of_arch.png}
\caption{Model architecture. Mask $\mathbf{M}$ is generated using model $f$ and is used to mask the input $\mathbf{x}$. GAN is trained using a meta learning framework with an adversarial triplet loss and GAN loss.}
\label{fig:architecture}
\end{figure}

Our proposed model is illustrated in Figure \ref{fig:architecture}. In case of white-box setting,
the generator $\mathcal{G}$ is trained using the generator loss, adversarial triplet loss and meta learning loss while the discriminator $\mathcal{D}$ is trained with the classical binary cross-entropy discriminator loss. The mask is obtained via self-supervised triplet loss. The network learns to generate adversarial image. While the GAN loss itself focuses on generating real samples, the adversarial triplet loss guides the network to generate samples that will be closer to negative samples and farther away from positive samples.
\subsection{GAN training}
Given a clean sample $\mathbf{x}$, we use the generator $\mathcal{G}$ to create the adversarial sample $\mathbf{x}_{adv}$. The overall GAN loss is given by, $\mathcal{L}_{GAN} = E_{\mathbf{x}}\log \mathcal{D}(\mathbf{x}) + E_{\mathbf{x}}\log(1 - \mathcal{D}(\Pi(\mathcal{G}(\mathbf{x}))))$.
Here $\Pi(.)$ denotes the projection into $l_{\infty}$ ball of $\epsilon$-radius within $\mathbf{x}$ and $\mathbf{x}_{adv} = \Pi(\mathcal{G}(\mathbf{x}))$. In order to generate adversarial samples, a deep mis-ranking loss is used \cite{wang2020transferable},
\begin{align}
    \mathcal{L}_{adv-trip}(\mathbf{x}_{adv}^{a}, \mathbf{x}_{adv}^{n}, \mathbf{x}_{adv}^{p}) &= \max(\lVert \mathbf{x}_{adv}^{a} - \mathbf{x}_{adv}^n\rVert_2 \label{eq:adv-triplet} \\ \nonumber
    &- \lVert \mathbf{x}_{adv}^{a} - \mathbf{x}_{adv}^p\rVert_2 + m,0)
\end{align}
where $m$ is the margin. {$\mathbf{x}_{adv}^{a}$ is the adversarial sample obtained from anchor sample $\mathbf{x}^{a}$. Similarly, $\mathbf{x}_{adv}^{p}$ and $\mathbf{x}_{adv}^{n}$ are the adversarial samples obtained from respective positive and negative samples $\mathbf{x}^{p}$ and $\mathbf{x}^{n}$.} This loss tries to push the negatives closer to each other and pulls the positives farther away. Thus the network learns to generate convincing adversarial samples.
\subsection{Mask Generation}
Attack obtained using the given model $f$ leads to poor generelization to other networks. In order to have a better tranferability, we first compute the gradients with respect to self-supervised triplet loss $\mathcal{L}_{adv-trip}(\mathbf{x},\mathbf{x}^n,\mathbf{x}^p)$, where $\mathbf{x}^p$ is obtained by augmentation of $\mathbf{x}$ and $\mathbf{x}^n$ is the sample in the batch which lies at a maximum Euclidean distance from $\mathbf{x}$. Here, the large gradients are primarily responsible for loss convergence. Since this way of achieving convergence is clearly coupled with $f$, we mask the large gradients. Thus, the convergence is not entirely dependent on the large gradients and focuses on other smaller ones which can also potentially posses discriminative nature. Thus the overfitting can be reduced by using the mask. To obtain the mask, we compute,
\begin{equation}
    \mathbf{grad}_{adv-triplet} = \nabla_{\mathbf{x}}\mathcal{L}_{adv-trip}(\mathbf{x},\mathbf{x}^n,\mathbf{x}^p)
    \label{eq:grad}
\end{equation}
Note that, we use the real samples in Eq. \ref{eq:grad}.
The mask is given by $\mathbf{M} = sigmoid(\lvert \mathbf{grad}_{adv-triplet} \rvert)$, where $\lvert \cdot \rvert$ denotes absolute value. We mask $\mathbf{x}$ before feeding as an input to the generator $\mathcal{G}$. The masked input is given as $\mathbf{x} = \mathbf{x}\odot (1-\mathbf{M})$, where $\odot$ denotes Hadamard product.

{Masking techniques have also been explored in \cite{parascandolo2020learning, shahtalebi2021sand} where the idea is to learn the model such that it does not overfit to the training distribution. Our masking technique is motivated from the idea that an adversarial example should be transferbale across different reid models. Our technique is distinct and can be applied to an individual sample. Whereas, masking technique in \cite{parascandolo2020learning, shahtalebi2021sand} seeks agreement among the gradients obtained from all the samples of a batch.
This technique in \cite{parascandolo2020learning, shahtalebi2021sand} also suffers from the drawback of tuning hyperparameter. Further, the masking technique of \cite{parascandolo2020learning} is boolean while ours is continuous.}

\subsection{Meta Learning}
Meta optimization technique allows to learn from multiple datasets for different tasks while generalizing well on a given task. One of the popular meta learning approaches, MAML \cite{finn2017model}, applies two update steps. The first update happens in an inner loop with a meta-train set while the second update happens in outer loop with a meta-test set. In our case, we perform the inner loop update on the discriminator and generator parameters using the meta-train set and the outer loop update is performed on the parameters of generator using a meta-test set.
\begin{algorithm}[h]
\SetKwData{Left}{left}\SetKwData{This}{this}\SetKwData{Up}{up}
\SetKwFunction{Union}{Union}\SetKwFunction{FindCompress}{FindCompress}
\SetKwInOut{Input}{input}\SetKwInOut{Output}{output}
\Input{Datasets $\mathcal{T}$ and $\mathcal{A}$, model $f$}
\Output{Generator network $\mathcal{G}$ parameters $\boldsymbol{\theta}_g$}
\BlankLine
\While{not converge}{
\For{samples in $\mathcal{T}$}{
\tcc*[h]{Obtain the mask}\\
$\mathbf{M}$ $\leftarrow$ $\sigma$($\lvert \nabla_{\mathbf{x}}{\mathcal{L}_{adv-trip}(\mathbf{x},\mathbf{x}^n,\mathbf{x}^p) } \rvert$)\\
\tcc*[h]{Meta train update using $\mathcal{T}$}\\
 $\boldsymbol{\theta}_d \leftarrow \argmax_{\boldsymbol{\theta}_d} E_{\mathbf{x}}\log \mathcal{D}(\mathbf{x}) + E_{\mathbf{x}}\log(1 - \mathcal{D}(\Pi(\mathcal{G}(\mathbf{x}))))$ \\
 $\boldsymbol{\theta}_g \leftarrow \argmin_{\boldsymbol{\theta}_g}  \mathcal{L}_{\mathcal{G}}^{\mathcal{T}} + \lambda \mathcal{L}_{adv-trip}^{\mathcal{T}}(\mathbf{x}_{adv}^a,\mathbf{x}_{adv}^n,\mathbf{x}_{adv}^p)$\\
 $\boldsymbol{\delta} = \mathbf{x} - \Pi(G(\mathbf{x}))$\\
 \tcc*[h]{Meta test loss using $\mathcal{A}$}\\
  Sample triplets from meta-test set $\mathcal{A}$ and compute $\mathcal{L} = \mathcal{L}_{adv-trip}^{\mathcal{A}}(\mathbf{x}^a - \boldsymbol{\delta},\mathbf{x}^n,\mathbf{x}^p)$\\
 }
 \tcc*[h]{Meta test update}\\
 $\boldsymbol{\theta}_g \leftarrow \argmin_{\boldsymbol{\theta}_g} \lambda \mathcal{L}$\\
 }
\caption{{Training for MeGA}}\label{algo_disjdecomp}
\end{algorithm}

More formally, given a network $\mathcal{D}$ parametrized by $\boldsymbol{\theta}_d$ and $\mathcal{G}$ parametrized by $\boldsymbol{\theta}_g$, we  perform the meta-training phase to obtain the parameters $\boldsymbol{\theta}_d$ and $\boldsymbol{\theta}_g$. The update steps are given in Algorithm \ref{algo_disjdecomp}.
We also obtain the adversarial perturbation as, $\boldsymbol{\delta} = \mathbf{x} - \Pi(G(\mathbf{x}))$.

We then apply the meta-testing update using the additional meta-test dataset ${\mathcal{A}}$. In Algorithm \ref{algo_disjdecomp},
 $\mathcal{L}_{\mathcal{G}}^{\mathcal{T}} = E_{\mathbf{x}}\log(1 - \mathcal{D}(\Pi(\mathcal{G}(\mathbf{x}))))$. We discriminate the datasets using superscripts $\mathcal{T}$ for meta-train set and $\mathcal{A}$ for meta-test set. $\mathcal{L}_{adv-trip}^{\mathcal{A}}$ draws its samples $\mathbf{x}$ from $\mathcal{A}$. At the inference stage, we only use $\mathcal{G}$ to generate the adversarial sample.

\subsection{Training in absence of labels}
 Deep mis-ranking loss can be used \cite{wang2020transferable} when the labels are available for $\mathcal{T}$. In this scenario, we present the case where no labels are available. In the absence of labels and inspired by unsupervised contrastive loss \cite{wang2021understanding}, we generate a positive sample $\mathbf{x}_{adv}^p$ by applying augmentation to the given sample $\mathbf{x}_{adv}^a$. The negative sample $\mathbf{x}_{adv}^n$ is generated using batch hard negative sample strategy, {that is we consider all samples except the augmented version of $\mathbf{x}_{adv}^a$ as negative samples and choose the one which is closest to $\mathbf{x}_{adv}^a$}. We then use {Eq. \ref{eq:adv-triplet}} to obtain the adversarial triplet loss.
\section{Experimental Results}
\subsection{Implementation Details} We implemented the proposed method in Pytorch framework. The GAN architecture is similar to that of the GAN used in \cite{xiao2018generating, isola2017image}. We use the models from Model Zoo \cite{modelzoo} - OSNet \cite{zhou2019omni}, MLFN \cite{chang2018multi}, HACNN \cite{li2018harmonious}, ResNet-50 and ResNet-50-FC512. We also use AlignedReID \cite{zhang2017alignedreid, AlignedReID}, LightMBN \cite{herzog2021lightweight}, and PCB \cite{sun2018beyond, PCB}.
We use an Adam optimizer with a learning rate = $10^{-5}$, $\beta_1$ = $0.5$ and $\beta_2 = 0.999$ and train the model for 40 epochs. We set $m=1$, {$\lambda = 0.01$}, and $\epsilon = 16$. In order to stabilize GAN training, we apply label flipping with 5\% flipped labels. We first present the ablation for mask and meta learning.

\subsection{Effect of mask $\mathbf{M}$}
 We find that when we use mask for Resnet50 and test for different models like MLFN \cite{chang2018multi} and HACNN \cite{li2018harmonious}, there is a substantial gain in the performance as shown in Table \ref{tab:resnet50_mask}. In terms of R-1 accuracy, introduction of mask gives a boost of 42.10\% and 4.8\% for MLFN and HACNN respectively. This indicates that mask provides better transferability. Further, when we evaluate on Resnet50 itself, there is a minor change in performance which could be because mask is learnt using Resnet50 itself.
\begin{table}[H]
\caption{Trained on Market-1501 \cite{zheng2015scalable}. Setting Market-1501 $\rightarrow$ Market-1501. $l$ indicates Market-1501 labels are used for training. $\mathbf{M}$ indicates the incorporation of mask. 'Before' indicates accuracy on clean samples.}
\label{tab:resnet50_mask}
\centering
{
    \begin{tabular}{c|c c | c c |  c c }
\hline
Model &\multicolumn{2}{c|}{Resnet50} &\multicolumn{2}{c|}{MLFN} &\multicolumn{2}{c}{HACNN} \\
& mAP &R-1 &mAP& R-1&mAP &R-1 \\
\hline
 Before & 70.4& 87.9 & 74.3 &90.1 & 75.6& 90.9\\
$l$ & {0.66}  & {0.41} & 3.95 &3.23   & 32.57& 42.01  \\
{$l+\text{AND}$}&{0.56} & {0.35} & 5.39 & 4.55 & 35.13 &44.20\\
{$l+\text{SAND}$}&\textbf{0.51} & \textbf{0.33} & 6.01 & 4.89 & 37.50 &45.11\\
$l+\mathbf{M}$ &0.69  & 0.50  &\textbf{2.80}   & \textbf{1.87} & \textbf{31.73}  & \textbf{39.99} \\
\hline
\end{tabular}
}
\end{table}

\subsection{Effect of meta learning}
We demonstrate the effect of meta learning in Table \ref{tab:resnet50_meta}. In the case of cross-dataset (Resnet50) as well as cross-dataset cross-model (MLFN) setting, we observe that introduction of meta learning gives a significant performance boost. In terms of R-1 accuracy, there is a boost of 69.87\% and 69.29\% respectively for Resnet50 and MLFN. We further observe that Resnet50 does not have a good transferability towards HACNN. This could be due to two reasons. First, Resnet50 is a basic model compared to other superior PRID models. Second, HACNN is built on Inception units \cite{szegedy2017inception}.
\begin{table}[H]
\caption{Trained on Market-1501 using MSMT-17 \cite{wei2018person} as meta test set. Setting Market-1501 $\rightarrow$ DukeMTMC-reID \cite{zheng2017unlabeled}. $\mathcal{A}$ indicates incorporation of meta learning.}
\label{tab:resnet50_meta}
\centering
{
    \begin{tabular}{c|c c | c c |  c c }
\hline
{Model} &\multicolumn{2}{c|}{Resnet50} &\multicolumn{2}{c|}{MLFN} &\multicolumn{2}{c}{HACNN} \\
& mAP &R-1 &mAP& R-1&mAP &R-1 \\
\hline
 Before & 58.9 & 78.3 &  63.2& 81.1 & 63.2&80.1 \\
$l$ & 17.96 & 24.86 & 18.25& 24.10 & \textbf{42.75} &\textbf{58.48} \\
$l+\mathcal{A}$ &\textbf{5.80} & \textbf{7.49} & \textbf{6.15} & \textbf{7.4} & 43.12& 58.97\\
\hline
\end{tabular}
}
\end{table}
\subsection{Adversarial attack performance}
We first present the results for cross-model attack in Table \ref{tab:aligned_source_market}. We use AlignedReID model, Market-1501 \cite{zheng2015scalable} as training set and MSMT-17 \cite{wei2018person} as meta test set. The results are reported for Market-1501 and DukeMTMC-reID \cite{zheng2017unlabeled}. In case of Market-1501, it is clearly evident that the proposed method is able to achieve a strong transferability. We can see that  incorporation of meta test set leads to less than halving the mAP and R-1 results compared to case when only labels are used. For instance, mAP and R-1 of AlignedReID goes down from 7.00\% and 6.38\% to 3.51\% and 2.82\% respectively. This is consistently observed for all three models. Further, the combined usage of mask and meta learning ($l+\mathbf{M}+\mathcal{A}$), denoted as MeGA, achieves best results in cross-model case of PCB and HACNN. The respective R-1 improvements are 10.00\% and 9.10\%. Thus our method is extremely effective in generating adversarial samples.
\begin{table}[H]
\caption{AlignedReID trained on Market-1501 with MSMT-17 as meta test set. M is Market-1501 and D is DukeMTMC-reID. MeGA denotes $l+\mathbf{M}+\mathcal{A}$.}
\label{tab:aligned_source_market}
\centering
\resizebox{\columnwidth}{!}
{
\begin{tabular}{c|c| c c | c c |c c }
\hline
& {Model} &\multicolumn{2}{c|}{AlignedReID} &\multicolumn{2}{c|}{PCB} &\multicolumn{2}{c}{HACNN} \\
& & mAP &R-1 &mAP& R-1&mAP &R-1 \\
\hline
M $\rightarrow$ M & Before & 77.56 & 91.18 & 78.54 & 92.87 & 75.6&90.9 \\
\cline{2-8}
&$l$ & 7.00 & 6.38 & 16.46 & 29.69 & 16.39 & 20.16\\
\cline{2-8}
&$l$ + $\mathbf{M}$  & 6.62& 5.93 & 15.96 & 28.94 & 16.01 & 19.47\\ \cline{2-8}
&$l+\mathcal{A}$ & \textbf{3.51}  & \textbf{2.82}  &  8.07 & 13.86 & 5.44& 5.28 \\
\cline{2-8}
&MeGA& 5.50 & 5.07 &  \textbf{7.39} &\textbf{12.47} & \textbf{4.85} & \textbf{4.80} \\
\hline
M $\rightarrow$ D& $l$ & 16.04 & 21.14 & 13.35 & 15.66 & 15.94 & 21.85 \\
\cline{2-8}
&$l+\mathbf{M}$ & 16.23 & 21.72  & 13.70 & 15.97  & 16.43 & 22.17  \\
\cline{2-8}
&$l+\mathcal{A}$ & \textbf{4.69}  & \textbf{5.70}  & \textbf{11.10} & \textbf{12.88} & 5.40 & 6.55\\
\cline{2-8}
&MeGA & 7.70 & 9.47 & 11.81 & 14.04& \textbf{4.73} & \textbf{5.40} \\
\hline
\end{tabular}
}
\end{table}

In case of Market-1501 to DukeMTMC-reID, we observe that simply applying the meta learning ($l+\mathcal{A}$) generalizes very well. In case of AlignedReID, mAP and R-1 of 4.60\% and 5.70\% respectively, are significantly lower compared to results obtained via $l$ or $l+\mathbf{M}$ settings. The combined setting of mask and meta learning yields better results for HACNN compared to AlignedReID and PCB. This may be because of the fact that learning of mask is still tied to training set and thus may result in overfitting.
\iffalse
\begin{table}[H]
\caption{AlignedReID trained on Market with MSMT-17 as meta test set. Results are reported for DukeMTMC-reID. Cross dataset and model setting. }
\label{tab:aligned_test_duke}
\centering
\resizebox{\columnwidth}{!}
{
    \begin{tabular}{c| c c c| c c c|c c c}
\hline
\hline
{Model} &\multicolumn{3}{c|}{AlignedReID} &\multicolumn{3}{c|}{PCB} &\multicolumn{3}{c}{HACNN} \\
& mAP &R-1 &R-10 & mAP &R-1 &R-10& mAP &R-1 &R-10 \\
\hline
$l+\mathbf{M}$ & 16.23 & 21.72 & 37.79 & 13.70 & 15.97 & 36.13 & 16.43 & 22.17 & 35.77 \\
\hline
$l+\mathcal{A}$ & 4.69  & 5.70  &  12.11 & 11.10 & 12.88& 29.30 & 5.40 & 6.55 & 14.13 \\
\hline
MeGA & 7.70 & 9.47 & 19.16 & 11.81 & 14.04 &31.23 & 4.73 & 5.40 & 11.57  \\
\hline
\end{tabular}
}
\end{table}
\fi

In Table \ref{tab:market-msmt_meta_duke} we discuss the results for cross-dataset and cross-model case against more models. Here also we can see that both AlignedReID and PCB lead to strong attacks against other models in a different dataset.

In Table \ref{tab:aligned_msmt}, we present the results for MSMT-17. Here, the model is trained using AlignedReID and PCB using Market-1501 and DukeMTMC-reID as meta test set. When trained and tested using AlignedReID, the R-1 accuracy drops from 67.6\% on clean samples to 17.69\%. On the other hand when trained using PCB and tested on AlignedReID, the performance drops to 16.70\%. This shows that our attack is very effective in large scale datasets such as MSMT-17.
\tabcolsep=4pt
\begin{table*}[tb]
\caption{AlignedReID and PCB trained on Market with MSMT-17 as meta test set. Setting Market-1501 $\rightarrow$ DukeMTMC-reID.}
\label{tab:market-msmt_meta_duke}
\centering
{
\begin{tabular}{c| c c c |c c c | c c c | c c c | c c c| c c c}
\hline
{Model} &\multicolumn{3}{c|}{OSNet} & \multicolumn{3}{c|}{{LightMBN}} & \multicolumn{3}{c|}{ResNet50} & \multicolumn{3}{c|}{MLFN} & \multicolumn{3}{c|}{ResNet50FC512} & \multicolumn{3}{c}{HACNN} \\
& mAP &R-1 &R-10 & mAP &R-1 &R-10 & mAP &R-1 &R-10 & mAP &R-1 &R-10  & mAP &R-1 &R-10  & mAP &R-1 &R-10 \\
\hline
Before & 70.2&  87.0 & - & 73.4 & 87.9 & - & 58.9 &  78.3& - & 63.2&  81.1 &-& 64.0 & 81.0& -& 63.2 & 80.1& - \\\hline
AlignedReID & 15.31 & 22.30 & 35.00 & 16.24 & 24.13 &39.65 & 5.17 & 6.64 & 13.77  & 12.28& 16.38 & 29.39 &6.97 & 9.69&19.38 & 4.77 & 5.61 &  11.98\\
\hline
PCB & 12.27  & 14.45 &  27.49 & 12.88 &  15.70 & 28.54& 7.14 &  8.55 & 20.01  & 11.95 &  16.54 &  30.92 & 9.45  & 11.46 & 23.90 & 3.97  & 4.66 &  10.00 \\
\hline
\end{tabular}
}
\end{table*}
\begin{table}[H]
\caption{Trained on Market-1501 using DukeMTMC-reID as meta test set. Setting Market-1501 $\rightarrow$ MSMT-17.}
\label{tab:aligned_msmt}
\centering
{
\begin{tabular}{c| c c c }
\hline
{Model} &\multicolumn{3}{c}{AlignedReID}  \\
& mAP &R-1 &R-10  \\
\hline
MeGA (AlignedReID)& 9.37 & 17.69 & 33.42 \\
\hline
MeGA (PCB) & 8.82 & 16.70 &  31.98\\
\hline
\end{tabular}
}
\end{table}
\begin{figure}[H]
\centering
\includegraphics[width = 0.8cm,height = .9cm, cfbox=red 1pt 1pt]{prid_images/original_img.png} \hspace{4mm}
\includegraphics[width = 0.8cm,height = .9cm]{prid_images/fake_samples__epoch_5.png}
\includegraphics[width = 0.8cm,height = .9cm]{prid_images/fake_samples__epoch_5_seq_11.png}
\includegraphics[width = 0.8cm,height = .9cm]{prid_images/fake_samples__epoch_7.png}
\includegraphics[width = 0.8cm,height = .9cm]{prid_images/fake_samples__epoch_10.png}
\includegraphics[width = 0.8cm,height = .9cm]{prid_images/fake_samples__epoch_20.png}\\
\includegraphics[width = 0.8cm,height = .9cm, cfbox=blue 1pt 1pt]{prid_images/market-mask.png} \hspace{4mm}
 \includegraphics[width = 0.8cm,height = .9cm]{prid_images/epoch_5_query_4.jpeg}
   \includegraphics[width = 0.8cm,height = .9cm]{prid_images/epoch_5_query_11.jpeg}
 \includegraphics[width = 0.8cm,height = .9cm]{prid_images/epoch_7_query_4.jpeg}
 \includegraphics[width = 0.8cm,height = .9cm]{prid_images/epoch_10_query_4.jpeg}
 \includegraphics[width = 0.8cm,height = .9cm]{prid_images/epoch_20_query_4.jpeg}
  \caption{{Left column: Red and blue box show the given image from Market-1501 and its mask ($1-M$) respectively.
  Right column:} Attacked (top) and clean (bottom) images from MSMT-17}
  \label{fig:subjective}
\end{figure}
\subsection{Comparison with SOTA models}
In Table \ref{tab:comparison_aligned_TCIAA} we present the comparison with TCIAA \cite{wang2020transferable}, UAP \cite{li2019universal} and Meta-attack \cite{yang2021learning}. We observe that our method outperforms TCIAA by a huge margin. We can also see that when mis-ranking loss is naively applied in case of TCIAA$^\dagger$ \cite{yang2021learning}, the model' performance degrades. Our attack has better performance compared to both TCIAA and Meta-attack.

\begin{table}[H]
\caption{AlignedReID trained on Market with MSMT-17 as meta test set. Setting Market-1501 $\rightarrow$ DukeMTMC-reID. $^\dagger$ uses PersonX \cite{sun2019dissecting} as extra dataset.$^*$ uses PersonX for meta learning. }
\label{tab:comparison_aligned_TCIAA}
\centering
{
\begin{tabular}{c| c c c  }
\hline
{Model} &\multicolumn{3}{c}{Aligned reid}  \\
& mAP &R-1 &R-10  \\
\hline
Before & 67.81 &80.50 & 93.18 \\
\hline
TCIAA \cite{wang2020transferable}&14.2 & 17.7 & 32.6 \\
{MeGA$^*$ (Ours)} & {11.34} & {12.81} & {24.11} \\
MeGA (Ours) & \textbf{7.70} & \textbf{9.47} & \textbf{19.16} \\
\hline
 & \multicolumn{3}{c}{PCB} \\
Before & 69.94 &84.47 & - \\
\hline
TCIAA \cite{wang2020transferable} & 31.2 & 45.4 & - \\
TCIAA$^\dagger$ \cite{wang2020transferable} & 38.0 & 51.4 & - \\
UAP \cite{li2019universal} & 29.0 & 41.9 & - \\
Meta-attack$^*$ ($\epsilon = 8$) \cite{yang2021learning} &26.9 & 39.9 & \\
\hline
{MeGA$^*$ ($\epsilon = 8$) (Ours)} & {22.91} & {31.70} & - \\
MeGA ($\epsilon = 8$) (Ours) & \textbf{18.01} & \textbf{21.85} & 44.29 \\
\hline
\end{tabular}
}
\end{table}

\iffalse
\begin{table}[H]
\caption{PCB-P4. Test on Duke. MSMT used for meta learning. $^*$ uses PersonX for meta learning.}
\label{tab:pcb_duke}
\centering
{
\begin{tabular}{c| c c c | }
\hline
\hline
\multirow{Model} &\multicolumn{3}{c|}{PCB}  \\
& mAP &R-1 &R-10  \\
\hline
Before & 69.94 &84.47 & - \\
\hline
TCIAA \cite{wang2020transferable} & 31.2 & 45.4 & - \\
TCIAA$^*$ \cite{wang2020transferable} & 38.0 & 51.4 & - \\
UAP \cite{li2019universal} & 29.0 & 41.9 & - \\
Meta-attack$^*$ ($\epsilon = 8$) \cite{yang2021learning} &26.9 & 39.9 & \\
\hline
MeGA ($\epsilon = 8$) & 18.01 & 21.85 & 44.29 \\
\hline
\end{tabular}
}
\end{table}
\fi

\iffalse
\begin{table}[!htb]
\caption{Test on market. MSMT-17 used for meta learning. PCB Same dataset and same model}
\label{tab:meta_market}
\centering
{
\begin{tabular}{c| c c c | }
\hline
\hline
\multirow{Model} &\multicolumn{3}{c|}{PCB}  \\
& mAP &R-1 &R-10  \\
\hline
Before & 78.54 & 92.87 & -  \\
\hline
\hline
w/ label + mask  & & &  \\
\hline
w/ label + mask + meta  & 4.26 & 6.20 & 13.12 \\
\hline
\end{tabular}
}
\end{table}

\begin{table}[H]
\caption{Test on market. MSMT-17 used for meta learning. Same dataset and cross model. Train on aligned and test on PCB and HACNN}
\label{tab:meta_market}
\centering
{
\begin{tabular}{c| c c c | }
\hline
{Model} &\multicolumn{3}{c|}{PCB}  \\
& mAP &R-1 &R-10  \\
\hline
w/ label + mask  & & &  \\
\hline
w/ label + mask + meta  + PCB& 7.39 & 12.47 & 24.04 \\
\hline
w/ label + mask + meta  + HACNN & 4.85 & 4.80 & 11.69 \\
\end{tabular}
}
\end{table}
\fi

\subsection{Subjective Evaluation}
We show the example images obtained by our algorithm in Figure \ref{fig:subjective} and top-5 retrieved results in Figure \ref{fig:retrieved_results} for the OSNet model. We can see that in the case of clean samples the top-3 retrieved images match the query ID, however, none of the retrieved images match query ID in the presence of our attack.
\begin{figure}[h]
\centering
\includegraphics[width = .9cm,height = 1.1cm, cfbox=blue 1pt 1pt]{retrieved_images/query_top000_name_0458_c1s6_032271_00.jpg}
\includegraphics[width = .9cm,height = 1.1cm, cfbox=green 1pt 1pt]{retrieved_images/clean_top001_name_0458_c4s6_032891_03.jpg}
\includegraphics[width = .9cm,height = 1.1cm, cfbox=green 1pt 1pt]{retrieved_images/clean_top002_name_0458_c5s3_081437_04.jpg}
\includegraphics[width = .9cm,height = 1.1cm, cfbox=green 1pt 1pt]{retrieved_images/clean_top003_name_0458_c5s3_081637_05.jpg}
\includegraphics[width = .9cm,height = 1.1cm, cfbox=red 1pt 1pt]{retrieved_images/clean_top004_name_0001_c1s2_037091_02.jpg}
\includegraphics[width = .9cm,height = 1.1cm, cfbox=red 1pt 1pt]{retrieved_images/clean_top005_name_0001_c1s6_011741_02.jpg}\\
\includegraphics[width = .9cm,height = 1.1cm]{retrieved_images/emptimage.png}
\includegraphics[width = .9cm,height = 1.1cm, cfbox=red 1pt 1pt]{retrieved_images/fake_top001_name_0431_c5s1_105373_04.jpg}
\includegraphics[width = .9cm,height = 1.1cm, cfbox=red 1pt 1pt]{retrieved_images/fake_top002_name_0431_c2s1_104821_01.jpg}
\includegraphics[width = .9cm,height = 1.1cm, cfbox=red 1pt 1pt]{retrieved_images/fake_top003_name_0431_c2s1_104746_02.jpg}
\includegraphics[width = .9cm,height = 1.1cm, cfbox=red 1pt 1pt]{retrieved_images/fake_top004_name_0000_c3s1_081467_04.jpg}
\includegraphics[width = .9cm,height = 1.1cm, cfbox=red 1pt 1pt]{retrieved_images/fake_top005_name_0431_c5s1_105323_03.jpg}
  \caption{Query image marked in blue border. Top 5 {retrieved} mages from OSNet for Market-1501 (top). Green colored boxes are correct match and red ones are incorrect. Retrieved images after attacking query sample (bottom).}
  \label{fig:retrieved_results}
\end{figure}

\subsection{Attack using unlabelled source}
In this section we discuss the attack when source dataset $\mathcal{T}$ is unlabeled and neither the victim model nor the dataset used for training victim model are available. This is a very challenging scenario as supervised models cannot be used for attack. Towards this, we use unsupervised trained models on Market-1501 and MSMT-17 from \cite{ge2020self}. In Table \ref{tab:train_msmt_test_market}, we present results for training using MSMT-17 and testing on Market. We observe that IBNR50 obtains a mAP and R-1 accuracy of 40.7\% and 52.34\% when both labels and mask are not used. When mask is incorporated there is a substantial boost of 3.82\% in mAP and 4.81\% in R-1 accuracy in case of OSNet. These gains are even higher for MLFN and HACNN.

In case of Market-1501 to MSMT-17 in Table \ref{tab:market-msmt}, we see that the attack using only mask performs reasonably well compared to that of attacks using label or both label and mask. Due to the comparatively small size of Market-1501, even the attacks using labels are not very efficient.
\begin{table}[H]
\caption{MSMT-17 $\rightarrow$ Market-1501. R50 denotes Resnet50.}
\label{tab:train_msmt_test_market}
\centering
{
\begin{tabular}{c| c c | c c| c c}
\hline
{Model} &\multicolumn{2}{c|}{OSNet} & \multicolumn{2}{c|}{MLFN} & \multicolumn{2}{c}{HACNN} \\
& mAP &R-1 & mAP &R-1  & mAP &R-1  \\
\hline
Before &82.6 & 94.2 & 74.3 & 90.1  & 75.6 & 90. 9 \\
\hline
$l$ (R50) & 30.50 & 39.45   & 26.37 & 38.03  & 31.15 & 39.34\\
$l+\mathbf{M}$ (R50) &24.50 &33.07  & 21.76 & 32.18  & 18.81&23.66  \\
$\mathbf{M}$ (R50) & 36.5 &47.56   & 34.92& 52.61 &31.15 &39.34 \\
\hline
\hline
IBN R50 & 40.7 & 52.34  & 40.62 & 61.46 & 35.44 & 44.84 \\
\hline
$\mathbf{M}$ (IBN R50) & 36.88 & 47.53 & 35.01 & 52.79  & 30.98& 38.98 \\
\hline
\end{tabular}
}
\end{table}
\begin{table}[H]
\caption{ Market-1501 $\rightarrow$ MSMT-17.}
\label{tab:market-msmt}
\centering
{
\begin{tabular}{c| c c | c c| c c}
\hline
{Model} &\multicolumn{2}{c|}{OSNet} & \multicolumn{2}{c|}{MLFN} & \multicolumn{2}{c}{HACNN} \\
& mAP &R-1 & mAP &R-1  & mAP &R-1  \\
\hline
Before & 43.8 & 74.9 & 37.2 & 66.4 & 37.2 &64.7\\
$l$ (R50) & 31.78 & 60.43  & 25.17 & 49.33 & 28.9&54.91\\
$l+\mathbf{M}$ (R50) &29.04 &56.11  & 22.02 & 43.57 &28.26 &53.53 \\
\hline
$\mathbf{M}$ (R50) & 35.16 & 66.28  &29.16 & 56.65 &29.69& 57.81  \\
\hline
\end{tabular}
}
\end{table}
\section{Conclusion}
We present a generative adversarial attack method using mask and meta-learning techniques. The mask allows better transferability across different networks, whereas, meta learning allows better generalizability. We present elaborate results under various settings. Our ablation also shows the importance of mask and meta-learning. Elaborate experiments on Market-1501, MSMT-17 and DukeMTMC-reID shows the efficacy of the proposed method.

\bibliographystyle{IEEEtran}