Enhancing robustness in video recognition models: Sparse adversarial attacks and beyond

Ronghui Mu, Leandro Soriano Marcolino, Qiang Ni, Wenjie Ruan

Abstract: Highlights•Sparse attacks on video models: perturb fewer frames to gain high fooling rate.•Combining additive and spatial perturbations to enhance attacking performance.•Using SSIM instead of lp-norm to maintain the human perception.•Applying Bayesian Optimisation to identify the most critical frame to perturb.•A new adversarial training method based on combination of diverse perturbations.