Black-Box Adversarial Video Attacks via Patch Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for generating black-box adversarial attacks on video recognition models are inefficient due to the high dimensionality of videos, requiring many more queries than image models, making them impractical for time and budget constraints.
Innovation Solution
A method involving passing input video frames through a public image model to obtain pixel-wise perturbations, partitioning these into patches, estimating rectification weights via querying the target model, applying patch-wise rectification, and using one-step projected gradient descent (PGD) perturbations, iteratively refining until an attack succeeds or a query limit is reached.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If black-box adversarial attacks are applied to video recognition models using traditional methods, then attack capability is achieved, but the number of queries required becomes excessively large due to high video dimensionality
Solution Approach 1:
The patent segments the high-dimensional video input into multiple lower-dimensional patches or regions. Instead of estimating gradients over the entire video, the method divides the video into spatial patches and processes each patch separately, significantly reducing the dimensionality and number of queries required for each gradient estimation step.
Solution Approach 2:
The patent transforms the problem from estimating gradients in the high-dimensional pixel space to estimating gradients in a lower-dimensional patch space. By changing the dimensionality of the attack space from individual pixels to aggregated patches, the method reduces the computational burden and query requirements while maintaining attack effectiveness.
2Measurement precision
If pixel-wise gradient estimation is performed on video frames, then precise attack direction is obtained, but the computational complexity and query requirements increase dramatically
Solution Approach 1:
The patent segments the video frames into patches and performs gradient estimation at the patch level rather than pixel level. This segmentation maintains sufficient precision for generating effective attack directions while dramatically reducing computational complexity by aggregating multiple pixels into each patch.
Solution Approach 2:
The patent applies partial gradient estimation by focusing on patch-level gradients rather than complete pixel-level gradients. This partial action provides sufficient precision for adversarial attacks without the excessive computational cost of full pixel-wise estimation, achieving a practical balance between accuracy and complexity.
Data Source
AI summary
A method for generating black-box adversarial attacks on video recognition models is provided, comprising a) passing input video frames into a public image model, to obtain pixel-wise tentative perturbations; b) partitioning the tentative perturbations into tentative perturbation patches; c) estimating the rectification weight required for each patch, via querying the target video model; d) applying the patch-wise rectification weight on the patches, to obtain the rectified pixel-wise perturbations; e) applying one step projected gradient descent (PGD) perturbation on the input video, according to the rectified pixel-wise perturbations; and f) iteratively performing steps a)-e) until an attack succeeds or a query limit is reached. Systems and networks therefor are also provided.