Source-linked AI summary
Sparse Adversarial Perturbations for Videos
Xingxing Wei, Jun Zhu, Hang Su
TL;DR
Adversarial attacks had been extensively studied for images but not videos, whose temporal structure requires sparse perturbations that can propagate across frames. The paper uses l2,1-norm optimization against CNN+RNN action-recognition models, finding strong sparsity, propagation, and transferability on UCF101, including a 59.7% fooling rate when only one frame is perturbed.
Problem
Adversarial examples were extensively studied for images, but video attacks must additionally address temporal cues and temporally sparse perturbations.
Method
The paper uses l2,1-norm regularization to compute sparse perturbations for action recognition under CNN+RNN threat models and exploits propagation across frames.
Results
59.7% fooling rate is achieved on UCF101 when only one frame is perturbed, while experiments also show propagation and transferability across videos.
Takeaways & Limitations
Perturbation propagation enables computing attacks on shortened videos and adapting them to longer videos, providing a more efficient video-attack method.
Takeaways & Limitations
The evaluation uses CNN+RNN architectures as the primary threat model, with CNN+Pooling results reported for comparison.
Abstract
from arXiv · showhide
Although adversarial samples of deep neural networks (DNNs) have been intensively studied on static images, their extensions in videos are never explored. Compared with images, attacking a video needs to consider not only spatial cues but also temporal cues. Moreover, to improve the imperceptibility as well as reduce the computation cost, perturbations should be added on as fewer frames as possible, i.e., adversarial perturbations are temporally sparse. This further motivates the propagation of perturbations, which denotes that perturbations added on the current frame can transfer to the next frames via their temporal interactions. Thus, no (or few) extra perturbations are needed for these frames to misclassify them. To this end, we propose an l2,1-norm based optimization algorithm to compute the sparse adversarial perturbations for videos. We choose the action recognition as the targeted task, and networks with a CNN+RNN architecture as threat models to verify our method. Thanks to the propagation, we can compute perturbations on a shortened version video, and then adapt them to the long version video to fool DNNs. Experimental results on the UCF101 dataset demonstrate that even only one frame in a video is perturbed, the fooling rate can still reach 59.7%.
1 Introduction
The paper extends adversarial-example research from images to videos by targeting temporal interactions, sparse frame perturbations, and their propagation through action-recognition models.
- Prior adversarial-example studies primarily targeted images, leaving video attacks unexplored despite DNNs’ broad use in video analysis.
- Video attacks must account for temporal structure, because perturbations on one frame may propagate through temporal interactions to other frames.
- The paper targets action recognition with CNN+RNN threat models and applies l2,1-norm regularization to select few frames for perturbation.
- The authors propose an l2,1-norm optimization algorithm and evaluate its effectiveness and transferability on UCF101.
- The proposed propagation-based method computes perturbations on shortened videos and adapts them to longer videos, reducing attack computation.
2 Related Work
Related work covers deep-learning approaches for action recognition and established adversarial attacks, while positioning CNN+RNN models as the paper’s temporal threat model.
- Action Recognition with Deep Learning: Action-recognition methods combine CNN features with temporal modeling through LSTM, optical flow, two-stream networks, and temporal segment sampling.
- Action Recognition with Deep Learning: The paper uses CNN+RNN architectures as threat models because they encode temporal information, while also reporting CNN+Pooling attack results for comparison.
- Adversarial Attack: Prior adversarial-attack research studied image classification, universal perturbations, object detection, and segmentation, but not videos.
3 Methodology
The method formulates video adversarial-example generation as an optimization problem, using temporal masks and an l2,1-norm regularizer to control frame sparsity. It targets CNN+RNN action-recognition models and uses perturbation propagation to support efficient attacks on longer videos.
- The paper introduces an optimization-based algorithm for generating adversarial samples in videos.
- The method represents a clean video X and adversarial video ˆX, with E = ˆX − X denoting the perturbation.
- A temporal mask restricts perturbations to selected frames, enforcing zero perturbations on masked frames.
- The l2,1-norm applies an l1 norm across frames, encouraging perturbations to concentrate on a few frames.The method compares l2,1-norm results with l2-norm results.
- CNN+RNN networks serve as the threat model because they encode temporal information in action-recognition videos.The paper also reports attacks on CNN+Pooling models for comparison.
- The optimization problems are solved with Adam, while perturbations are initialized with 0.0001 rather than zeros.
4 Experiments
The experiments evaluate the proposed video adversarial-perturbation method from three aspects.
- The experiments are organized around three evaluation aspects.
4.1 Datasets and Metrics
The experiments use UCF101 for action-recognition evaluation and measure fooling success, perceptibility, and temporal sparsity.
- Datasets: UCF101 contains 13,320 videos across 101 action classes, with more than 8,000 training videos and more than 3,000 testing videos.
- Evaluation setup: Because video adversarial-sample methods were unavailable, the comparison uses image-based perturbations computed independently for each frame.
- Metrics: Fooling ratio is the percentage of adversarial videos that are successfully misclassified.
- Metrics: Perceptibility is measured with Mean Absolute Perturbation, which averages the absolute perturbation intensity across pixels.The intensity vector is three-dimensional in RGB space.
- Metrics: Sparsity is the proportion of clean frames among all frames in a video used to fool the DNN.It is defined as S = K/T, where K is the number of clean frames and T is the total number of frames.
4.2 Perturbation Propagation
The experiments show that sparse perturbations can propagate across video frames: later frames may require little or no direct perturbation while remaining misclassified. Temporal masking preserves this effect with fewer perturbed frames, and propagation also reduces computation for longer videos.
- Propagation examples: The l2,1-norm perturbations successfully fool action-recognition networks while their MAP values decrease across frames to nearly zero.This indicates that earlier perturbations help fool later frames through propagation.
- Propagation examples: Unlike l2 perturbations, l2,1-norm outputs are sparse, so later frames need few or no added perturbations while propagation continues to fool the networks.The l2 comparison shows propagation, but not the same frame-level sparsity.
- Temporal masking: With a temporal mask selecting only the top 8 frames, the remaining frames stayed misclassified and their MAP values still decreased over time.The result further supports propagation under an explicitly restricted set of perturbed frames.
- Sparsity results: 59.7% fooling rate was achieved when only one frame was polluted at S = 97.5% on UCF101.The same experiments report that 8 polluted frames were required for a 100% fooling rate on the used dataset.
- Visual imperceptibility: The polluted frames at S = 97.5% were visually indistinguishable from the corresponding clean frames despite the largest perceptibility score P = 1.9319.Figure 6 compares original clean frames with adversarial frames for this one-frame setting.
- Computational efficiency: Computing perturbations on a shortened video and adapting them to the long video linearly reduces computation time as sparsity increases.This propagation-based procedure avoids computing perturbations for the whole video.
4.3 Performance and Transferability
The experiments evaluate transferability across recurrent models and videos on UCF101. The results show stronger transferability for models with long memory and a 95.2% fooling rate when universal perturbations are transferred across videos.
- Transferability across Models: LSTM and GRU are easier to attack than Vanilla RNN, consistent with their ability to represent long memory and support perturbation propagation.The reported comparison identifies better performance for LSTM columns than Vanilla RNN columns.
- Transferability across Videos: 95.2% fooling rate is achieved on the testing set when universal perturbations are transferred across videos.The perturbations are computed on the training set and added to testing videos, where they can fool new action-recognition videos.
- Transferability across Videos: The cross-video attack evaluates whether universal perturbations transfer from training videos to testing videos.The corresponding results are reported in Table 4.
5 Conclusions
The paper introduces an l2,1-norm optimization method for sparse video adversarial perturbations and evaluates transferability across models and videos. Experiments on UCF101 demonstrate propagation within CNN+RNN architectures, motivating a more efficient attack method.
- 5 Conclusions: The l2,1 norm applies an l1 norm across frames to enforce sparse perturbations.This formulation selects relatively few frames for perturbation.
- 5 Conclusions: Experiments on UCF101 show better transferability across models and videos for the proposed method.The conclusion summarizes the reported experimental findings.
- 5 Conclusions: Perturbations propagate within CNN+RNN architectures under the l2,1 constraint, supporting an efficient adversarial-video attack.The paper presents the efficient method based on this propagation observation.