面向骨架行为识别的角空间对抗攻击方法  

Angle Space Adversarial Attack on Skeletal Action Recognition

作　　者：曹男 刁云峰 黄垠钦 杜润[1] 李怀仙[1] 程天健 CAO Nan;DIAO Yunfeng;HUANG Yinqin;DU Run;LI Huaixian;CHENG Tianjian(School of Mechanical Engineering,Southwest Jiaotong University,Chengdu 610031,China;School of Information and Communication Engineering,University of Electronic Science and Technology of China,Chengdu 611731,China;Faculty of Geosciences and Environmental Engineering,Southwest Jiaotong University,Chengdu 610031,China)

机构地区：[1]西南交通大学机械工程学院,成都610031 [2]电子科技大学信息与通信工程学院,成都611731 [3]西南交通大学地球科学与环境工程学院,成都610031

出　　处：《计算机工程与应用》2023年第14期260-267,共8页Computer Engineering and Applications

基　　金：国家自然科学基金(51675450);国家自然科学基金项目-青年基金(51905451);中央高校基本科研业务费专项资金资助项目(2682020CX34)。

摘　　要：深度学习模型在基于骨架数据的行为识别任务中取得了较好的性能。然而,骨架行为识别模型的鲁棒性最近受到了质疑,因为它们很容易受到对抗攻击的威胁。目前现有的行为识别白盒攻击方法无法对对抗骨架动作样本的独特空间结构进行严格约束,其生成的对抗骨架动作样本为非流形对抗样本,即对抗分布远离了原有的数据分布,使得骨架动作不自然,很容易被人眼察觉。提出了一种利用球坐标系表示骨架结构的角空间对抗攻击方法,球坐标攻击(spherical coordinate attack,SCA)。在公开数据集上的实验结果表明,SCA可以发现大部分存在流形空间上的对抗样本,而目前已有的行为识别白盒攻击方法只能寻找到非流形空间上的对抗样本。Deep learning models achieve good performance in skeleton-based action recognition tasks.However,the robustness of skeleton action recognition models has recently been questioned because they are vulnerable to adversarial attacks.At present,the existing white-box attack methods for skeleton action recognition cannot strictly constrain the unique spatial structure of the adversarial skeleton action samples,and the generated adversarial skeleton action samples are nonmanifold adversarial samples,that is,the adversarial distribution is far from the original data distribution,which makes the skeleton action unnatural and easy to be perceived by humans.This paper proposes a new angular space adversarial attack method SCA(spherical coordinate attack)that uses spherical coordinate system to represent the skeleton structure.The experimental results on public datasets show that SCA can find most of the adversarial samples in the manifold space,while the existing white-box attack methods for skeleton action recognition can only find the adversarial samples in the non-manifold space.

关 键 词：对抗攻击 骨架行为识别 深度学习 球坐标 流形对抗样本 

分 类 号：TP301[自动化与计算机技术—计算机系统结构]