In recent years, a significant amount of research efforts concentrated on adversarial attacks on images, while adversarial video attacks have seldom been explored. We propose an adversarial attack strategy on videos, called DeepSAVA. Our model includes both additive perturbation and spatial transformation by a unified optimisation framework, where the structural similarity index (SSIM) measure is adopted to measure the adversarial distance. We design an effective and novel optimisation scheme which alternatively utilizes Bayesian optimisation to identify the most influential frame in a video and Stochastic gradient descent (SGD) based optimisation to produce both additive and spatial-transformed perturbations. Doing so enables DeepSAVA to perform a very sparse attack on videos for maintaining human imperceptibility while still achieving state-of-the-art performance in terms of both attack success rate and adversarial transferability. Our intensive experiments on various types of deep neural networks and video datasets confirm the superiority of DeepSAVA.

本文提出了一种面向视频的对抗攻击策略DeepSAVA，通过加性扰动和空间变换的统一优化框架，利用贝叶斯优化和随机梯度下降算法产生扰动，采用结构相似性指数（SSIM）测量对抗距离，使DeepSAVA在保持人眼无法察觉的情况下获得最先进的攻击成功率和对抗转移性能，被证明在各种类型的深度神经网络和视频数据集上具有优越性。

利用空间变换的稀疏对抗性视频攻击