Deep learning based video frame interpolation (VIF) method, aiming to
synthesis the intermediate frames to enhance video quality, have been highly
developed in the past few years. This paper investigates the adversarial
robustness of VIF models. We apply adversarial attacks to VIF models and find
that the VIF models are very vulnerable to adversarial examples. To improve
attack efficiency, we suggest to make full use of the property of video frame
interpolation task. The intuition is that the gap between adjacent frames would
be small, leading to the corresponding adversarial perturbations being similar
as well. Then we propose a novel attack method named Inter-frame Accelerate
Attack (IAA) that initializes the perturbation as the perturbation for the
previous adjacent frame and reduces the number of attack iterations. It is
shown that our method can improve attack efficiency greatly while achieving
comparable attack performance with traditional methods. Besides, we also extend
our method to video recognition models which are higher level vision tasks and
achieves great attack efficiency.

研究通过对视频帧差值 (VIF) 模型的对抗性攻击，提出了使用视频帧差值的性质对攻击进行改进的方法，并提出了一种名为 “帧间加速攻击”(IAA) 的新型攻击方法，该方法可以显著提高攻击效率。同时，还将这种方法扩展到更高级别的视频识别模型，并取得了很好的攻击效果。

视频插帧模型的帧间加速攻击

Inter-frame Accelerate Attack against Video Interpolation Models

Adversarial robustness assessment for video recognition models has raised
concerns owing to their wide applications on safety-critical tasks. Compared
with images, videos have much high dimension, which brings huge computational
costs when generating adversarial videos. This is especially serious for the
query-based black-box attacks where gradient estimation for the threat models
is usually utilized, and high dimensions will lead to a large number of
queries. To mitigate this issue, we propose to simultaneously eliminate the
temporal and spatial redundancy within the video to achieve an effective and
efficient gradient estimation on the reduced searching space, and thus query
number could decrease. To implement this idea, we design the novel Adversarial
spatial-temporal Focus (AstFocus) attack on videos, which performs attacks on
the simultaneously focused key frames and key regions from the inter-frames and
intra-frames in the video. AstFocus attack is based on the cooperative
Multi-Agent Reinforcement Learning (MARL) framework. One agent is responsible
for selecting key frames, and another agent is responsible for selecting key
regions. These two agents are jointly trained by the common rewards received
from the black-box threat models to perform a cooperative prediction. By
continuously querying, the reduced searching space composed of key frames and
key regions is becoming precise, and the whole query number becomes less than
that on the original video. Extensive experiments on four mainstream video
recognition models and three widely used action recognition datasets
demonstrate that the proposed AstFocus attack outperforms the SOTA methods,
which is prevenient in fooling rate, query number, time, and perturbation
magnitude at the same.

我们提出了一种基于 AstFocus 攻击的多智能体强化学习框架，该框架同时在视频的关键帧和关键区域上进行攻击，并且通过减小搜索空间来降低查询数，使得在四种主流的视频识别模型和三个广泛使用的动作识别数据集上的结果均优于现有的最佳方法。

通过针对视频的敌对时空聚焦实现有效的健壮性评估

Efficient Robustness Assessment via Adversarial Spatial-Temporal Focus  on Videos

Adversarial attacks on video recognition models have been explored recently.
However, most existing works treat each video frame equally and ignore their
temporal interactions. To overcome this drawback, a few methods try to select
some key frames and then perform attacks based on them. Unfortunately, their
selection strategy is independent of the attacking step, therefore the
resulting performance is limited. Instead, we argue the frame selection phase
is closely relevant with the attacking phase. The key frames should be adjusted
according to the attacking results. For that, we formulate the black-box video
attacks into a Reinforcement Learning (RL) framework. Specifically, the
environment in RL is set as the recognition model, and the agent in RL plays
the role of frame selecting. By continuously querying the recognition models
and receiving the attacking feedback, the agent gradually adjusts its frame
selection strategy and adversarial perturbations become smaller and smaller. We
conduct a series of experiments with two mainstream video recognition models:
C3D and LRCN on the public UCF-101 and HMDB-51 datasets. The results
demonstrate that the proposed method can significantly reduce the adversarial
perturbations with efficient query times.

该研究提出了一种基于强化学习 (RL) 框架的黑盒视频攻击方法，通过调整关键帧的选择策略，使反对抗扰动逐渐变小，实验证明该方法可以有效降低反对抗扰动。

稀疏黑盒视频攻击与强化学习

Sparse Black-box Video Attack with Reinforcement Learning

We study the problem of attacking video recognition models in the black-box
setting, where the model information is unknown and the adversary can only make
queries to detect the predicted top-1 class and its probability. Compared with
the black-box attack on images, attacking videos is more challenging as the
computation cost for searching the adversarial perturbations on a video is much
higher due to its high dimensionality. To overcome this challenge, we propose a
heuristic black-box attack model that generates adversarial perturbations only
on the selected frames and regions. More specifically, a heuristic-based
algorithm is proposed to measure the importance of each frame in the video
towards generating the adversarial examples. Based on the frames' importance,
the proposed algorithm heuristically searches a subset of frames where the
generated adversarial example has strong adversarial attack ability while keeps
the perturbations lower than the given bound. Besides, to further boost the
attack efficiency, we propose to generate the perturbations only on the salient
regions of the selected frames. In this way, the generated perturbations are
sparse in both temporal and spatial domains. Experimental results of attacking
two mainstream video recognition methods on the UCF-101 dataset and the HMDB-51
dataset demonstrate that the proposed heuristic black-box adversarial attack
method can significantly reduce the computation cost and lead to more than 28\%
reduction in query numbers for the untargeted attack on both datasets.

提出了一种基于启发式算法的黑盒视频识别攻击模型，生成的对抗扰动仅作用于筛选的视频帧和区域，大大降低了计算成本和减少了查询次数，攻击效果明显。