FeatureFool: Zero-Query Fooling of Video Models via Feature Map

TL;DR

FeatureFool introduces a novel zero-query black-box attack method that manipulates video feature maps to fool models efficiently and stealthily, achieving high success rates without model interaction.

Contribution

It is the first to leverage feature maps for zero-query video attacks, significantly improving attack efficiency and stealthiness in the video domain.

Findings

Achieves over 70% success rate against video classifiers

Can bypass Video-LLMs using transferred feature map attacks

Produces high-quality, barely perceptible adversarial videos

Abstract

The vulnerability of deep neural networks (DNNs) has been preliminarily verified. Existing black-box adversarial attacks usually require multi-round interaction with the model and consume numerous queries, which is impractical in the real-world and hard to scale to recently emerged Video-LLMs. Moreover, no attack in the video domain directly leverages feature maps to shift the clean-video feature space. We therefore propose FeatureFool, a stealthy, video-domain, zero-query black-box attack that utilizes information extracted from a DNN to alter the feature space of clean videos. Unlike query-based methods that rely on iterative interaction, FeatureFool performs a zero-query attack by directly exploiting DNN-extracted information. This efficient approach is unprecedented in the video domain. Experiments show that FeatureFool achieves an attack success rate above 70\% against traditional video classifiers without any queries. Benefiting from the transferability of the feature map, it can also craft harmful content and bypass Video-LLM recognition. Additionally, adversarial videos generated by FeatureFool exhibit high quality in terms of SSIM, PSNR, and Temporal-Inconsistency, making the attack barely perceptible. This paper may contain violent or explicit content.