Black-box Adversarial Attacks on Video Recognition Models

By Linxi Jiang, Xingjun Ma, Shaoxiang Chen, James Bailey, Yu-Gang Jiang. 2019

171 citations recorded by the source corpus.

Deep neural networks (DNNs) are known for their vulnerability to adversarial examples. These are examples that have undergone small, carefully crafted perturbations, and which can easily fool a DNN into making misclassifications at test time. Thus far, the field of adversarial research has mainly focused on image models, under either a white-box setting, where an adversary has full access to model parameters, or a black-box setting where an adversary can only query the target model for probabilities or labels. Whilst several white-box attacks have been proposed for video models, black-box video attacks are still unexplored. To close this gap, we propose the first black-box video attack framework, called V-BAD. V-BAD utilizestentative perturbations transferred from image models andpartition-based rectifications found by the NES to obtain good adversarial gradient estimates with fewer queries to the target model. V-BAD is equivalent to estimating the projection of the adversarial gradient on a selected subspace. Using three benchmark video datasets, we demonstrate that V-BAD can craft both untargeted and targeted attacks to fool two state-of-the-art deep video recognition models. For the targeted attack, it achieves $>$93% success rate using only an average of $3.4 \sim 8.4 \times 10^4$ queries, a similar number of queries to state-of-the-art black-box image attacks. This is despite the fact that videos often have two orders of magnitude higher dimensionality than static images. We believe that V-BAD is a promising new tool to evaluate and improve the robustness of video recognition models to black-box adversarial attacks.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

Citations in the corpus

Adversarial Example Games (2020, methodology): “…estimation is an attractive approach with notable approaches utilizing black box optimization schemes such as Finite Differences [15], Natural Evolutionary Strategies [39, 42], learned priors in a bandit optimization framework [40], meta-learning attack patterns [23], and query efﬁcient Defenses .”
On Improving Adversarial Transferability of Vision Transformers (2021, methodology): “While gradient estimation methods that estimate the gradients of the target model using black-box optimization methods such as Finite Differences (FD) [25, 26] or Natural Evolution Strategies (NES) [27, 28] exist, these methods are dependent on multiple queries to the target model which is not pract”
Improving Adversarial Robustness Requires Revisiting Misclassified Examples (2020, background): “This vulnerability of DNNs raises serious security concerns about their practicability in security critical applications (Chen et al., 2015; Kurakin et al., 2016; Jiang et al., 2019; Finlayson et al., 2019; Ma et al., 2019).”
Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNets (2020, methodology): “Gradient estimation methods estimate the gradients of the target model using black-box optimization methods such as Finite Differences (FD) (Chen et al., 2017; Bhagoji et al., 2018) or Natural Evolution Strategies (NES) (Ilyas et al., 2018; Jiang et al., 2019).”
Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks (2021, background): “A type of well-studied adversary is called the adversarial attack (Szegedy et al., 2013; Goodfellow et al., 2014; Ma et al., 2018; Jiang et al., 2019; Wang et al., 2019b; 2020; Duan et al., 2020; Ma et al., 2020).”
Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks (2020, background): “fool state-of-the-art DNNs with high success rate [19,58,44,64,65,67,28,29].”