Adversarial Bone Length Attack on Action Recognition

Abstract

Skeleton-based action recognition models have recently been shown to be vulnerable to adversarial attacks. Compared to adversarial attacks on images, perturbations to skeletons are typically bounded to a lower dimension of approximately 100 per frame. This lower-dimensional setting makes it more difficult to generate imperceptible perturbations. Existing attacks resolve this by exploiting the temporal structure of the skeleton motion so that the perturbation dimension increases to thousands. In this paper, we show that adversarial attacks can be performed on skeleton-based action recognition models, even in a significantly low-dimensional setting without any temporal manipulation. Specifically, we restrict the perturbations to the lengths of the skeleton's bones, which allows an adversary to manipulate only approximately 30 effective dimensions. We conducted experiments on the NTU RGB+D and HDM05 datasets and demonstrate that the proposed attack successfully deceived models with sometimes greater than 90% success rate by small perturbations. Furthermore, we discovered an interesting phenomenon: in our lowdimensional setting, the adversarial training with the bone length attack shares a similar property with data augmentation, and it not only improves the adversarial robustness but also improves the classification accuracy on the original original data. This is an interesting counterexample of the tradeoff between adversarial robustness and clean accuracy, which has been widely observed in studies on adversarial training in the high-dimensional regime.

Defending Black-Box Skeleton-Based Human Activity Classifiers

“…Adversaries have been developed in video-based recognition (Zhang et al 2020a;Pony, Naeh, and Mannor 2021;Hwang et al 2021;Wei et al 2020) and multi-modal setting (Kumar et al 2020). Very recently, skeleton-based HAR has been shown to be extremely vulnerable (Liu, Akhtar, and Mian 2020;Tanaka, Kera, and Kawamoto 2021;Wang et al 2021a;Diao et al 2021;Zheng et al 2020). Adversarial examples can be generated by Gen-erative Adversarial Networks (Liu, Akhtar, and Mian 2020), optimization based on a new perceptual metric (Wang et al 2021a), or exploring the interplay between the classification boundary and the natural motion manifold under the hardlabel black-box setting (Diao et al 2021).…”

“…We use it as one baseline. Standard AT (Madry et al 2018) has recently been briefly attempted on HAR (Tanaka, Kera, and Kawamoto 2021), so we use it as a baseline SMART-AT (Diao et al 2022) which employs SMART as the attacker. We also employ another two baseline methods TRADES (Zhang et al 2019b) and MART (Wang et al 2020), which are the state-of-the-art defense methods on images.…”