Black-box adversarial attacks on videos
A method for generating black-box adversarial attacks on video recognition models is provided, comprising a) passing input video frames into a public image model, to obtain pixel-wise tentative perturbations; b) partitioning the tentative perturbations into tentative perturbation patches; c) estimating the rectification weight required for each patch, via querying the target video model; d) applying the patch-wise rectification weight on the patches, to obtain the rectified pixel-wise perturbations; e) applying one step projected gradient descent (PGD) perturbation on the input video, according to the rectified pixel-wise perturbations; and f) iteratively performing steps a)-e) until an attack succeeds or a query limit is reached. Systems and networks therefor are also provided.
1. A method for providing black-box video attacks on video recognition models, comprising:
a) passing input video frames into a public image model, to obtain pixel-wise tentative perturbations;
b) partitioning the tentative perturbations into tentative perturbation patches;
c) estimating the rectification weight required for each patch, via querying the target video model;
d) applying the patch-wise rectification weight on the patches, to obtain the rectified pixel-wise perturbations;
e) applying one step projected gradient descent (PGD) perturbation on the input video, according to the rectified pixel-wise perturbations; and
f) iteratively performing steps a)-e) until an attack succeeds or a query limit is reached.
2. The method of claim 1 , wherein the tentative perturbation is defined as the sign values of the perturbation.
3. The method of claim 1 , wherein the tentative perturbation is a random perturbation, wherein the perturbation for each input dimension is generated randomly with 50% probability of being either 1 or −1.
4. The method of claim 1 , wherein the tentative perturbation is a static perturbation, wherein the perturbation for each input dimension is fixed to 1.
5. The method of claim 1 , wherein the tentative perturbation is a transferred perturbation, wherein the perturbation can alternatively be transferred from existing pre-trained image models.
6. The method of claim 1 , wherein each tentative perturbation patch is adjusted by multiplying all its dimensions by a rectification factor found by a gradient estimator.
7. The method of claim 6 , wherein the gradient estimator is FD or NES.
8. The method of claim 1 , wherein the partitioning step includes dividing input dimensions randomly into a certain number of partitions.
9. The method of claim 1 , wherein the partitioning step includes splitting a frame uniformly into some patches.
10. The method of claim 1 , wherein the partitioning step includes partitioning the video input according to its semantic content.
11. The method of claim 1 , wherein a successful attack comprises the situation that an untargeted adversarial example has been found or a targeted adversarial example.
12. The method of claim 1 , wherein the query limit is preset.
13. The method of claim 11 , wherein the untargeted adversarial example is an example that can be misclassified in an arbitrary class other than the correct one.
14. The method of claim 11 , wherein the targeted adversarial example is an example that can be misclassified in a targeted adversarial class.
15. The method of claim 1 , wherein the public image model is pre-trained ImageNet.
16. A system for providing black-box video attacks on a video recognition model, comprising:
a) a perturbation creator for creating pixel-wise tentative perturbations by passing input video frames into a public image model;
b) a partitioner for dividing the tentative perturbations into tentative perturbation patches;
c) a black-box gradient estimator for estimating the rectification weight required for each patch, via querying the target video model;
d) a patch-based rectifier for applying the patch-wise rectification weight on the patches, to obtain the rectified pixel-wise perturbations;
e) a frame modifier for applying one step projected gradient descent (PGD) perturbation on the input video, according to the rectified pixel-wise perturbations;
f) a counter for counting query numbers; and
g) a receiver for receiving the recognition result from the video recognition model;
wherein the perturbation creator, the partitioner, the black-box gradient estimator, the patch-based rectifier and the frame modifier work iteratively, until the query numbers reach a query limit in the counter, or a result including an untargeted adversarial example or a target adversarial example is received by the receiver.
17. The system of claim 16 , wherein the partitioner divides the tentative perturbations into tentative perturbation patches randomly.
18. The system of claim 16 , wherein the partitioner divides the tentative perturbations into tentative perturbation patches uniformly.
19. The system of claim 16 , wherein the partitioner divides the tentative perturbations into tentative perturbation patches according to the semantic content of the tentative perturbations.