Enhancing robustness in video recognition models: Sparse adversarial attacks and beyond.

Area of Science:

• Computer Vision
• Machine Learning
• Cybersecurity

Background:

• Adversarial attacks on images are well-studied, but adversarial attacks on videos remain largely unexplored.
• Existing methods often lack efficiency and human imperceptibility in video attack scenarios.

Purpose of the Study:

• To propose DeepSAVA, a novel sparse adversarial attack strategy for videos.
• To enhance the robustness of video classification models against adversarial attacks.

Main Methods:

• DeepSAVA integrates spatial transformation and additive perturbations on key video frames.
• Utilizes Bayesian Optimization (BO) for critical frame identification and Stochastic Gradient Descent (SGD) for perturbation generation.
• Employs Structural Similarity Index (SSIM) to measure frame alterations, prioritizing human imperceptibility.

Main Results:

• DeepSAVA achieves state-of-the-art attack success rates (up to 100% on I3D model with single-frame perturbation) and adversarial transferability.
• Demonstrates high efficiency and human imperceptibility in generated adversarial videos.
• The proposed adversarial training framework significantly improves video classifier robustness compared to PGD-based methods.

Conclusions:

• DeepSAVA presents an effective and efficient method for generating sparse adversarial video attacks.
• The developed adversarial training strategy enhances the resilience of video classification models.
• This research opens new avenues for understanding and defending against video-based adversarial threats.