Heuristic Black-Box Adversarial Attacks on Video Recognition Models

Wei, Zhipeng; Chen, Jingjing; Wei, Xingxing; Jiang, Linxi; Chua, Tat-Seng; Zhou, Fengfeng; Jiang, Yu‐Gang

doi:10.1609/aaai.v34i07.6918

Cited by 64 publications

(60 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Adversarial attack on videos: Wei et al [47] claimed that they are the first to attack videos. Instead of attacking each frame of a video, they apply additive perturbations on randomly selected frames and use l 2,1 norm to guide the Flickering [29] RL [57] Heuristic [48] Append [4] BlackBox attack [15] GAN-based attack [24] Sparse Attack [ gradient-based optimisation and evaluated the performance on the CNN+LSTM model. Li et al [24] used a GAN network to generate offline universal perturbations for each frame.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Sparse Adversarial Video Attacks with Spatial Transformations

Ronghui¹,

Ruan²,

Marcolino³

et al. 2021

Preprint

View full text Add to dashboard Cite

In recent years, a significant amount of research efforts concentrated on adversarial attacks on images, while adversarial video attacks have seldom been explored. We propose an adversarial attack strategy on videos, called DeepSAVA. Our model includes both additive perturbation and spatial transformation by a unified optimisation framework, where the structural similarity index measure is adopted to measure the adversarial distance. We design an effective and novel optimisation scheme which alternatively utilizes Bayesian optimisation to identify the most influential frame in a video and Stochastic gradient descent (SGD) based optimisation to produce both additive and spatial-transformed perturbations. Doing so enables DeepSAVA to perform a very sparse attack on videos for maintaining human imperceptibility while still achieving state-of-the-art performance in terms of both attack success rate and adversarial transferability. Our intensive experiments on various types of deep neural networks and video datasets confirm the superiority of DeepSAVA.

show abstract

Section: Related Workmentioning

confidence: 99%

“…Jiang et al [15] were the first to propose a black-box approach to attack videos. Wei et al [48] proposed to use a heuristic method and Yan et al [57] used a reinforcement learning algorithm to select the key frames to perform black-box attack. However, these works only applied additive perturbation based on l p -norm distance.…”

Section: Related Workmentioning

confidence: 99%

Sparse Adversarial Video Attacks with Spatial Transformations

Ronghui¹,

Ruan²,

Marcolino³

et al. 2021

Preprint

View full text Add to dashboard Cite

show abstract

“…Jiang et al [12] proposed an adversarial attack on a video recognition model under a black-box setting. Wei et al [45] proposed a method that adds perturbation to selected keyframes and salient regions. Our work differs from the above-mentioned adversarial action recognition works such that our work is on multi-modal settings and includes attention mechanisms that efficiently and selectively choose segments within individual modality and among multi-modalities to carry out an intelligently adversarial attack.…”

Section: Adversarial Attackmentioning

confidence: 99%

“…Many adversarial attack methods have been proposed for some computer vision tasks [2,45], but not on action recognition applications. Complexity arisen from multiple modalities of action recognition, such as RGB, Depth, and Skeleton, adds to the challenges of adversarial attacks on such a task.…”

Section: Introductionmentioning

confidence: 99%

Finding Achilles' Heel

Kumar

Seah

et al. 2020

Proceedings of the 28th ACM International Conference on Multimedia

View full text Add to dashboard Cite

Neural network-based models are notoriously known for their adversarial vulnerability. Recent adversarial machine learning mainly focused on images, where a small perturbation can be simply added to fool the learning model. Very recently, this practice has been explored in human action video attacks by adding perturbation to key frames. Unfortunately, frame selection is usually computationally expensive in run-time, and adding noises to all frames is unrealistic, either. In this paper, we present a novel yet efficient approach to address this issue. Multi-modal video data such as RGB, depth and skeleton data have been widely used for human action modeling, and they have been demonstrated with superior performance than a single modality. Interestingly, we observed that the skeleton data is more "vulnerable" under adversarial attack, and we propose to leverage this "Achilles' Heel" to attack multi-modal video data. In particular, first, an adversarial learning paradigm is designed to perturb skeleton data for a specific action under a black

show abstract

“…However, recent studies have shown that deep neural networks (DNNs) are highly vulnerable to adversarial examples [7,23], which are generated by adding small human-imperceptible perturbations that can lead to wrong predictions. The existence of adversarial examples has posed serious security threats for the application of DNNs in security-critical scenarios, such as autonomous driving [20], face recognition [5], video analysis [26], etc. As a result, adversarial examples have attracted numerous research attentions in recent years.…”

Section: Introductionmentioning

confidence: 99%

Cross-Modal Transferable Adversarial Attacks from Images to Videos

Wei¹,

Chen²,

Wu³

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

Recent studies have shown that adversarial examples hand-crafted on one white-box model can be used to attack other black-box models. Such cross-model transferability makes it feasible to perform black-box attacks, which has raised security concerns for real-world DNNs applications. Nevertheless, existing works mostly focus on investigating the adversarial transferability across different deep models that share the same modality of input data. The cross-modal transferability of adversarial perturbation has never been explored. This paper investigates the transferability of adversarial perturbation across different modalities, i.e., leveraging adversarial perturbation generated on white-box image models to attack black-box video models. Specifically, motivated by the observation that the low-level feature space between images and video frames are similar, we propose a simple yet effective cross-modal attack method, named as Image To Video (I2V) attack. I2V generates adversarial frames by minimizing the cosine similarity between features of pre-trained image models from adversarial and benign examples, then combines the generated adversarial frames to perform black-box attacks on video recognition models. Extensive experiments demonstrate that I2V can achieve high attack success rates on different black-box video recognition models. On Kinetics-400 and UCF-101, I2V achieves an average attack success rate of 77.88% and 65.68%, respectively, which sheds light on the feasibility of cross-modal adversarial attacks.

show abstract

Heuristic Black-Box Adversarial Attacks on Video Recognition Models

Cited by 64 publications

References 15 publications

Sparse Adversarial Video Attacks with Spatial Transformations

Sparse Adversarial Video Attacks with Spatial Transformations

Finding Achilles' Heel

Cross-Modal Transferable Adversarial Attacks from Images to Videos

Contact Info

Product

Resources

About