Boosting Adversarial Transferability using Dynamic Cues
Authors: Muzammal Naseer
Ahmad Mahmood
Salman Khan
Fahad Khan
Venue: ICLR 2023 poster (2023)
Keywords: Adversarial attacks
Transferability
Prompt learning
Dynamic video modeling

Abstract: The transferability of adversarial perturbations between image models has been extensively studied. In this case, an attack is generated from a known surrogate \eg, the ImageNet trained model, and transferred to change the decision of an unknown (black-box) model trained on an image dataset. However, attacks generated from image models do not capture the dynamic nature of a moving object or a changing scene due to a lack of temporal cues within image models. This leads to reduced transferability of adversarial attacks from representation-enriched \emph{image} models such as Supervised Vision Transformers (ViTs), Self-supervised ViTs (\eg, DINO), and Vision-language models (\eg, CLIP) to black-box \emph{video} models. In this work, we induce dynamic cues within the image models without sacrificing their original performance on images. To this end, we optimize \emph{temporal prompts} through frozen image models to capture motion dynamics. Our temporal prompts are the result of a learnable transformation that allows optimizing for temporal gradients during an adversarial attack to fool the motion dynamics. Specifically, we introduce spatial (image) and temporal (video) cues within the same source model through task-specific prompts. Attacking such prompts maximizes the adversarial transferability from image-to-video and image-to-image models using the attacks designed for image models. As an example, an iterative attack launched from image model Deit-B with temporal prompts reduces generalization (top1 \% accuracy) of a video model by 35\% on Kinetics-400. Our approach also improves adversarial transferability to image models by 9\% on ImageNet w.r.t the current state-of-the-art approach. Our attack results indicate that the attacker does not need specialized architectures, \eg, divided space-time attention, 3D convolutions, or multi-view convolution networks for different data modalities. Image models are effective surrogates to optimize an adversarial attack to fool black-box models in a changing environment over time. Code is available at \url{https://bit.ly/3Xd9gRQ}

Published as a conference paper at ICLR 2023
BOOSTING ADVERSARIAL TRANSFERABILITY USING DYNAMIC CUES
Muzammal - Ahmad Mahmood
Salman Khan
Fahad Shahbaz Khan
*Mohamed bin Zayed University of AI,
"Lahore University of Management Sciences
'Linköping University
muzammal. www.aaa.aaaaeaaaaaaaaaaaaa anu. edu.au
(" "quual contribution)
ABSTRACT
The transferability of adversarial perturbations between image models has been extensively studied. In this case, an attack is generated from a known surrogate e.g., the ImageNet trained model, and transferred to change the decision of an unknown (black-box) model trained on an image dataset. However, attacks generated from image models do not capture the dynamic nature of a moving object or changing scene due to lack of temporal cues within image models. This leads to reduced transferability adversarial attacks from representation-eeniihhe image models such as Supervised Vision Transformers (ViTs), Self-supervised ViTs (e.g.. DINO), and Vision- langunl models (e.g., CLIP) to black-box video models. In this work, induce dynamic cues within the image models without sacrificing their original performance on images. To this end, we optimize temporal prompts through frozen image models to capture motion dynamics. Our temporal prompts the result of a learnable transformation that allows optimizing for temporal gradients during an adversarial attack to fool the motion dynamics. Specifically, we introduce spatial (image) and temporal (video) cues within the same source model through task- specific prompts. Attacking such prompts maximizes the adversarial transferability from image-to-video and image-to-image models using the attacks designed for image models. As an example, an iterative attack launched from image model Deit-B with temporal prompts reduces generalization (top1 % accuracy) of a video model by 35% on Kinetics-400. Our approach also improves adversarial transfcrability to image models by 9% on ImageNet w.r. the current state-of-the-ee approach. Our attack results indicate that the attacker does not need specialized architectures, e.g., divided space-time attention, 3D convolutions, convolution networks for different data modalities. Image models are effective surrogates to optimize an adversarial attack fool black-box models in changing environment over time. Code is available at attttss:/bbt...l/33aa00/
multi-view
INTRODUCTION
Deep learning models are vulnerable to imperceptible changes the input images. It has been shown that for a successful attack, an attacker no longer needs to know the attacked target model to compromise its decisions (Naseer et al. 2019 2020 Nakka & Salzmann 202T). Adversarial perturbations suitably optimized from a known source model (a surrogate) can fool an unknown target model (Kurakin et al. 2016). These attacks are known as black-box attacks since the attacker is restricted to access the deployed model or compute its adversarial gradient information. Adversarial attacks are continuously evolving, revealing new blind spots of deep neural networks.
Adversarial transferability has been extensively studied in image-domain (Akhtar & Mian 2018 Wang & He 2021; Naseer et al. 2022b Malik et al., 2022). Existing works demonstrate how adversarial patterns can be generalized to models with different architectures (Zhou et al. 2018 and even different data domains (Naseer et al. 2019). However, the adversarial transferability between different architecture families designed for varying data modalities, e.g., image models to video models, has not been actively explored. Since the adversarial machine learning topic has gained maximum attention in the image-domain, it is natural question if image models can help transfer

---

Published as a conference paper at ICLR 2023
better to video-domain models. However, the image models lack dynamic temporal cues which are essential for transfer to the video models.
We motivated by the fact that in real-world setting, scene is not static but mostly involves various dynamics, e.g., object motion, changing viewpoints, illumination and background changes. Therefore, exploiting dynamic cues within an adversarial attack is essential to find blind-spots of unknown target models. For this purpose, we introduce the idea of encoding disentangled temporal representations within an image-based Vision Transformer (ViT) model using dedicated temporal prompts while keeping the remaining network frozen. The temporal prompts can learn the dynamic cues which are exploited during attack for improved transferability from image-domain models. Specifically, we introduce the proposed temporal prompts to three types of image models with enriched representations acquired via supervised (ViT (Dosovitskiy et al. 20200). self-supervised 2021
(DINO (Caron et al., 2021)) 1) or multi- learning (CLJP (Radford et al.
Our approach offers the benefit that the attacks do not need to rely on specialized networks designed for videos towards better adversarial transferability. As an example, popular model designs for videos incorporate 3D convolutions, space-time attention, tube embeddings or multi-view information to be robust against the temporal changes (Bertasius et al. 202 Arnab et al., (202). Without access to such specific design choices, our approach demonstrates how an attacker can leverage regular image models augmented with temporal prompts to learn dynamic cues. Further, our approach can be easily extended to image datasets, where disentangled representations can be learned via tokens across a scale-space at varying image resolutions. In summary, the major contributions of this work include:
We demonstrate how temporal prompts incorporated with frozen image-based models can help model dynamic cues which can be exploited to fool deep networks designed for videos.
Our approach for dynamic cue modeling via prompts does not affect the original spatial representations learned by the image-basee models during pre-training, e.g., supervsupe. self- sefe-supereieed and multi-modal models.
The proposed method significantly improves transfer black- image and video models. Our approach is easily extendable to 3D datasets via learning cross-view prompts; and image-only datasets via modeling the scale-space. Finally, it enables generalization from popular plain VIT models without considering video-specific specialized designs.
We analyse the adversarial space of three type of image models (fully-supervisee supf--uue and text-supervised). A pre-trained ImageNet VIT with approximately 6 million parameters exhibits 44.6 and 72.2 top-1 (%) accuracy on Kinetics-400 and ImageNet validation sets using our approach, thereby significantly improving the adversarial transferability on video-domain models. A similar trend exists with other image models. Our results indicate that the multi-modal CLIP can better adapt to video modalities than fully-supervised or self-supervised ViTs. However, CLIP adversaries are relatively less transferable as compared to fully-supervised ViT or self-supervised DINO model.As an example, a momentum based iterative attack launched from our DINO model can reduce the performance of TimesFormer (Bertasius et al. 202T) from 75.6% to 35.8% on Kinetics-400 dataset.
2 BOOSTING ADVERSARIAL TRANSFERABILITY USING DYNAMIC CUES
Adversarial transferability refers manipulating clean sample (image, video, or 3D object rendered into multi-views) in a way that is deceiving for an unknown (black-box) model. In the absence of an adversarial perturbation, the same black-box model predicts the correct label for the given image, video, or a rendered view of a 3D object. A known surrogate model is usually used to optimize for the adversarial patterns. Instead of training the surrogate model from scratch on a given data distribution, an attacker can also adapt pre-trained image models to the new task. These image models can include supervised ImageNet models such as Deit (Touvron al., 2020), seef-super ImageNet models like DINO (Caron et al. (202)) and text-supervised large-scale multi-moda models egg. CLIP (Radford et al., 2021). The adversarial attack generated from such pre-trained models with enriched representations transfer better in the black-box setting for image-to-image transfer task (Zhang et al. 2022 Naseer et al. 2022b Aich et al. 2022). However, adversarial perturbations optimized from image models are well suited to fool motion dynamics learned by a video model (Sec. B). To cater for this, we introduce temporal cues to model motion dynamics within adversarial attacks through pre-trained image models. Our approach, therefore, models both spatial and temporal
2

---

Published as a conference paper at ICLR 2023
Proposed training dynamic within image models
Input Video (x)
Transformation
Image pre-trained vision transformer
Perturbed Video
(x')
Tolenn
MASA
Temporal Takens
Temporal
Licer Norm
Dayer Norm
MHSA
Randim Sample
Tokemizer
2000
Spatial
Spatal
Source Image Model
Attack
Crawling
x
Crawling
x
Baby
Former
Times
ResNet3D
BiT50
Jumping ing
Playing
x
Target Video / Image Models (Black-box)
Frazen madel
Learned
Multi-head Self-attention
Feod forward network
Figure 1: Overview of inducing dynamic within image models: Attackers easily access freely available, pre-trained image models learned on large-scale image and language datasets to launch adversarial attacks. These models, however, lack temporal information. Therefore, adversarial attacks launched using image models have less success rate against moving target such as vidcos. We learn transformation T(-) to convert a given video with f number of frames into temporal tokens. Our transformation based on self-attention thus learns the motion dynamies between the video frames with global context during training. We randomly sample a single frame represent the spatial tokens. The temporal and spatial tokens are concatenated and passed through the frozen model. The spatial tokens are ignored while the average of temporal tokens is processed through temporal head for video recognition. The image/spatial class token learned on images (e.g.. ImageNet) interacts with our temporal tokens (e.g., Kinetics) within the network through self-attention. After the training, image and video solutions are preserved within spatial and temporal tokens used adversarial attacks.
information during the attack (Sec. 2.1 and does not depend on specialized video networks e-g-- with 3D convolutions (Tran et al.) 2018), space-time divided attention (Bertasius et al.) 2021) even multi-branch models (Su et al. 2015). this end, we first introduce lemporal prompt adaptation of image models to learn dynamic cues on videos or multi-view information on rendered views of a 3D object, as explained next.
2.1 INTRODUCING DYNAMIC CUES THROUGH TEMPORAL PROMPTS
Preliminaries: We consider image model F pre-trained on the input samples æ of size x h x w, where c, and represent the color channels, height and width, respectively. We consider Vision Transformers (ViT') (Dosovitskiy et al.] 2020 Touvron et al.) 2020) sequentially composed of n Transformer blocks comprising of multi-head self-attention (MHSA) and feed-forward layer Dosoviiskiy et al. 2020) i.e. F (/1 f2 f3 ........ fn). where fi represents single Transformer block. ViTs divide an input sample x into patches also called patch tokens, Pt R D where D is the patch dimension. A class toker 2T Iole E R. x usually combined with these patch tokens within these image models (Dosovitskiy et al. 2020 Caron et al. 2021 Radford et al. (021). We refer to these patch and class tokens collectively processed by the model F to produce output of the same size of input i.e. F(x)) E (N++)) In the of image classification, the refined class token (Iets) is extracted from the model output and processed by MLP (gs), named spatial head (Fig. []. It maps the refined class token from RIXD IR lg1xc, where C. represents the number of image class categories.
'spatial tokens' (Fig. D}. These tokens are then
The spatial class token in image models, Zets is never optimized for temporal informa- tion. Our objective is to adapt the pre-trained and frozen image model for videos or multi-views by training a temporal class token I' R D that is optimal for input samples of size t c X h X w,
Motivation:
'ierarchical ViTs such Swin Transformer [Liu al. layers like MI M-x-er (Tolstikhin al. 2021) average of patch tokens the class token.
2021c
more simple designs without self-attention
3

---

Published as a conference paper at ICLR 2023
72
Teansnikal .901
Teerie 2331
Teaone ar 723
Figure 2: Mimicking dynamic cues on static images: We optimize our proposed transformation (Fig. for different spatial scales to mimic changes. This improves model generalization e.g. Deit-T performance increases from 7.7% to 45% on ImageNet val. set at 96x9.. Attacking models with such prompts increases transferability.
where represents the number of temporal frames in a video or rendered views of a 3D object. We optimize the temporal token through MLP (gr), named temporal head (Fig. I It maps the temporal token from R x I. LxC, where C2 represents the number of video action categories.
A trivial way is to concatenate all the additional frames of a video to generate t x N patch tokens which can then combined with the temporal token before forwadpass through the image model. We can then optimize temporal class token cds and temporal head (ge) for video classification and incorporate the dynamic cues within a frozen image model. This approach, however, has a drawback as the computational time complexity increases significantly to O ((t x N2² x D) within the self-attention layers of ViTs. Another naive way is to either apply temporal pooling to convert t x N to only N spatial tokens approximate video via single frame that is t, xex h x w, where t; corresponds to a randomly sampled frame from the input video. These approaches are however sub-optimal as we are unable optimize for motion dynamics available from different video frames.
We induce the temporal information within image models without increasing the quadratic complexity within self-attention of a Vision Transformer. We achieve this by representing a given video by randomly sampled frame while at the same time each frame in video is modeled via a temporal prompt of size R² x The temporal prompts for different frames in video are generated through our transformation T. Therefore, we only train transformation T, temporal class token It and head gr to learn motion dynamics within pre-trained and frozen image models. Our approach preserves the original image or spatial representation encoded within spatial class token Tels (Table 55. Both spatial and temporal tokens, Iel, and It Ists. are then used within our attack approach (Sec. 2.2
2.1.1 TEMPORAL PROMPTS THROUGH TRANSFORMATION
As mentioned above, the transformation T processes a video with number of temporal frames and produces only i temporal prompts (Fig. I A video sample, æ, is divided into patch tokens such that x The transformation T is single self-attention block (Dosovitskiy al. 2020) that interacts between the tokens and learns the relationship between the video frames. The transformation output is then pooled across spatial dimension N produce temporal tokens i.e., T(x) R Attacking such temporal tokens allows finding adversarial patterns capable of fooling the dynamic cues learned by the unknown black-box video model. Mimicking dynamic behavior on image datasets: Image samples are static and have no temporal dimension. So we adopt simple strategy to mimic changing behavior for such static data. We consider images at different spatial scales to obtain a scale-space (Fig. 2 and learn prompts for different spatial scales. The dynamic cues within image models not only boost transfcrability of the existing adversarial attacks from image-to-video models but also increase the attack success rate in the black-box image models (Sec.
2.1.2
IMAGE MODELS WITH TEMPORAL AND SPATIAL PROMPTS
Our approach is motivated by the shallow prompt transfer learning (Jia et al. above, we divide given a video x into video patches such that E XXXND are processed by our transformation to produce temporal tokens i.e. T(x) E R Further, we randomly sample a single frame x; ~ I and divide it into patch tokens such that 2; E R ND These single frame tokens are then concatenated with the temporal prompts generated by T(x), temporal class token Th and the image class token I,ts to equip the pre-trained image representation of model F with discriminative temporal information.
2022 As discussed
These video patches
(1) After the forwardpass through the image model (Eq. [ we extract the refined temporal class token and temporal prompts from the model's 's output. The average of these refined temporal class tokens,
F(x) = F (['a..
4

---

Published as a conference paper at ICLR 2023
Bonanaz
be
Boe Sosenas
Exx Brsana
Brnanass
Figure 3: Visualizing the behavior of Adversarial Putterns across Time: We generate adversarial signals from DINO model with temporal prompts using DIM attack (Xic 2019). Observe the change in gradients across different frames (best viewed in zoom). We provide visual demos adversarial patterns Appendix
and temporal prompts is then projected through the temporal head 9: for the new video classification task. For the sake of brevity, we will refer to the average of our refined temporal class and prompts tokens collectively as I During backpass, we only update the parameters of our transformation. temporal class token and temporal head (Fig. D. Training: Given pre-trained ViT, we freeze all of existing weights and insert our learnable transformation (7), temporal class token I and video-specific temporal head. We train for 15 epochs only using SGD optimizer with a learning rate of 0.005 which is decayed by a factor of 10 after the 11th and 14th epoch. We use batch size of 64 and train 16 A100 GPUs for large-scale datasets such Kinetics-400 (Kay et al. 2017) and only A100 GPUs for other small datasets. We discuss the effect of our temporal prompts on temporal (video) and spatial (image) solutions in Table 5) Our method mostly retains the original image solution captured in image class token Iets while exhibiting dynamic temporal modeling.
2.2 TRANSFERABLE ATTACK USING SPATIAL AND TEMPORAL CUES
Given an image model adapted for motion dynamics via our approach (Fig. D. our attack exploits the spatial and temporal cues to generate transferable perturbations for both image and video models.
Given a video and corresponding label: Our attack uses the refined temporal class token i'y, output by the model a supervised manner, while the spatial class token I.ds serves in self-supervised objective.
Given an image and its corresponding label: Our attack uses the refined class tokens T(p learned at different resolutions to mimic the dynamic behavior from images a supervised manner, while the spatial class token Ins serves in an self-supervised objective.
We generate an adversarial example x' for video or image sample æ using the following objective:
find such that F(x')argmer + y, and || - 1lppp S c,
(2)
where is the original label and represents maximum perturbation budget within a norm distance p. We optimize Eq. by maximizing the loss objective in Eq. 3 within existing adversarial attacks.
maximize L= L.s:
where C, a supervised loss function. uses the labels of given image/video through supervised MLP head. L, can be optimized by any of the existing supervised losses proposed in transferable attacks literature: cross enosopy (Dong et al. 2018), relativistic cross-entropy (Naseer logit loss (Zhao et al. 2021). Unless otherwise mentioned, we use cross-entropy loss to demonstrate the effectiveness of our approach. Similarly, L.s self-supervised loss that exploits pre-trained representation within spatial class tokens. We minimize the cosine similarity between the refined class tokens of clean and adversarial samples. Specifically, we define L, and Las as follows:
2019) or
I' I
Σ yolog (I 1 og), Les |I''ctol|[[ctt
C. =
5

---

Published as a conference paper at ICLR 2023
Fast Gradient Sign Method (FGSM) (Goodfellow et al, 2014
TimesFormer
ResNer3D
MVCNN
Models (1) Temporal Prompes
UCF
HMDB
K400
55v2
UCF
HMDB
K400
55v2
Depth
Shaded
90.6
59.1
75.6
45.1
79,9
45.4
60.5
26.7
92.6
94.8
Doit-T
x
75.1
32.9
57.8
23.5
25.7
9.8
23,3
14.7
16.0
79.0
64.5
21.9,322)
51.6
19.8,353)
22.3,31
8,9,
19.4;4L)
13.9.12:)
15.2,m14
77.4.114
S
74.7
33.5
58.2
23.0
25.4
9.7
23.9
15.9
17.2
79.8
(4.0
20.6,
19.1
22.6
8,6
20,6,
13.6.131
15.9,
78.9.
Deit-B
75.5
31.7
57.5
22.6
25.0
9.2
22,4
15.5
17.3
80.6
64.7,75w
20.0,30.1
48.6
19.3,ss
22.7,
19.5,41
13.4.183)
17.4
80.9,u14
X
71.0
33.7
54.2
23.8
32.0
12.4
24.3
15.2
15.2
72.7
DINO
60.7:;253p
18.8,40)
46.7/225)
19.4,a5.)
21.9
8,3
19.6
13.9k12.)
15.0,mm
70.7.26.
CLIP
79.8
36.6
62.3
26.4
38.5
15.0
29.9
17.3
15.8
81.4
77.5 29.3
b) 25.00 00 2011
45.6.4439
(1.2
28.8,
m6.5.mm
15.6,m00
81.2
Projected Gradient Decent (PGD) Madry et al. 2018
84.9
40.9
68.3
32,5
69.4
32.7
44.3
18.4
37.0
90.5
Deit-T
78. 18.1
32.0,mn
61.5
27.8 27.8,11.
65.9:34m
29.5.159:
19.1
17.6,99
34.6:31m
90.2(44)
85.1
42.0
68.6
32.5
69.9
32.7
44.8
19.4
39.4
90.9
Deit-S
V
74.1.165;
26.1,38m
58.3
26.1.m00
65.4.145
28.2
28.9,310
17.1.0s
36.5,35.
90.1(42)
Deit-B
x
85.5
41.5
67.7
33.3
69.9
32.6
44.7
18.9
37.7
91.1
73.6,
25.0.
56.3,193)
24.4,20)
64.7.132)
26.6.183)
37.0.223)
16.6.mm
36.7;33.)
90.5(43)
DINO
81.7
38.0
64.8
30.9
68.0
31.8
42.5
18.2
33.1
89.2
64.9.
14.8,44)
21.5
22.4.
loiss
25.9.195)
35.2
16.6.
28.9
87.5
CLIP
86.9
44.5
70.7
35.4
71.9
35.1
46.5
20.0
39,8
91.3
82.6,am
32.3
66.9.am
32.7.1241
69.7.102s
28.9.163
43.2,173)
18.9.
37.6.55
90.1647)
Table 1: Adversarial Transferability from image to video models: Adversarial accuracy (%) is reported at < S 16. When attack is optimized from an image model without temporal prompts (X), then we minimize the unsupervised adversarial objective (Eq. [} i.e., cosine similarity between the feature embedding of spatial class token of clean and adversarial frames. We use frames from given video. Attacks transferability improves by a clear margin with temporal prompts. Clean accuracy (top1 % on randomly selected validation set of 1.5k samples) is highlighted with cell color. Single step FGSM and multi-step PGD attacks perform better with our proposed temporal prompts (c.g. FGSM reduces TimesFormer generalization from 90.6% to 64.5% on UCF by exploiting dynamic cues within the DeiT-T). similar trend exists for ResNet3D and MVCNN.
In this manner, any of the existing attacks can be combined with our approach to transfer adversarial perturbations as we demonstrate in Sec.
2.2.1 1 CHANGING SPATIAL RESOLUTION FOR REGULARIZATION
An adversarial attack can easily overfit the source models meaning it can have a 100% success rate on the source model but mostly fails to fool the unknown black-box model. Different heuristics like adding momentum (Dong et al. 2018 Lin et al. 2019 Wang & He| 2021 augmentations (Naseer eet al.] 2021 Xie et al. 2011), ensemble of different models (Dong et al.) 2018) or even self-ensemble (Naseer et al. 2022b) at target resolution are proposed to reduce such overfitting and increase adversarial transferability. Low-resolution pre-training followed by high-resolution fine-tuning have a regularization effect on the generalization of neural networks (Touvron et al., 2022). Similarly, observe that fine-tuning scale-space prompts at different low resolutions (e.g.. 96x66) within a model pre-trained on high resolution (224x224) also has a complimentary regularization effect on the transferability of adversarial perturbations (Tables 3 and 4 Most publicly available image models are trained at a resolution of size 224 224 and their performance at low-resolution inputs is sub-optimal (Fig. Learning at low-resolution with our approach (Fig. [ also allows to mimic a changing scene over time from static datasets like ImageNet (Fig. 2). Our low-resolution scale-space prompts (Sec. 2.I) significantly improves generalization at low-resolution inputs (Fig. 2).
EXPERIMENTS
We generate Lxc adversarial examples from the adapted image models and study their transferability to video and image models. We followed standard adversarial transferability protocol Dong et al. (2018); [aseer et al. (2022b); the attacker is unaware of the black-box video model but has access to its train data. Our temporal cues also boost cross-task adversarial transferability with access

---

Published as a conference paper at ICLR 2023
Momentum Iterative Fast Gradient Sign Method (MIM) (Dng et al. 2018
TimesFormer
ResNer3D
MVCNN
Models
Temporal Prompts
UCF
HMDB
K400
55v2
UCF
HMDB
K400
55v2
Depth
Shaded
90.6
59.1
15.6
45.1
79.9
45.4
60.5
26.7
92.6
94.8
Deit-T
77.0
30.1
58.5
25.2
42.0
16.2
29.1
16.0
19.2
83,0
66.9.22.
21.4
51.4,242)
21.5,234
41.5
(6.1
26.4,340
15.3,14)
19.0
82.9(.1.:
Deic-S
/
60.8,
78.7
31.8
16.
59.3
47.6
25.1
21.0
41,9,
42.2
16.5
15.7
26.8,117)
31.0
14.2.12)
16.5
19,3,
83.6
83.5
Deit-B
78.7
32.0
$9.7
25.9
43.1
16.2
29.5
16.8
20.6
84.4
61.7.as5,
15.6,435)
45.2, 9044
19.1
40.7,093
13.6,318)
24.8,377)
14.5.122)
20.5,m..
84.2.
DINO
71.3
28.0
54,6
24.1
46.0
18.8
30.3
15.9
19.7
80.4
47.7
8.40
38.8
16.4,a0)
39.8
12.7
24.5,
14.3
19:4,912
80.7
CLIP
35.6
63.5
29.3
53.2
21.9
35.5
17.9
86.7
78.2
28.2.
45.9 27.2
37.8
32.9.
16.5.mm2
20.2:32.0
84.7.mm
MIM with Input Diversity (DIM) Xie al. 2019
75.3
28.2
59.2
24.3
41.3
16.5
29.5
16.3
20.3
84.5
D
/
62.6,2400
16.9,42
48.1
20.5,3u4)
13.4,3aa
24.2/3%
14.3,12
19.6,71m
85.0
x
76.3
29.4
57.5
24.1
39.8
17.3
29.8
16.2
21.8
85.9
Deit-S
14.1:355)
12.3,463
42.8
17.7,224
36.8.41.)
12.7,327
22.3,a52)
14.6,120
21.0,21
85.7cam
Deit-B
75.9
28.8
57.8
24.5
41.5
16.5
30.5
15.6
22.2
85.1
/
55.5
12.6,44)
40.6.
16.8,22
37.3:412)
11.4,34
21.5
13.3,134)
20.5
86.3
DINO
64.9
23.1
51.8
22.6
43.5
16.7
27.6
13.7
19.0
80.2
45.2,
5130
35.8.
15.8,300
32.2.
10.6,343
18.3,423
12.0.147
18.9,m
78.6.162
CLIP
78.0
29.5
61.0
26.9
50.0
19.6
32.8
16.9
20.8
87.8
73.4..02
22.7(364)
56.7.
25.
2,.00
36.5.
33.6,318)
31.5,220
15.7.na
20.5,72.
87.4.54)
Table 2: Adversarial Transferability from image to video models: Adversarial accuracy (%) is reported at
16. When attack is optimized from Image model without temporal prompts (X), then minimize the unsupervised adversarial objective (Eq. [). cosine similarity, between the feature embedding of spatial class token of clean and adversarial frames. We use 8 frames from a given video. Attacks transferability improves by clear margin with temporal prompts. Clean accuracy (top1 % on randomly selected validation set of 1.5k samples) is highlighted with cell color. We observe that a small Image model (c.g. With with only 5 Million parameters) can significantly reduce the generalization of TimesForme with the presence of our temporal prompts. The attack performance with temporal prompts increases with network capucity (e.g. Deit-T to Deit-B).
to the black-box video model, its training data, or label space ( Appendix BB.
The maximum pixel perturbation is set to S 16 for pixel range of [0, 255]. We use standard image attacks to optimize adversarial examples through our adapted image models and boost adversarial transferability to video models by using the following protocols:
Surrogate image models:
We optimize adversaries from the known surrogate models. We study three types of surrogate image models trained via supervised (Touvron et al. 2020), self-supervised (Carnn et al. 202T) and text-supervised (Radford et al., 202I) models.
Supervised image models: We use Deit-T, DeiT-S, and DeiT-B with 5, 22, and 86 million parameters to video datasets. These models are pre-trained in a supervised manner on ImageNet.
- Self-Suuprvised image model: We use Vision Transformer trained in self-supervised fashion on ImageNet using DINO training framework (Caron et al. (02T).
TTxt-Superrised image model: We adapt CLIP image encoder only trained on text- images.
DeÎT-B, DINO, and CLIP share the same network based on Vision Transformer. These models process images of size x 224x22x2 224 that are divided into 196 patches with a patch size of 16. Each of these patch tokens has 768 embedding dimensions. Thus, the only difference between these models lies in their corresponding training frameworks. These models are adapted to different video datasets. Adversarial examples are then simply created using existing single and multi-step attacks (Goodfellow et al. 2014 Madry et al. 2018 Dong et al. 2018 Xie et al. 2019).
We transfer adversarial examples to unknown (black-box) video and image models. - Targett Video Models: We consider recently proposed TimesFormer (Bertasius et al. 202T) with divided space-time attention, 3D convolutional network (Tran et al., 2018), and multi-view convolutional network (Su et al. (015)). -Target Image Models: We consider the same
Target video and image models:
image models used in baseline by (Naseer et al. 2022b): BiT-ResNet50 (BiT50) (Beyer et al.
7

---

Published as a conference paper at ICLR 2023
MIM with Input Diversity (DIM) Xie al. 2019
Convolutional
Transformer
Models (1)
Method
BIT50
Res152
WRN
DN201
ViT-L
T2124
TnT
T21-7
Deit-B
Naseer et al. 2022b
80.10
84.92
86.36
89.24
78.90
84.00
92.28
93.42
Deit-B
86.64
90.88
92.14
93.82
95.64
95.74
98.48
94.74
DINO
Ours
84,36
93.74
95.16
96.20
96.48
89.68
94.74
96.18
CLIP
55.34
64.24
65.76
71.78
59,94
54.66
62.72
75.80
Table 3: Adversarial Transferability from image to image models: Fool Rate (%) on 5k ImageNet val. samples from Naseer ct al. 2022b). We compare against the best results from Nascer et al. (2022b) that our bascline is a self-ensemble Deit-B with token refinement blocks. To mimic the dynamics with static images, optimize proposed prompts at resolutions of 56x56, 96x94, 120x 120, and 224. Adversaries are optimized at the target resolution of 224. Our method performs favorably well against self-ensemble with refined tokens.
Table Effect of Change in Spatial Resolution (SR): Incorporating change in spatial resolution improves adversarial transferability (% accuracy, lower is better). Adversaries are created at target resolution of 224 from ensemble of models adopted 56x56, 96,96, and 224x224.
Models
Temporal Prompts
SR
TimesFormer
UCF
HMDB
x
X
75.9
28.8
DeiT-B
55.5
12.6
53.9
11.8
2021
Wide-ResNet-50- (WRN) Zagoruyko & Komodakis 2016), DenseNet201 (DN201) (Huang et al. 2017) and other ViT models including Miken-to-Token
15 (Res152) (He et al. 2016))
transformer (T2T) (uuan et al.) 2021). Transformer in Transformer (Tn'T) (Mao et al. [021).
Adapting image models for videos using dynamic cues: We use UCF (Soomro et al. 2012).
HMDB (Kuchne et al. 2011), K400 (Kay al. (017), and SSv2 (Goyal et al. [2017) training sets to learn temporal prompts and adapt image models to videos via our approach [F HMDB has the smallest validation set of 1.5k samples. For evaluating robustness, we selected all validation samples in HMDB, while randomly selected 1.5k samples from UCF, K400, and SSv2 validation sets. We also use multi view training samples rendered for 3D ModelNet40 (depth and shaded) for image models. We use validation samples of rendered multi-views for both modalities.
Adapting image models to images mimicking dynamic cues: We use ImageNet training set and learn our proposed transformation and prompts at multiple spatial scales; 56x56, 96x 96, 120x 1 120, and 224. We optimize adversarial attacks at the target resolution of 224 x 224 by using the ensemble of our learned models at multiple resolutions. In this manner, our approach mimic the change over time by changing the spatial scale or resolution over time. We study our attack approach using the 5k samples from ImageNet validation set proposed by (Naseer et al. 2022b).
Inference and metrics: We randomly sample 8 frames from a given video for testing. We report drop in top-1 (%) accuracy on adversarial and clean videos. We report fooling rate (%) of adversarial samples for which the predicted label flipped w.r.t the original labels) to evaluate on image datasets.
Extending image attacks to videos: We apply image attacks such as single step fast gradient sign method (FGSM) (Goodfellow et al. 2014) as well as iterative attacks with twenty iterations including PGD Maady et al. 2018)) MIM (Dong et al. 2018) and input diversity (augmentations to the inputs) (DIM) (Xie et al. 2019) attacks to adapted image models and transfer their adversarial perturbations to black-box video models. We follow the attack settings used by (Naseer et al. 2022b). Our proposed transformation (T (.)) allows to model temporal gradients during attack optimization (Fig. 3). We simply aggregates the gradients from both branches of our model the input video frames (Fig. I..
3.1 ADVERSARIAL TRANSFER FROM IMAGE-TO-- VIDEO MODELS
The generalization of image models on videos is discussed in Table 5 We observe that image solution remains preserved in VIT backbones even after training with our proposed transformation and temporal prompts. Deit models retain their top-1 (%) accuracy on ImageNet when measured through image class token, while also exhibiting decent performance mulit-views of ModelNet40. CLIP achieves the best performance on videos. The transferability of image based attacks from our adapted image models to video and multi-view models is presented in Tables Tand Following insights emerges from our analysis: a) The attack success to video models increases with size of the image models. The larger the image model (e.g. Deit-T to DeiT-B) the
video datasets and rendered
8

---

Published as a conference paper at ICLR 2023
Figure 4: Adversaries (DIM (Xie et 2019)) from an en- semble of image models with different networks transfer well and fool the black-box video models. First row shows trans- ferablity from an ensemble of different networks, while sec- ond row shows attack results from ensemble of similar networks but pre-traines with different training schemes.
Del-3
[NRT]
23
33
39
Das
(hiti SENO, CLIP)
Tland
[Dettd, BING, (L3P) BaA110
(betxa) SENO, CLIP) NVENN
2000
6:35
ImageNet
ImageNet and Videos
ImageNet and ModeINet40
Models
IN
IN UCF
IN-HMDA
IN K400
IN - SSy2
IN Depth
IN Shaded
Deit-T
72.2
72.0 70.0
72.3 36.2
72.2 44.6
72.2 11.2
72.2 86.0
72.1 81.0
Deit-S
79.9
79.8 77.2
79.8 44.6
79,9- 53.0
79.9 15.3
78.8 86.6
79.8 886.2
Deit-B
81.8
81.9
81.4
81.7 47.7
81.9 57.0
81.8 17.5
81.8 90.1
81.4 88.2
DINO
NA
NA 79.5
45-45.1
N7-5
NA 17.4
NA 90.1
NA- 89.8
CLIP
NA
NA 86.0
NA 54.6
NA 67.3
19.9
NA 89.5
NA 88.9
Table Spatial along with Temporal Solutions within Image Models: Our approach successfully incorporates temporal information into pre-trainn trained and frozen image models and increases their generalization (top-1 (%) at resolution 224) to high-din sish--immnsionall datasets. The original image solution remains preserved in our approach. Ours Deit-B retains 81.9% top-1 accuracy ImageNet validation while exhibiting 81.4% on UCF.
higher the attack success, b) The adversarial perturbations generated using self-supervised DINO transfer better than CLIP or supervised Deit-B, e) Divided space-time attention is more robust than 3D convolution, and d) MVCNN trained on shaded rendered views is more robust than depth.
3.1.1 ENSEMBLE ADVERSARIAL TRANSFER
Adversarial attacks optimized from an ensemble of models (Dong et al., 2018 Xie et al., 2019) or self-ensemble (Naseer et al.) 2022b increases transferability. We study three types of image ensembles including a) Ensemble of Different Networks: We transfer attack from three image models of the Deit family (Touvron et al. 2020) including Deit-T, Deit-S and Deit-B. B. These models differ in architecture, b) Ensemble of Different Training Frameworks: We transfer attack from three image models including Deit-B, DINO and CLIP. These models share similar architecture but differ in their training, and e) Ensemble of Different Spatial Resolutions: We transfer attack from three image models with the same architecture (Deit-B) but prompt adapted to different spatial resolutions.
Ensemble of different training frameworks performs favorably to boost attack transferability (Fig. An attacker can adapt our approach at different resolutions to enhance transferability (Table 4 We provide generalization Deit-B at varying spatial scales for video datasets in Appendix]
3.2 ADVERSARIAL TRANSFER FROM IMAGE-TO-IEE IMAGE MODELS
Image datasets are static but we mimic the dynamic behaviour by learning our proposed transformation at different spatial scales (Fig. 2). Our approach exhibit significant gains in adversarial transferability
(Table 3) Refer to appendices B for extensive analysis on cross-task adversarial transferabilityy textual bias of CLIP on adversarial transferability, visualization of attention roll-outs and latent embeddings, and effect of the number of temporal prompts on adversarial transferability.
4 CONCLUSION
In this work, we study the adversarial transferability between models trained for different data modalities (e.g., images to videos). We propose a novel approach to introduce dynamic cues within pre-trained (supervised or self-supervised) image models by learning simple transformation on videos. Our transformation enables temporal gradients from image models and boost transferability through temporal prompts. We show how approach can be extended to multi- view information from 3D objects and varying image resolutions. Our work brings attention to the image models as universal surrogates to optimize and transfer adversarial attacks to black-box models.

---

Published as a conference paper at ICLR 2023
Reproducibility Statement: Training image models: We adapt pre- pre-trained image models Deit, DINO and CLIP, open sourced by the corresponding authors. We freeze the weights of these models and adapt them for video datasets by introducing
modifications (transformation with temporal prompts). We incorporate the adapted models into the open sourced Fomesrormer github repo https Tigithub.com/face http://aabaoooorrrccccc///c www.rrrreeerrrtmmmfetefeee Tireerormer and train them with default settings. Training video models: We use the TimesFormer github repo with default settings to train ResNet3D on UCF, HMDB, K-400, and SSv2. Training MVCNN: We use open source code https://github com/jongchyisu//me www.n/ pytorch to train multi-view models on rendered views (depth, shaded) of ModelNet40. Attacks: We use adversarial attacks with default parameters as described in baseline (Naseer et al. (022b). Datasets: We use the same 5k image samples from ImageNet validation set, open sourced by Naseer et al. (2022b), while randomly selected 1.5k samples from the validation sets of explored video datasets. Furthermore, we will release the pre-trained model publicly.
Ethics Statement: Our work highlights the use of freely available pre-trained image models to generate adversarial attacks. This can be used to create attacks real-world deep learning systems in the short run. Our work also provides insights on how such attack can emerge from different work provides an opportunity to develop more robust models to defend against such attacks. Further, the image and video datasets used in this work also pose privacy risks which is important topic we hope explore in future.
resources. Therefore,
REFERENCES
Samira Abnar and Willem Zuidema. Quantifying attention flow transformers. In Proceedings of the 58th Anmual Meeting of the Association for Computational Linguistics. pp. 4190-4197 4197, Online, July 2020. Association for Computational Linguistics. doi: (0.18653/11/0220.ag 385. URL https
srcclaathooogy.or/2200...o maaim...maaainn.........mm..mmna 385
Abhishek Aich, Calvin Khang-Ta, Ta, Akash Gupta, Chengyu Song, Srikanth V. Krishnamurthy, M. Salman Asif, and Amit K. Roy-Chowdhury. Gama: Generative adversarial multi-object scene attacks, 2022.
Naveed Akhtar and Ajmal Mian. Threat of adversarial attacks on deep learning in computer vision: A survey, leee Access. 6:14410-14440 2018.
Anurag Arnab, Mostafa Dehghani, Georg Heigold, Chen Sun, Mario Lučié, and Cordelia Schmid. Vivit: A video vision transformer. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 6836-6846, 2021.
Gedas Bertasius, Heng Wang, and Lorenzo Torresani. Is space-time attention all you need for video understand- ing? In ICML, volume 2. pp. 4, 2021.
Lucas Beyer, Xiaohua Zhai, Amélic Royer, Larisa Markeeva, Rohan Anil, and Alexander Kolesnikov. Knowledge distillation: A good teacher is patient and consistent. arXiv preprint arXt:21106.052.7, 2021.
Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and Armand Joulin.
Emerging properties in self-supervised vision transformers. arXiv preprint arXiv:2104. 14294, 2021.
Joao Carreira and Andrew Zisserman. Quo vadis, action recognition? new model and the kinetics dataset. In proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 6299 9999-630,,550 2017.
Yinpeng Dong. Fangzhou Liao, Tianyu Pang. Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In CVPR, 2018
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenbom, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthiss Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x 16 words: Transformers for image recognition at scale. arXiv preprint 2000:2000.11122 2020.
Gamaleldin F Elsayed, Ian Goodfellow, and Jascha Sohl-Dickstein. Adversarial reprogramming of neural
networks. arXiv preprint arXiv:18066 11146 2018
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2014.
Raghav Goyal, Samira Ebrahimi Kahou, Vincent Michalski, Joanna Materzynska, Susanne Westphal, Heuna Kim, Valentin Haenel, Ingo Fruend, Peter Yianilos, Moritz Mueller-Freiie Freitag, et al. The" something something" video database for learning and evaluating visual common sense. In Proceedings of the IEFE international conference on computer vision, pp. 5842-5850, 2017.
10

---

Published as a conference paper at ICLR 2023
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016.
Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinherger. Densely connected convolutional networks. In Proceedings of the IEEE conference on compuder vision and pattern recognition, pp. 4700-4708. 2017.
Menglin Jia, Luming Tang. Bor-Chun Chen, Claire Cardie, Serge Belongie, Bharath Hariharan, and Ser-Nam Lim. Visual prompt tuning. arXiv preprint arXiv:2203. 12, 2022.
Zhengbao Jiang, Frank F Xu, Jun Araki, and Graham Neubig, How can we know what language models know? Transactions of the Association for Computational Linguistics, 8:423 438, 2020.
Will Kay, Joao Carreira, Karen Simonyan, Brian Zhang, Chloc Hillier, Sudheendra Vijayanarasimhan, Fabio Viola, Tim Green, Trevor Back, Paul Natsev, al. The kineties human action video dataset. arXiv preprint WwXiv:/705.06550 2017.
Hildegard Kuehne, Hueihan Jhuang. Estibaliz Garrote, Tomaso Poggio, and Thomas Serre Hmdb: large video database for human motion recognition. In 20/ International conference computer vision, pp. 2556-2563. TEEE, 2011.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning scale. arXiv preprint arXiv:661.001236 2016.
Brian Lester, Rami Al-Rfou, and Noah Constant, The power of scale for parameter-efficient prompt tuning. arXiv preprint arXiv:2104. 142100440060000000
Xiang Lisa Li and Percy Liang. Prefix-tuning: Optimizing continuous prompts for generation. arXiv preprint arXiv:2101.00 0009000.000...00000 2021.
Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E. Hoperoft. Nesterov accelerated gradient and scale invariance for adversarial attacks. arXiv preprint arXiv: 1908.0628), 2019.
Pengfei Liu, Weizhe Yuan, Jinlan Fu, Zhengbao Jiang, Hiroaki Hayashi, Graham Neubig. Pre-train, prompt, and predict: A systematic survey of prompting methods in natural language processing. arXiv preprint 1rXiv:2107.13586 2021a.
Xiao Liu, Kaixuan Ji, Yicheng Fu, Zhengxiao Du Zhilin Yang. and Jie Tang. P-tuning v2: Prompt tuning can be comparable to fine-tuning universally across scales and tasks. arXiv preprint arXiv:21 202
Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hicrarchical vision transformer using shifted windows. arXiv preprint arXiv:2003. 14030, 2021c.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. ICLR, 2018
Hashmat Shadab Malik, Shahina Kunhimon, Muzammal Naseer, Salman Khan, and Fahad Shahbaz Khan. pretext task for transferable perturbations. In 33rd British Machine Vision Conference 2022, BMVC 2022, London, UK, November 21-24, 2022. BMVA Press, 2022. URL htttp:///bmvc2222.mmpp wwwp::/222..mmmii..mmp.....mm mpg. de/pg//./0/555.p..//
Adversarial pixel restoration
Yuxin Mao, Jing Zhang, Zhexiong Wan, Yuchao Dai, Aixuan Li, Yunqiu Lv, Xinyu Tian, Deng-Ping Fan, and Nick Barnes. Transformer transforms salient object detection and camouflaged object detection. arXiv preprint XXxx:2104.10122 2021.
Krishna kanth Nakka and Mathieu Salzmann. Learning transferable adversarial perturbations. Advances in Neural Information Processing Systems, 2021.
Muzammal Nascer, Salman H Khan, Harris Khan, Fahad Shahbaz Khan, and Fatih Porikli. Cross-domain
transferability of adversarial perturbations. Advances in Neural Information Processing Systems, 2019.
Muzammal Nascer, Salman Khan, Munawar Hayat, Fahad Shahbaz Khan, and Fatih Porikli. A self supervupe approach for adversarial robustness. IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2020.
Muzammal Naseer, Salman Khan, Munawar Hayat, Fahad Shahbaz Khan, and Fatih Porikli. On generating transferable targeted perturbations. arXiv preprint Stti::2033.1400 2021.
Muzammal Naseer, Salman Khan, Fatih Porikli, and Fahad Shahbaz Khan, Guidance through surrogate: Toward generic diagnostic attack. IEFE Transactions on Neural Networks and Learning Systems, 2022a.
11

---

Published as a conference paper at ICLR 2023
Muzammal Naseer, Kanchana Ranasinghe, Salman Khan, Fahad Khan, and Fatih Porikli. On improving adversarial transfcrabiliiyy of vision transformers. International Conference on Learning Representations, 2022b. URL /tLLitt////pppeeeeviee
F. Pedregosa, G. Varoquaux, A. Gramfort, V. Michel, B. Thirion, O. Grisel, M. Blondel, P. Prettenhofer, R. Weiss, V. Dubourg, J. Vanderplas, A. Passos, D. Cournapeau, M. Brucher, M. Perrot, and E. Duchesnay. Scikit-leam: Machine learning in Python. Journal of Machine Learning Research, 12:2825-2883 2011.
Omid Poursaeed. Isay Katsman, Bicheng Gao, and Serge Belongie. Generative adversarial perturbations. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, pp. 4422-4431, 2018.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. learning transferable visual models from natural language supervision. In International Conference on Machine Learning, pp. 8748-8766 PMLR, 2021.
Taylor Shin, Yasaman Razeghi, Robert L Logan IV, Eric Wallace, and Sameer Singh. Autoprompt: Eliciting knowledge from language models with automatically generated prompts. arXiv preprint arX1v:2010.15980. 2020.
Khurram Saomro, Amir Roshan Zamir, and Muharak Shah. Ucf101: A dataset of 101 human actions classes from videos the wild, arXiv preprint 1rXiv:/212.0402, 2012.
Hang Su, Subhransu Maji, Evangelos Kalogerakis, and Erik cearedd-Mllee Multi-view convolutional neural networks for 3d shape recognition. In Proceedings of the IEEE international conference computer vision, pp.
2015.
Ilya Tolstikhin, Neil Houlsby, Alexander Kolesnikov, Lucas Beyer, Xiaohua Zhai, Thomas Unterthiner, Jessica Yung, Daniel Keysers. Jakob Uszkoreit, Mario Lucic, et al. Mlp-mixer: An all-mlp architecture for vision. 2021.
arXiv preprint
Hugo Touvron, Matthicu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data-efficient image transformers & distillation through attention. arXiv preprint 122777201 2020.
Hugo Touvron, Matthieu Cord, and Hervé Jégou. Deit iii: Revenge of the vit. arXiv preprint urXiv:2204.07118 2022.
Du Tran, Heng Wang. Lorenzo Torresani, Jamie Ray, Yann LeCun, and Manohar Paluri. A closer look spatiotemporal convolutions for action recognition. In Proceedings of the IEEE conference on Computer Vision and Pattern Recognition, pp. 6450-6459, 2018.
Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research. 911), 2008
Xiaosen Wang and Kun He. Enhancing the transferability of adversarial attacks through variance tuning. arXiv preprint arXiv:2103. 2021.
Zhipeng Wei, Jingjing Chen, Zuxuan Wu, and Yu-Gang Jiang. Cross-modal transferable adversarial attacks from images to videos. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, 15064-15073, 2022.
Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Improving transferability of adversarial examples with input diversity. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 2730- 2739, 2019.
Li Yuan, Yunpeng Chen, Tao Wang. Weihno Yu, Yujun Shi, Francis EH Tay, Jiashi Feng, and Shuicheng Yan. Tokens-to-token vit: Training vision transformers from scratch imagenet. arXiv preprint 2rXiv:2101.11988. 2021.
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. arXiv preprint 1151::660..07146, 2016.
Qilong Zhang, Xiaodan Li, Yuefeng Chen, Jingkuan Song, Lianli Gao, Yuan Hc, and Hui Xue. Beyond imagenet attack: Towards crafting adversarial examples for black-box domains. arXiv preprint arXiv:2201. 2022.
Zhengyu Zhao, Zhuoran Liu, and Martha Larson. On success and simplicity: second look transferable targeted attacks. Advances Neural Information Processing Systems, 34:6115-6122 2021.
Wen Zhou, Xin Hou, Yongjun Chen, Mengyun Tang, Xiangqi Huang, Xiang Gan, and Yong Yang. Transferable adversarial perturbations. In Proceedings of the European Conference Computer Vision (ECCV), pp- 452-467, 2018.
12

---

Published as a conference paper at ICLR 2023
Appendix
Our approach simply augments the existing adversarial attacks developed for image models and enhances their transferability to black-box video models using our proposed temporal cues. We study cross-task adversarial transferability (Nasser et al.
2019)); the attacker has no access to the
black-box video model, its training data, or label space in Appendix [ We compare the adversarial
transferability of our best image models (DINO (Caron et al. (021)) with temporal cues against pure
video models (TimesFormer Bertasius et al. (021), ResNNet3 (Tran et al. 2018), and I3D (Carreira)
& Zisserman
2017) in Appendix C We observe that adversarial examples found within adapted
CLIP models show lower transferability image and video models (Tables 2 and (3). We analyze the textual biases of CLIP vision features in Appendix Dito further explain the difference between adversarial space of uni-modal and vision-language models such as CLIP. Appendix E] we analyze the attention roll-out from our temporal prompts to signify that our prompts pay attention to temporal information across frames as compared to the original image features. We also observe the behavior of our temporal prompts across shuffled frames in Appendix F We study the effect of increasing the number of temporal prompts during the attack in Appendix G The effect of fully fine-tuning the image models with our proposed temporal prompts attack transferability is presented in Appendix H The generalization of the image model (Deit-B) at varying spatial scales on video modalities is presented in appendix [ In appendix[] we visualize the latent space of class tokens trained at spatial resolution of 224 x 224 vs our adapted tokens at various spatial resolution scales. The evolution of
adversarial patterns across time generated using our approach provided in appendix K
A RELATED WORK
Adversarial Attacks:
Transferable adversarial attacks compromise the decision of black-box target model. Attacker can not access weights, model outputs or gradient information of a black-box model.
These attacks can broadly be categorized into iterative (Goodfellww et 2014 Dong al. 2018 Lin et al. 2019 Wang & He [ Xie et al. [019 Zhou et al. [0188] Naseer et al. 2022b Wei et al. 2022) and generative (Poursaeed et al. 2018 Naseer et al. (022)220222 methods. Iterative attacks optimize adversary from a given clean sample by searching adversarial space of a white-box surrogate model iteratively. Attacker can access weights, model outputs and gradient information of white-box surrogate model. Generative attacks on the other hand train universal function (an auto-encoder) against the white-box model over a given data distribution. These attacks can generate adversary via single forward- pass after training. Our proposed approach can be augmented with any of these existing attacks to boost transferability from image-to-vided or multi-view models.
2022a)
Prompt Adaptation of Image Models:
Prompting refers to providing manual instructions (Liu 2021a Jiang et al. 2020; Shin et al. 2020) or fine-tuning task-specific tokens (Li & Liang
et al.
2021 Liu et al. 202Tb]] Lester et al.] 2021 for desired behavior from large language models (e.g.. GPT-3). Recently, prompt fine-tuning has been studied for vision models with promising results to adapt image models from one image task to another (Jia et al. 2022 Elsayed al. 2018). We extend prompt transfer learning to adapt image models to videas and multi view data modalities. We only train a transformation along with a prompt class token to learn dynamic cues and adapt image model to video tasks. Our approach allows transferable attacks from amage-to-vided or multi-view models.
B DYNAMIC CUES TO BOOST BROSS-TASH TRANSFERABILITY
We apply the task attack using self-supervised objective (cosine similarity such as described in Eq. [3] Sec. 2.2) to our surrogate image models with temporal cues and compare the adversarial transferability with pure video surrogate models (I3D (Carreira & Zisserman (017)). and Timesformer (Bertasius et al. 202I)) in Table 6. The cross-task attack transfcrability when combined with our approach described in Section 2.2 performs favorably well against the video models. This is contributed to the fact that the attack exploits an ensemble of two different representations (image and video) when combined with our adapted image models. Therefore our approach frees the attacker from having access to a specialized video architecture trained specifically on the video to generate more transferable attacks.
13

---

Published as a conference paper at ICLR 2023
MIM with Input Diversity (DIM) (Xie al. 2019
UCF
HMDB
Source Domain
Model (1)
Temporal Prompts
B3D
TimesFormer
ResNet3D
13D
Timeerormer
ResNer3D
TimesFormer
35.0
42.1
21.3
21.1
K400
I3D
75.6
47.9
25.1
19.0
DINO (Ours)
v
13.2
63.2
41.5
8,4
22.9
15.8
TimesFormer
38.2
40.6
22.6
21.0
SSv2
I3D
78.0
45.0
29.1
18.9
DINO (Ours)
18.7
62.9
42.6
10,9
21.6
16.1
Table Cross-Tast attack with Temporal Prompts:
Adversarial attack using the self-supe image model performs favorably as compared to pure video models.
Caron et al. 202T) with our dynamic cues (Section 2.2
Gradient Sign Method (FGSM) Goodfellow al. 2014
UCF
HMDB
Model ($)
Temporal Prompts
TimesForer
ResNer3D
Tomerr
ResNer3D
TimesFormer
30.1
15.6
ResNer3D
69.9
30.7
(Ours)
60.7
21.9
Projected Gradient Decent (PGD) (Madry et al. 2018
TimesFormer
73.3
36.3
ResNet3D
86.0
46.5
DINO (Ours)
64.9
63,1
14.8
25.9
Momentum Iterative Fast Gradient Sign Method (MIM) (Dong al. 2018
TimesFormer
44.5
21.5
ResNet3D
77.4
35.0
DINO (Ours)
47.7
39,8
12.7
MIM with Input Diversity (DIM) (Xie ul. 2019
Tomeerrrmer
41.7
18.4
ResNer3D
74.4
DINO (Ours)
45.2
32.2
7.30
10.6
Table 7: Temporal Prompts Vs. Video Models: Adversarial attack using the self-supervised image model (Caron)
2021)
with dynamic cues (Section) 2.2
performs favorably compared to pure video models.
Table 8: Generalization of Video Models: The top-1 (% accuracies the validation datasets are reported. We provide single view inference on 8 frames to be consistent across these video models.
Generalization of Video Models
Dataset (L)
TimesFormer
ResNet3D
I3D
UCF
90.6
79.9
79.7
HMDB
59.1
45.4
43.8
K400
75.6
60.5
73.5
SSv2
45.1
26.7
48.4
C IMAGE Vs. VIDEO SURROGATE MODELS
The attack transferability of our image models with dynamic cues compared against pure video models (TimesFormer (Bertasius et al. 2021). ResNet3D (Tran et al. 2018), and I3D (Carreira & Zisserman 2017)) in Table The generalization (top-1 % accuracies) of the video models (Table g higher than adapted image models (Table(5). This is expected video models specifically designed and trained from scratch on the video datasets. However, the adversarial transferability of our image models compares well against these pure video models (Table Our approach enables
the attacker to exploit image and video solution from the same image model while pure video models lack the image representation.
D ANALYSING CLIP
Vision- -anguaee models like CLIP consists of an image and text encoder and are trained on large- scale image-text pairs to find common feature space between images and textual labels. Inherently visual features of CLIP aliened with text. Our results indicate that adversarial perturbations
14

---

Published as a conference paper at ICLR 2023
Clean
Adversarial
Clean
Adversarial
Clean
Adversarial
Clean
Adversarial
We apply DIM attack (Xie et al. 2019) the original CL.IP model. generates adversaries with text imprints. These perturbation successfully fools CLIP but does not transfer well on image models since the presence of textual bias not optimal for black-bov box image models. We adapt the pre-trained and frozen CLIP vision encoder to vidcos. Therefore, it is expected that after training our temporal prompts introduced within CLIP also contain textual bias as these prompts interact with CLIP frozen features. Best Viewed in Zoom.
Figure 5: Visualizing Textual Bias of CLIP Adversarial Space:
found via the CLIP vision encoder show lower transferability as compared to similar models such as DINO (Caron al. (02T]) and Deit-B (Touvron al. 2020). The alignment of CLIP vision features towards text results into adversaries with textual bias. We can see textual patterns emerging within adversarial perturbations (Fig. 5). These perturbations are optimal fool CLIIP but not that meaningful for vision models trained without text supervision. We quantify this as well by measuring cosine similarly between visual features CLIP vision encoder, DINO, and Deit-B with CLIP
15

---

Published as a conference paper at ICLR 2023
Measuring Textual Bias
Table 9: Textual Bias of Vision Encoders: Results are reported on 1000 randomly selected images (one per class) from ImageNet validation set. We measure the similarity between the refined class token output by vision encoders with textual features output by CLIP encoder for text label input "a photo of {class name)".
Vision Encoder
Text Encoder
Cosine Similarity
CLIP
CLIP
0.31
Deit-B
CLIP CLIP
0.005
DINO
0.002
on Shuffled
Table 10: Robustness to Temporal Variations: We repeal inference re- sults three times with 8 randomly sampled and shuf- fled frames. Our adapted image mod- els show higher robustness to such temporal variations.
Model Temporal Prompts
UCF
HMDB
1400
single view
Deit-B
/
80.31:10.33
46.21:0.22
57.111035
16.9:0.52
DINO
0.34
46.11:0.19
55.7-40.1
17.1
CLIP
/
85.6 0.23 55.0 66.2 4:
19.1 = 0.21
Effect of Number of Temporal Prompts Transferability
TimesFormer
ResNet3D
Model (L)
Temporal Prompts
UCF
HMDB
K400
SSv2
UCF
HMDB
K400
SSv2
55.5
12.6
40.6
16.8
37.3
11.4
21.5
Deit-B
51.4
10.6
15.3
35.2
9.9
20.6
21.5
6.5
10.4
19,6
13.9
45.2
7.3
35.8
15.8
32.2
10.6
18.3
12.0
DINO
42.9
6.0
35.3
14.5
29.7
8.8
18.1
11.5
30.2
5.7
22.6
8.3
15.3
4.9
10.0
7.3
Table 11: Effect of Number of Temporal Prompts on Adversarial Transferability observe non-trivial gains adversarial transferability as we increase our temporal prompts. This indicates that the more the temporal information the better the attack transferability (DIM (Xie et al. 2019)) of our approach (lower is better).
textual features produced for text labels (Table 9 These observations further explain the lower performance of the ensemble of different training frameworks ((DINO, CLIP, Deit-B)) as compared to an ensemble of different networks (Deiit-T, Deit-S, Deit-B)) (Fig.
E ATTENTION ROLL-OUT ACROSS TIME
We compute the roll-out attention (Abnar & Zundema 2020) of our temporal prompts within image models and compared those against original image models (Fig. (6. We observe that temporal prompts focuses on action across different frames for video as compared to the spatial class token with in pre-trained image models. Fooling such models allows for finding transferable adversarial patterns.
F ANALYSING DYNAMIC CUES AGAINST TEMPORAL VARIATIONS
We further analyse our dynamic cues by measure robustness to temporal variations. We provide inference results on shuffled video frames Table TO We randomly sample single view with frames and report average and standard deviation across three runs. Our models are robust to such temporal variations.
G EFFECT OF NUMBER OF TEMPORAL PROMPTS
It's a common practice to increase the number of frames for better temporal modeling. In similar spirit, we also increase number of training frames and consequently the number of our temporal prompts through transformation. As expected, this strategy leads to better performance in modeling dynamic cues and attack transferability (Table 11)
16

---

Published as a conference paper at ICLR 2023
Attention Roll-out: Deit-B with and without our Dynamic Cues
With Prompts Without Prompts frames
Speed
Spee
Spicrr
Spcee
Spcce
Spcce
Prompts Withoout Prompts
frame
frame
frame
frame 3
frame 3
frame 5
frame 6
freme 7
Attention
Roll-out: DINO with and without Dynamic Cues
With Prompts without Promots Row frames
Speed
Speen
Speeed
Spece
Reed
Sheeek
Promptss Without Promats
frame
frama
frame
frame
frame &
frame 5
frame f
frame 7
Figure 6: Visualization of Dynamic Cues through Attention role-out: We use Abnar Zuidemal 2020 to observe the most salient regions for the spatial and temporal class tokens. Our temporal class token pay more attention to action within video across temporal frames.
17

---

Published as a conference paper at ICLR 2023
Temporal Prompting Vs. Fine-Tuning
Table 12: Temporal Prompts Vs. Full Fine Our proposed temporal Prompts per- form favorably as compared to the full fine- tuning of the image model for dynamic cues. Full fine-tuning affects the pre-trained image representations which turn lowers the con- tribution of self-supervised attack loss (Eg. B during the attack, reducing adversarial trans- ferability.
Tuning:
Tormer
Models (
Temporal Prompts
Fine Tuning
UCF
HMDB
56.3
13.6
DINO
45.2
7.3
59.3
12.1
Deit-B
55.5
12.6
Model
Temporal Prompts
Total Parameters (Millions)
Trainable Parameters (Millions) GFLOPs
Deit-B
86.0
140.6
Deit-B
95.0
7.7
34.1
DINO
X
86.0
140.6
DINO
/
95.0
7.7
34.1
CLIP
x
85.6
139.5
CLIP
/
93.6
7.4
34.1
TimesFormer
121.7
121.7
196
Table 13: Our approach has significantly less computational overhead with few learnable parameters. In comparison to video models such as TimesFormer, we need to train only 7 million parameters. Note that video models like Timesformer simultancously forward pass all sampled frames through the model layers. The image models like Deit can only process frame time so these models require multiple forward pass process a video. contrast, our single transformation layer process a video to generate temporal prompts which are combined with a randomly selected single frame to forward pass through our image models. As result, our approach is computationally cheaper than pure video or image models while increasing the adversarial transferbiility.. We present these results for single view with frames.
H PROMPT LEARNING Vs. FINE TUNING
We aim to use the same image backbone for different video or multi-view datasets. has lower memory cost and computational overhead we don't need to update all the model parameters during the backpass (Table
Our attack exploits pre-trained image representations (for example learned on ImageNet) along with dynamic cues (introduced via learning temporal prompts) to fool black-box video models. These adapted image models not optimal for video learning as compared to specialized video networks such as TomesFormer (Bertasius et al. 2021). When we fully fine-tune the pre-trained image model with design videos, the performance of the adapted models improves, in terms of top- (%) accuracy, on video datasets. As result of this fine-tuning, however, we loss the original image representations otherwise preserved our approach. This means that the contribution of our self- supervised loss (C..). designed to exploit image level representation, reduces and as a result it affects the transferability of adversarial attacks.
Our prompt learning approach preserves the original image representations within the spatial class token which is used our self-supervised loss boost adversarial transferability. We lose the original image representations when doing full fine-tuning of our model on videos and as a result, transferability decreases (aable 12) Interestingly this tradeoff between full fine-tuning and adversar- ial transferability is affects the self-supervised inductive biases learned by the DINO.
prominent with self-supervised DINO model as supervised fine-tuning
In conclusion, attacks from pure image representations that is without temporal prompts, or from pure video representation that is without image representation show relatively lower transferability. The combination of adversarial image and video representations compliments each other in enhancing the transferability to black-bor videos and image models. Both image and video representations are well preserved in our approach with in single image model.
18

---

Published as a conference paper at ICLR 2023
1 IMAGE MODELS FOR VIDEOS AT VARYING SPATIAL SCALES
We observe that our approach significantly improve generalization of image models on videos with low spatial resolutions (Table (4].
Table 14: Adapting image models to videos at varying spatial resolutions (SR): We showcase the generalization of DeïT-B model adopted for UCF and HMDB at multiple spatial resolutions.
UCF
HMDB
Model
224x224
96x96
56x56
224
96
56
DeiT-B
81.4
60.0
32.3
47.7
31.1
15.4
J
VISUALIZING LATENT EMBEDDINGS
We show latent space embedding of our prompts for low resolution inputs Fig. 7
Oura
The class tokens of DeiT-S models projected from R384 to I2
Tousren 2020
Touvron 2020
Touwion 2020
Oure
The class tokens of DeiT-B models projected from I 768 R.
Figure 7: We adopted me-trained Deit models (Touvron et al. 2020) at varying spatial resolutions using our approach: 56 556 96x96, 120x 120 (from left to right). We showcase inter-class separation and intraclass variation via t-SNE (Van der Maaten & Hinton (008) image model have lower intraclass variations and hetter interclass separation than the original models. We used sklearn (Pedregosa et al. 2011) with perplexity set to 30 for all the experiments. (best viewed zoom).
10 classes from ImageNet validation set. Our adopted
K VISUAL DEMOS
Figures & 9 and 10 shows adversarial pattern from our adapted image models, Deit-B, DINO, and CLIP, for different video samples.
19

---

Published as a conference paper at ICLR 2023
Clean video sample
Eax Fraans
Brianus
Adversarial patterns of DINO for video sample.
Adversarial patterns of CLIP for video sample.
Adversarial patterns Deit-B for video sample.
Figure 8: Visualizing the behavior of Adversarial Patterns Time: We generate adversarial signals from DINO, CLIP, and DEIT-B models temporal prompts using DIM attack (Xie et al. 2019 Observe change in gradients across different frames (best viewed in zoom).
20

---

Published as a conference paper at ICLR 2023
Clean video sample
Adversarial patterns of DINO for a video sample.
Adversarial patterns CLIP for video sample.
Adversarial patterns of Deit-B for video sample.
Figure 9: Visualizing the behavior of Adversarial Patterns across Time: We generate adversarial signals from DINO, CLIP, and Deit-B models with temporal prompts using DIM attack (Xie et al. 2019), Observe the change in gradients different frames (best viewed in zoom).
21

---

Published as a conference paper at ICLR 2023
Clean video sample
Adversarial patterns of DINO for a video sample.
Adversarial patterns CL.IP for video sample.
Adversarial patterns of Deit-B for video sample.
Figure 10: Visualizing the behavior of Adversarial Patterns across Time: We generate adversarial signals from DINO, CLIP, and Deit-B models with temporal prompts using DIM attack (Xie et al. 2019), Observe the change in gradients different frames (best viewed in zoom).
22

---

Published as a conference paper at ICLR 2023
Clean video sample
Adversarial patterns of DINO for a video sample.
Adversarial patterns CL.IP for video sample.
Adversarial patterss of Deit-B for video sample.
Figure 11: Visualizing the behavior of Adversarial Patterns across Time: We generate adversarial signals from DINO, CLIP, and Deit-B models with temporal prompts using DIM attack (Xie et al. 2019), Observe the change in gradients different frames (best viewed in zoom).
23


Reviews:
[{"review_id": "is-YwLQU9bY", "reviewer": "Reviewer_TDqC", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "his work studies the role of temporal dynamics in adversarial transfer between image and video models. The authors introduce temporal prompts to adapt pretrained image models to video inputs, giving them the capacity to capture dynamic cues. Motivated by visual prompt tuning, patches from video clips are processed by a self-attention layer and spatially pooled into one prompt token per frame. Spatial tokens from a single video frame and the temporal prompts are then concatenated and fed to the pretrained image classifier. Experiments show that when temporal prompts are used in surrogate model, transferred adversarial examples have a higher success rate on various target video models.", "summary_of_the_review": "The paper presents an interesting approach towards adversarial transfer from pretrained image models to video tasks. While the proposed method has its own strengths and shows decent performances compared to baselines, I have a few concerns with the validity of hypothesis made in the paper on temporal modeling, as well as the absence of certain comparisons. Therefore, I set my initial rating as borderline reject and look forward to responses and clarifications from the authors over the discussion period.\n\nUpdate 12/12: Increased rating after rebuttal and discussions with authors. See details in thread.", "strength_and_weaknesses": "## Pros\n- Incorporating temporal prompts appears to be a promising strategy as it significantly improves the transferability of attacks compared to using image models alone, when evaluated on various datasets and models.  \n- The proposed method also seems to have a small computational overhead as it involves learning a single attention layer while preserving the weights of the pretrained image model.  \n- A variety of visualizations are provided for understanding the generated adversarial patterns.  \n\n## Cons\n- I am not sure I fully understand process of \"mimicking dynamic cues on static images\" (figure 2). Can the authors explain how the dynamic cues are created by varying the spatial scale? What would be the input to the prompting module $\\cal T$ in this case? I am also confused about its role in the proposed system, as the prompting module is trained on video data (bottom of page 6). I assume mimicking is only used when evaluating on image datasets, but would appreciate if the authors can provide further clarifications.  \n- While the prompting module enjoys the benefit of efficiency, I am not sure if a single attention layer is sufficient to capture complex temporal dynamics. Table 5 confirms that spatial cues are retained in the temporal prompt learning (which is expected as the backbone encoder is frozen), but the accuracy on temporal-heavy dataset SSv2 is still quite low, even compared to small spatiotemporal networks. I think additional experiments are needed to show that models trained with prompting indeed learn meaningful temporal cues (e.g. testing with original vs. shuffled frame ordering), instead of relying merely on spatial features. I also think more work is needed to understand if the improvement in adversarial transfer can entirely be attributed to temporal cues, since the difference introduced by temporal prompting is larger on UCF and HMDB, which have less temporal cues than SSv2.  \n- Alternative ways have been studied to adapt pretrained image models to video inputs (e.g. I3D, TimeSformer). While they might not be as efficient as temporal prompting, it would still be an important comparison between proposed method and using those video models as surrogate in terms of adversarial transferability.  \n- There has been prior work on adapting adversarial samples between image and video modalities (e.g. https://arxiv.org/abs/2112.05379). There should be discussion/comparison to these related works.  \n- Results on transfer from ensemble models can be better presented. In figure 4 it is difficult to compare across rows of bar plots, or to single-model results from the main tables.  ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "dperSQyFD42", "reviewer": "Reviewer_yaNd", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "Authors explore the problem of robustifying a video transformer using a pre-trained image transformer as a surrogate model. Authors argue that using adversarial patterns optimal for large image models (such as Deit, DINO and CLIP) improves adversarial robustness of other image models, but is not suitable out-of-the-box for robostifying video models because image models lack temporal cues (e.g. motion). Authors train a network that generates a sequence of temporal tokens (one per frame) for the entire video, concatenate them with spatial tokens (one per spatial location) for a single random frame, and pass through a frozen pre-trained image transformer with fine-tuned heads. The resulting pipeline is trained using a combination of supervised and unsupervised losses and is then attacked to obtain adversarial examples. Authors train their method across multiple scales to improve transferability and mimic scale changes in videos on image datasets. Authors show that in the resulting pipeline, larger image models yield better image-to-video adversarial transferability, self-supervised DINO transfer best, that their approach is more robust then 3D convolution, that the ensembling helps their approach as well. Authors claim that the resulting procedure is significantly more memory efficient compared to a naive baseline of processing all spatial tokens of all frames jointly.\n", "summary_of_the_review": "I think that the paper does a good job of motivating the problem it tackles, and that results reported in this paper would benefit the community at large, but the lack of clarity severely undermines the impact this publication can make in its current form.", "strength_and_weaknesses": "Strengths:\nThe problem is well-motivated - it is clear why one might want to adjust the surrogate model when going from images to videos\nResults are promising - the resulting model bests all baselines by a significant margin\nEvaluation is thorough and shows similar trends across a wide range of datasets, surrogate models, adversarial attacks, resolutions, and ensembling techniques.\nWeaknesses:\nI am not familiar with prior work on adversarial transferability, so my confusion might be stemming from that. Nevertheless, I found the paper quite difficult to follow. The syntax in the introduction is sometimes difficult to parse, but is generally understandable (“in a real-world setting, a scene is not static but mostly involves various dynamics, e.g., object motion”,  “approach offers the benefit that the attacks do not need to rely on specialized networks designed for videos towards better adversarial transferability”, “dynamic cues are shown here to aid in better transfer not only to video models, but also to the original domain (image) models due to the expressivity of dynamic information”). The method section is more difficult to follow, because \n\n1) The method is introduced only in a figure and scattered throughout two pages of plain text - no model expression summarizing how final outputs are obtained via inputs, no clear definition of used losses;\n2) After re-reading the method section and following the diagram several times, I am still confused about some of the wording. \n\nWhy does the caption in Figure 1 say that “the spatial tokens are ignored”? \n\nDo authors use the term “token” and the output of the transformer at that token’s position interchangeably? (e.g. I_cls in the first paragraph of Sec 3.1) \n\nIn sec 3.2 “spatial class token Icls serves in an unsupervised objective” - means that it is used only in the unsupervised objective? Is self-supervised L_ss - that unsupervised objective? \n\nI also found it difficult to follow the line of thought in the experiment results section 4.1 - it is only a few dozen lines long and it basically lists all provided Tables, and follows straight to conclusions, not connecting observations to conclusions in the main text.\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "LkLRx8BwXD", "reviewer": "Reviewer_iNv7", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a transfer-based adversarial attack for black-box video models. The surrogate model is built via prompt tuning from a pre-trained image model with additional temporal prompt tokens. It is validated that a surrogate model with the learned temporal prompts (or \"dynamic cues\") achieves better adversarial transferability for various attacks than a surrogate model without them. This approach can also extend to target models on image or 3D data.", "summary_of_the_review": "The problem studied in this paper is meaningful and the proposed method is intuitive. The major issue is the unsupported claims with some important baselines missing. Besides, the writing and organization can be improved to make it easier to understand the method and settings.", "strength_and_weaknesses": "[Strength]\n1. The problem studied in this paper, i.e., using image models to attack black-box video models, is interesting and important in practice, as there are a large and increasing number of public pre-trained image models.\n2. The proposed method is simple and seems effective. The idea of mimicking dynamic cues on static images with different spatial scales is interesting, which can improve the adversarial transferability on image data.\n\n[Weakness]\n1. The problem settings are not clearly stated. For example, it can only be inferred from the method and experiments that the attacker has the information on which dataset the target model is trained on and also the access to this dataset.\n2. Some of the claims are not well supported.\n- Abstract: \"Our attack results indicate that the attacker does not need specialized architectures ... Image models are all we need\nto optimize for an effective surrogate ...\" Without baseline results on surrogate models with those \"specialized architectures\", it cannot be determined whether the proposed method is really \"effective\" compared with the baselines.\n- Section 4.1 (Table 5): \"Deit models retain their top-1 (%) accuracy on ImageNet ..., while also exhibiting decent performance on video datasets and ...\" To support this claim, it is expected that Table 5 should contain: (1) the ImageNet results for raw Deit models; (2) a baseline result for video datasets.\n- Section 4.1.1 (Figure 4): \"Ensemble of different training frameworks performs favorably to boost attack transferability.\" Visually comparing the two rows in Figure 4 to figure out which is better can be difficult. A better demonstration is preferred.\n3. In the proposed method shown in Figure 1, a random frame is sampled from the input video. It is not stated whether the input receives gradient from this branch during attacks. Besides, does this single frame sampling strategy limits the attack to the video data where any single frame contains a large portion of information of the video?\n4. It is discovered that \"CLIP adversaries are relatively less transferable as compared to fully-supervised ViT or self-supervised DINO model\". This may be weird since CLIP is pre-trained on a wider range of data. Is there any reasonable explanation?\n5. The paper still learns the downstream task when attacking the video task, which only replaces fine-tuning with visual prompt tuning. This adversarial attack transfer is not a direct attack on the image model. Considering Transformation and the image model as a whole, it can be considered as a video model learned by the prompt tuning method.  And although visual prompt tuning needs to learn fewer parameters, the training time is not shorter than fine-tuning.\n6. The prompt tuning approach usually does not perform as well as the fine-tuning approach. Would an attack using a fine-tuning model on a downstream video task perform better?\n7. The paper only compares the use of Temporal Prompts in the experimental section. Currently, some methods have been proposed to improve the cross-task or cross-model transferability of adversarial attacks, and these methods should also be involved in the comparison.\n8. The approach of the paper only tries to attack the transformer model and has limited transferability to CNN models. Can this approach also be used to attack pre-trained CNN models, such as MOCO for Resnet?\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "D8xQFSbdPF5", "reviewer": "Reviewer_QXGV", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "Adversarial transferability is often studied in the image-model-to-image-model setting. This paper studies how to transfer adversarial examples from image models to video (or multi-view) models. They note that simply transferring adversarial examples from image models to video models are suboptimal, and propose a prompt tuning method, inspired by recent development in prompt fine-tuning. They demonstrate that the proposed temporal prompt adaptation to learn dynamic cues on videos or multi-view renderings of 3D objects is effective to transfer adversary from pre-trained image models to video models and multi-view models.", "summary_of_the_review": "While prompt fine-tuning has been studied before and this work is a straightforward application of prompt fine-tuning, applying prompt fine-tuning to adversarial transfer is novel, and it seems that their approach empirically works well.", "strength_and_weaknesses": "## Strength\n- As far as I know, this is the first work that tries to transfer adversarial examples from image models to video models using prompt tuning.\n- It seems their approach empirically works well.\n- \"Mimicking dynamic behavior on image datasets: Image samples are static and have no temporal dimension. So we adopt a simple strategy to mimic changing behavior for such static data. We consider images at different spatial scales to obtain a scale-space (Fig. 2) and model temporal prompts for image dataset\"\n\t- This is equivalent to approximating camera motions via zooming. It's interesting that such a simple approach works.\n\n## Weaknesses\n\n- The way to present their results is sometimes confusing. For example, I think it would be easier to see if the authors only focus on Deit-B, Dino, and CLIP in the Table 1, and expand the discussion regarding the difference between training strategies. Separately, it would be nice to have more discussion regarding the model size difference. For example, I'm surprised that Deit-T, Deit-S and Deit-B are performing almost the same for FGSM in Table1. Can you comment on that?\n\n- Section 4.1.1 (Ensemble Adversarial Transfer) needs more clarification. What attack was used to produce the numbers in Figure 4? It seems like for some datasets (e.g. SSv2, Shared, Depth, ) there is not benefit for ensemble adversarial transfer when I compare the bar plot of Figure 4 and the numbers of Table 2. If you claim that adversarial transfer is boosted by ensemble, I think the work should compare Figure 4 with the the number of Table 2. As of now, it's hard to see this.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Accept: poster