[Paper Review] Attacking Video Recognition Models with Bullet-Screen Comments

Kai Chen, Zhipeng Wei+3 more|arXiv (Cornell University)|Oct 29, 2021

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes a novel black-box adversarial attack on video recognition models using bullet-screen comments (BSCs) as meaningful, low-visibility adversarial patches. By formulating the attack as a reinforcement learning (RL) problem to optimize BSC position and transparency, the method achieves a 90% fooling rate on UCF-101 and HMDB-51 with less than 8% video occlusion, significantly outperforming square patch attacks in stealth and efficiency.

ABSTRACT

Recent research has demonstrated that Deep Neural Networks (DNNs) are vulnerable to adversarial patches which introduce perceptible but localized changes to the input. Nevertheless, existing approaches have focused on generating adversarial patches on images, their counterparts in videos have been less explored. Compared with images, attacking videos is much more challenging as it needs to consider not only spatial cues but also temporal cues. To close this gap, we introduce a novel adversarial attack in this paper, the bullet-screen comment (BSC) attack, which attacks video recognition models with BSCs. Specifically, adversarial BSCs are generated with a Reinforcement Learning (RL) framework, where the environment is set as the target model and the agent plays the role of selecting the position and transparency of each BSC. By continuously querying the target models and receiving feedback, the agent gradually adjusts its selection strategies in order to achieve a high fooling rate with non-overlapping BSCs. As BSCs can be regarded as a kind of meaningful patch, adding it to a clean video will not affect people' s understanding of the video content, nor will arouse people' s suspicion. We conduct extensive experiments to verify the effectiveness of the proposed method. On both UCF-101 and HMDB-51 datasets, our BSC attack method can achieve about 90\% fooling rate when attacking three mainstream video recognition models, while only occluding extless 8\% areas in the video. Our code is available at https://github.com/kay-ck/BSC-attack.

Motivation & Objective

• To address the lack of effective patch-based attacks on video recognition models in the black-box setting.
• To reduce perceptibility and suspicion in adversarial attacks by using bullet-screen comments (BSCs) instead of standard rectangular patches.
• To improve query efficiency and fooling rate in black-box video attacks through reinforcement learning.
• To evaluate the robustness of BSCs against defense mechanisms like Local Gradient Smoothing (LGS).

Proposed method

• Formulates the BSC attack as a reinforcement learning (RL) problem where the agent selects BSC positions and transparencies based on feedback from the target model.
• Uses an image captioning model to automatically generate diverse, meaningful BSCs for each video frame.
• Designs a dual-reward function in RL: one for maximizing fooling rate and another for minimizing IoU between BSCs to avoid overlap.
• Employs an LSTM and fully connected layer as the agent policy network to handle sequential decision-making across frames.
• Applies the attack in a black-box setting with only model predictions as feedback, enabling query-efficient optimization.
• Optimizes BSCs to minimize visual impact while maximizing misclassification of video recognition models.

Experimental results

Research questions

• RQ1 Can bullet-screen comments (BSCs) serve as effective, stealthy adversarial patches for video recognition models?
• RQ2 How does the RL-based optimization of BSC position and transparency improve attack efficiency and fooling rate compared to random or baseline methods?
• RQ3 To what extent do BSCs reduce perceptibility and suspicion compared to traditional square patches?
• RQ4 How robust are BSCs against defense mechanisms like Local Gradient Smoothing (LGS)?
• RQ5 Can BSCs achieve high fooling rates while occluding significantly less video area than square patches?

Key findings

• The BSC attack achieves a 90% fooling rate on both UCF-101 and HMDB-51 datasets when attacking three mainstream video models, with less than 8% video occlusion.
• Compared to square patches, BSCs reduce occluded area by over 52% due to their scattered, non-rectangular shape.
• Reinforcement learning reduces query count by more than 22% compared to baseline heuristic (BH) methods on C3D and LRCN models.
• BSCs outperform square patches in fooling rate under the same occlusion area, especially on I3D-Slow (93.9% vs. 67.3% on HMDB-51).
• BSCs are more robust than square patches against the LGS defense, maintaining higher fooling rates under the same conditions.
• Visual saliency analysis confirms that BSCs are less conspicuous than square patches, reducing the likelihood of detection at a glance.