Open Access

ARTICLE

Adversarial AI through Frequency-Domain Imperceptible Attack on Person Re-Identification

Asma Sattar¹, Maryam Bukhari², M. Saud Khan³, Anam Mustaqeem⁴, Mi Young Lee⁵, Seungmin Rho^5,*

1 College of Computer and Information Sciences (CCIS), Prince Sultan University, Riyadh, Saudi Arabia
2 Department of Computer Science, COMSATS University Islamabad, Attock Campus, Attock, Pakistan
3 Department of Computer Science, Air University Islamabad, Aerospace and Aviation Campus, Kamra, Pakistan
4 Faculty of Information Technology and Computer Science, University of Central Punjab, Lahore, Pakistan
5 Department of Industrial Security, Chung-Ang University, Seoul, Republic of Korea

* Corresponding Author: Seungmin Rho. Email:

Computers, Materials & Continua 2026, 88(2), 57 https://doi.org/10.32604/cmc.2026.078413

Received 30 December 2025; Accepted 27 April 2026; Issue published 15 June 2026

Abstract

Video surveillance systems play an important role in maintaining security in smart city environments. In this context, person identification (Re-ID) systems based on deep learning are currently drawing substantial academic interest. However, these systems remain vulnerable to adversarial attacks. In existing methods, several attacks against Re-ID systems have been designed; nevertheless, they operate in the spatial domain. Existing attacks often suffer from perturbation visibility and low imperceptibility, making them easily detectable by human observers or automated detection systems. From this line of research, this study proposed a novel and potent alternative by designing frequency domain attacks, namely FreqAdv-FFT, FreqAdv-Wavelet, FreqAdv-Phase, FreqAdv-SelDCT, and FreqAdv-RandDCT. The frequency domain allows perturbations to be constructed in a way that utilizes the individual’s visual system’s decreased sensitivity to specific frequency ranges, making these perturbations less obvious. The proposed adversarial attacks were evaluated on two prominent datasets, Market-1501 and WB_WoB-ReID, across multiple models and attack variants. The highest performance degradation was observed with FreqAdv Wavelet on HRNet for the WB_WoB-ReID dataset, reducing the mean Average Precision (mAP) to 2.52%, and FreqAdv FFT on ResNet-50 for the Market-1501 dataset, achieving a mAP of 3.96%. The suggested attacks provide insights into establishing strong AI models as well as designing defenses for ReID-based surveillance systems that are relevant to the rising development of next-generation real-time applications.

---

Keywords

---