A Robust Adversarial Example Attack Based on Video Augmentation
Source abstract
Abstract
Despite the success of learning-based systems, recent studies have highlighted video adversarial examples as a ubiquitous threat to state-of-the-art video classification systems. Video adversarial attacks add subtle noise to the original example, resulting in a false classification result. Thorough studies on how to generate video adversarial examples are essential to prevent potential attacks. Despite much research on this, existing research works on the robustness of video adversarial examples are still limited. To generate highly robust video adversarial examples, we propose a video-augmentation-based adversarial attack (v3a), focusing on the video transformations to reinforce the attack. Further, we investigate different transformations as parts of the loss function to make the video adversarial examples more robust. The experiment results show that our proposed method outperforms other adversarial attacks in terms of robustness. We hope that our study encourages a deeper understanding of adversarial robustness in video classification systems with video augmentation.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Adversarial Robustness in Machine Learning · Anomaly Detection Techniques and Applications
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Institute of Computer Application, China Academy of Engineering Physics, Mianyang 621900, China
Funding
National Natural Science Foundation of China
References (34)
Show source-provided references
1. Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. (2013). Intriguing properties of neural networks. arXiv.
2. Goodfellow, I.J., Shlens, J., and Szegedy, C. (2014). Explaining and harnessing adversarial examples. arXiv.
3. Liu, X., Du, X., Zhang, X., Zhu, Q., Wang, H., and Guizani, M. (2019). Adversarial Samples on Android Malware Detection Systems for IoT Systems. Sensors, 19.10.3390/s19040974 ↗
4. A low-query black-box adversarial attack based on transferability10.1016/j.knosys.2021.107102 ↗
5. Domain-adversarial training of neural networks
6. Tramèr, F., Kurakin, A., Papernot, N., Goodfellow, I., Boneh, D., and McDaniel, P. (2017). Ensemble adversarial training: Attacks and defenses. arXiv.
7. Shafahi, A., Najibi, M., Xu, Z., Dickerson, J., Davis, L.S., and Goldstein, T. (2020, January 7–12). Universal adversarial training. Proceedings of the AAAI Conference on Artificial Intelligence, New York, NY, USA.10.1609/aaai.v34i04.6017 ↗
8. Carlini, N., and Wagner, D. (2017, January 29–30). Towards evaluating the robustness of neural networks. Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP), Paris, France.10.1109/SP.2017.49 ↗
9. Liu, X., Hu, T., Ding, K., Bai, Y., Niu, W., and Lu, J. (December, January 30). A black-box attack on neural networks based on swarm evolutionary algorithm. Proceedings of the Australasian Conference on Information Security and Privacy, Perth, WA, Australia.
10. One pixel attack for fooling deep neural networks10.1109/TEVC.2019.2890858 ↗
11. Chen, P.Y., Sharma, Y., Zhang, H., Yi, J., and Hsieh, C.J. (2018, January 2–7). EAD: Elastic-net attacks to deep neural networks via adversarial examples. Proceedings of the Thirty-Second AAAI Conference on Artificial Intelligence, New Orleans, LO, USA.10.1609/aaai.v32i1.11302 ↗
12. Carlini, N., and Wagner, D. (2018, January 24). Audio adversarial examples: Targeted attacks on speech-to-text. Proceedings of the 2018 IEEE Security and Privacy Workshops (SPW), San Francisco, CA, USA.10.1109/SPW.2018.00009 ↗
13. Kreuk, F., Adi, Y., Cisse, M., and Keshet, J. (2018, January 15–20). Fooling end-to-end speaker verification with adversarial examples. Proceedings of the 2018 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Calgary, AB, Canada.10.1109/ICASSP.2018.8462693 ↗
14. Yuan, X., Chen, Y., Zhao, Y., Long, Y., Liu, X., Chen, K., Zhang, S., Huang, H., Wang, X., and Gunter, C.A. (2018, January 10–14). Commandersong: A systematic approach for practical adversarial voice recognition. Proceedings of the 27th USENIX Security Symposium (USENIX Security 18), Montreal, QC, Canada.
15. Qin, Y., Carlini, N., Goodfellow, I., Cottrell, G., and Raffel, C. (2019). Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition. arXiv.
16. Liu, X., Wan, K., Ding, Y., Zhang, X., and Zhu, Q. (2020, January 7–12). Weighted-sampling audio adversarial example attack. Proceedings of the AAAI Conference on Artificial Intelligence, New York, NY, USA.10.1609/aaai.v34i04.5928 ↗
17. Cheng, Z., Lu, R., Wang, Z., Zhang, H., Chen, B., Meng, Z., and Yuan, X. (2020, January 23–28). BIRNAT: Bidirectional recurrent neural networks with adversarial training for video snapshot compressive imaging. Proceedings of the European Conference on Computer Vision, Glasgow, UK.10.1007/978-3-030-58586-0_16 ↗
18. Zajac, M., Zołna, K., Rostamzadeh, N., and Pinheiro, P.O. (February, January 27). Adversarial framing for image and video classification. Proceedings of the AAAI Conference on Artificial Intelligence, Honolulu, HI, USA.
19. Wei, Z., Chen, J., Wu, Z., and Jiang, Y.G. (2021). Cross-Modal Transferable Adversarial Attacks from Images to Videos. arXiv.10.1109/CVPR52688.2022.01464 ↗
20. Black-box adversarial attacks by manipulating image attributes10.1016/j.ins.2020.10.028 ↗
21. Wei, X., Zhu, J., Yuan, S., and Su, H. (February, January 27). Sparse Adversarial Perturbations for Videos. Proceedings of the AAAI Conference on Artificial Intelligence, Honolulu, HI, USA.
22. Wei, Z., Chen, J., Wei, X., Jiang, L., Chua, T.S., Zhou, F., and Jiang, Y.G. (2020, January 7–12). Heuristic black-box adversarial attacks on video recognition models. Proceedings of the AAAI Conference on Artificial Intelligence, New York, NY, USA.10.1609/aaai.v34i07.6918 ↗
23. Xu, Y., Liu, X., Yin, M., Hu, T., and Ding, K. (2022, January 22–27). Sparse Adversarial Attack For Video Via Gradient-Based Keyframe Selection. Proceedings of the 2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Singapore.10.1109/ICASSP43922.2022.9747698 ↗
24. Jiang, L., Ma, X., Chen, S., Bailey, J., and Jiang, Y.G. (2019, January 21–25). Black-Box Adversarial Attacks on Video Recognition Models. Proceedings of the 27th ACM International Conference on Multimedia, Nice, France.10.1145/3343031.3351088 ↗
25. Yan, H., Wei, X., and Li, B. (2020). Sparse black-box video attack with reinforcement learning. arXiv.
26. Adversarial attacks on black box video classifiers: Leveraging the power of geometric transformations
27. Zhang, H., Zhu, L., Zhu, Y., and Yang, Y. (2020, January 23–28). Motion-excited sampler: Video adversarial attack with sparked prior. Proceedings of the European Conference on Computer Vision, Glasgow, UK.10.1007/978-3-030-58565-5_15 ↗
28. Luo, B., Liu, Y., Wei, L., and Xu, Q. (2018, January 2–7). Towards Imperceptible and Robust Adversarial Example Attacks Against Neural Networks. Proceedings of the AAAI, New Orleans, LO, USA.10.1609/aaai.v32i1.11499 ↗
29. Athalye, A., Engstrom, L., Ilyas, A., and Kwok, K. (2018, January 10–15). Synthesizing Robust Adversarial Examples. Proceedings of the ICML, Stockholm, Sweden.
30. Eykholt, K., Evtimov, I., Fernandes, E., Li, B., Rahmati, A., Xiao, C., Prakash, A., Kohno, T., and Song, D. (2018, January 18–22). Robust Physical-World Attacks on Deep Learning Visual Classification. Proceedings of the CVPR. Computer Vision Foundation/IEEE Computer Society, Salt Lake City, UT, USA.10.1109/CVPR.2018.00175 ↗
31. Brendel, W., Rauber, J., and Bethge, M. (2017). Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. arXiv.
32. Soomro, K., Zamir, A.R., and Shah, M. (2012). UCF101: A dataset of 101 human actions classes from videos in the wild. arXiv.
33. Donahue, J., Anne Hendricks, L., Guadarrama, S., Rohrbach, M., Venugopalan, S., Saenko, K., and Darrell, T. (2015, January 7–12). Long-term recurrent convolutional networks for visual recognition and description. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Boston, MA, USA.10.1109/CVPR.2015.7298878 ↗
34. Moosavi-Dezfooli, S.M., Fawzi, A., and Frossard, P. (2016, January 27–30). Deepfool: A simple and accurate method to fool deep neural networks. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Las Vegas, NV, USA.10.1109/CVPR.2016.282 ↗