发表机构
Indiana University Indianapolis; Bangladesh University of Engineering and Technology; Tennessee State University（印第安纳大学印第安纳波利斯分校; 孟加拉国工程技术大学; 田纳西州立大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本文提出隐蔽性是观察者相对的概念，并构建Null攻击，利用事件累积窗口的精确盲区在保持受保护张量不变的同时实现高攻击成功率，证明隐蔽性取决于观察者的时间处理方式。
AI 中文摘要
事件相机产生异步事件流，但该流中可见的内容取决于下游消费者（如模型或检测器）如何处理时间。相同的时间戳变化可能使粗粒度的时间表示保持不变，同时改变保留更精细时序的模型的响应。我们将这种依赖性刻画为观察者相对的隐蔽性。对于记录的事件流，在事件受保护的累积窗口内重新调整事件的时间戳，会使累积的整数张量完全不变。我们利用这一精确盲区构建了Null，一种梯度引导的时间戳重定时攻击，并定义了SC-ASR_A(tau)来度量攻击成功率，同时限制观察者A可见的变化。在DVS Gesture上，以10%的事件预算，Null在ConvSNN上达到81.56 ± 5.81%的ASR，在GRU上达到98.67 ± 0.45%，同时精确保持受保护张量不变。在DailyDVS-200上，一种协议规模的多视图融合网络变体达到99.28 ± 0.11%的精确零攻击成功率，而其匹配对照组为9.70 ± 1.06%。在五种攻击的比较中，Null是唯一在精确观察者等价条件下具有非零攻击成功率的方法，在DVS Gesture上达到81.4%，在DailyDVS-200上达到87.35%。我们还使用独立实现的受约束投影梯度优化器C-PGD搜索相同的精确盲区。在匹配的受害者梯度评估下，C-PGD在DVS Gesture上达到84.50 ± 2.89%的ASR，在DailyDVS-200上达到89.55 ± 4.39%，同样具有精确的受保护等价性。精确隐藏于受保护观察者的扰动在移位、更精细、重叠和随机化的时间视图下变得可见。增加观察者约束将实值盲区比例从87.5%降至75.0%再降至62.5%，而DVS ConvSNN的ASR从74.9%降至61.9%再降至37.2%。这些结果表明，隐蔽性并非扰动本身的属性。
英文摘要
An event camera produces an asynchronous stream, but what is visible in that stream depends on how a downstream consumer, such as a model or detector, processes time. The same timestamp change may leave a coarse temporal representation unchanged while changing the response of a model that preserves finer timing. We characterize this dependence as observer-relative stealth. For recorded event streams, retiming an event within its protected accumulation window leaves the accumulated integer tensor exactly unchanged. We use this exact blind space to construct Null, a gradient-guided timestamp-retiming attack, and define SC-ASR_A(tau) to measure attack success while bounding the change visible to observer A. On DVS Gesture at a 10% event budget, Null reaches 81.56 +/- 5.81% ASR on ConvSNN and 98.67 +/- 0.45% on a GRU while preserving the protected tensor exactly. On DailyDVS-200, a protocol-scale Multi-View Fusion Network variant reaches 99.28 +/- 0.11% exact-null ASR, compared with 9.70 +/- 1.06% for its matched control. In a five-attack comparison, Null is the only method with nonzero attack success at exact observer equality, reaching 81.4% on DVS Gesture and 87.35% on DailyDVS-200. We also search the same exact blind space with an independently implemented constrained projected-gradient optimizer, C-PGD. At matched victim-gradient evaluations, C-PGD reaches 84.50 +/- 2.89% ASR on DVS Gesture and 89.55 +/- 4.39% on DailyDVS-200, again with exact protected equality. Perturbations that are exactly hidden from the protected observer become visible under shifted, finer, overlapping, and randomized temporal views. Adding observer constraints reduces the real-valued blind-space fraction from 87.5% to 75.0% to 62.5%, while DVS ConvSNN ASR falls from 74.9% to 61.9% to 37.2%. These results show that stealth is not a property of the perturbation alone.
Comments30 pages, 8 figures, 20 tables. Code: https://github.com/shoaibdipu/Stealth_Is_a_Relation_Not_a_Property
