StyleFool：通过风格迁移欺骗视频分类系统
StyleFool: Fooling Video Classification Systems via Style Transfer
AI总结：
本文提出 StyleFool，一种基于风格迁移的黑盒视频对抗攻击方法，通过色彩主题邻近性选择风格图像并结合无梯度优化，在 UCF-101 和 HMDB-51 上以更少查询次数和更强防御鲁棒性超越现有攻击。
摘要：
视频分类系统容易受到对抗性攻击，这可能在视频验证中造成严重的安全问题。当前的黑盒攻击需要大量查询才能成功，导致攻击过程中产生高昂的计算开销。另一方面，带有受限扰动的攻击对去噪或对抗训练等防御手段效果不佳。在本文中，我们聚焦于非受限扰动，并提出 StyleFool，一种通过风格迁移来欺骗视频分类系统的黑盒视频对抗攻击方法。StyleFool 首先利用色彩主题邻近性来选择最佳风格图像，这有助于避免风格化视频中出现不自然的细节。同时，在定向攻击中额外考虑目标类别置信度，通过使风格化视频更接近甚至跨越决策边界来影响分类器的输出分布。随后采用一种无梯度方法进一步优化对抗扰动。我们在两个标准数据集 UCF-101 和 HMDB-51 上进行了大量实验来评估 StyleFool。实验结果表明，StyleFool 在查询次数和对现有防御的鲁棒性方面均优于最先进的对抗攻击方法。此外，在非定向攻击中，50% 的风格化视频不需要任何查询，因为它们已经能够欺骗视频分类模型。进一步地，我们通过用户研究评估了不可区分性，结果表明 StyleFool 的对抗样本尽管使用了非受限扰动，但在人眼看来仍然难以察觉。
英文摘要：
Video classification systems are vulnerable to adversarial attacks, which can create severe security problems in video verification. Current black-box attacks need a large number of queries to succeed, resulting in high computational overhead in the process of attack. On the other hand, attacks with restricted perturbations are ineffective against defenses such as denoising or adversarial training. In this paper, we focus on unrestricted perturbations and propose StyleFool, a black-box video adversarial attack via style transfer to fool the video classification system. StyleFool first utilizes color theme proximity to select the best style image, which helps avoid unnatural details in the stylized videos. Meanwhile, the target class confidence is additionally considered in targeted attacks to influence the output distribution of the classifier by moving the stylized video closer to or even across the decision boundary. A gradient-free method is then employed to further optimize the adversarial perturbations. We carry out extensive experiments to evaluate StyleFool on two standard datasets, UCF-101 and HMDB-51. The experimental results demonstrate that StyleFool outperforms the state-of-the-art adversarial attacks in terms of both the number of queries and the robustness against existing defenses. Moreover, 50% of the stylized videos in untargeted attacks do not need any query since they can already fool the video classification model. Furthermore, we evaluate the indistinguishability through a user study to show that the adversarial samples of StyleFool look imperceptible to human eyes, despite unrestricted perturbations.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
