Defending from GeoLocalization through Adversarial Road Trips
For users concerned about privacy, this work provides a method to evade geolocalization systems, though it is an incremental improvement over existing adversarial attack techniques.
The paper tackles the problem of defending user privacy against image geolocalization by proposing a targeted adversarial attack. The RoadTrip Attack (RTA) achieves high success rates in both white-box and black-box settings, with less perceptible perturbations.
Retrieval-based image geolocalization has emerged as a powerful technique for determining the location of a query image by matching it against a large, geotagged database. The success of deep learning based approaches has raised concerns regarding privacy and safety. A way to protect users from geolocalization is to design adversarial attacks for such methods. In this paper, we introduce RoadTrip Attack (RTA), a novel and highly effective targeted adversarial attack for geolocalization. RTA conceptualizes the adversarial process as finding an optimal distractor journey to a specific, attacker-chosen location. It employs a beam search algorithm to iteratively construct a sequence of incorrect geographic locations that form a path to the target. At each step, the attack generates subtle perturbations to the query image, guiding the geolocalization model toward the next location in this deceptive path. We show that our method is also strong in black-box settings, obtaining highly transferable attacks with less perceptible image artifacts.