TASAR: Transfer-based Attack on Skeletal Action Recognition

Authors: Yunfeng Diao, Baiqi Wu, Ruixuan Zhang, Ajian Liu, Xiaoshuai Hao, Xingxing Wei, Meng Wang, He Wang
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: Human Activity Recognition, Transfer-based adversarial attack

Abstract:
Skeletal sequence data, as a widely employed representation of human actions, are crucial in Human Activity Recognition (HAR). Recently, adversarial attacks have been proposed in this area, which exposes potential security concerns, and more importantly provides a good tool for model robustness test. Within this research, transfer-based attack is an important tool as it mimics the real-world scenario where an attacker has no knowledge of the target model, but is under-explored in Skeleton-based HAR (S-HAR). Consequently, existing S-HAR attacks exhibit weak adversarial transferability and the reason remains largely unknown. In this paper, we investigate this phenomenon via the characterization of the loss function. We find that one prominent indicator of poor transferability is the low smoothness of the loss function. Led by this observation, we improve the transferability by properly smoothening the loss when computing the adversarial examples. This leads to the first Transfer-based Attack on Skeletal Action Recognition, TASAR. TASAR explores the smoothened model posterior of pre-trained surrogates, which is achieved by a new post-train Dual Bayesian optimization strategy. Furthermore, unlike existing transfer-based methods which overlook the temporal coherence within sequences, TASAR incorporates motion dynamics into the Bayesian attack, effectively disrupting the spatial-temporal coherence of S-HARs. For exhaustive evaluation, we build the first large-scale robust S-HAR benchmark, comprising 7 S-HAR models, 10 attack methods, 3 S-HAR datasets and 2 defense models. Extensive results demonstrate the superiority of TASAR.  Our benchmark enables easy comparisons for future studies, with the code available in the https://github.com/yunfengdiao/Skeleton-Robustness-Benchmark.

Decision: accept (poster)
Reviewer scores: 6, 8, 5, 6

Reviews and discussion:
<thread>
creation date:
1730093272231

thread_type:
official_review

<thread_object>
creator: reviewer_wytn

<content>
summary:
This paper investigates the issue of weak adversarial transferability in skeleton-based Human Activity Recognition (S-HAR) attacks. It proposes a new transfer-based attack called TASAR, which aims to improve transferability by smoothing the loss surface. The authors also establish a large-scale robust S-HAR benchmark for comprehensive evaluation.

strengths:
The paper identifies a crucial limitation of existing S-HAR attacks and proposes a practical solution. The proposed TASAR attack is innovative and demonstrates potential improvements in adversarial transferability. The evaluation on the large-scale benchmark provides valuable insights into the effectiveness of existing and proposed methods.

The author has submitted the code, making the work reproducible.

weaknesses:
I suggest that the authors cite more papers related to recent research from top conferences over the past two years.

More related literature can be included, for instance, by adding a topic on noise-robust human action recognition.

questions:
N/A
</content>
</thread_object>

</thread>
<thread>
creation date:
1730271203509

thread_type:
official_review

<thread_object>
creator: reviewer_lgjh

<content>
summary:
This paper explores an interesting research problem in skeleton-based action recognition.

This paper proposes the transfer-based attack on skeletal action recognition.

The proposed model incorporates motion dynamics into the Bayesian attack gradient, effectively disrupting the spatial-temporal coherence of the skeletal action recognition.

The authors explore and analyse several model architectures, and conduct experimental analysis and evaluations on several benchmarks and show that the proposed model achieves good performance compared to existing baselines.

strengths:
+ Overall this paper explores an interesting research problem.

+ The authors conduct large-scale evaluations to show that the proposed model achieves good performance on several benchmarks.

+ Some of the figures presented in the paper are quite nice and provide some insights to readers.

weaknesses:
Major: 

- One of the major issues of this paper is that some of the concepts presented in the paper are not properly and clearly explained. For example, in abstract section, what is "white-box scenarios". Also what does it mean by saying "its sharpness contributes to the weak transferability in S-HAR"?

- Fig. 1 is not being introduced and explained clearly. For example, what is spatial attack, spatial-temporal attack, why frozen, trainable, being lightweight and demanding? What are appended models and dual bayesian? These concepts should be clearly explained to readers, either in texts or figure caption. Moreover, how to tell which one is better? 

- The introduction section is not very well-motivated. For example, in Line 83, referring to Table 1; however, the concepts to understand the table are not being explained. The authors are encouraged to reorganise the section, explain the concepts properly before going deep into the technical jargon. What is "white-box"? In contribution section, what is "low adversarial transferability"?

- In related work section, the authors outline some closely related works; however, they do not highlight what are the major differences between existing works and the proposed method, what are the insights, how the proposed method has the potential to address the challenges etc.

- Fig. 2, the font sizes are invisible to reviewer, what are the x and y axis represent for? What do "random direction vectors" mean? These concepts should be properly explained. 

- In Eq. (2), what are boldface $x$ and $\tilde{x}$ mean?  In Line 158 and 183, it says "a clean motion" and "the adversarial sample", what do they mean and how they align with each other, what would be the relationship between them? These concepts and maths symbols are not properly explained. It is suggested to have a notation section detailing the maths symbols and operations used in the paper. Eq. (3) right hand side is a bit confusing, the reviewer cannot understand that, could you explain step by step?


Minor:

-  Remove the  full stop "." inside Sec. 3.4.1 and 3.4.2 headings.

- Table of font sizes should be consistent in the whole paper. In the main paper, table 1, 2, 3 and 5 font sizes are too small, and hard to read; however, table 6 in appendix section, the font sizes are too big. The authors should make those representations consistent and nicer.

- While the maths presented in the paper seem to be accurate, its presentations, especially in the method section, needs extensive improvement. The reviewer gets lost many times, and some of the concepts are not very well introduced and explained. A good paper should explain these concepts clearly and in a more intuitive way. 

- An excellent paper should use efficient figures and plots to show the experimental results. In this paper, most experimental results are presented in the form of tables, it would be better if the authors could provide some plots and visualisations to make the evaluations, comparisons and analysis more interesting to wide communities.

questions:
Please refer to my main comments above.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730446410575

thread_type:
official_review

<thread_object>
creator: reviewer_bzge

<content>
summary:
For the transfer-based attack on skeletal action recognition tasks, this paper builds the first comprehensive benchmark, comprising 7 skeletal models, 10 attack models, 3 skeletal datasets, and 2 defense methods. Additionally, a novel post-train Dual Bayesian Motion attack is presented, aiming to explore a smoother model posterior by incorporating a small MLP layer. Unlike image data, the spatial-temporal characteristics, represented by first-order velocity and second-order acceleration, are considered.

strengths:
1. Extensive experiments.
2. The post-train Dual Bayesian Motion attack method is reasonable in general.

weaknesses:
1. Although it is reasonable to assume that a smoother loss landscape benefits transfer attacks, exploring the reasons for poor transferability in S-HAR tasks and comparing the differences among surrogate models may reveal various factors. Therefore, directly concluding that smoothing the loss landscape is the sole solution may not be entirely logical.

2. In this method, an MLP is primarily added after the original model. However, the consideration of first-order velocity and second-order acceleration to capture spatial-temporal information, as mentioned in this paper, has already been addressed by SMART (Wang et al., 2021), which limits the novelty of this approach.

3. The Bayesian optimization approach used in this method is similar to BEAT (Wang et al., 2023), and the differences between the two approaches should be discussed further.

questions:
Please see in Weaknesses.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730590245738

thread_type:
official_review

<thread_object>
creator: reviewer_ngyv

<content>
summary:
This paper studies transfer-based attacks for skeleton-based action recognition. A last-layer Bayesian approches is applied to smooth the loss surface to improve adversarial transferability. The authors setup a benchmark for transfer-based skeleton-based action recognition attacks. The proposed method is evaluted using different backbone approaches on NTU-60, NTU-120, and HDM05. The results demonstrate the effectiveness of the proposed approaches.

strengths:
1) The paper is well-written with clear motivations of each step
2) The proposed approch is easy to apply on existing methods since only a few layers are needed at the end of the networ.
3) Thorough experiments and ablation studies

weaknesses:
1) As the pretrained models are frozen, modeling p(\theta’|D, \theta) is not as good as modeling p(\theta, \theta’|D). If trainable, it would be better to justify the performance difference on a small subset of data.
2) Besides the visualization of loss surfaces, quantitative evaluation of the surface smoothess can be added.

questions:
1) In Table 4, why K=3 yields better results than K=5? I thought more samples lead to better approximation
</content>
</thread_object>

</thread>
<thread>
creation date:
1732425689153

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
Summary of Changes

comment:
Dear ACs and Reviewers,

We sincerely appreciate the reviewers for their valuable and insightful suggestions, which are helpful for us to improve our work. We have carefully considered each issue mentioned in these comments and revised our manuscript based on them.  The revised version of the manuscript has been submitted, with the corresponding changes highlighted in blue. Below, we address each comment from the reviewers individually.
</content>
</thread_object>

</thread>


Metareview:
metareview:
The paper presents a well-written, easy-to-apply approach for transfer-based attacks for skeleton-based action recognition. The new approach improves adversarial transferability and addresses limitations in S-HAR attacks, demonstrated by thorough experiments and ablation studies. On the other hand, reviewers have major concerned about the unclear explanations of concepts like "white-box scenarios" and technical jargon. The paper is advised to better motivate its sections and clarify its unique contributions compared to existing work. Some other minors include figures and equations that lack clarity and are not sufficiently introduced, causing confusion about their significance.