Recent text-to-image diffusion models have shown significant advancements in high-quality image synthesis. Represented by Stable Diffusion, these models have been applied in various fields, such as art design, digital development, personalization, etc. However, they still fail to generate images that properly comply with the given text prompts, especially when encountering multiple subjects. Current approaches for multi-subject synthesis focus on latent code optimization at specific timesteps,yet yielding compromised text-image alignment. In this paper, we explore the generation of diffusion models through the lens of both noise initialization and denoising process, and propose an effective two-stage Attention Refinement and Inheritance (ARI) approach. Firstly, we update the initial noise by refining the cross-attention maps between different subject tokens, employing strategies of separation, energization, and centralization. Then, we introduce attention-level interpolation as an inheritancemechanism to explicitly regulate the denoising process. This enables the image generation to maintain high correspondence with the refined initial attention, thereby achieving a more controllable synthesis. Extensive experiments show that our approach achieves more faithful alignment between generated images and text prompts compared with state-of-the-art multi-subject image synthesis methods.

In recent years, the study on defending deep hashing models against adversarial attacks has garnered increasing attention. Among them, adversarial training is an effective method to train robust deep hashing models. Existing adversarial training methods for deep hashing simultaneously optimize original deep hashing loss and proposed adversarial training loss to train a robust model. However, we argue that directly using the original deep hashing loss will guide the model to learn excessive non-robust patterns from clean examples when extracting discriminative semantic information, thereby limiting model robustness. To tackle this, we propose a novel Clean model Representation Distillation based Adversarial Training (CRDAT) method, which enables the robust model to learn both discriminative semantic information and robust patterns by separating these two losses into two stages, i.e., standard training stage of a clean teacher model and adversarial training stage of a robust student model. Specifically, we propose a novel representation distillation based adversarial training loss, which distills the representations of the teacher model on clean examples at both the hash code level and feature level to guide the student model's learning on adversarial examples. Extensive experiments on multiple datasets and deep hashing methods demonstrate that our CRDAT method can greatly improve model robustness and achieve state-of-the-art defense performance.

Although image-dependent adversarial attacks have been studied, the more challenging image-agnostic adversarial attack for deep hashing remains an unexplored territory. In this paper, we take the first attempt on the more efficient and malicious targeted universal adversarial attack (TUAA) for deep hashing. When previous image-dependent attacks are directly applied to TUAA task, they usually face two main issues. Firstly, existing anchor code generation methods generate anchor code with inferior representative semantic-preserving ability. Secondly, previous methods simply minimize the distance between hash codes and anchor code in Hamming space, which tends to optimize targeted universal adversarial perturbation (TUAP) in a coarse-grained manner. To tackle the above problems, we propose a Semantic-enhanced and Stabilized Targeted Universal Adversarial Attack (SS-TUAA) method. Specifically, we first propose a new Candidate Anchor code Evaluation (CAE) method to generate anchor code with superior semantic-preserving ability. Then, to enhance the ‘dominant role’ and the stability of TUAP, we propose a Feature Consistency Loss (FCL) to align the fine-grained feature representation between TUAP and adversarial examples. Extensive experiments demonstrate the effectiveness of each component within our SS-TUAA method, and our method can achieve the state-of-the-art TUAA performance for deep hashing.

With the extensive utilization of deep hashing, there exists a surging interest in studying adversarial attacks against it. Previous methods have demonstrated the superior white-box attack performance against deep hashing. However, the more challenging and realistic targeted black-box attack has not yet been explored sufficiently, which will result in an over-estimation on model robustness. In this paper, we focus on targeted black-box attack based on transferability, and propose a novel Targeted Transferable Attack method against deep hashing with Generative Adversarial Network (TTA-GAN). Specifically, we first propose a new Iterative Anchor code Optimization (IAO) method to generate anchor code with superior representative semantics of target label, which can improve both targeted white-box and black-box performances. Then, we propose a generation-based method to directly generate targeted transferable adversarial example by training a conditional generator and a discriminator. Moreover, to further promote the targeted transferability, we conduct multiple input transformations on the generated adversarial example to alleviate the overfitting phenomenon on source model. Finally, we extend our method to a novel model ensemble attack method TTA-GANens to preserve the representative semantics on multiple models, specialized for deep hashing. Extensive experiments demonstrate the superior targeted black-box attack performance than the state-of-the-art methods.

Person re-identification (ReID) aims at retrieving images of the same person across non-overlapping camera views. The prior works focus on either fully supervised or unsupervised ReID settings, and achieve remarkable performances. In real scenarios, however, the major annotation cost comes from matching identity classes across camera views, thus leading to the Intra-Camera Supervised (ICS) ReID problem. In this work, we propose a Prototype-based Inter-camera ReID (PIRID) method, which tackles the ICS setting through the lens of prototype learning. Specifically, we first introduce the intra-camera learning with non-parametric classifiers to separately generate discriminative features within each camera view. Moreover, the inter-camera prototype learning provides prototypes as the representatives of each class in the common space, making the learned features to be camera-agnostic. Experiments conducted on three benchmarks, i.e., Market-1501, DukeMTMC-ReID, and MSMT17, show the superiority of our method.

Person Re-IDentification (ReID) aims at retrieving images of the same person across multiple camera views. Despite its popularity in surveillance and public safety, the leakage of identity information is still at risk. For example, once obtaining the illegal access to ReID systems, malicious user can accurately retrieve the target person, leading to the exposure of private information. Recently, some pioneering works protect private images with adversarial examples by adding imperceptible perturbations to target images. However, in this paper, we argue that directly applying adversary-based methods to protect the ReID system is sub-optimal due to the 'overlap identity' issue. Specifically, merely pushing the adversarial image away from its original label would probably make it move into the vicinity of other identities. This leads to the potential risk of being retrieved when querying with all the other identities exhaustively. We thus propose a novel preemptive-Protection person Re-IDentification (PRIDE) method. By explicitly constraining the adversarial image to an isolated location, the target person is far away from neither the original identity nor any other identities, which protects him from being retrieved by illegal queries. Moreover, we further propose two crucial attack scenarios (Random Attack and Order Attack) and a novel Success Protection Rate (SPR) metric to quantify the protection ability. Experiments show consistent outperformance of our method over other baselines across different ReID models, datasets and attack scenarios.