A kind of anti-attack method for video action recognition that is not sensitive to sampling

Abstract

The invention discloses a video action recognition confrontation attack method that is insensitive to sampling. The video sample set χ is manually divided into the confrontation disturbance generation set χ. 1 and the adversarial check set χ 2 , and then generate the set χ from the adversarial perturbation 1 The adversarial disturbance feature set V is extracted from the adversarial disturbance feature set V, and then based on the adversarial disturbance feature set V, combined with the adversarial verification set χ 2 , and obtain the optimal sampling-insensitive anti-disturbance R through iterative optimization. * , and finally add sampling-insensitive adversarial perturbation R to the test arbitrary video sample X * , and test the attack effect.

Description

technical field [0001] The invention belongs to the technical field of adversarial attack and video action recognition, and more particularly relates to a video action recognition adversarial attack method that is insensitive to sampling. Background technique [0002] In recent years, video data has grown exponentially on the Internet due to its easy availability. Information mining and content understanding based on these video data have important academic and commercial value. Video action recognition has received extensive attention as an important video content understanding problem. The existing mainstream recognition methods in the field of video action recognition are based on deep convolutional neural networks. However, in recent years, it has been proved that deep convolutional neural networks are vulnerable to adversarial attacks. Adversarial attacks mainly achieve the purpose of misclassifying existing deep network models by adding some noise to the data in the ...

AI Technical Summary

Problems solved by technology

[0010] (1) Separate attack processing is performed on video frames. The rich time-domain connection characteristics of video frames in videos are ignored. In video data sets with complex timing reasoning, this method of separately processing video frames will lose video timing. Context features, thereby affecting the attack effect;

[0011] (2), Only the sampled video frame data is attacked and processed, and video-level confrontation attacks cannot be achieved

Since there are many frame sampling methods for a given video, if the adversarial attack processing is only performed on the sampled frame data under a certain sampling method, then the attack method will be invalid under another sampling method of the video

Images