# A Robust Adversarial Example Attack Based on Video Augmentation
## 3 Methodology
### Video Augmentations Based Adversarial Attack  
Adversarial examples may introduce noise or image transformations during delivery, thus the robustness of the examples has a large influence on the success rate. At the same time, smart system owners may introduce noise or transformations for security considerations. Existing adversarial video attacks did not consider the potential noise and variation, resulting in a low success rate and poor robustness. To address this challenge, We propose the video-augmentation-based adversarial attack method v3a. By introducing noise and video-augmentation-based transformations during the attack process, our method significantly improves the robustness of adversarial examples while keeping an acceptable perturbation size. Figure 2 gives an overview of v3a. Instead of applying adversarial perturbations to the clean input video frames directly, v3a performs video-augmentation-based transformations on the generated perturbations and the original frames. Specifically, we consider three factors that may affect the adversarial example: Gaussian noise, video shape transformation, and video color transformation. Gaussian noise may be the most common transformation that may occur during the transmission process of video data and is also easy to be introduced by security defenders. Video shape transformations include random rotation, expansion, and contraction, and video color transformations include random brightness and saturation adjustment. These factors are also likely to occur during video transmission. They have little effect on the classification of clean examples because they have little impact on the semantic information of the clean examples. However, these transformations will lead to the failure of adversarial perturbations with high probabilities. Figure 3 gives a visualization of three different types of video augmentations introduced in our method. Given the input \(\mathbf{x}\) and three transformations denoted by \(T_{1},T_{2},T_{3}\), respectively, the transformation function of our method can be defined as follows:  
\[T(\mathbf{x})=\gamma_{1}T_{1}(\mathbf{x})+\gamma_{2}T_{2}(\mathbf{x})+\gamma_{3}T_{3}(\mathbf{ x}) \tag{6}\]  
where \(T\) represents the transformation function, \(\gamma_{1},\gamma_{2},\gamma_{3}>0\) and \(\gamma_{1}+\gamma_{2}+\gamma_{3}=1\), balancing three different transformations. Meanwhile, we consider three different ways of adding transformations to the iterations:  
* **Before iterations. ** By performing once-transformation before the attack, the robustness of adversarial examples can be improved to some degree. This method is fast but limited because it does not consider the effect of the perturbation. * **During iterations. ** By performing transformation in each iteration, the robustness of adversarial examples can be greatly enhanced. However, repeated transformations can make attacks more difficult or even fail, as the original examples transform multiple times. At the same time, the size of the perturbation will keep increasing with iterations, which leads to weaker concealment. * **During iterations but only for perturbations. ** By performing once-transformation before the attack and transforming the adversarial perturbations in each iteration, the robustness of adversarial examples is effectively improved and the difficulty of the attacks does not increase significantly. This approach thus meets the comprehensive needs. Figure 3: Visualization of different video augmentations introduced in v3a. Figure 2: Overview of the video-augmentation-based adversarial attack. Therefore, the optimization goal of v3a can be described as follows:  
For untargeted attacks,  
\[\underset{\hat{g}}{argmin}\ \alpha||\mathbf{M}\cdot T(\delta)||_{2,1}-\beta L(y,F_{\theta}(T( \mathbf{x}+\mathbf{M}\cdot\delta))) \tag{7}\]  
where the start point of the algorithm is changed from the benign input video \(\mathbf{x}\) to the once-transformed video example \(T(\mathbf{x})\).