Sparse Adversarial Video Attacks with Spatial Transformations
In recent years, a significant amount of research efforts concentrated on adversarial attacks on images, while adversarial video attacks have seldom been explored. We propose an adversarial attack strategy on videos, called DeepSAVA. Our model includes both additive perturbation and spatial transformation by a unified optimisation framework, where the structural similarity index (SSIM) measure is adopted to measure the adversarial distance. We design an effective and novel optimisation scheme which alternatively utilizes Bayesian optimisation to identify the most influential frame in a video and Stochastic gradient descent (SGD) based optimisation to produce both additive and spatial-transformed perturbations. Doing so enables DeepSAVA to perform a very sparse attack on videos for maintaining human imperceptibility while still achieving state-of-the-art performance in terms of both attack success rate and adversarial transferability. Our intensive experiments on various types of deep neural networks and video datasets confirm the superiority of DeepSAVA.
Code (1)
Tasks
Adversarial AttackBayesian OptimisationSSIMSimilar Papers 제목 키워드 기반
Identifying and Resisting Adversarial Videos Using Temporal Consistency
Video classification is a challenging task in computer vision. Although Deep Neural Networks (DNNs) have achieved excellent performance in video classification, recent research shows adding imperceptible perturbations to…
Video ClassificationTemporal Sparse Adversarial Attack on Sequence-based Gait Recognition
Gait recognition is widely used in social security applications due to its advantages in long-distance human identification. Recently, sequence-based methods have achieved high accuracy by learning abundant temporal and …
Adversarial AttackGait RecognitionGenerative Adversarial NetworkAdversarial Attacks on Black Box Video Classifiers: Leveraging the Power of Geometric Transformations
When compared to the image classification models, black-box adversarial attacks against video classification models have been largely understudied. This could be possible because, with video, the temporal dimension poses…
Classificationimage-classificationImage ClassificationVideo ClassificationA Unified Spatial Alignment Framework for Highly Transferable Transformation-Based Attacks on Spatially Structured Tasks
Transformation-based adversarial attacks (TAAs) demonstrate strong transferability when deceiving classification models. However, existing TAAs often perform unsatisfactorily or even fail when applied to structured tasks…
Semantic SegmentationObject DetectionProvable Defenses against Spatially Transformed Adversarial Inputs: Impossibility and Possibility Results
One intriguing property of neural networks is their inherent vulnerability to adversarial inputs, which are maliciously crafted samples to trigger target networks to misbehave. The state-of-the-art attacks generate adver…