[Paper Review] Flickering Adversarial Attacks against Video Recognition Networks

Itay Naeh, Roi Pony+1 more|arXiv (Cornell University)|Feb 12, 2020

Adversarial Robustness in Machine Learning15 references1 citations

TL;DR

This paper proposes flickering adversarial attacks that exploit temporal inconsistencies in video recognition models using barely perceptible, time-varying perturbations. By applying these perturbations universally across videos and making them temporally invariant, the method achieves high fooling rates in real-world settings with minimal input data, bridging the gap between simulation and practical deployment.

ABSTRACT

Deep neural networks for video classification, just like image classification networks, may be subjected to adversarial manipulation. The main difference between image classifiers and video classifiers is that the latter usually use temporal information contained within the video. In this work we present a manipulation scheme for fooling video classifiers by introducing a flickering temporal perturbation that is practically unnoticeable by human observers and is implementable in the real world. After demonstrating the manipulation of action classification of single videos, we generalize the procedure to make universal adversarial perturbation by using only dozens of videos, achieving high fooling ratio. In addition, we generalize the universal perturbation and produce a temporal-invariant perturbation, which can be applied to the video without synchronizing the perturbation to the input. These properties allow us to bridge the gap between simulated environment and real-world application.

Motivation & Objective

• To develop adversarial attacks that exploit temporal dynamics in video classification models.
• To create perturbations that are imperceptible to humans but effective in fooling video classifiers.
• To generalize single-video attacks into universal perturbations using only dozens of videos.
• To design temporally invariant perturbations that do not require synchronization with input video.

Proposed method

• Introduces a flickering temporal perturbation that alternates rapidly between frames to remain undetected by human observers.
• Applies gradient-based optimization to generate adversarial perturbations that maximize misclassification in video models.
• Learns a universal perturbation across a small set of videos, enabling transferability to unseen videos.
• Constructs a temporal-invariant perturbation by decoupling the perturbation from input video timing, enabling application without synchronization.

Experimental results

Research questions

• RQ1 Can flickering temporal perturbations effectively fool video recognition models while remaining imperceptible?
• RQ2 How can a universal adversarial perturbation be learned with minimal training data (dozens of videos)?
• RQ3 Can temporal-invariant perturbations be constructed to work across videos without timing alignment?
• RQ4 To what extent do these attacks generalize across different video recognition models?

Key findings

• The proposed flickering perturbations achieve high fooling rates on video classification models while being nearly imperceptible to human observers.
• Universal adversarial perturbations are successfully learned using only dozens of videos, significantly reducing data requirements.
• Temporal-invariant perturbations can be applied without synchronization to the input video, enhancing real-world feasibility.
• The method demonstrates strong transferability across different video recognition architectures, indicating robustness and generalization.