[Paper Review] Over-the-Air Adversarial Flickering Attacks against Video Recognition Networks

Roi Pony, Itay Naeh+1 more|arXiv (Cornell University)|Feb 12, 2020

Adversarial Robustness in Machine Learning36 references4 citations

TL;DR

This paper proposes over-the-air adversarial flickering attacks that manipulate video action recognition models using subtle, temporally varying RGB light perturbations from an RGB LED bulb. By optimizing for imperceptibility and time-invariance, the method achieves 93% fooling ratio on I3D models and demonstrates real-world transferability across models without frame synchronization.

ABSTRACT

Deep neural networks for video classification, just like image classification networks, may be subjected to adversarial manipulation. The main difference between image classifiers and video classifiers is that the latter usually use temporal information contained within the video. In this work we present a manipulation scheme for fooling video classifiers by introducing a flickering temporal perturbation that in some cases may be unnoticeable by human observers and is implementable in the real world. After demonstrating the manipulation of action classification of single videos, we generalize the procedure to make universal adversarial perturbation, achieving high fooling ratio. In addition, we generalize the universal perturbation and produce a temporal-invariant perturbation, which can be applied to the video without synchronizing the perturbation to the input. The attack was implemented on several target models and the transferability of the attack was demonstrated. These properties allow us to bridge the gap between simulated environment and real-world application, as will be demonstrated in this paper for the first time for an over-the-air flickering attack.

Motivation & Objective

• To develop a real-world applicable adversarial attack on video action recognition models using physical light modulation.
• To ensure the adversarial perturbation remains imperceptible to human observers through temporal smoothness and reduced spatio-temporal roughness.
• To generalize the attack into a universal, time-invariant perturbation that does not require synchronization with the input video.
• To demonstrate transferability of the attack across different video recognition models and real-world deployment.
• To bridge the gap between simulated adversarial attacks and real-world physical implementations in video classification systems.

Proposed method

• Apply a uniform RGB perturbation across each frame to create a flickering temporal pattern that mimics natural lighting changes.
• Introduce two regularization terms during optimization: one for temporal smoothness (reducing flicker rate) and one for amplitude control (minimizing perceptibility).
• Modify the adversarial loss function to jointly optimize for fooling the target model and minimizing perceptibility via regularization.
• Construct universal perturbations that generalize across actions and scenes, enabling application without prior knowledge of the input video.
• Implement the attack over-the-air by transmitting the adversarial RGB pattern via a Wi-Fi-controlled RGB LED bulb to modulate real-world lighting.
• Use time-invariant perturbations to eliminate the need for frame-level synchronization between the attack signal and video input.

Experimental results

Research questions

• RQ1 Can flickering adversarial perturbations be made imperceptible to human observers while still effectively fooling video action recognition models?
• RQ2 Can a universal, time-invariant adversarial perturbation be constructed that works across diverse video inputs without synchronization?
• RQ3 To what extent does the attack transfer across different video recognition models in real-world settings?
• RQ4 Can the attack be successfully deployed in the physical world using real lighting devices like smart RGB bulbs?
• RQ5 How does the combination of temporal regularization and modified adversarial loss improve the imperceptibility and effectiveness of the attack?

Key findings

• The proposed flickering attack achieves a 93% fooling ratio on the I3D model for video action recognition using universal, time-invariant perturbations.
• The attack is imperceptible to human observers when the perturbation is smooth and temporally constrained, as demonstrated in video examples.
• The method successfully demonstrates over-the-air deployment using a Wi-Fi-controlled RGB LED bulb to modulate real-world lighting conditions.
• The attack shows strong transferability across different video recognition models, including those from the Kinetics-400 benchmark.
• Time-invariant perturbations enable real-world applicability by eliminating the need for frame-level synchronization with the input video.
• The attack remains effective even when the camera’s RGB response and chromatic crosstalk differ from the ideal model, confirming robustness in real-world conditions.