PaperlayerView exact revision on arXiv

Source-linked AI summary

Black-box Adversarial Attacks on Video Recognition Models

Linxi Jiang, Xingjun Ma, Shaoxiang Chen, James Bailey, Yu-Gang Jiang

arXiv:1904.05181v2cs.LGcs.CRcs.CVcs.MMstat.ML

TL;DR

Black-box attacks on video recognition are underexplored, particularly because videos have high dimensionality and require query-efficient methods. V-BAD combines transferred tentative perturbations with partition-based NES rectification, achieving high success rates with relatively few queries across video benchmarks. The framework provides a tool for evaluating the robustness of video recognition models to black-box attacks.

  • Problem

    Black-box adversarial attacks for video recognition are underexplored, while video dimensionality makes efficient query-limited attacks important.

    Source: §1 · p. 2

  • Method

    V-BAD transfers tentative perturbations from image models and uses NES to rectify them over patches, estimating adversarial gradients in a reduced attack space.

    Source: §1 · p. 2, §3.2 · p. 4, §3.4 · p. 5

  • Results

    V-BAD achieved high success rates using significantly fewer queries for targeted and untargeted attacks across two video models and three benchmark datasets.

    Source: §1 · p. 2, §5 · p. 9

  • Takeaways & Limitations

    V-BAD is a tool for evaluating the robustness of video recognition models to black-box adversarial attacks.

    Source: §1 · p. 2, §5 · p. 9

    The estimated gradient remains considerably different from the actual gradient, indicating that the method does not produce highly accurate gradient estimates.

    Source: §4.4 · p. 9

Abstract

from arXiv · show

Deep neural networks (DNNs) are known for their vulnerability to adversarial examples. These are examples that have undergone small, carefully crafted perturbations, and which can easily fool a DNN into making misclassifications at test time. Thus far, the field of adversarial research has mainly focused on image models, under either a white-box setting, where an adversary has full access to model parameters, or a black-box setting where an adversary can only query the target model for probabilities or labels. Whilst several white-box attacks have been proposed for video models, black-box video attacks are still unexplored. To close this gap, we propose the first black-box video attack framework, called V-BAD. V-BAD utilizes tentative perturbations transferred from image models, and partition-based rectifications found by the NES on partitions (patches) of tentative perturbations, to obtain good adversarial gradient estimates with fewer queries to the target model. V-BAD is equivalent to estimating the projection of an adversarial gradient on a selected subspace. Using three benchmark video datasets, we demonstrate that V-BAD can craft both untargeted and targeted attacks to fool two state-of-the-art deep video recognition models. For the targeted attack, it achieves $>$93\% success rate using only an average of $3.4 \sim 8.4 \times 10^4$ queries, a similar number of queries to state-of-the-art black-box image attacks. This is despite the fact that videos often have two orders of magnitude higher dimensionality than static images. We believe that V-BAD is a promising new tool to evaluate and improve the robustness of video recognition models to black-box adversarial attacks.

1 INTRODUCTION

Black-box attacks on video recognition remain underexplored because videos have much higher dimensionality than images, making query-efficient methods important. V-BAD addresses this gap by transferring tentative perturbations from image models and rectifying them with NES over patches.

  • Black-box video attacks remain largely unexplored, whereas prior work mainly studies image attacks or white-box video attacks.Source: §1 · pp. 1–2
  • Videos often have two orders of magnitude higher dimensionality than static images, creating a need for attacks that use fewer target-model queries.Source: §1 · pp. 1–2
  • V-BAD transfers tentative perturbations from ImageNet-pretrained image models and rectifies them patchwise using NES queries to the target model.Source: §1 · p. 2
  • V-BAD is presented as the first black-box adversarial attack framework for video recognition models.Source: §1 · p. 2
  • V-BAD was evaluated on three benchmark video datasets and two state-of-the-art video recognition models, achieving high attack success rates with few queries.Source: §1 · p. 2

2 RELATED WORK

Related work spans white-box image attacks, black-box image attacks, and white-box video attacks, while this paper targets black-box attacks against video recognition models. Video recognition architectures include frame-based, recurrent, and spatiotemporal convolutional models.

White-box Image Attack

  • White-box image attacks include FGSM, PGD, C&W, JSMA, DeepFool, and EAD, with PGD described as a strong iterative first-order method.Source: §2 · p. 2

Black-box Image Attack

  • Black-box image attacks use transferred adversarial examples or gradient estimation, including finite differences and NES, often with dimensionality reduction.Source: §2 · p. 2

White-box Video Attack

  • Prior video adversarial research mainly studies white-box attacks, including sparse or propagated perturbations across frames and GAN-based real-time perturbations.Source: §2 · p. 2

Video Recognition Models

  • Video recognition models include CNN+LSTM systems that capture temporal dependencies and I3D models that learn hierarchical spatiotemporal representations.Source: §2 · pp. 2–3

3 PROPOSED FRAMEWORK V-BAD

V-BAD generates black-box adversarial video examples by combining transferred tentative perturbations with patch-level gradient estimation and rectification. It supports targeted and untargeted attacks while reducing estimation to a selected perturbation subspace.

Threat model

  • V-BAD constrains the threat model to top-1 labels and probabilities returned by a query-limited black-box video classifier.The attacker must generate an adversarial video within a prescribed query budget.Source: §3.1 · p. 3

Framework overview

  • Tentative perturbations are initialized from image-model guidance, with random, static, and image-model-derived variants considered.The image-model perturbations provide pixel-wise directions before patch-level correction.Source: §3.2 · p. 3, §3.3 · p. 4

Attack variants

  • Targeted attacks start from a target-class sample and decay the perturbation bound, whereas untargeted attacks start from the clean sample with a fixed bound.These procedures maintain different class-related conditions during optimization.Source: §3.2 · p. 4

Partition-based rectification

  • V-BAD partitions tentative perturbations into patches and estimates a rectification weight for each patch through black-box queries.The rectified patch weights produce pixel-wise perturbations used in iterative updates.Source: §3.2 · p. 4, §3.4 · p. 5

Partitioning methods

  • The framework evaluates random and uniform partitioning strategies while leaving semantic partitioning for future work.Random partitions ignore local correlations; uniform partitions preserve frame-local correlations.Source: §3.4 · p. 5

Subspace interpretation

  • Patch rectification reduces the estimation space from N × H × W × C dimensions to patch weights and estimates the gradient projection onto the resulting subspace.With perfect patch-weight estimation, the rectified perturbation is the closest vector to the adversarial gradient within that subspace.Source: §3.5 · pp. 5–6

4 EXPERIMENTS

The experiments evaluate V-BAD and its variants on three video datasets against two state-of-the-art recognition models, covering targeted and untargeted attacks. Ablations show that transferred perturbations, uniform partitioning, and NES improve attack efficiency and effectiveness, while V-BAD consistently performs strongly against the evaluated baselines.

Experimental setting

  • V-BAD is evaluated on UCF-101, HMDB-51, and Kinetics-400 against I3D and CNN+LSTM video recognition models.The evaluation covers both targeted and untargeted black-box attacks under a perturbation bound of ϵ = 0.05 per frame and a query limit of Q = 3 × 10^5.Source: §4 · p. 6, §4.1 · p. 6

Tentative perturbations

  • Transferred tentative perturbations reduce successful-attack queries from more than 10^5 to less than 6×10^4 with one image model and around 5×10^4 with an ensemble.The ensemble also improves over random and static perturbations, while static perturbations achieve 70% success rate versus 95% for random perturbations.Source: §4.1 · p. 6, §4.2 · p. 7

Estimation methods

  • NES achieves a 100% success rate within the query limit, whereas FD achieves 70%, and successful NES attacks require roughly 20% fewer queries.The comparison uses similar query budgets per update for the two estimators.Source: §4.2 · p. 8

Attack comparisons

  • For untargeted attacks, V-BAD is the most effective and efficient method across all evaluated datasets and models, requiring only a few hundred queries to break CNN+LSTM.Untargeted attacks require approximately 10% as many queries as targeted attacks, and both attack types indicate substantial black-box vulnerability in video models.Source: §4.3 · p. 8

5 CONCLUSION

The paper introduces V-BAD as the first black-box framework for attacking video recognition models using only black-box queries. Across two state-of-the-art models and three benchmark datasets, it achieves high attack success with significantly fewer queries for targeted and untargeted attacks, highlighting video models’ vulnerability and the need for effective defenses.

  • V-BAD generates video adversarial examples using only black-box queries to the target video model.Source: §5 · p. 9
  • V-BAD addresses video dimensionality through tentative perturbation transfer followed by partition-based rectification with NES gradient estimation.Source: §5 · p. 9
  • V-BAD attacks two state-of-the-art video recognition models across three benchmark video datasets.Source: §5 · p. 9
  • V-BAD achieves high success rates with significantly fewer queries than existing black-box methods for both targeted and untargeted attacks.Source: §5 · p. 9
  • The results indicate that video models are highly vulnerable to black-box adversarial attacks and require effective defenses for secure video recognition.Source: §5 · p. 9

Related papers

Loading 1904.05181v2…