Source-linked AI summary
Black-box Adversarial Attacks on Video Recognition Models
Linxi Jiang, Xingjun Ma, Shaoxiang Chen, James Bailey, Yu-Gang Jiang
TL;DR
Black-box attacks on video recognition are underexplored, particularly because videos have high dimensionality and require query-efficient methods. V-BAD combines transferred tentative perturbations with partition-based NES rectification, achieving high success rates with relatively few queries across video benchmarks. The framework provides a tool for evaluating the robustness of video recognition models to black-box attacks.
Problem
Black-box adversarial attacks for video recognition are underexplored, while video dimensionality makes efficient query-limited attacks important.
Method
V-BAD transfers tentative perturbations from image models and uses NES to rectify them over patches, estimating adversarial gradients in a reduced attack space.
Results
V-BAD achieved high success rates using significantly fewer queries for targeted and untargeted attacks across two video models and three benchmark datasets.
Takeaways & Limitations
V-BAD is a tool for evaluating the robustness of video recognition models to black-box adversarial attacks.
Takeaways & Limitations
The estimated gradient remains considerably different from the actual gradient, indicating that the method does not produce highly accurate gradient estimates.
Abstract
from arXiv · showhide
Deep neural networks (DNNs) are known for their vulnerability to adversarial examples. These are examples that have undergone small, carefully crafted perturbations, and which can easily fool a DNN into making misclassifications at test time. Thus far, the field of adversarial research has mainly focused on image models, under either a white-box setting, where an adversary has full access to model parameters, or a black-box setting where an adversary can only query the target model for probabilities or labels. Whilst several white-box attacks have been proposed for video models, black-box video attacks are still unexplored. To close this gap, we propose the first black-box video attack framework, called V-BAD. V-BAD utilizes tentative perturbations transferred from image models, and partition-based rectifications found by the NES on partitions (patches) of tentative perturbations, to obtain good adversarial gradient estimates with fewer queries to the target model. V-BAD is equivalent to estimating the projection of an adversarial gradient on a selected subspace. Using three benchmark video datasets, we demonstrate that V-BAD can craft both untargeted and targeted attacks to fool two state-of-the-art deep video recognition models. For the targeted attack, it achieves $>$93\% success rate using only an average of $3.4 \sim 8.4 \times 10^4$ queries, a similar number of queries to state-of-the-art black-box image attacks. This is despite the fact that videos often have two orders of magnitude higher dimensionality than static images. We believe that V-BAD is a promising new tool to evaluate and improve the robustness of video recognition models to black-box adversarial attacks.
1 INTRODUCTION
Black-box attacks on video recognition remain underexplored because videos have much higher dimensionality than images, making query-efficient methods important. V-BAD addresses this gap by transferring tentative perturbations from image models and rectifying them with NES over patches.
- Black-box video attacks remain largely unexplored, whereas prior work mainly studies image attacks or white-box video attacks.
- Videos often have two orders of magnitude higher dimensionality than static images, creating a need for attacks that use fewer target-model queries.
- V-BAD transfers tentative perturbations from ImageNet-pretrained image models and rectifies them patchwise using NES queries to the target model.
- V-BAD is presented as the first black-box adversarial attack framework for video recognition models.
- V-BAD was evaluated on three benchmark video datasets and two state-of-the-art video recognition models, achieving high attack success rates with few queries.
2 RELATED WORK
Related work spans white-box image attacks, black-box image attacks, and white-box video attacks, while this paper targets black-box attacks against video recognition models. Video recognition architectures include frame-based, recurrent, and spatiotemporal convolutional models.
- White-box Image Attack: White-box image attacks include FGSM, PGD, C&W, JSMA, DeepFool, and EAD, with PGD described as a strong iterative first-order method.
- Black-box Image Attack: Black-box image attacks use transferred adversarial examples or gradient estimation, including finite differences and NES, often with dimensionality reduction.
- White-box Video Attack: Prior video adversarial research mainly studies white-box attacks, including sparse or propagated perturbations across frames and GAN-based real-time perturbations.
- Video Recognition Models: Video recognition models include CNN+LSTM systems that capture temporal dependencies and I3D models that learn hierarchical spatiotemporal representations.
3 PROPOSED FRAMEWORK V-BAD
V-BAD generates black-box adversarial video examples by combining transferred tentative perturbations with patch-level gradient estimation and rectification. It supports targeted and untargeted attacks while reducing estimation to a selected perturbation subspace.
- Threat model: V-BAD constrains the threat model to top-1 labels and probabilities returned by a query-limited black-box video classifier.The attacker must generate an adversarial video within a prescribed query budget.
- Framework overview: Tentative perturbations are initialized from image-model guidance, with random, static, and image-model-derived variants considered.The image-model perturbations provide pixel-wise directions before patch-level correction.
- Attack variants: Targeted attacks start from a target-class sample and decay the perturbation bound, whereas untargeted attacks start from the clean sample with a fixed bound.These procedures maintain different class-related conditions during optimization.
- Partition-based rectification: V-BAD partitions tentative perturbations into patches and estimates a rectification weight for each patch through black-box queries.The rectified patch weights produce pixel-wise perturbations used in iterative updates.
- Partitioning methods: The framework evaluates random and uniform partitioning strategies while leaving semantic partitioning for future work.Random partitions ignore local correlations; uniform partitions preserve frame-local correlations.
- Subspace interpretation: Patch rectification reduces the estimation space from N × H × W × C dimensions to patch weights and estimates the gradient projection onto the resulting subspace.With perfect patch-weight estimation, the rectified perturbation is the closest vector to the adversarial gradient within that subspace.
4 EXPERIMENTS
The experiments evaluate V-BAD and its variants on three video datasets against two state-of-the-art recognition models, covering targeted and untargeted attacks. Ablations show that transferred perturbations, uniform partitioning, and NES improve attack efficiency and effectiveness, while V-BAD consistently performs strongly against the evaluated baselines.
- Experimental setting: V-BAD is evaluated on UCF-101, HMDB-51, and Kinetics-400 against I3D and CNN+LSTM video recognition models.The evaluation covers both targeted and untargeted black-box attacks under a perturbation bound of ϵ = 0.05 per frame and a query limit of Q = 3 × 10^5.
- Tentative perturbations: Transferred tentative perturbations reduce successful-attack queries from more than 10^5 to less than 6×10^4 with one image model and around 5×10^4 with an ensemble.The ensemble also improves over random and static perturbations, while static perturbations achieve 70% success rate versus 95% for random perturbations.
- Estimation methods: NES achieves a 100% success rate within the query limit, whereas FD achieves 70%, and successful NES attacks require roughly 20% fewer queries.The comparison uses similar query budgets per update for the two estimators.
- Attack comparisons: For untargeted attacks, V-BAD is the most effective and efficient method across all evaluated datasets and models, requiring only a few hundred queries to break CNN+LSTM.Untargeted attacks require approximately 10% as many queries as targeted attacks, and both attack types indicate substantial black-box vulnerability in video models.
5 CONCLUSION
The paper introduces V-BAD as the first black-box framework for attacking video recognition models using only black-box queries. Across two state-of-the-art models and three benchmark datasets, it achieves high attack success with significantly fewer queries for targeted and untargeted attacks, highlighting video models’ vulnerability and the need for effective defenses.
- V-BAD generates video adversarial examples using only black-box queries to the target video model.
- V-BAD addresses video dimensionality through tentative perturbation transfer followed by partition-based rectification with NES gradient estimation.
- V-BAD attacks two state-of-the-art video recognition models across three benchmark video datasets.
- V-BAD achieves high success rates with significantly fewer queries than existing black-box methods for both targeted and untargeted attacks.
- The results indicate that video models are highly vulnerable to black-box adversarial attacks and require effective defenses for secure video recognition.