Adversarial Perturbations Against Real-Time Video Classification Systems

Abstract

Recent research has demonstrated the brittleness of machine learning systems to adversarial perturbations. However, the studies have been mostly limited to perturbations on images and more generally, classification that does not deal with temporally varying inputs. In this paper we ask "Are adversarial perturbations possible in real-time video classification systems and if so, what properties must they satisfy?" Such systems find application in surveillance applications, smart vehicles, and smart elderly care and thus, misclassification could be particularly harmful (e.g., a mishap at an elderly care facility may be missed). We show that accounting for temporal structure is key to generating adversarial examples in such systems. We exploit recent advances in generative adversarial network (GAN) architectures to account for temporal correlations and generate adversarial samples that can cause misclassification rates of over 80% for targeted activities. More importantly, the samples also leave other activities largely unaffected making them extremely stealthy. Finally, we also surprisingly find that in many scenarios, the same perturbation can be applied to every frame in a video clip that makes the adversary's ability to achieve misclassification relatively easy.

References in corpus (14)

• Adam: A Method for Stochastic Optimization
• Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift
• Explaining and Harnessing Adversarial Examples
• Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networks
• Ensemble Adversarial Training: Attacks and Defenses
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Class Imbalance Problem in Data Mining Review
• Adversarial Perturbations Against Deep Neural Networks for Malware Classification
• Fast Feature Fool: A data independent approach to universal adversarial perturbations
• Feature Squeezing Mitigates and Detects Carlini/Wagner Adversarial Examples
• Attacking Automatic Video Analysis Algorithms: A Case Study of Google Cloud Video Intelligence API
• Drive Video Analysis for the Detection of Traffic Near-Miss Incidents

Cited by in corpus (4)

• Adversarial Frontier Stitching for Remote Neural Network Watermarking
• Evaluating and Improving Adversarial Robustness of Machine Learning-Based Network Intrusion Detectors
• Constrained Concealment Attacks against Reconstruction-based Anomaly Detectors in Industrial Control Systems
• Temporal Shuffling for Defending Deep Action Recognition Models against Adversarial Attacks