Generative Adversarial Perturbations with Cross-paradigm Transferability on Localized Crowd Counting

2026-03-25

AI Summary

Existing adversarial attacks struggle to transfer effectively between the two dominant crowd counting paradigms—density map regression and point regression—and lack a unified framework for evaluating cross-paradigm robustness. This work proposes a novel generative adversarial perturbation framework that, for the first time, enables transferable attacks across both paradigms through multi-task loss optimization. The approach introduces scene-density-specific high-confidence logit suppression and peak-directed density map suppression strategies, combined with model-agnostic perceptual constraints to ensure visual imperceptibility of perturbations. Experiments demonstrate that the method degrades the performance of seven state-of-the-art models by increasing their mean absolute error by an average factor of seven, achieving transferability ratios ranging from 0.55 to 1.69 while preserving visual quality.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Multiagent Systems: Adversarial Agents

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Security and Privacy: Large-scale security measurements

Abstract

State-of-the-art crowd counting and localization are primarily modeled using two paradigms: density maps and point regression. Given the field's security ramifications, there is active interest in model robustness against adversarial attacks. Recent studies have demonstrated transferability across density-map-based approaches via adversarial patches, but cross-paradigm attacks (i.e., across both density map-based models and point regression-based models) remain unexplored. We introduce a novel adversarial framework that compromises both density map and point regression architectural paradigms through a comprehensive multi-task loss optimization. For point-regression models, we employ scene-density-specific high-confidence logit suppression; for density-map approaches, we use peak-targeted density map suppression. Both are combined with model-agnostic perceptual constraints to ensure that perturbations are effective and imperceptible to the human eye. Extensive experiments demonstrate the effectiveness of our attack, achieving on average a 7X increase in Mean Absolute Error compared to clean images while maintaining competitive visual quality, and successfully transferring across seven state-of-the-art crowd models with transfer ratios ranging from 0.55 to 1.69. Our approach strikes a balance between attack effectiveness and imperceptibility compared to state-of-the-art transferable attack strategies. The source code is available at https://github.com/simurgh7/CrowdGen

Problem

• adversarial attacks
• crowd counting
• cross-paradigm transferability
• density map
• point regression

Innovation

• cross-paradigm transferability
• generative adversarial perturbations
• crowd counting
• density map suppression
• point regression attack