Qi Deng

In recent years, video recognition models have witnessed the rapid development of Deep Neural Networks (DNNs). However, these models remain not robust to adversarial examples that are created by adding imperceptible perturbations to clean samples. Recent studies indicate that generating adversarial examples in the hard-label black-box setting is particularly challenging yet highly practical. Compared to image recognition models, there are few hard-label black-box adversarial example generation algorithms for video recognition models. To this end, we propose a hard-label black-box video adversarial example generation algorithm, referred to as Dynamic Black-box Algorithm (DBA). First, DBA uses the binary search algorithm to find the boundary video between two original videos; then, the sampling-based algorithm is used to estimate the gradient on the boundary video; finally, with a dynamic step size adjustment strategy, DBA moves the boundary video towards the direction of the estimated gradient to generate the adversarial video. Additionally, we designed another strategy to skip invalid samples generated during the adversarial example generation process. Experiments demonstrate that DBA attains a superior trade-off between the magnitude of perturbations and query efficiency. Specifically, DBA outperforms state-of-the-art algorithms, achieving an average reduction in Mean Squared Error (MSE) of over 50%.