Sparse Adversarial Video Attacks with Spatial Transformations

Abstract

In recent years, a significant amount of research efforts concentrated on adversarial attacks on images, while adversarial video attacks have seldom been explored. We propose an adversarial attack strategy on videos, called DeepSAVA. Our model includes both additive perturbation and spatial transformation by a unified optimisation framework, where the structural similarity index (SSIM) measure is adopted to measure the adversarial distance. We design an effective and novel optimisation scheme which alternatively utilizes Bayesian optimisation to identify the most influential frame in a video and Stochastic gradient descent (SGD) based optimisation to produce both additive and spatial-transformed perturbations. Doing so enables DeepSAVA to perform a very sparse attack on videos for maintaining human imperceptibility while still achieving state-of-the-art performance in terms of both attack success rate and adversarial transferability. Our intensive experiments on various types of deep neural networks and video datasets confirm the superiority of DeepSAVA.

arXiv commentThe short version of this work will appear in the BMVC 2021 conference

References in corpus (12)

• Explaining and Harnessing Adversarial Examples
• UCF101: A Dataset of 101 Human Actions Classes From Videos in The Wild
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Spatially Transformed Adversarial Examples
• Generating Adversarial Examples with Adversarial Networks
• A Boundary Tilting Persepective on the Phenomenon of Adversarial Examples
• A Game-Based Approximate Verification of Deep Neural Networks with Provable Guarantees
• Functional Adversarial Attacks
• Maximal Jacobian-based Saliency Map Attack
• Appending Adversarial Frames for Universal Video Attack
• Towards the Quantification of Safety Risks in Deep Neural Networks
• Fooling Object Detectors: Adversarial Attacks by Half-Neighbor Masks