Abstract
Gait recognition is a non-intrusive method that captures unique walking patterns without subject cooperation, which has emerged as a promising technique across various fields. Recent studies based on Deep Neural Networks (DNNs) have notably improved the performance, however, the potential vulnerability inherent in DNNs and their resistance to interference in practical gait recognition systems remain under-explored. To fill the gap, in this paper, we focus on imperceptible adversarial attack for deep gait recognition and propose an edge-oriented attack strategy tailored for silhouette-based approaches. Specifically, we make a pioneering attempt to explore the intrinsic characteristics of binary silhouettes, with a primary focus on injecting noise perturbations into the edge area. This simple yet effective solution enables sparse attack in both the spatial and temporal dimensions, which largely ensures imperceptibility and simultaneously achieves high success rate. In particular, our solution is built on a unified framework, allowing seamless switching between untargeted and targeted attack modes. Extensive experiments conducted on in-the-lab and in-the-wild benchmarks validate the effectiveness of our attack strategy and emphasize the necessity to study adversarial attack and defense strategy in the near future.
This is a preview of subscription content, log in via an institution to check access.
Similar content being viewed by others
Data Availability
The data that support the findings of this study are available from CASIA-B4, OUMVLP5 Gait3D6 and GREW7, upon reasonable request.
Notes
We asked the volunteers to check whether the imperceptibility is acceptable. The group consists of ten volunteers where one half are researchers who are familiar with gait recognition and the other half are recruited from other majors rather than computer science. We ask the volunteers to check whether the generated silhouettes for adversarial attack are significantly altered compared to the raw input.
GaitBase3D is implemented by replacing 2D convolution of GaitBase with 3D convolution (Fan et al., 2023b)
The sequence-based GaitPart and GaitGL rely on the continuous frames for temporal modeling, as a result, it is infeasible to transform them into GEI-based methods that squeeze the temporal dimension in the input phase.
References
An, W., Yu, S., Makihara, Y., Wu, X., Xu, C., Yu, Y., Liao, R., & Yagi, Y. (2020). Performance evaluation of model-based gait on multi-view very large population database with pose sequences. IEEE Transactions on Biometrics, Behavior, and Identity Science, 2(4), 421–430. https://doi.org/10.1109/TBIOM.2020.3008862
Arnab, A., Miksik, O., & Torr, P. H. (2018). On the robustness of semantic segmentation models to adversarial attacks. in Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 888–897.
Bai, S., Li, Y., Zhou, Y., Li, Q., & Torr, P. H. (2020). Adversarial metric attack and defense for person re-identification. IEEE Transactions on Pattern Analysis and Machine Intelligence, 43(6), 2119–2126. https://doi.org/10.1109/TPAMI.2020.3031625
Brendel, W., Rauber, J., & Bethge, M. (2017). Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. arXiv preprint arXiv:1712.04248
Chakraborty, A., Alam, M., Dey, V., Chattopadhyay, A., & Mukhopadhyay, D. (2018). Adversarial attacks and defences: A survey. arXiv preprint arXiv:1810.00069
Chao, H., He, Y., Zhang, J., & Feng, J. (2019). GaitSet: Regarding gait as a set for cross-view gait recognition. in Proceedings of the AAAI conference on artificial intelligence, vol. 33, pp. 8126–8133. https://doi.org/10.1609/aaai.v33i01.33018126
Cui, Y., & Kang, Y. (2023). Multi-modal gait recognition via effective spatial-temporal feature fusion. in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 17949–17957.
Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., & Li, J. (2018). Boosting adversarial attacks with momentum. in Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 9185–9193.
Fan, C., Hou, S., Huang, Y., & Yu, S. (2023). Exploring deep models for practical gait recognition. arXiv preprint arXiv:2303.03301
Fan, C., Liang, J., Shen, C., Hou, S., Huang, Y., & Yu, S. (2023). OpenGait: Revisiting gait recognition towards better practicality. in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 9707–9716.
Fan, C., Ma, J., Jin, D., Shen, C., & Yu, S. (2024). SkeletonGait: Gait recognition using skeleton maps. in Proceedings of the AAAI conference on artificial intelligence, vol. 38, pp. 1662–1669. https://doi.org/10.1609/aaai.v38i2.27933
Fan, C., Peng, Y., Cao, C., Liu, X., Hou, S., Chi, J., Huang, Y., Li, Q., & He, Z. (2020). GaitPart: Temporal part-based model for gait recognition. in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 14225–14233.
Goldblum, M., Fowl, L., Feizi, S., & Goldstein, T. (2020). Adversarially robust distillation. in Proceedings of the AAAI conference on artificial intelligence, vol. 34, pp. 3996–4003. https://doi.org/10.1609/aaai.v34i04.5816
Goodfellow, I. J., Shlens, J., & Szegedy, C. (2015). Explaining and harnessing adversarial examples. in ICLR.
Han, J., & Bhanu, B. (2005). Individual recognition using gait energy image. IEEE Transactions on Pattern Analysis and Machine Intelligence, 28(2), 316–322. https://doi.org/10.1109/TPAMI.2006.38
Hendrik Metzen, J., Chaithanya Kumar, M., Brox, T., & Fischer, V. (2017). Universal adversarial perturbations against semantic image segmentation. in Proceedings of the IEEE international conference on computer vision, pp. 2755–2764.
He, Z., Wang, W., Dong, J., & Tan, T. (2023). Temporal sparse adversarial attack on sequence-based gait recognition. Pattern Recognition, 133, 109028. https://doi.org/10.1016/j.patcog.2022.109028
Hou, S., Cao, C., Liu, X., & Huang, Y. (2020). Gait lateral network: Learning discriminative and compact representations for gait recognition. in European conference on computer vision. https://doi.org/10.1007/978-3-030-58545-7_22
Hou, S., Fan, C., Cao, C., Liu, X., & Huang, Y. (2022). A comprehensive study on the evaluation of silhouette-based gait recognition. IEEE Transactions on Biometrics, Behavior, and Identity Science. https://doi.org/10.1109/TBIOM.2022.3216857
Hou, S., Liu, X., Cao, C., & Huang, Y. (2021). Set residual network for silhouette-based gait recognition. IEEE Transactions on Biometrics, Behavior, and Identity Science. https://doi.org/10.1109/TBIOM.2021.3074963
Hou, S., Liu, X., Cao, C., & Huang, Y. (2022). Gait quality aware network: Toward the interpretability of silhouette-based gait recognition. IEEE Transactions on Neural Networks and Learning Systems. https://doi.org/10.1109/TNNLS.2022.3154723
Huang, S., Papernot, N., Goodfellow, I., Duan, Y., & Abbeel, P. (2017). Adversarial attacks on neural network policies. arXiv preprint arXiv:1702.02284
Huang, Z., Xue, D., Shen, X., Tian, X., Li, H., Huang, J., & Hua, X. -S. (2021). 3d local convolutional neural networks for gait recognition. in Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 14920–14929.
Huang, X., Zhu, D., Wang, H., Wang, X., Yang, B., He, B., Liu, W., & Feng, B. (2021). Context-sensitive temporal feature learning for gait recognition. in Proceedings of the IEEE/CVF international conference on computer vision, pp. 12909–12918.
Jia, M., Yang, H., Huang, D., & Wang, Y. (2019). Attacking gait recognition systems via silhouette guided GANs. in Proceedings of the 27th ACM international conference on multimedia, pp. 638–646. https://doi.org/10.1145/3343031.3351018
Kingma, D. P., & Ba, J. (2014). Adam: A method for stochastic optimization. in ICLR.
Kos, J., Fischer, I., & Song, D. (2018). Adversarial examples for generative models. in IEEE security and privacy workshops, pp. 36–42. https://doi.org/10.1109/SPW.2018.00014
Kurakin, A., Goodfellow, I. J., & Bengio, S. (2016). Adversarial examples in the physical world. in Artificial intelligence safety and security, pp. 99–112.
Li, X., Makihara, Y., Xu, C., Yagi, Y., Yu, S., & Ren, M. (2020). End-to-end model-based gait recognition. in Proceedings of the Asian conference on computer vision.
Li, S., Zhu, S., Paul, S., Roy-Chowdhury, A., Song, C., Krishnamurthy, S., Swami, A., & Chan, K. S. (2020). Connecting the dots: Detecting adversarial perturbations using context inconsistency. in Computer vision–ECCV 2020: 16th European conference, pp. 396–413. https://doi.org/10.1007/978-3-030-58592-1_24
Liang, J., Fan, C., Hou, S., Shen, C., Huang, Y., & Yu, S. (2022). GaitEdge: Beyond plain end-to-end gait recognition for better practicality. in European conference on computer vision. https://doi.org/10.1007/978-3-031-20065-6_22
Liao, R., Yu, S., An, W., & Huang, Y. (2020). A model-based gait recognition method with body pose and human prior knowledge. Pattern Recognition, 98, 107069. https://doi.org/10.1016/j.patcog.2019.107069
Lin, Y. -C., Hong, Z. -W., Liao, Y. -H., Shih, M. -L., Liu, M. -Y., & Sun, M. (2017). Tactics of adversarial attack on deep reinforcement learning agents. arXiv preprint arXiv:1703.06748
Lin, B., Zhang, S., & Yu, X. (2021) Gait recognition via effective global-local feature representation and local temporal aggregation. in Proceedings of the IEEE/CVF international conference on computer vision, pp. 14648–14656.
Liu, Z., Zhao, Z., & Larson, M. (2019). Who’s afraid of adversarial queries? The impact of image modifications on content-based image retrieval. in Proceedings of the 2019 on international conference on multimedia retrieval, pp. 306–314. https://doi.org/10.1145/3323873.3325052
Li, N., & Zhao, X. (2022). A strong and robust skeleton-based gait recognition method with gait periodicity priors. IEEE Transactions on Multimedia. https://doi.org/10.1109/TMM.2022.3154609
Loper, M., Mahmood, N., Romero, J., Pons-Moll, G., & Black, M. J. (2015). SMPL: A skinned multi-person linear model. ACM Transactions on Graphics, 34(6), 1–16. https://doi.org/10.1145/2816795.2818013
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2018). Towards deep learning models resistant to adversarial attacks. in ICLR.
Maqsood, M., Yasmin, S., Gillani, S., Aadil, F., Mehmood, I., Rho, S., & Yeo, S.-S. (2023). An autonomous decision-making framework for gait recognition systems against adversarial attack using reinforcement learning. ISA Transactions, 132, 80–93. https://doi.org/10.1016/j.isatra.2022.11.016
Narodytska, N., & Kasiviswanathan, S. P. (2017). Simple black-box adversarial attacks on deep neural networks. in CVPR workshops, vol. 2, p. 2.
Papernot, N., McDaniel, P., Wu, X., Jha, S., & Swami, A. (2016). Distillation as a defense to adversarial perturbations against deep neural networks. in 2016 IEEE symposium on security and privacy (SP), pp. 582–597. https://doi.org/10.1109/SP.2016.41
Qi, C. R., Su, H., Mo, K., & Guibas, L. J. (2017). PointNet: Deep learning on point sets for 3d classification and segmentation. in Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 652–660.
Qi, C. R., Yi, L., Su, H., & Guibas, L. J. (2017). PointNet++: Deep hierarchical feature learning on point sets in a metric space. in NeurIPS, vol. 30.
Rony, J., Hafemann, L. G., Oliveira, L. S., Ayed, I. B., Sabourin, R., & Granger, E. (2019). Decoupling direction and norm for efficient gradient-based l2 adversarial attacks and defenses. in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 4322–4330.
Ruder, S. (2016). An overview of gradient descent optimization algorithms. arXiv preprint arXiv:1609.04747
Sepas-Moghaddam, A., & Etemad, A. (2021). Deep gait recognition: A survey. arXiv preprint arXiv:2102.09546
Shen, C., Fan, C., Wu, W., Wang, R., Huang, G. Q., & Yu, S. (2023). LidarGait: Benchmarking 3d gait recognition with point clouds. in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1054–1063.
Shen, C., Yu, S., Wang, J., Huang, G. Q., & Wang, L. (2022). A comprehensive survey on deep gait recognition: Algorithms, datasets and challenges. arXiv preprint arXiv:2206.13732
Soll, M., Hinz, T., Magg, S., & Wermter, S. (2019). Evaluating defensive distillation for defending text processing neural networks against adversarial examples. in International conference on artificial neural networks, pp. 685–696. https://doi.org/10.1007/978-3-030-30508-6_54
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013). Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199
Tabacof, P., Tavares, J., & Valle, E. (2016). Adversarial images for variational autoencoders. arXiv preprint arXiv:1612.00155
Takemura, N., Makihara, Y., Muramatsu, D., Echigo, T., & Yagi, Y. (2018). Multi-view large population gait dataset and its performance evaluation for cross-view gait recognition. IPSJ Transactions on Computer Vision and Applications, 10(1), 4. https://doi.org/10.1186/s41074-018-0039-6
Teepe, T., Gilg, J., Herzog, F., Hörmann, S., & Rigoll, G. (2022). Towards a deeper understanding of skeleton-based gait recognition. in CVPR workshop, pp. 1569–1577.
Teepe, T., Khan, A., Gilg, J., Herzog, F., Hörmann, S., & Rigoll, G. (2021). GaitGraph: Graph convolutional network for skeleton-based gait recognition. in 2021 IEEE international conference on image processing, pp. 2314–2318. https://doi.org/10.1109/ICIP42928.2021.9506717
Tolias, G., Radenovic, F., & Chum, O. (2019). Targeted mismatch adversarial attack: Query with a flower to retrieve the tower. in Proceedings of the IEEE/CVF international conference on computer vision, pp. 5037–5046.
Venkat, I., & De Wilde, P. (2011). Robust gait recognition by learning and exploiting sub-gait characteristics. International Journal of Computer Vision, 91, 7–23. https://doi.org/10.1007/s11263-010-0362-6
Wang, Y., Du, B., Shen, Y., Wu, K., Zhao, G., Sun, J., & Wen, H. (2019). EV-Gait: Event-based robust gait recognition using dynamic vision sensors. in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 6358–6367.
Wang, M., Guo, X., Lin, B., Yang, T., Zhu, Z., Li, L., Zhang, S., & Yu, X. (2023). Dygait: Exploiting dynamic representations for high-performance gait recognition. in Proceedings of the IEEE/CVF international conference on computer vision, pp. 13424–13433.
Xie, C., Wang, J., Zhang, Z., Zhou, Y., Xie, L., & Yuille, A. (2017). Adversarial examples for semantic segmentation and object detection. in Proceedings of the IEEE international conference on computer vision, pp. 1369–1378.
Yin, M., Li, S., Cai, Z., Song, C., Asif, M. S., Roy-Chowdhury, A. K., & Krishnamurthy, S. V. (2021). Exploiting multi-object relationships for detecting adversarial attacks in complex scenes. in Proceedings of the IEEE/CVF international conference on computer vision, pp. 7858–7867.
Yin, M., Li, S., Song, C., Asif, M. S., Roy-Chowdhury, A. K., & Krishnamurthy, S. V. (2022). ADC: Adversarial attacks against object detection that evade context consistency checks. in Proceedings of the IEEE/CVF winter conference on applications of computer vision, pp. 3278–3287.
Yu, S., Tan, D., & Tan, T. (2006). A framework for evaluating the effect of view angle, clothing and carrying condition on gait recognition. ICPR, 4, 441–444. https://doi.org/10.1109/ICPR.2006.67
Zheng, T., Chen, C., Yuan, J., Li, B., & Ren, K. (2019). Pointcloud saliency maps. in Proceedings of the IEEE/CVF international conference on computer vision, pp. 1598–1606.
Zheng, J., Liu, X., Liu, W., He, L., Yan, C., & Mei, T. (2022). Gait recognition in the wild with dense 3d representations and a benchmark. in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 20228–20237.
Zheng, Z., Zheng, L., Hu, Z., & Yang, Y. (2018). Open set adversarial examples. arXiv preprint arXiv:1809.02681
Zhu, Z., Guo, X., Yang, T., Huang, J., Deng, J., Huang, G., Du, D., Lu, J., & Zhou, J. (2021). Gait recognition in the wild: A benchmark. in Proceedings of the IEEE/CVF international conference on computer vision, pp. 14789–14799.
Acknowledgements
This work is jointly supported by National Natural Science Foundation of China (62276031, 62276025, 62206022), Beijing Municipal Science & Technology Commission (Z231100007423015) and Shenzhen Technology Plan Program (KQTD20170331093217368). The authors have no conflict of interest to declare that are relevant to the content of this article.
Author information
Authors and Affiliations
Corresponding authors
Additional information
Communicated by Segio Escalera.
Publisher's Note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Rights and permissions
Springer Nature or its licensor (e.g. a society or other partner) holds exclusive rights to this article under a publishing agreement with the author(s) or other rightsholder(s); author self-archiving of the accepted manuscript version of this article is solely governed by the terms of such publishing agreement and applicable law.
About this article
Cite this article
Hou, S., Wang, Z., Zhang, M. et al. Edge-Oriented Adversarial Attack for Deep Gait Recognition. Int J Comput Vis 133, 1549–1563 (2025). https://doi.org/10.1007/s11263-024-02225-1
Received:
Accepted:
Published:
Version of record:
Issue date:
DOI: https://doi.org/10.1007/s11263-024-02225-1