Local imperceptible adversarial attacks against human pose estimation networks  

作　　者：Fuchang Liu Shen Zhang Hao Wang Caiping Yan Yongwei Miao 

机构地区：[1]School of Information Science and Technology,Hangzhou Normal University,Hangzhou 311121,Zhejiang,China

出　　处：《Visual Computing for Industry,Biomedicine,and Art》2023年第1期318-328,共11页工医艺的可视计算（英文）

基　　金：National Natural Science Foundation of China,No.61972458;Natural Science Foundation of Zhejiang Province,No.LZ23F020002.

摘　　要：Deep neural networks are vulnerable to attacks from adversarial inputs.Corresponding attack research on human pose estimation(HPE),particularly for body joint detection,has been largely unexplored.Transferring classification-based attack methods to body joint regression tasks is not straightforward.Another issue is that the attack effectiveness and imperceptibility contradict each other.To solve these issues,we propose local imperceptible attacks on HPE networks.In particular,we reformulate imperceptible attacks on body joint regression into a constrained maximum allowable attack.Furthermore,we approximate the solution using iterative gradient-based strength refinement and greedy-based pixel selection.Our method crafts effective perceptual adversarial attacks that consider both human perception and attack effectiveness.We conducted a series of imperceptible attacks against state-of-the-art HPE methods,including HigherHRNet,DEKR,and ViTPose.The experimental results demonstrate that the proposed method achieves excellent imperceptibility while maintaining attack effectiveness by significantly reducing the number of perturbed pixels.Approximately 4%of the pixels can achieve sufficient attacks on HPE.

关 键 词：Adversarial attack Human pose estimation White-box attack IMPERCEPTIBILITY Local perturbation 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]