Generative Adversarial Perturbations with Cross-paradigm Transferability on Localized Crowd Counting

Alabi Mehzabin Anisha; Guangjing Wang; Sriram Chellappan

cs.CVMar 25, 2026

Generative Adversarial Perturbations with Cross-paradigm Transferability on Localized Crowd Counting

Authors: Alabi Mehzabin Anisha, Guangjing Wang, Sriram Chellappan

Organizations: University of South Florida, Tampa, Florida, USA

Abstract

State-of-the-art crowd counting and localization are primarily modeled using two paradigms: density maps and point regression. Given the field's security ramifications, there is active interest in model robustness against adversarial attacks. Recent studies have demonstrated transferability across density-map-based approaches via adversarial patches, but cross-paradigm attacks (i.e., across both density map-based models and point regression-based models) remain unexplored. We introduce a novel adversarial framework that compromises both density map and point regression architectural paradigms through a comprehensive multi-task loss optimization. For point-regression models, we employ scene-density-specific high-confidence logit suppression; for density-map approaches, we use peak-targeted density map suppression. Both are combined with model-agnostic perceptual constraints to ensure that perturbations are effective and imperceptible to the human eye. Extensive experiments demonstrate the effectiveness of our attack, achieving on average a 7X increase in Mean Absolute Error compared to clean images while maintaining competitive visual quality, and successfully transferring across seven state-of-the-art crowd models with transfer ratios ranging from 0.55 to 1.69. Our approach strikes a balance between attack effectiveness and imperceptibility compared to state-of-the-art transferable attack strategies. The source code is available at https://github.com/simurgh7/CrowdGen

Figures & tables

Panel of Figure 1 — Figure 1: Localized crowded counting predictions and density maps in clean and adversarial images designed in our work.

Figure 2: (i) Perturbation loss (GradCAM Perturbation & Frequency-Magnitude Reduction) in Sec. 3.3.3 , and (ii) Paradigm-specific losses (Density & Logit suppression) in Secs. 3.3.1 and 3.3.2 are proposed for training the perturbation generator $G_{\theta}$ .

Panel of Figure 3 — Figure 3: Sample adversarial image comparison with our method with respect to state-of-the-art models

Source Model	Target Model
Source Model	SASNet	P2PNet	FIDTM	PET	HMoDE	APGCC	Gramformer
SASNet [ 32 ]	300.82/1.0	420.17/1.40	338.67/1.13	364.59/1.21	249.61/0.83	397.96/1.32	257.54/0.86
P2PNet [ 31 ]	281.00/0.89	316.58/1.0	268.90/0.85	255.61/0.81	189.79/0.60	224.67/0.71	221.08/0.70
FIDTM [ 18 ]	313.45/1.21	426.89/1.64	353.08/1.0	373.70/1.44	250.52/0.96	407.76/1.57	277.25/1.07
PET [ 21 ]	315.00/1.03	430.91/1.41	350.84/1.15	305.43/1.0	252.33/0.83	406.19/1.33	269.92/0.88
HMoDE [ 12 ]	301.36/1.21	420.71/ 1.69	338.82/1.36	366.16/1.47	249.19/1.0	397.48/1.60	257.62/1.03

Table 1: Transferability of our designed adversarial examples across crowd counting models (MAE/TR) on the SHHA dataset., where the highest and lowest values are indicated by bold and underline .

Source Model	Target Model
Source Model	SASNet	P2PNet	FIDTM	PET	HMoDE	APGCC	Gramformer
SASNet [ 32 ]	619.74/1.0	819.59/1.32	741.62/1.20	843.36/1.36	526.73/0.85	808.79/1.31	613.61/0.99
P2PNet [ 31 ]	615.04/0.93	663.95/1.0	632.00/0.95	671.59/1.01	437.98/ 0.66	686.58/1.03	527.64/0.79
FIDTM [ 18 ]	639.64/0.83	833.09/1.09	767.54/1.0	846.11/1.10	530.23/0.69	819.93/1.07	647.00/0.84
PET [ 21 ]	630.50/0.83	831.23/1.09	747.29/0.98	763.30/1.0	530.11/0.69	813.33/1.07	621.62/0.81
HMoDE [ 12 ]	619.96/1.18	819.81/1.55	741.44/1.41	843.42/ 1.60	527.32/1.0	808.13/1.53	614.00/1.16

Table 2: Transferability of our designed adversarial examples across crowd counting models (MAE/TR) on UCF-QNRF dataset, where the highest and lowest values are indicated by bold and underline .

Panel of Figure 4 — Figure 4: GradCAM response of clean and adversarial images

	Overall				Sparse (<100)				Moderate (100-1000)				Dense (>1000)
Method	MAE $\uparrow$	MR $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$	MAE $\uparrow$	MR $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$	MAE $\uparrow$	MR $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$	MAE $\uparrow$	MR $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$
Clean	28.1	4.28	N/A	N/A	2.83	5.06	N/A	N/A	16.69	3.75	N/A	N/A	128.0	7.82	N/A	N/A
DI- 2 FGSM [ 42 ]	77.14	11.44	20.59	0.836	4.33	6.09	23.65	0.924	56.44	11.30	20.78	0.843	273.0	15.47	17.43	0.736
Admix [ 37 ]	69.21	9.73	20.80	0.841	2.83	4.60	24.14	0.930	48.61	9.44	21.00	0.848	260.8	14.71	17.48	0.738
FIA [ 38 ]	68.96	10.27	20.59	0.837	3.67	5.23	23.65	0.924	50.88	10.18	20.78	0.844	241.0	13.73	17.43	0.736
SVRE [ 43 ]	77.83	11.76	20.58	0.836	4.83	6.72	23.64	0.924	58.35	11.68	20.78	0.843	264.6	15.11	17.43	0.736

Table 3: Evaluation of attacks using FIDTM model across density regimes (SHHA dataset), where

\uparrow

indicates the higher the better.

Loss Equations	MR(%)	PSNR
$\alpha\mathcal{L}_{\text{hmap}}+\beta\mathcal{L}_{\text{hinge}}$	45.35	17.67
$\alpha\mathcal{L}_{\text{hmap}}+\beta\mathcal{L}_{\text{hinge}}+\kappa\mathcal{L}_{\text{cam}}$	59.47	17.67
$\alpha\mathcal{L}_{\text{hmap}}+\beta\mathcal{L}_{\text{hinge}}+\zeta\mathcal{L}_{\text{freq}}$	60.46	17.75
$\alpha\mathcal{L}_{\text{hmap}}+\beta\mathcal{L}_{\text{hinge}}+\gamma\mathcal{L}_{\text{tv}}+\zeta\mathcal{L}_{\text{freq}}$	60.26	17.65
$\alpha\mathcal{L}_{\text{hmap}}+\beta\mathcal{L}_{\text{hinge}}+\gamma\mathcal{L}_{\text{tv}}+\zeta\mathcal{L}_{\text{freq}}+\kappa\mathcal{L}_{\text{cam}}$	60.89	17.47
$\alpha\mathcal{L}_{\text{peak}}+\beta\mathcal{L}_{\text{hinge}}$	44.93	17.71

Table 4: Impact of combinations of loss functions on MR and PSNR for SHHA dataset.

Adversarial Attacks

Adversarial attacks exploit crafted inputs, poisoned data, or system interactions to manipulate AI predictions, behavior, privacy, or reliability.

See all 448 papers

APC: Transferable and Efficient Adversarial Point Counterattack for Robust 3D Point Cloud Recognition
Apr 17, 2026Geunyoung Jung, Soohong Kim, Inseok Kong +1Point Cloud Classification Adversarial Robustness
Department of Artificial Intelligence, University of Seoul, South Korea · Department of Geo Informatics, University of Seoul, South Korea
Boosting the Local Invariance for Better Adversarial Transferability
Mar 8, 2025Bohan Liu, Xiaosen WangAdversarial Attacks Transfer-Based Adversarial Attacks
School of Computer Science and Technology, Xidian University, Xi’an 710126, China · School of Computer Science and Technology, Huazhong University of Science and Technology, Wuhan 430074, China
Pareto-Improving Adversarial Attacks with Primal-Dual Regularization
Oct 3, 2026Yang Dai, Longfei Zhang, Wei Tao +3Adversarial Attacks Transfer-Based Adversarial Attacks
Laboratory for Big Data and Decision, National University of Defense Technology, Changsha 410073, China

Apr 17, 2026J/K move · Enter open · S save

APC: Transferable and Efficient Adversarial Point Counterattack for Robust 3D Point Cloud Recognition

Geunyoung Jung, Soohong Kim, Inseok Kong, Jiyoung Jung

Department of Artificial Intelligence, University of Seoul, South Korea · Department of Geo Informatics, University of Seoul, South Korea

Point Cloud Classification Adversarial Robustness Adversarial Transferability Adversarial Purification

Open paper AskPDF arXiv

The advent of deep neural networks has led to remarkable progress in 3D point cloud recognition, but they remain vulnerable to adversarial attacks. Although various defense methods have been studied, they suffer from a trade-off between robustness and transferability. We propose Adversarial Point Counterattack (APC) to achieve both simultaneously. APC is a lightweight input-level purification module that generates instance-specific counter-perturbations for each point, effectively neutralizing attacks. Leveraging clean-adversarial pairs, APC enforces geometric consistency in data space and semantic consistency in feature space. To improve generalizability across diverse attacks, we adopt a hybrid training strategy using adversarial point clouds from multiple attack types. Since APC operates purely on input point clouds, it directly transfers to unseen models and defends against attacks targeting them without retraining. At inference, a single APC forward pass provides purified point clouds with negligible time and parameter overhead. Extensive experiments on two 3D recognition benchmarks demonstrate that the APC achieves state-of-the-art defense performance. Furthermore, cross-model evaluations validate its superior transferability. The code is available at https://github.com/gyjung975/APC.

Abstract

Adversarial Attacks

Explore similar work

APC: Transferable and Efficient Adversarial Point Counterattack for Robust 3D Point Cloud Recognition

Boosting the Local Invariance for Better Adversarial Transferability

Pareto-Improving Adversarial Attacks with Primal-Dual Regularization