MultAV: Multiplicative Adversarial Videos

TL;DR

This paper introduces MultAV, a novel multiplicative adversarial attack on videos that challenges existing defenses by applying perturbations through multiplication, extending attack types beyond additive methods.

Contribution

The paper presents a new multiplicative attack method for videos, expanding adversarial attack strategies and testing robustness of defenses against non-additive perturbations.

Findings

Models trained against additive attacks are less robust to MultAV.

MultAV can be generalized to various attack constraints and physical realizations.

Experimental results demonstrate MultAV's effectiveness against video recognition models.

Abstract

The majority of adversarial machine learning research focuses on additive attacks, which add adversarial perturbation to input data. On the other hand, unlike image recognition problems, only a handful of attack approaches have been explored in the video domain. In this paper, we propose a novel attack method against video recognition models, Multiplicative Adversarial Videos (MultAV), which imposes perturbation on video data by multiplication. MultAV has different noise distributions to the additive counterparts and thus challenges the defense methods tailored to resisting additive adversarial attacks. Moreover, it can be generalized to not only Lp-norm attacks with a new adversary constraint called ratio bound, but also different types of physically realizable attacks. Experimental results show that the model adversarially trained against additive attack is less robust to MultAV.