发表机构
Kyushu University（九州大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
研究在线手写识别模型的对抗攻击问题，提出基于显著性引导时间编辑的框架，通过按时间显著性插入和删除点生成对抗样本，在保持手写视觉结构的同时具有更强的一次性黑盒转移性。
AI 中文摘要
深度学习模型在在线手写识别中已被证明有效且应用广泛，但易受对抗攻击。现有方法多针对图像输入，用于在线手写时会引入高频抖动和不自然笔画。本文提出基于显著性引导时间编辑的对抗攻击框架，通过按时间显著性插入和删除点生成对抗样本，保留手写形状和平滑度。利用基于梯度的激活映射估计时间显著性。在两个数据集上评估，结果表明传统图像攻击白盒性能强但跨模型转移性差，本文方法在保持手写视觉结构的同时具有更强的一次性黑盒转移性。
英文摘要
Deep learning models for online handwriting recognition have been shown effective and are increasingly deployed in practical applications. However, their vulnerability to adversarial attacks is still a challenge. Existing adversarial methods are predominantly designed for image-based inputs and typically rely on additive spatial perturbations. When applied to online handwriting, which is inherently represented as a time series of pen trajectories, such perturbations often introduce high-frequency jitter and visibly unnatural stroke artifacts. In this work, we propose a novel adversarial attack framework for online handwriting recognition based on salience-guided temporal editing. Instead of adding noise, the proposed method generates adversarial examples by inserting and deleting points at time steps selected according to temporal salience, preserving the shape and smoothness of the original handwriting. Temporal salience is estimated using gradient-based activation mapping, which guides edits toward time steps that strongly support the original class prediction. We evaluate the proposed approach on the Unipen and CASIA-OLHWDB datasets under both white-box and one-shot black-box attack settings. Experimental results demonstrate that while conventional image-based attacks achieve strong white-box performance, they exhibit poor transferability across models. In contrast, the proposed temporal editing attack achieves stronger one-shot black-box transferability while preserving the visual structure of the handwriting. These results indicate that temporal editing is a relevant threat model for online handwriting recognition, particularly in one-shot black-box transfer settings.
CommentsAccepted at ICDAR 2026
