Recently, methods for skeleton-based human activity recognition have been
shown to be vulnerable to adversarial attacks. However, these attack methods
require either the full knowledge of the victim (i.e. white-box attacks),
access to training data (i.e. transfer-based attacks) or frequent model queries
(i.e. black-box attacks). All their requirements are highly restrictive,
raising the question of how detrimental the vulnerability is. In this paper, we
show that the vulnerability indeed exists. To this end, we consider a new
attack task: the attacker has no access to the victim model or the training
data or labels, where we coin the term hard no-box attack. Specifically, we
first learn a motion manifold where we define an adversarial loss to compute a
new gradient for the attack, named skeleton-motion-informed (SMI) gradient. Our
gradient contains information of the motion dynamics, which is different from
existing gradient-based attack methods that compute the loss gradient assuming
each dimension in the data is independent. The SMI gradient can augment many
gradient-based attack methods, leading to a new family of no-box attack
methods. Extensive evaluation and comparison show that our method imposes a
real threat to existing classifiers. They also show that the SMI gradient
improves the transferability and imperceptibility of adversarial samples in
both no-box and transfer-based black-box settings.

该研究证明了基于骨骼的人体活动识别方法容易受到对抗性攻击，并通过学习动作流形和定义对抗损失函数得到了一种新的梯度，称为骨骼 - 运动信息梯度。该研究提出了一种无需访问受攻击模型、训练数据或标签的攻击方法，对现有分类器构成真正的威胁，并提升了对抗样本在不同设置下的转移性和感知性。

基于骨骼动态信息的人体动作识别中的硬性无框对抗性攻击

Hard No-Box Adversarial Attack on Skeleton-Based Human Action  Recognition with Skeleton-Motion-Informed Gradient

Skeleton-based Human Activity Recognition has achieved great interest in
recent years as skeleton data has demonstrated being robust to illumination
changes, body scales, dynamic camera views, and complex background. In
particular, Spatial-Temporal Graph Convolutional Networks (ST-GCN) demonstrated
to be effective in learning both spatial and temporal dependencies on
non-Euclidean data such as skeleton graphs. Nevertheless, an effective encoding
of the latent information underlying the 3D skeleton is still an open problem,
especially when it comes to extracting effective information from joint motion
patterns and their correlations. In this work, we propose a novel
Spatial-Temporal Transformer network (ST-TR) which models dependencies between
joints using the Transformer self-attention operator. In our ST-TR model, a
Spatial Self-Attention module (SSA) is used to understand intra-frame
interactions between different body parts, and a Temporal Self-Attention module
(TSA) to model inter-frame correlations. The two are combined in a two-stream
network, whose performance is evaluated on three large-scale datasets,
NTU-RGB+D 60, NTU-RGB+D 120, and Kinetics Skeleton 400, consistently improving
backbone results. Compared with methods that use the same input data, the
proposed ST-TR achieves state-of-the-art performance on all datasets when using
joints' coordinates as input, and results on-par with state-of-the-art when
adding bones information.

本文提出了一种基于 Spatial-Temporal Transformer 网络的骨骼姿态行为识别方法，使用自注意力机制成功提取了骨骼运动及其相关性的信息，与其他同类算法相比在多个大规模数据集上表现出更好的精度。