Defending from GeoLocalization through Adversarial Road Trips
2026-07-03 • Computer Vision and Pattern Recognition
Computer Vision and Pattern Recognition
AI summaryⓘ
The authors propose a new method called RoadTrip Attack (RTA) to trick image geolocalization systems, which identify where a photo was taken by comparing it to a large database of images with known locations. RTA works by creating a fake path of locations leading to a chosen target location, subtly altering the input image at each step to mislead the system into thinking the image is from these wrong places. They use a beam search algorithm to find the best distracting locations and show that their attack can fool models even when the internal details of the model are unknown. Their approach produces less noticeable changes to images while still effectively deceiving geolocation systems.
image geolocalizationadversarial attackdeep learningbeam searchblack-box attackimage perturbationtargeted attackgeotagged databasetransferabilityprivacy protection
Authors
Niccolò Niccoli, Federico Becattini, Lorenzo Seidenari
Abstract
Retrieval-based image geolocalization has emerged as a powerful technique for determining the location of a query image by matching it against a large, geotagged database. The success of deep learning based approaches has raised concerns regarding privacy and safety. A way to protect users from geolocalization is to design adversarial attacks for such methods. In this paper, we introduce RoadTrip Attack (RTA), a novel and highly effective targeted adversarial attack for geolocalization. RTA conceptualizes the adversarial process as finding an optimal distractor journey to a specific, attacker-chosen location. It employs a beam search algorithm to iteratively construct a sequence of incorrect geographic locations that form a path to the target. At each step, the attack generates subtle perturbations to the query image, guiding the geolocalization model toward the next location in this deceptive path. We show that our method is also strong in black-box settings, obtaining highly transferable attacks with less perceptible image artifacts.