FeatureFool：通过特征图实现视频模型的零查询欺骗

Parsimonious Black-Box Adversarial Attacks via Efficient Combinatorial Optimization

Solving for adversarial examples with projected gradient descent has been demonstrated to be highly effective in fooling the neural network based classifiers. However, in the black-box setting, the attacker is limited only to the query access to the network and solving for a successful adversarial example becomes much more difficult. To this end, recent methods aim at estimating the true gradient signal based on the input queries but at the cost of excessive queries. We propose an efficient discrete surrogate to the optimization problem which does not require estimating the gradient and conseq…

面向服务计算的查询高效视频对抗攻击：带风格化标志

Query-Efficient Video Adversarial Attack with Stylized Logo on Service Computing

提出一种黑盒视频攻击框架SLA，通过风格化标志和强化学习实现低预算、高逼真度的对抗样本生成，在目标攻击中优于现有方法。

Low Frequency Adversarial Perturbation

Adversarial images aim to change a target model's decision by minimally perturbing a target image. In the black-box setting, the absence of gradient information often renders this search problem costly in terms of query complexity. In this paper we propose to restrict the search for adversarial images to a low frequency domain. This approach is readily compatible with many existing black-box attack frameworks and consistently reduces their query cost by 2 to 4 times. Further, we can circumvent image transformation defenses even when both the model and the defense strategy are unknown. Finally,…

GeoDA: a geometric framework for black-box adversarial attacks

Adversarial examples are known as carefully perturbed images fooling image classifiers. We propose a geometric framework to generate adversarial examples in one of the most challenging black-box settings where the adversary can only generate a small number of queries, each of them returning the top-$1$ label of the classifier. Our framework is based on the observation that the decision boundary of deep networks usually has a small mean curvature in the vicinity of data samples. We propose an effective iterative algorithm to generate query-efficient black-box perturbations with small $\ell_p$ n…

StyleFool：通过风格迁移欺骗视频分类系统

StyleFool: Fooling Video Classification Systems via Style Transfer

本文提出 StyleFool，一种基于风格迁移的黑盒视频对抗攻击方法，通过色彩主题邻近性选择风格图像并结合无梯度优化，在 UCF-101 和 HMDB-51 上以更少查询次数和更强防御鲁棒性超越现有攻击。

Zero-Query Transfer Attacks on Context-Aware Object Detectors

Adversarial attacks perturb images such that a deep neural network produces incorrect classification results. A promising approach to defend against adversarial attacks on natural multi-object scenes is to impose a context-consistency check, wherein, if the detected objects are not consistent with an appropriately defined context, then an attack is suspected. Stronger attacks are needed to fool such context-aware detectors. We present the first approach for generating context-consistent adversarial attacks that can evade the context-consistency check of black-box object detectors operating on …

LocalStyleFool：使用 Segment Anything Model 的区域视频风格迁移攻击

LocalStyleFool: Regional Video Style Transfer Attack Using Segment Anything Model

提出 LocalStyleFool，利用 SAM 进行区域分割与跟踪，将基于风格迁移的扰动叠加到选定区域，提升了对抗攻击的自然性与高分辨率下的可扩展性，同时保持欺骗率和查询效率。

Efficient Robustness Assessment via Adversarial Spatial-Temporal Focus on Videos

Adversarial robustness assessment for video recognition models has raised concerns owing to their wide applications on safety-critical tasks. Compared with images, videos have much high dimension, which brings huge computational costs when generating adversarial videos. This is especially serious for the query-based black-box attacks where gradient estimation for the threat models is usually utilized, and high dimensions will lead to a large number of queries. To mitigate this issue, we propose to simultaneously eliminate the temporal and spatial redundancy within the video to achieve an effec…

Detection of Face Recognition Adversarial Attacks

Deep Learning methods have become state-of-the-art for solving tasks such as Face Recognition (FR). Unfortunately, despite their success, it has been pointed out that these learning models are exposed to adversarial inputs - images to which an imperceptible amount of noise for humans is added to maliciously fool a neural network - thus limiting their adoption in real-world applications. While it is true that an enormous effort has been spent in order to train robust models against this type of threat, adversarial detection techniques have recently started to draw attention within the scientifi…