# A Robust Adversarial Example Attack Based on Video Augmentation
## 4 Experimental Results
### Performance Comparison
#### 4.2.3 Impact on MAP  
After that, we analyzed the differences in the effects that the various transformation positions had on MAP. Using the UCF-101 dataset, we conduct untargeted attacks against the LRCN model and then calculate the change in MAP that occurs as a result of the attack process. As shown in Figure 4, the MAP and SA of our method remain stable as the number of iterations increases, and they begin to gradually decrease after reaching a certain level of increase. On the other hand, transforming both the perturbation and the original image during the iteration results in a continuous increase of MAP, which is unacceptable for the concealment of adversarial examples. The adversarial examples that are produced by using the accumulative method all have significant perturbations, as can be seen in Figure 5.  
Combining the above experimental results and theoretical analysis in Section 3, we can have the following observations:  
* The generation process of adversarial examples is the primary focus of existing methods for conducting video adversarial attacks; as a result, the robustness of video adversarial examples has not been investigated. Because video data contain more complex temporal and spatial structures than image data, even relatively minor transformations carried out on the video frames can have a significant effect on the semantic information of the adversarial perturbations. This renders previously developed methods of attack less applicable to the real-world setting in which they are intended to be used.
* Performing transformation during the generation process of video adversarial examples is a practicable solution for enhancing the robustness of adversarial examples.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Transformations** & **Method** & **FR Untargeted** & **FR Targeted** \\ \hline \multirow{2}{*}{Benign} & SA & 100\% & 100\% \\  & v3a & 100\% & 100\% \\ \hline \multirow{2}{*}{Gaussian Noise} & SA & 72.28\% & 65.35\% \\  & v3a & 97.03\% & 93.07\% \\ \hline \multirow{2}{*}{Random Shape} & SA & 81.19\% & 76.24\% \\  & v3a & 95.05\% & 91.09\% \\ \hline \multirow{2}{*}{Random Color} & SA & 85.70\% & 80.20\% \\  & v3a & 98.02\% & 96.40\% \\ \hline \multirow{2}{*}{Assemble} & SA & 57.14\% & 49.50\% \\  & v3a & 89.11\% & 84.16\% \\ \hline \hline \end{tabular}
\end{table}
Table 1: White-box attacks against the LRCN model. The MAP of SA and our method are 0.0125 and 0.0133, respectively.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Transformations** & **Method** & **FR Untargeted** & **FR Targeted** \\ \hline \multirow{2}{*}{Benign} & HA & 100\% & 100\% \\  & v3a & 100\% & 100\% \\ \hline \multirow{2}{*}{Gaussian Noise} & HA & 89.11\% & 84.16\% \\  & v3a & 94.06\% & 90.10\% \\ \hline \multirow{2}{*}{Random Shape} & HA & 91.09\% & 88.12\% \\  & v3a & 96.04\% & 94.06\% \\ \hline \multirow{2}{*}{Random Color} & HA & 87.13\% & 87.13\% \\  & v3a & 98.02\% & 93.07\% \\ \hline \multirow{2}{*}{Assemble} & HA & 80.20\% & 75.25\% \\  & v3a & 93.07\% & 87.13\% \\ \hline \hline \end{tabular}
\end{table}
Table 2: Black-box attacks against the LRCN model. The MAP of HA and our method are 1.4528 and 1.4991, respectively.  
However, repeated transformations can make attacks more difficult or even fail. At the same time, it will also lead to weaker concealment.
* The resilience of video adversarial instances was considerably improved by v3a thanks to the once-transformation that was performed before the attack and the transformation of adversarial perturbations that was performed throughout each iteration. In the meantime, v3a can be effectively integrated with other video adversarial attack methods, which in turn increases the rate of successful attacks.