Universal Sparse Adversarial Attack on Video Recognition Models

Abstract

Recent studies have discovered that deep neural networks (DNNs) are vulnerable to adversarial examples. So far, most of the adversarial researches have focused on image models. Whilst several attacks have been proposed for video models, their crafted perturbation are mainly per-instance and totally polluted ways. Thus, universal sparse video attacks are still unexplored. In this article, the authors propose a new method to explore universal sparse adversarial perturbation for video recognition system and study the robustness of a 3D-ResNet-based video action recognition model. A large number of experiments on UCF101 and HMDB51 show that this attack method can reduce the success rate of recognition model to 5% or less while only changing 1% of pixels in the video. On this basis, by changing the selection method of sparse pixels and the pollution mode in the algorithm, the patch attack algorithm with temporal sparsity and the one-pixel attack algorithm are proposed.