# A Robust Adversarial Example Attack Based on Video Augmentation
## 3 Methodology
### Adversarial Video Attack  
In this paper, we use the sparse adversarial video attack method (SA) [21] and the heuristic black-box adversarial video attack method (HA) [22] as two baseline methods of our proposed method, v3a. SA is the first sparse adversarial attack method for video classification models which achieved key-frame selection under white-box constraints. By selecting a constant number of frames and only adding adversarial perturbations on these frames, SA accelerates video adversarial attacks and reduces the perturbation sizes. HA first extended SA to black-box conditions with a zero-order gradient estimation algorithm. To perform key-frame selections under black-box conditions, HA further proposes a heuristic method that helps evaluate the importance of different frames. Following SA and HA, the optimization process of untargeted attacks of v3a can be described as:  
\[\underset{\delta}{argmin}\ \alpha||\mathbf{M}\cdot\delta||_{2,1}-\beta L(y,F_{ \theta}(\mathbf{x}+\mathbf{M}\cdot\delta)) \tag{1}\]  
where \(\mathbf{M}\in\{0,1\}^{N\times\mathbb{C}\times H\times W}\) denotes the sparse mask which achieves sparse attack via keyframe selection. For a specific frame in the input example \(\mathbf{x}\), the value of the corresponding position of \(\mathbf{M}\) is set to 1 and the other positions are set to 0. \(L(.,. )\) is the adversarial loss function that calculates the cross-entropy loss. \(F_{\theta}\) denotes the victim model with parameters \(\theta\). \(||\delta||_{2,1}\) calculates the \(L_{2,1}\) norm for the generated perturbation which serves to reduce the perturbation size. \((\alpha,\beta)\) are the two weights of the different terms of the equation. As for targeted attacks, the optimization process can be represented as follow:  
\[\underset{\delta}{argmin}\ \alpha||\mathbf{M}\cdot\delta||_{2,1}+\beta L(\hat{y},F_{ \theta}(\mathbf{x}+\mathbf{M}\cdot\delta)) \tag{2}\]  
where \(\hat{y}\) denotes the target label of the attack. For white-box conditions, attackers use gradient-based optimization methods to solve the above-defined optimization problems by directly computing the gradient. However, the attacker cannot directly compute the gradients under black-box conditions, so HA uses the zero-order algorithm for black-box gradient estimation. The estimated gradient is defined as:  
\[\hat{\mathbf{g}}=\frac{1}{N}\sum_{n=1}^{N}\frac{F(\mathbf{x}+\mathbf{\delta}+\mu\mathbf{\phi_{n}} )-F(\mathbf{x}+\mathbf{\delta})}{\mu}\mathbf{\phi_{n}} \tag{3}\]  
where \(\mathbf{\phi_{n}}\) is sampled from the standard Gaussian distribution and \(N\) is the number of samples. \(\mu\) is a smoothing parameter, we set \(\mu\) to 0.005 in the experiment. During each iteration, the update of \(\delta\) is given by  
\[\delta\leftarrow\delta-s\hat{\mathbf{g}} \tag{4}\]  
where \(s\) denotes the step size. Meanwhile, HA assumes that the victim black-box model only provides the top-1 prediction label, thus there is no available information for the adversary to guide the gradient descent process. So HA introduces the boundary attack algorithm [31], which initializes the adversarial perturbation by randomly selecting a sample from the target class and then iteratively reduces the perturbation size via gradient descent algorithms. Therefore, the optimization goal is changed to minimize the perturbation size while keeping adversarial properties. The optimization process of boundary attack can be formulated as:  
\[d(\mathbf{x},\mathbf{\hat{x}^{k}})=d(\mathbf{x},\mathbf{\hat{x}^{k-1}}+\eta^{k})+\epsilon\cdot d (\mathbf{x},\mathbf{\hat{x}^{k-1}}) \tag{5}\]  
where \(d\) denotes the distance of the original video \(x\) and the corresponding adversarial example \(\hat{x}\), \(k\) denotes the \(k\)-th iteration, \(\eta\) denotes the random direction extracted by a binary search process, and \(\epsilon\) denotes the smoothing parameter. In this paper, we use SA and HA as two baseline methods that mainly focus on the attack success rate but rarely consider the robustness of the generated adversarial examples.