Sparse Adversarial Perturbations for Videos

Abstract

Although adversarial samples of deep neural networks (DNNs) have been intensively studied on static images, their extensions in videos are never explored. Compared with images, attacking a video needs to consider not only spatial cues but also temporal cues. Moreover, to improve the imperceptibility as well as reduce the computation cost, perturbations should be added on as fewer frames as possible, i.e., adversarial perturbations are temporally sparse. This further motivates the propagation of perturbations, which denotes that perturbations added on the current frame can transfer to the next frames via their temporal interactions. Thus, no (or few) extra perturbations are needed for these frames to misclassify them. To this end, we propose an l2,1-norm based optimization algorithm to compute the sparse adversarial perturbations for videos. We choose the action recognition as the targeted task, and networks with a CNN+RNN architecture as threat models to verify our method. Thanks to the propagation, we can compute perturbations on a shortened version video, and then adapt them to the long version video to fool DNNs. Experimental results on the UCF101 dataset demonstrate that even only one frame in a video is perturbed, the fooling rate can still reach 59.7%.

References in corpus (7)

• Adam: A Method for Stochastic Optimization
• Two-Stream Convolutional Networks for Action Recognition in Videos
• UCF101: A Dataset of 101 Human Actions Classes From Videos in The Wild
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Adversarial Examples for Semantic Segmentation and Object Detection
• Universal adversarial perturbations
• Boosting Adversarial Attacks with Momentum

Cited by in corpus (8)

• A Survey of Safety and Trustworthiness of Deep Neural Networks: Verification, Testing, Adversarial Attack and Defence, and Interpretability
• Transferable Adversarial Attacks for Image and Video Object Detection
• Black-box Adversarial Attacks on Video Recognition Models
• Targeted Nonlinear Adversarial Perturbations in Images and Videos
• Motion-Excited Sampler: Video Adversarial Attack with Sparked Prior
• RoVISQ: Reduction of Video Service Quality via Adversarial Attacks on Deep Learning-based Video Compression
• SMART: Skeletal Motion Action Recognition aTtack
• Robustness Guarantees for Deep Neural Networks on Videos