Human motion prediction has achieved a brilliant performance with the help of
CNNs, which facilitates human-machine cooperation. However, currently, there is
no work evaluating the potential risk in human motion prediction when facing
adversarial attacks, which may cause danger in real applications. The
adversarial attack will face two problems against human motion prediction: 1.
For naturalness, pose data is highly related to the physical dynamics of human
skeletons where Lp norm constraints cannot constrain the adversarial example
well; 2. Unlike the pixel value in images, pose data is diverse at scale
because of the different acquisition equipment and the data processing, which
makes it hard to set fixed parameters to perform attacks. To solve the problems
above, we propose a new adversarial attack method that perturbs the input human
motion sequence by maximizing the prediction error with physical constraints.
Specifically, we introduce a novel adaptable scheme that facilitates the attack
to suit the scale of the target pose and two physical constraints to enhance
the imperceptibility of the adversarial example. The evaluating experiments on
three datasets show that the prediction errors of all target models are
enlarged significantly, which means current convolution-based human motion
prediction models can be easily disturbed under the proposed attack. The
quantitative analysis shows that prior knowledge and semantic information
modeling can be the key to the adversarial robustness of human motion
predictors. The qualitative results indicate that the adversarial sample is
hard to be noticed when compared frame by frame but is relatively easy to be
detected when the sample is animated.

本文提出一种新的适用于人体运动序列的可调节的针对性对抗攻击方法，通过引入两个物理约束条件，提高对抗样本的无感知性，定量和定性结果表明，串联对抗样本可以很好地欺骗目标预测模型，提高人体运动预测器的对抗鲁棒性，但相较于帧至帧比较，该攻击样本比较容易被检测到。