Query-Efficient Video Adversarial Attack with Stylized Logo

TL;DR

This paper introduces Stylized Logo Attack (SLA), a novel black-box video adversarial attack method that enhances naturalness and targeted success by using style transfer, reinforcement learning, and perturbation optimization.

Contribution

The paper proposes a new video adversarial attack framework combining style transfer, reinforcement learning, and optimization to improve attack effectiveness and naturalness.

Findings

SLA outperforms state-of-the-art methods in fooling rate.

SLA maintains effectiveness against various defense strategies.

SLA produces more natural adversarial videos.

Abstract

Video classification systems based on Deep Neural Networks (DNNs) have demonstrated excellent performance in accurately verifying video content. However, recent studies have shown that DNNs are highly vulnerable to adversarial examples. Therefore, a deep understanding of adversarial attacks can better respond to emergency situations. In order to improve attack performance, many style-transfer-based attacks and patch-based attacks have been proposed. However, the global perturbation of the former will bring unnatural global color, while the latter is difficult to achieve success in targeted attacks due to the limited perturbation space. Moreover, compared to a plethora of methods targeting image classifiers, video adversarial attacks are still not that popular. Therefore, to generate adversarial examples with a low budget and to provide them with a higher verisimilitude, we propose a novel black-box video attack framework, called Stylized Logo Attack (SLA). SLA is conducted through three steps. The first step involves building a style references set for logos, which can not only make the generated examples more natural, but also carry more target class features in the targeted attacks. Then, reinforcement learning (RL) is employed to determine the style reference and position parameters of the logo within the video, which ensures that the stylized logo is placed in the video with optimal attributes. Finally, perturbation optimization is designed to optimize perturbations to improve the fooling rate in a step-by-step manner. Sufficient experimental results indicate that, SLA can achieve better performance than state-of-the-art methods and still maintain good deception effects when facing various defense methods.