Video action recognition adversarial attack method insensitive to sampling

Abstract

The invention discloses a video action recognition adversarial attack method insensitive to sampling. The method comprises the steps of: manually dividing a video sample set chi into an adversarial disturbance generation set chi 1 and an adversarial check set chi 2; extracting an adversarial disturbance feature set V from the adversarial disturbance generation set chi 1; and then based on the adversarial disturbance feature set V and verification of the adversarial verification set chi 2, obtaining an optimal sampling insensitive adversarial disturbance R * through an iterative optimization mode, and finally adding the sampling insensitive adversarial disturbance R * into any video sample X to be tested and testing an attack effect.

Description

technical field [0001] The invention belongs to the technical field of adversarial attack and video action recognition, and more particularly relates to a video action recognition adversarial attack method that is insensitive to sampling. Background technique [0002] In recent years, video data has grown exponentially on the Internet due to its easy availability. Information mining and content understanding based on these video data have important academic and commercial value. Video action recognition has received extensive attention as an important video content understanding problem. The existing mainstream recognition methods in the field of video action recognition are based on deep convolutional neural networks. However, in recent years, it has been proved that deep convolutional neural networks are vulnerable to adversarial attacks. Adversarial attacks mainly achieve the purpose of misclassifying existing deep network models by adding some noise to the data in the ...

AI Technical Summary

Problems solved by technology

[0010] (1) Separate attack processing is performed on video frames. The rich time-domain connection characteristics of video frames in videos are ignored. In video data sets with complex timing reasoning, this method of separately processing video frames will lose video timing. Context features, thereby affecting the attack effect;

[0011] (2), Only the sampled video frame data is attacked and processed, and video-level confrontation attacks cannot be achieved

Since there are many frame sampling methods for a given video, if the adversarial attack processing is only performed on the sampled frame data under a certain sampling method, then the attack method will be invalid under another sampling method of the video

Images