[Paper Review] Universal 3-Dimensional Perturbations for Black-Box Attacks on Video Recognition Systems

Shangyu Xie, Han Wang+2 more|arXiv (Cornell University)|Jul 9, 2021

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes Universal 3-Dimensional (U3D) perturbations for black-box adversarial attacks on video recognition systems, generating transferable, imperceptible, and temporally consistent perturbations that universally fool multiple DNN models without model access. The method achieves high attack success rates on large-scale video datasets while bypassing state-of-the-art defenses and enabling real-time streaming attacks with minimal computational overhead.

ABSTRACT

Widely deployed deep neural network (DNN) models have been proven to be vulnerable to adversarial perturbations in many applications (e.g., image, audio and text classifications). To date, there are only a few adversarial perturbations proposed to deviate the DNN models in video recognition systems by simply injecting 2D perturbations into video frames. However, such attacks may overly perturb the videos without learning the spatio-temporal features (across temporal frames), which are commonly extracted by DNN models for video recognition. To our best knowledge, we propose the first black-box attack framework that generates universal 3-dimensional (U3D) perturbations to subvert a variety of video recognition systems. U3D has many advantages, such as (1) as the transfer-based attack, U3D can universally attack multiple DNN models for video recognition without accessing to the target DNN model; (2) the high transferability of U3D makes such universal black-box attack easy-to-launch, which can be further enhanced by integrating queries over the target model when necessary; (3) U3D ensures human-imperceptibility; (4) U3D can bypass the existing state-of-the-art defense schemes; (5) U3D can be efficiently generated with a few pre-learned parameters, and then immediately injected to attack real-time DNN-based video recognition systems. We have conducted extensive experiments to evaluate U3D on multiple DNN models and three large-scale video datasets. The experimental results demonstrate its superiority and practicality.

Motivation & Objective

• To address the limitations of frame-by-frame adversarial attacks on video recognition, which suffer from poor temporal consistency, high computational cost, and detectability by defenses like AdvIT.
• To develop a transfer-based black-box attack framework that universally fools multiple video DNN models without requiring access to or querying the target model.
• To ensure human imperceptibility and robustness against state-of-the-art defense mechanisms, including universal adversarial training, detection schemes, and certified defenses.
• To enable efficient, on-the-fly generation of perturbations for real-time video stream attacks with low latency (~0.015s per frame).

Proposed method

• The method generates U3D perturbations by maximizing feature deviation in the DNN’s feature space while strictly bounding perturbation magnitude across spatial and temporal dimensions.
• It optimizes for transferability by explicitly targeting layer-wise features of video DNNs, enhancing performance across diverse models.
• Boundary effect mitigation is integrated into the optimization to prevent misalignment between perturbations and video frames.
• The attack uses a transfer-based strategy, enabling universal perturbation generation independent of the target model, with optional query enhancement for improved success.
• Perturbations are generated offline with pre-learned parameters and injected in real time, ensuring low computational overhead.
• The framework is designed to be model-agnostic and compatible with various video recognition architectures and datasets.

Experimental results

Research questions

• RQ1 Can universal 3D perturbations be generated that transfer effectively across multiple video recognition models in a black-box setting without model access or queries?
• RQ2 How does the proposed U3D attack compare in transferability, imperceptibility, and robustness to existing frame-by-frame or 2D-based video attacks?
• RQ3 To what extent can U3D perturbations bypass state-of-the-art defense mechanisms, including universal adversarial training, detection schemes, and certified defenses?
• RQ4 Can U3D perturbations be efficiently generated and applied in real-time to streaming video data with minimal latency?
• RQ5 How does the integration of temporal consistency and boundary effect mitigation improve attack performance and imperceptibility?

Key findings

• The U3D attack achieves significantly higher attack success rates than state-of-the-art methods like C-DUP, V-BAD, and H-Opt on three large-scale video datasets.
• U3D perturbations are highly transferable, successfully attacking multiple video DNN models without requiring access to or queries against the target model.
• The attack maintains strong human imperceptibility, validated through user surveys, and avoids detection by AdvIT, a leading adversarial example detector.
• U3D perturbations successfully bypass multiple defense schemes, including universal adversarial training (UAT), detection-based defenses (e.g., AdvIT), and certified defenses like PixelDP and randomized smoothing.
• The method enables real-time attack deployment with minimal computational cost—approximately 0.015 seconds per frame—making it suitable for streaming video applications.
• Even when defenses are adapted to the U3D attack, the attack remains more effective than prior methods, indicating its robustness and practical threat potential.