Adversarial Bone Length Attack on Action Recognition
This work addresses security concerns for skeleton-based action recognition systems, such as in surveillance or human-computer interaction, by demonstrating a novel low-dimensional attack and its counterintuitive benefits, though it is incremental in the broader field of adversarial attacks.
The paper tackled the vulnerability of skeleton-based action recognition models to adversarial attacks by proposing a low-dimensional attack that perturbs only bone lengths, achieving over 90% success rate on datasets like NTU RGB+D and HDM05. It also found that adversarial training with this attack improves both robustness and clean accuracy, challenging the typical trade-off observed in high-dimensional settings.
Skeleton-based action recognition models have recently been shown to be vulnerable to adversarial attacks. Compared to adversarial attacks on images, perturbations to skeletons are typically bounded to a lower dimension of approximately 100 per frame. This lower-dimensional setting makes it more difficult to generate imperceptible perturbations. Existing attacks resolve this by exploiting the temporal structure of the skeleton motion so that the perturbation dimension increases to thousands. In this paper, we show that adversarial attacks can be performed on skeleton-based action recognition models, even in a significantly low-dimensional setting without any temporal manipulation. Specifically, we restrict the perturbations to the lengths of the skeleton's bones, which allows an adversary to manipulate only approximately 30 effective dimensions. We conducted experiments on the NTU RGB+D and HDM05 datasets and demonstrate that the proposed attack successfully deceived models with sometimes greater than 90% success rate by small perturbations. Furthermore, we discovered an interesting phenomenon: in our low-dimensional setting, the adversarial training with the bone length attack shares a similar property with data augmentation, and it not only improves the adversarial robustness but also improves the classification accuracy on the original data. This is an interesting counterexample of the trade-off between adversarial robustness and clean accuracy, which has been widely observed in studies on adversarial training in the high-dimensional regime.