Abstract
Recent research has demonstrated the brittleness of machine learning systems to adversarial perturbations. However, the studies have been mostly limited to perturbations on images and more generally, classification that does not deal with temporally varying inputs. In this paper we ask "Are adversarial perturbations possible in real-time video classification systems and if so, what properties must they satisfy?" Such systems find application in surveillance applications, smart vehicles, and smart elderly care and thus, misclassification could be particularly harmful (e.g., a mishap at an elderly care facility may be missed). We show that accounting for temporal structure is key to generating adversarial examples in such systems. We exploit recent advances in generative adversarial network (GAN) architectures to account for temporal correlations and generate adversarial samples that can cause misclassification rates of over 80% for targeted activities. More importantly, the samples also leave other activities largely unaffected making them extremely stealthy. Finally, we also surprisingly find that in many scenarios, the same perturbation can be applied to every frame in a video clip that makes the adversary's ability to achieve misclassification relatively easy.
Abstract (translated)
最近的研究表明机器学习系统对对抗性扰动的脆弱性。然而，研究主要局限于图像的扰动，更一般地说，分类不涉及时间上变化的输入。在本文中，我们问“在实时视频分类系统中是否可能存在对抗性扰动，如果是这样，它们必须满足哪些属性？”这样的系统可应用于监视应用，智能车辆和智能老人护理，因此，错误分类可能特别有害（例如，可能错过老年护理机构的事故）。我们表明，时间结构的计算是在这种系统中产生对抗性例子的关键。我们利用生成对抗网络（GAN）架构的最新进展来解释时间相关性并生成可能导致针对目标活动的错误分类率超过80％的对抗性样本。更重要的是，这些样本还会使其他活动在很大程度上不受影响，使其非常隐蔽。最后，我们还惊奇地发现，在许多场景中，相同的扰动可以应用于视频剪辑中的每个帧，这使得对手能够相对容易地实现错误分类。
URL
https://arxiv.org/abs/1807.00458
