arXiv 2403.116562024-03-27cs.CV

LocalStyleFool：使用 Segment Anything Model 的区域视频风格迁移攻击

LocalStyleFool: Regional Video Style Transfer Attack Using Segment Anything Model

Shenzhen International Graduate School, Tsinghua University（清华大学深圳国际研究生院）；Shandong University（山东大学）；CSIRO’s Data61（联邦科学与工业研究组织数据61部）；Ping An Technology（平安科技）；Shenzhen Institute of Information Technology（深圳信息职业技术学院）

Yuxin Cao, Jinghao Li, Xi Xiao, Derui Wang, Minhui Xue, Hao Ge, Wei Liu, Guangwu Hu

备注：: Accepted to 2024 IEEE Security and Privacy Workshops (SPW)

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

提出 LocalStyleFool，利用 SAM 进行区域分割与跟踪，将基于风格迁移的扰动叠加到选定区域，提升了对抗攻击的自然性与高分辨率下的可扩展性，同时保持欺骗率和查询效率。

摘要：

先前的研究表明，精心设计的对抗性扰动会威胁视频识别系统的安全性。当扰动具有语义不变性时（例如 StyleFool），攻击者可以以较低的查询预算入侵此类模型。尽管查询效率较高，但细节区域的自然性仍有待改善，因为 StyleFool 对每帧中的所有像素都进行风格迁移。为了弥补这一差距，我们提出了 LocalStyleFool，这是一种改进的黑盒视频对抗攻击方法，将基于区域风格迁移的扰动叠加在视频上。得益于 Segment Anything Model (SAM) 的普及和可扩展的可用性，我们首先根据语义信息提取不同区域，然后通过视频流跟踪它们以保持时间一致性。接着，我们基于迁移梯度信息的关联标准和区域面积，向选定的几个区域添加基于风格迁移的扰动。随后进行扰动微调，使风格化视频具有对抗性。我们通过人工评估调查证明，LocalStyleFool 能够提升帧内和帧间的自然性，同时保持具有竞争力的欺骗率和查询效率。在高分辨率数据集上的成功实验也表明，SAM 的精细分割有助于提升对抗攻击在高分辨率数据下的可扩展性。

英文摘要：

Previous work has shown that well-crafted adversarial perturbations can threaten the security of video recognition systems. Attackers can invade such models with a low query budget when the perturbations are semantic-invariant, such as StyleFool. Despite the query efficiency, the naturalness of the minutia areas still requires amelioration, since StyleFool leverages style transfer to all pixels in each frame. To close the gap, we propose LocalStyleFool, an improved black-box video adversarial attack that superimposes regional style-transfer-based perturbations on videos. Benefiting from the popularity and scalably usability of Segment Anything Model (SAM), we first extract different regions according to semantic information and then track them through the video stream to maintain the temporal consistency. Then, we add style-transfer-based perturbations to several regions selected based on the associative criterion of transfer-based gradient information and regional area. Perturbation fine adjustment is followed to make stylized videos adversarial. We demonstrate that LocalStyleFool can improve both intra-frame and inter-frame naturalness through a human-assessed survey, while maintaining competitive fooling rate and query efficiency. Successful experiments on the high-resolution dataset also showcase that scrupulous segmentation of SAM helps to improve the scalability of adversarial attacks under high-resolution data.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。