arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2409.02483cs.CVcs.AI
收藏

TASAR:基于迁移的骨骼动作识别攻击

TASAR: Transfer-based Attack on Skeletal Action Recognition

Hefei University of Technology(合肥工业大学);Institute of Automation, Chinese Academy of Sciences(中国科学院自动化研究所);Beijing Academy of Artificial Intelligence(北京智源人工智能研究院);Beihang University(北京航空航天大学);University College London(伦敦大学学院)

Yunfeng Diao, Baiqi Wu, Ruixuan Zhang, Ajian Liu, Xiaoshuai Hao, Xingxing Wei, Meng Wang, He Wang

AI总结:

本文针对基于骨骼的人类活动识别(S-HAR)中基于迁移的攻击研究不足、迁移性弱的问题,提出首个基于迁移的攻击TASAR,通过平滑损失函数、引入双重贝叶斯优化和运动动力学,构建大规模基准验证其优越性。

摘要:

骨骼序列数据作为人类动作的广泛使用表示形式,在人类活动识别(HAR)中至关重要。近年来,该领域提出了对抗攻击,暴露了潜在的安全问题,更重要的是为模型鲁棒性测试提供了良好工具。在这项研究中,基于迁移的攻击是一个重要工具,因为它模拟了攻击者不了解目标模型的真实场景,但在基于骨骼的HAR(S-HAR)中研究不足。因此,现有S-HAR攻击的对抗迁移性较弱,原因在很大程度上仍未知。在本文中,我们通过损失函数的表征来研究这一现象。我们发现迁移性差的一个突出指标是损失函数的低平滑性。基于这一观察,我们通过在计算对抗样本时适当平滑损失来提高迁移性。这导致了首个针对骨骼动作识别的基于迁移的攻击TASAR。TASAR探索了预训练代理的平滑模型后验,这是通过新的训练后双重贝叶斯优化策略实现的。此外,与现有忽略序列内时间连贯性的基于迁移的方法不同,TASAR将运动动力学纳入贝叶斯攻击,有效破坏S-HAR的时空连贯性。为了详尽评估,我们构建了首个大规模鲁棒S-HAR基准,包括7个S-HAR模型、10种攻击方法、3个S-HAR数据集和2个防御模型。大量结果证明了TASAR的优越性。我们的基准使未来研究易于比较,代码可在https://github.com/yunfengdiao/Skeleton-Robustness-Benchmark获取。

英文摘要:

Skeletal sequence data, as a widely employed representation of human actions, are crucial in Human Activity Recognition (HAR). Recently, adversarial attacks have been proposed in this area, which exposes potential security concerns, and more importantly provides a good tool for model robustness test. Within this research, transfer-based attack is an important tool as it mimics the real-world scenario where an attacker has no knowledge of the target model, but is under-explored in Skeleton-based HAR (S-HAR). Consequently, existing S-HAR attacks exhibit weak adversarial transferability and the reason remains largely unknown. In this paper, we investigate this phenomenon via the characterization of the loss function. We find that one prominent indicator of poor transferability is the low smoothness of the loss function. Led by this observation, we improve the transferability by properly smoothening the loss when computing the adversarial examples. This leads to the first Transfer-based Attack on Skeletal Action Recognition, TASAR. TASAR explores the smoothened model posterior of pre-trained surrogates, which is achieved by a new post-train Dual Bayesian optimization strategy. Furthermore, unlike existing transfer-based methods which overlook the temporal coherence within sequences, TASAR incorporates motion dynamics into the Bayesian attack, effectively disrupting the spatial-temporal coherence of S-HARs. For exhaustive evaluation, we build the first large-scale robust S-HAR benchmark, comprising 7 S-HAR models, 10 attack methods, 3 S-HAR datasets and 2 defense models. Extensive results demonstrate the superiority of TASAR. Our benchmark enables easy comparisons for future studies, with the code available in the https://github.com/yunfengdiao/Skeleton-Robustness-Benchmark.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑