SVASTIN: Sparse Video Adversarial Attack via Spatio-Temporal Invertible Neural Networks

TL;DR

SVASTIN introduces a novel method for generating imperceptible adversarial videos by leveraging spatio-temporal invertible neural networks, improving attack effectiveness while maintaining video quality.

Contribution

The paper presents SVASTIN, a new approach combining spatio-temporal feature exchange and a guided learning module for more effective adversarial video attacks.

Findings

Outperforms state-of-the-art methods in imperceptibility

Achieves higher fooling rates on UCF-101 and Kinetics-400

Maintains high video quality with minimal perturbations

Abstract

Robust and imperceptible adversarial video attack is challenging due to the spatial and temporal characteristics of videos. The existing video adversarial attack methods mainly take a gradient-based approach and generate adversarial videos with noticeable perturbations. In this paper, we propose a novel Sparse Adversarial Video Attack via Spatio-Temporal Invertible Neural Networks (SVASTIN) to generate adversarial videos through spatio-temporal feature space information exchanging. It consists of a Guided Target Video Learning (GTVL) module to balance the perturbation budget and optimization speed and a Spatio-Temporal Invertible Neural Network (STIN) module to perform spatio-temporal feature space information exchanging between a source video and the target feature tensor learned by GTVL module. Extensive experiments on UCF-101 and Kinetics-400 demonstrate that our proposed SVASTIN can generate adversarial examples with higher imperceptibility than the state-of-the-art methods with the higher fooling rate. Code is available at \href{https://github.com/Brittany-Chen/SVASTIN}{https://github.com/Brittany-Chen/SVASTIN}.