Abstract:Y Recent studies demonstrated that deep neural networks (DNNs) are vulnerable to adversarial examples, which would seriously threaten security-sensitive applications. Existing works synthesized the adversarial examples by perturbing the original/benign images by leveraging the L-p-norm to penalize the perturbations, which restricts the pixel-wise distance between the adversarial images and correspondingly benign images. However, they added perturbations globally to the benign images without explicitly considering their content/spacial structure, resulting in noticeable artifacts especially in those originally clean regions, e.g., sky and smooth surface. In this paper, we propose an invisible adversarial attack, which synthesizes adversarial examples that are visually indistinguishable from benign ones. We adaptively distribute the perturbation according to human sensitivity to a local stimulus in the benign image, i.e., the higher insensitivity, the more perturbation. Two types of adaptive adversarial attacks are proposed: 1) coarse-grained and 2) fine-grained. The former conducts L-p-norm regularized by the novel spatial constraints, which utilizes the rich information of the cluttered regions to mask perturbation. The latter, called Just Noticeable Distortion (JND)-based adversarial attack, utilizes the proposed JND(p) metric for better measuring the perceptual similarity, and adaptively sets penalty by weighting the pixel-wise perceptual redundancy of an image. We conduct extensive experiments on the MNIST, CIFAR-10 and ImageNet datasets and a comprehensive user study with 50 participants. The experimental results demonstrate that JND(p) is a better metric for measuring the perceptual similarity than L-p-norm, and the proposed adaptive adversarial attacks can synthesize indistinguishable adversarial examples from benign ones and outperform the state-of-the-art methods.

Edge-Oriented Adversarial Attack for Deep Gait Recognition

Accelerometer-Based Gait Segmentation: Simultaneously User and Adversary Identification

DyGait: Exploiting Dynamic Representations for High-performance Gait Recognition

Cross-view Gait Recognition Through Ensemble Learning

Non-local Gait Feature Extraction and Human Identification

CLASH: Complementary Learning with Neural Architecture Search for Gait Recognition

Center-Assisted Personal Gait Authentication Using Orientation Adversarial Feature Extraction

Wearable Device-Based Gait Recognition Using Angle Embedded Gait Dynamic Images and a Convolutional Neural Network

GaitSet: Cross-view Gait Recognition through Utilizing Gait as a Deep Set

Generative Adversarial Patches for Physical Attacks on Cross-Modal Pedestrian Re-Identification

DeepGait: A Learning Deep Convolutional Representation for View-Invariant Gait Recognition Using Joint Bayesian

Towards Understanding the Adversarial Vulnerability of Skeleton-based Action Recognition

A Novel Algorithm of Gait Recognition

Bio-Inspired Adversarial Attack Against Deep Neural Networks

On Learning Disentangled Representations for Gait Recognition

Understanding the Robustness of Skeleton-based Action Recognition under Adversarial Attack

Detecting and Mitigating Adversarial Perturbations for Robust Face Recognition

Attack Anything: Blind DNNs via Universal Background Adversarial Attack

QAGait: Revisit Gait Recognition from a Quality Perspective

Invisible Adversarial Attack Against Deep Neural Networks: an Adaptive Penalization Approach

Adv-Attribute: Inconspicuous and Transferable Adversarial Attack on Face Recognition