IntensPure: Attack Intensity-aware Secondary Domain Adaptive Diffusion for Adversarial Purification

1 Introduction

Person re-identification (re-ID) retrieves individuals across non-overlapping camera views in various locations, which is crucial for enhancing urban safety. Moreover, person re-ID aids in locating fugitive criminals or missing children. In recent years, person re-ID systems have also been threatened by the influence of adversarial attacks [Bouniot et al., 2020; Bai et al., 2020; Sun et al., 2024; Wang et al., 2020].

Adversarial training methods [Bai et al., 2020; Bouniot et al., 2020; Yang et al., 2022] can be commonly employed to defend against adversarial attacks in person re-ID systems (re-ID attacks). However, adversarial training approaches are limited in their ability to address unseen attacks, even when incorporating a comprehensive threat model into the training pipeline. Figure 1(a and b) illustrate the rank-1 to rank-5 results of the three defense models against Metric-FGSM [Bai et al., 2020] with attack intensity (ϵ) values of 8 and 16, on the Market1501 dataset [Zheng et al., 2015]. The top row of Figure 1(a and b) displays the person re-ID results for GOAT [Bouniot et al., 2020], revealing the failure case of the adversarial training approach against unseen attacks.

∗Corresponding author

Moreover, adversarial purification methods, another adversarial defense approach, have actively been studied because they can effectively defend against unseen threats using generative models. As generative models have advanced, diffusion model-based adversarial purification methods [Lee and Kim, 2023; Nie et al., 2022; Yoon et al., 2021] have also emerged. Diffusion models have demonstrated robust performance against adversarial attacks by purifying images without destroying their label semantics. However, existing diffusion-based purification methods treat benign (before attack) and perturbed images equally and purify all images. Such indiscriminate purification is likely to result in re-ID performance degradation. This is because the re-ID is more sensitive to image changes than other classification tasks due to the presence of unseen re-ID queries during testing [Zheng et al., 2016]. Figure 1(c) presents an example where existing purification is applied to a benign case, leading to an incorrect re-ID result with reduced rank-1 accuracy by 14.11%p.

In addition, existing adversarial purification methods do not consider attack intensity appropriately. For instance, existing diffusion-based purification methods lack robustness to varying attack intensities because they use fixed-time steps. The problem of fixed-time steps is revealed in the second row of Figure 1(a and b), which show that DiffPure successfully purifies perturbed images with ϵ = 8 but fails to purify images properly with ϵ = 16. An optimal diffusion time step exists for purification, and Figure 1(d) indicates that this optimal time step varies depending on the attack intensity.

Another observation is that low- and mid-frequency coefficients are vulnerable to person re-ID attacks compared to high-frequency ones. Figure 1(e) demonstrates the rank-1 accuracy on the Market1501 dataset under person re-ID attack, as the attack scope progressively extends from high- to low-frequency coefficients. An 8×8 block discrete cosine transform (BDCT) isolates the frequency coefficients, and the experiment was conducted by replacing the original benign BDCT coefficients with their adversarial counterparts. While replacing 1 to 58 high-frequency BDCT coefficients with adversarial components has little influence on person re-ID performance, replacing the remaining six BDCT coefficients causes significant person re-ID performance degradation. This outcome suggests that the six lowest-frequency BDCT coefficients are vulnerable to the person re-ID attack. Building on these observations, we propose an attack intensity estimator that quantifies the adversarial attack intensity beyond mere detection. We further introduce an adversarial purification method that seamlessly integrates this estimator. To the best of our knowledge, IntensPure is the first adversarial purification method for re-ID systems. The proposed estimator assesses the attack intensity via identity (ID) stability and attribute inconsistency. This approach optimizes reID performance by selectively applying purification. Benign images remain intact, whereas perturbed images undergo tailored purification via adaptive time step adjustments in the diffusion process. In addition, we propose secondary domain adaptive diffusion, focusing on purifying the low- and mid-frequency coefficients that are strongly affected by person re-ID attacks. Thus, the spatial dimension is reduced by 64-fold, leading to significant computational cost savings. Further, leveraging the directional characteristics of BDCTbased secondary images, directional diffusion achieves effective purification. Our source code and appendix are available at https://github.com/st0421/IntensePure. We summarize the contributions below:

• We propose an attack intensity estimator by leveraging ID stability and attribute inconsistency by integrating an inner auxiliary network.
• We observe a meaningful correlation between the adversarial attack intensity and the optimal purification strength. We customize the diffusion time step to the estimated attack intensity to achieve optimal purification.
• We propose a secondary domain adaptive diffusion model. The diffusion process considers only a few secondary images; therefore, the computational complexity is reduced significantly compared to the existing methods while improving the re-ID accuracy.
• We propose two refinement strategies: an inter-block directional filter to enhance the inter-block correlation in the secondary domain and a perturbation constraint set to restrict excessive variations in pixel values.

2 RelatedWork

2.1 Adversarial Attack Detection

Adversarial attack detection [Feinman et al., 2017; Hendrycks and Gimpel, 2017; Kim et al., 2023; Liu et al., 2019; Wang et al., 2023; Yin et al., 2021] is an approach to distinguishing adversarial examples from benign ones. [Li et al., 2020] proposed using auto-encoders to identify inconsistencies among region proposals and detect adversarial attacks in object detection. Moreover, [Deng et al., 2021] introduced LiBRe, which is a task- and attack-agnostic adversarial example detector. [Zhang et al., 2023b] proposed EPS-AD, which performs adversarial detection based on a new statistic called the expected perturbation score. For re-ID, unlike other classification or detection tasks, the training and testing sets do not share the same categories. [Wang et al., 2021a] proposed MEAAD for detecting inconsistencies in context, using multiple re-ID networks with different structures. However, despite their capacity to identify the presence or absence of adversarial attacks, the estimation of attack intensities is limited.

2.2 Adversarial Attacks in Person Re-ID

Some studies have addressed attack methods to analyze the vulnerability to adversarial attack [Bouniot et al., 2020; Kang et al., 2023; Liu et al., 2023; Lu et al., 2023; Wang et al., 2021b; Wang et al., 2021c; Zhang et al., 2023a]. For the person re-ID attack, [Zheng et al., 2018a] presented an opposite-direction feature attack to manipulate features in reverse directions using adversarial gradients. Moreover, [Bai et al., 2020] introduced Metric-FGSM to maximize the metric distance between perturbed image features and reference features by extending classification attacks to re-ID attacks. [Wang et al., 2020] proposed deep mis-ranking, which disrupts person re-ID system rankings with a multi-stage network, displaying substantial success in black-box attacks. Recently, [Yang et al., 2022] introduced MetaAttack, combining combinatorial adversarial attacks and meta-learning to improve attack universality. Furthermore, [Sun et al., 2024] proposed a backdoor attack for person re-ID models, using dynamic triggers to change target identities, proving effective in open-set scenarios. Adversarial queries are sufficient to deceive the re-ID system and relatively cheap to generate [Zheng et al., 2018a]. Although it is possible to attack the gallery set, it is generally much larger and more time-consuming to attack, making adversarial queries a more practical option [Wang et al., 2021a]. Therefore, we focus on query image manipulation attacks in a white-box setting, where the attacker has full knowledge of the re-ID model.

2.3 Adversarial Defense

Adversarial Training. Adversarial attacks cause a significant security problem because they can induce unwanted behavior in deep learning models, drawing considerable attention to defense methods. Adversarial training [Gowal et al., 2020; Kang et al., 2021; Madry et al., 2018] is a powerful countermeasure against such attacks. [Yu et al., 2022] introduced the loss stationary condition for controlled weight perturbation, enhancing its robustness by avoiding excessive perturbations. Additionally, [Gong et al., 2022] introduced a color-based local transformation attack and a joint adversarial defense, improving the re-ID model robustness across domains. However, as [Bai et al., 2021] indicated, adversarial training has a trade-off between robustness and generalization and still struggles to counter unseen attacks effectively.

Adversarial Purification. As a counterpart to adversarial training, adversarial purification methods [Samangouei et al., 2018; Song et al., 2018; Yang et al., 2024] have demonstrated robustness against unseen attacks. [Du and Mordatch, 2019] and [Grathwohl et al., 2020] demonstrated the effectiveness of energy-based models trained with Markov chain Monte Carlo methods in purifying adversarial examples. Moreover, [Hill et al., 2021] presented the robustness of long-run Markov chain Monte Carlo methods with energybased models for the purification of perturbed images, using Langevin dynamics to enhance the robustness and efficacy. Similarly, [Yoon et al., 2021] used the denoising score-based model for purification. In recent work [Ankile et al., 2023; Shi et al., 2023; Sun et al., 2023; Wu et al., 2022; Xiao et al., 2023], diffusion models have been considered for purification. Specifically, [Nie et al., 2022] optimized the computations for solving reverse-time stochastic differential equations using the adjoint sensitivity method. Moreover, [Carlini et al., 2023] introduced a diffusion-denoised smoothing method to achieve adversarial robustness and efficiency. Moreover, [Lee and Kim, 2023] proposed a robustness measurement guideline and introduced an improved purification strategy with a gradual noise-scheduling technique. Despite advancements in adversarial purification methods, they did not adaptively purify perturbed images based on the intensity of attacks, often leading to unnecessary or insufficient purification efforts.

3 ProposedMethod

3.1 Overview

As depicted in Figure 2, we propose IntensPure, an adversarial purification method that adaptively purifies perturbed images using attack intensity estimation and secondary domain adaptive diffusion. IntensPure estimates the attack intensity using ID stability and attribute inconsistency. This method determines the optimal diffusion time step and generates secondary images by aggregating the six lowest-frequency BDCT coefficients. This secondary domain purification focuses on low- and mid-frequency coefficients, which are particularly vulnerable to person re-ID attacks. Further, employing directional diffusion leverages the BDCT coefficient directional characteristics. Inter-block directional filtering is employed to improve the diffusion process further, enhancing inter-block correlations within the secondary image. Once the diffusion process is complete, the secondary images revert to its original spatial domain. Overpurification is restrained through the perturbation constraint set to ensure the robustness of the ID feature extractor against adversarial attacks.

3.2 Attack Intensity Estimation

Inspired by the basis that inner models that do not output to users are undetectable to attackers [Wang et al., 2021a], we leveraged an auxiliary task model that acts as an undetectable inner model that is robust to primary task attacks. Figure 3(a) presents the accuracy of ResNet50 for attribute recognition (auxiliary task: ⋆) and person re-ID (primary task: ·) under re-ID attacks (Metric-FGSM, Deep-Mis-Ranking, and MetaAttack) with varying intensity. Both primary and auxiliary models are on the same network, but the rank-1 accuracy decreased significantly due to the re-ID attack, whereas the attribute recognition results were virtually unaffected. This empirical study supports the validity of auxiliary task models that are insensitive to primary task attacks. Accordingly, we estimate the person re-ID attack intensity by leveraging attacked retrieval results and the results from attribute recognition as an auxiliary task.

Additionally, the re-ID attack causes a retrieval system to return images irrelevant to the query in the top ranking list [Li et al., 2019]. As a secondary effect, the consistency between retrieval results is compromised. In addition, re-ID attacks can also affect the consistency of the bottom retrieval results because the retrieval process relies on similarity metrics. Therefore, we extract features from not only the top 10 retrieval results but also the bottom 10 retrieval results to estimate the attack intensity. In Appendix A, we provide the inconsistent retrieval results due to person re-ID attacks and the analysis of the effectiveness of the bottom list.

ID Stability. We define ID stability with a dimension of 1×100 as a concatenated set of SIMtop, SIMbottom, and SIMQ-R1, containing cosine similarities between embedded vectors extracted by ID feature extractors. The SIMtop represents the cosine similarities between the top 10 retrieval results themselves and is obtained as follows:

where Fi and Fj are embedding vectors of the rank-i and rank-j images selected from the top 10 retrieval results in the gallery. The middle dot symbol represents the inner product, employed for cosine similarity calculation. In addition, {·}Top10 denotes a set of 10 retrieval result features that have the highest cosine similarity to the query feature. Similarly, the SIMbottom can be obtained from the same operation with Equation 1, replacing the top 10 with the bottom 10. Then, the dimensions of both SIMtop and SIMbottom are 1×45. The SIMQ-R with a dimension of 1×10 is obtained as follows:

where FQ and FR represent the embedding vectors of the query image and the top 10 retrieval results.

The ID stability sum in Figure 3(b) is the sum of 100 elements (SIMtop, SIMbottom, and SIMQ-R1) that make up ID stability for observing the correlation between ID stability and the attack intensity. Figure 3(b) demonstrates the monotonic decline of ID stability sum in response to increasing attack intensity, suggesting the potential for estimating the attack intensity based on ID stability.

Attribute Inconsistency. We define attribute inconsistency with a dimension of 1×3N as a merged set of INCONtop, INCONbottom, and INCONQ-R1, containing absolute errors between attribute recognition results. The N is the number of the person attribute classes provided by [Lin et al., 2019]. Concretely, INCONtop with a dimension of 1×N denotes absolute errors between the attribute recognition results of the query image and the mean of the attribute recognition results of the top 10 retrieval results and is obtained as follows:

where Attr(I) represents the results of the attribute recognition for image I. The IQ denotes the query image and It denotes the top 10 retrieval results. Similarly, the INCONbottom can be obtained from the same operation with Equation 3 using the bottom 10 retrieval results instead of It. Then, the dimensions of both INCONtop and INCONbottom are 1×N. The analysis of the number of retrieval results is provided in Appendix B. Further, INCONQ-R1 with a dimension of 1×N consists of absolute errors between the attribute recognition results of IQ and them of rank-1 image. The attribute inconsistency sum in Figure 3(c) is the sum of 3N elements that make up attribute inconsistency to examine the relationship between attribute inconsistency and attack intensity. Figure 3(c) depicts the steady increase in attribute inconsistency sum as the attack intensity escalates. The monotonic nature of this increase implies the potential of attribute inconsistency as a tool for attack intensity estimation.

Implementation of Estimator. Figure 4 illustrates the estimator framework, exploiting a pre-built gallery memory bank. The gallery memory bank is a key-value store where keys (K) are image ID features and values (V ) are attribute recognition results. The estimator extracts the ID feature of an input image as a query (Q) and maps it to the 10 most and least similar keys in the memory bank. Using this mapping, the estimator obtains ID stability and attribute inconsistency, and concatenates them. Finally, a multi-layer perceptron regression model uses these information to estimate the attack intensity. The regression model is implemented with two hidden layers with 512 and 256 nodes, respectively. Rectified linear unit functions are applied after each hidden layer.

3.3 Secondary Image Generation

As depicted in the upper left part of Figure 2, IntensPure conducts an 8×8 BDCT on the input image with a dimension of H×W×C. For each patch, the six lowest frequency coefficients, including DC, are extracted, and the coefficients are aggregated into six secondary images with a dimension of H8 × W8 ×6C. After the secondary image generation process, the input dimensions are reduced to 6/64-fold (≃0.093) compared to the initial input dimensions. Through this, the computational complexity of IntensPure is significantly reduced compared to the conventional diffusion method.

3.4 Secondary Domain Adaptive Diffusion

Optimal Time Step Determination. For the diffusion process, Figure 5 indicates the variation of empirically selected time steps optimal for purifying according to the attack intensities. For each attack method employed in the experiments, the graphs illustrating the optimal time step for the most effective diffusion-based purification have consistent logarithmic trends across attack intensities. Therefore, we fit a logarithmic curve that can cover the variations in Figure 5 using SciPy [Virtanen et al., 2020]. The prominent red curve in the figure indicates the fitted curve. Then, IntensPure determines the approximately optimal time step t∗ using the formula derived from the fitted curve and the estimated attack intensity.

Secondary Domain Diffusion. Figure 6 illustrates the secondary domain adaptive diffusion process with a determined time step t∗ . IntensPure operates in the frequency domain on secondary images with dimensions of H8 × W8 ×6C. IntensPure addresses the six lowest frequency coefficients from DC to AC5, which are vulnerable to re-ID attacks, excluding the other high-frequency coefficients. Experiments exploring the influence of BDCT coefficient counts are presented in Appendix C. Additionally, IntensPure uses secondary image directional characteristics in the diffusion process to address coefficients adaptively according to the isotropic, vertical, and horizontal diffusion processes. Specifically, IntensPure performs forward and reverse processes in a direction parallel to each coefficient during t∗ . For DC and AC4 coefficients, IntensPure employs an isotropic diffusion process with 3×3 convolutional layers, considering all directions within the kernel. For AC1 and AC5 coefficients with vertical directions, IntensPure employs a vertical diffusion process with

3×1 convolutional layers. For AC2 and AC3 coefficients with horizontal directions, 1×3 convolutional layers are employed. These directional layers enable the effective detection of perturbations along vertical or horizontal directions, facilitating the efficient purification of perturbations.

Inter-block Directional Filter. As depicted on the right in Figure 6, the inter-block directional filters are employed after the diffusion process to achieve two goals: removing remaining perturbations and enhancing inter-block correlation. This approach employs distinct directional filters for DC and AC coefficients, optimized to address their specific directional characteristics. These filters are defined as follows:

where D′ denotes filtered coefficients, while D denotes input coefficients. Further, p represents the pixel index, and Ω is the set of pixels pi in a window. The window size is set to 5×5 for isotropic filtering, 5×1 for vertical filtering, and 1×5 for horizontal filtering, corresponding to the respective directions. Moreover, W is the normalization term, and Gσr and Gσs denote the range and spatial Gaussian functions, respectively, with σr and σs as their standard deviations (set to 0.15 and 3.0). The investigation of inter-block filter size and σ values is presented in Appendix D.

3.5 Spatial Image Reconstruction

In the bottom-right of Figure 2, the spatial image reconstruction involves the transformation process from the secondary domain to the original spatial domain, following the diffusion. Following an arrangement of purified secondary images into their designated coefficient positions on zero-padded 8×8 blocks, an inverse BDCT process is applied. Through this process, the image is reconstructed to its original dimensions of H×W×C. Inadvertently, the reconstructed image can lose essential details or experience excessive variation in pixel level due to the diffusion process. We introduce a perturbation constraint set restricting pixel variations more than the attack intensity to address this problem. This perturbation constraint set is defined as follows:

where O denotes the image purified from diffusion, I denotes the input image, and ˆ ϵ represents the estimated attack intensity. The image is effectively purified while maintaining image integrity without excessive alterations via the perturbation constraint set. Moreover, when ˆ ϵ equals 0, it maintains the initial state of the input image.

4 Experiments

4.1 Experimental Setup

Datasets and Person Re-ID Network. For the experiments, we used two real-world datasets: Market1501 [Zheng et al., 2015] and DukeMTMC-reID [Ristani et al., 2016]. Market1501 includes 32,668 images of 1,501 identities. In addition, 750 IDs are labeled for the training set, and 751 IDs are labeled for the testing set. The DukeMTMC-reID set consists of 36,411 images of 1,404 identities, with 702 IDs used for both the training and testing sets. For person reID performance evaluation, we leveraged the ResNet50 [He et al., 2016] architecture and pre-trained weights provided by [Zheng et al., 2018b] for fair comparisons.

Adversarial Attacks. To evaluate the performance of IntensPure against a variety of person re-ID attack methods, we applied Metric-FGSM [Bai et al., 2020], Deep MisRanking [Wang et al., 2020], and MetaAttack [Yang et al., 2022] on the Market1501 and DukeMTMC-reID datasets. To demonstrate the superiority of the proposed method, we considered various attack intensities, ranging from ϵ = 0 to 16.

Evaluation Metrics. We evaluated the attack intensity estimator using the area under the receiver operating characteristic (AUROC) and classification accuracy for adversarial detection comparison and the mean absolute error (MAE) for attack intensity estimation. In addition, we considered rank-1 accuracy to assess the overall performance of IntensPure.

4.2 Implementation Details

Attack Intensity Estimator. The attack intensity estimator uses an ID feature extractor and an attribute recognition network as the inner networks. The ID feature extractor shares the weight with the re-ID model, and the attribute recognition model uses pre-trained weights, as provided by [Lin et al., 2019]. For training the estimator, the training set is selected in the same way as by [Wang et al., 2021a], perturbing query samples in the training set with only Metric-FGSM and Deep Mis-Ranking with attack intensities from ϵ = 0 to 16. We extracted the ID stability and attribute inconsistency from the samples, and the attack intensity is designated as a label.

Secondary Domain Adaptive Diffusion. We adopted the U-Net architecture used in Palette [Saharia et al., 2022]. For the experiments, we set the total time steps to 1,000. The initial and final values of the linear noise schedule are set to 1e-6 and 9e-2, respectively. The training process encompassed 700 epochs, with a learning rate of 1e-4. The IntensPure network was trained on a single A100 GPU.

4.3 Comparison of Person Re-IDAttack Detection

First, we compared the estimator to previous studies in terms of adversarial detection because no previous studies exist on estimating the attack intensity. We transformed the estimator into a detector by distinguishing between 0 and non-zero outcomes of the rounded estimated result.

We compared the adversarial detection performance with three state-of-the-art detection methods: LiBRe [Deng et al., 2021], MEAAD [Wang et al., 2021a], and EPS-AD [Zhang et al., 2023b]. These methods do not require additional modifications to be used with person re-ID attack detection. In addition, LiBRe and EPS-AD are only evaluated using AUROC, making it challenging to determine their exact accuracy and adjust the network for attack intensity estimation.

Table 1 presents a comparative analysis of adversarial detection methods. It shows accuracy and AUROC under the proposed default attack intensity ϵ values for Metric-FGSM, Deep Mis-Ranking, and MetaAttack. Across the three evaluated person re-ID attacks, the proposed detector consistently demonstrated superior performance in terms of accuracy and AUROC values. Notably, the MetaAttack is an unseen attack method that was not included in the training data. This result highlights the effectiveness of the detector for unseen threats.

To evaluate the performance of attack intensity estimation, we converted MEAAD to an estimator and compared it to the proposed estimator after learning under the same conditions. Table 2 indicates that the proposed estimator outperforms MEAAD in terms of MAE for all three attacks. The results demonstrate that ID stability and attribute inconsistency are more effective than the context feature proposed by MEAAD for attack detection and intensity estimation.

4.4 Comparison of Adversarial Purification

Table 3 compares the rank-1 accuracy of existing purification methods on the Market1501 dataset. The results were evaluated against adversarial attacks: Metric-FGSM, Deep Mis-Ranking, and MetaAttack, each with ϵ values (0, 4, 8, 12, and 16) to represent the attack intensity. For comparison with existing purification methods, the default settings were applied based on each paper. The table reveals that our IntensPure consistently outperforms other purification methods in all cases and is the most effective against adversarial attacks while maintaining its performance on benign examples (ϵ = 0). As the attack intensity increases, the re-ID accuracy of the ResNet50 re-ID model decreases, and this trend continues even after purification. This is because the purification strength is insufficient to remove stronger perturbations. IntensPure adaptively increases the purification strength, but it also shows a similar trend of decline due to the trade-off of losing benign information. However, our IntensPure is superior because, the rate of decline is much more gradual compared to other purification models when attack intensity increases from ϵ = 0 to 16.

Table 4 presents a comparison of rank-1 accuracy on the DukeMTMC-ReID dataset in the same setting as Table 3 to evaluate the robustness and effectiveness of the defense methods. IntensPure demonstrates outstanding performance against various adversarial attacks, with a consistent rank-1 accuracy across ϵ values. These results exhibit a reliable ability to respond to diverse adversarial environments and variations in attack intensity effectively.

Table 5 compares the complexity of diffusion-based purification models and IntensPure in terms of the FLOPs, parameters, and inference time on the Market1501 dataset. To ensure a fair comparison, we evaluated comparison models using their respective default settings with a single diffusion time step. While IntensPure exhibits a higher parameter count than its counterparts due to the separated directional diffusion networks, it achieves a marked reduction in inference time and FLOPs by leveraging only a few BDCT coefficients instead of the complete set. Furthermore, the proposed estimator operates only once regardless of the diffusion time step and is remarkable in all types of complexity, making it more practical for real-world applications.

4.5 Ablation Study

Table 6 presents the analysis of the individual contributions of each IntensPure component to the overall rank-1 accuracy on the Market1501 dataset, attacked by Metric-FGSM with various ϵ values (0, 4, 8, 12, and 16). Each row represents a distinct framework configuration, incrementally activating modules following the IntensPure procedure to isolate their respective effects on rank-1 accuracy.

The first row establishes a baseline with no activated modules and a time step t=150, which is the default setting of DiffPure. The activation of the attack intensity estimation module yields notable performance improvements, showing its crucial role in adaptive purification tailored to attack intensity. Subsequently, the secondary image generation module leads to a performance increase, presenting its individual effectiveness. Furthermore, the directional diffusion module assists in a slight increase in re-ID accuracy. Finally, the inter-block directional filter and the perturbation constraint set provide incremental yet valuable improvements. These results demonstrate that each of the suggested modules plays a role in enhancing the overall performance. Appendix E presents an ablation study that removes one module at a time to demonstrate the individual effect of each module.

5 Conclusion

This paper addresses the limitations of existing adversarial purification methods, such as their high computational cost and inflexible purification strength, by proposing IntensPure. The proposed method introduces the attack intensity-aware adaptive diffusion model, incorporating a network that estimates attack intensity using ID stability and attribute inconsistency. IntensPure efficiently operates by adjusting the purification strength and using the secondary domain to focus on a few low- and mid-frequencies vulnerable to adversarial attacks. Additionally, we introduce two refinement strategies, including inter-block directional filtering to enhance the interblock correlation and a perturbation constraint set to preserve the benign information. Consequently, IntensPure performs computationally efficiently and achieves state-of-the-art reID performance against adversarial attacks.

Acknowledgments

This work was supported by the Industrial Fundamental Technology Development Program (No. 20018699) funded by MOTIE of Korea and the IITP grant funded by the Korea government (MSIT) (No.2021-0-02068, RS-2023-00256629, RS-2022-00156287).

Contribution Statement

Eun-Gi Lee, Moon Seok Lee, and Jae Hyun Yoon contributed equally to this work.