ReToMe-VA: Recursive Token Merging for Video Diffusion-based Unrestricted Adversarial Attack

Venue: acmmm_org_ACMMM_2024_Conference
Published: 2024-04-03 15:22:23

Abstract: Recent diffusion-based unrestricted attacks generate imperceptible adversarial examples with high transferability compared to previous unrestricted attacks and restricted attacks. However, existing works on diffusion-based unrestricted attacks are mostly focused on images yet are seldom explored in videos. In this paper, we propose the Recursive Token Merging for Video Diffusion-based Unrestricted Adversarial Attack (ReToMe-VA), which is the first framework to generate imperceptible adversarial video clips with higher transferability. Specifically, to achieve spatial imperceptibility, ReToMe-VA adopts a Timestep-wise Adversarial Latent Optimization (TALO) strategy that optimizes perturbations in diffusion models' latent space at each denoising step. TALO offers iterative and accurate updates to generate more powerful adversarial frames. TALO can further reduce memory consumption in gradient computation. Moreover, to achieve temporal imperceptibility, ReToMe-VA introduces a Recursive Token Merging (ReToMe) mechanism by matching and merging tokens across video frames in the self-attention module, resulting in temporally consistent adversarial videos. ReToMe concurrently facilitates inter-frame interactions into the attack process, inducing more diverse and robust gradients, thus leading to better adversarial transferability. Extensive experiments demonstrate the efficacy of ReToMe-VA, particularly in surpassing state-of-the-art attacks in adversarial transferability by more than 14.16\% on average.

Main paper: 
 introduction: 
 Recent years have witnessed remarkable performance exhibited by Deep Neural Networks (DNNs) across various computer vision and multimedia tasks [8, 13] . However, the emergence of adversarial examples has posed a challenge to the robustness of DNNs [11] .These adversarial examples, created by making imperceptible modifications to benign samples, can easily deceive state-of-the-art DNNs. Importantly, adversarial examples generated against one model can also mislead other models even with different architectures [6, 36] . The transferability of adversarial examples makes it feasible to carry out black-box attacks, which highlight security flaws in safety-critical scenarios, such as face verification [30] and surveillance video analysis [6] , etc. To avoid potential risks, it is crucial to expose as many "blind spots" of DNNs by deeply exploring the transferability of adversarial examples. Nowadays, the majority of transfer-based adversarial attacks [21, 38, 39] try to guarantee "subtle perturbation" by limiting the 𝐿 𝑝norm of the perturbation (a.k.a. restricted attacks). However, adversarial examples generated under 𝐿 𝑝 -norm constraint have humanperceptible perturbations, thereby rendering them more easily detectable [1, 46] . Therefore, unrestricted adversarial attacks [43, 45] , which optimize unrestricted but natural changes (such as texture, style, color modifications, etc.) for given benign samples, are beginning to emerge. These unrestricted attacks yield more imperceptible perturbations but fall short in transferability compared to restricted attacks. With diffusion models drawing significant attention, recent works [5, 7] have employed diffusion models for unrestricted attacks to generate imperceptible adversarial examples with high transferability. The difference between previous unrestricted attacks, restricted attacks, and diffusion-based unrestricted attacks is displayed in Figure 1 . Nevertheless, existing works on diffusionbased unrestricted attacks are mostly focused on images yet are seldom explored in videos.This paper investigates transferable diffusion-based unrestricted attacks across different video recognition models. Specifically, we map each frame into the latent space and optimize the latents along the adversarial direction. The challenge of video diffusion-based unrestricted attacks comes from three aspects. Firstly, given the fact that diffusion models tend to add coarse semantic information in the early denoising steps [22] , premature manipulation of the latents from previous work [7] yields significant alternations to the crafted frames compared to the corresponding benign frames.Concurrently, these spatial perceptible changes further result in temporal inconsistency in crafted adversarial videos when directly applying such generation to each frame. Consequently, further effort is needed to generate adversarial videos with temporal imperceptibility. Secondly, separately perturbing each benign frame induces monotonous gradients because the interactions among the video frames have not been fully exploited. Therefore, inter-frame interaction is necessary for boosting adversarial transferability. Lastly, the previous generation involves the gradient calculation throughout the entire denoising process, leading to a heavy memory overhead, especially when updating all the frames simultaneously.To this end, we propose ReToMe-VA, which is the first video diffusion-based unrestricted adversarial attack framework, aiming at producing imperceptible adversarial video clips with higher transferability, as shown in Figure 2 . Specifically, to achieve spatial imperceptibility, we introduce a Timestep-wise Adversarial Latent Optimization (TALO) that gradually updates perturbations in the latent space at each denoising timestep. Instead of calculating gradients of the entire denoising process, TALO only involves one timestep gradient calculation thereby reducing memory consumption in gradient computation. Furthermore, to reduce the spatial structure differences between benign and adversarial frames, TALO establishes constraints on the self-attention maps, which have been demonstrated to regulate structure effectively [5] . To effectively trade-off between spatial imperceptibility and adversarial transferability, TALO introduces the incremental iteration strategy, which prioritizes fewer iterations during the early timesteps to preserve the structure and increases the number of iterations during later timesteps to add more adversarial content. Therefore, TALO offers iterative and accurate updates to generate more powerful adversarial frames. To achieve temporal imperceptibility of adversarial video, we propose a novel Recursive Token Merging (ReToMe) mechanism, which recursively aligns tokens across frames according to the correlation and compresses the temporally redundant tokens to facilitate joint self-attention. With shared tokens in the self-attention module, ReToMe fixes the misalignment of details in per-frame optimization, resulting in temporally consistent adversarial videos. Additionally, inter-frame interaction can make the gradient of the current frame fuse information from associated frames, which has the potential to generate robust and diverse update directions to fool various target video models [34] . The Re-ToMe facilitates inter-frame interactions into the attack process, thus boosting the adversarial transferability.Our contributions can be summarized as follows:• We introduce the first framework for video diffusion-based unrestricted adversarial attacks, leveraging the Stable Diffusion model to generate imperceptible adversarial video clips with higher transferability.  
related work: 
 As there are no previous works focusing on transferable video unrestricted attacks, this section reviews recent works on transferable unrestricted attacks against image models and transferable restricted attacks against video models.In the transferable image unrestricted attacks, color manipulationbased approaches play a significant role. Semantic Adversarial Examples (SAE) [15] converts the image from the RGB color space to the HSV color space, followed by random perturbation of both the H (Hue) and S (Saturation) channels. ReColorAdv [17] optimizes color transformation within the CIELUV color space, employing a flexibly parameterized function 'f' to recolor every pixel color 'c' to a new one. Colorization Attack (cAdv) [3] utilizes a pre-trained colorization network for color transformation, simultaneously adjusting input hints and masks to generate more natural adversarial examples. Unlike the previous one, Adversarial Color Enhancement (ACE) [45] generates adversarial images by using and optimizing a simple piece-wise linear differentiable color filter, with fewer parameters and better performance. To prevent human detection of unrestricted disturbances, ColorFool [29] manually selects four human-sensitive semantic classes and modifies colors within these sensitive regions constrainedly in the Lab color space. To make adversarial images more natural, Natural Color Fool (NCF) [43] constructs a "distribution of color distributions" for different semantic classes based on an existing dataset, using fused color distribution and optimizable transfer matrix to generate adversarial images. Except for color manipulation-based methods, Texture Attack (tAdv) [3] fuses the texture of images from another class to generate adversarial examples, with an additional constraint on the victim image to prevent producing artistic images. Different from Texture Attack, Adversarial Content Attack (ACA) [7] introduces a diffusion model to perform unrestricted attacks on image models. By leveraging the diffusion model as a low-dimensional manifold, ACA maps the victim image into the latent space, where adversarial attacks and optimizations are conducted. When compared to both color manipulation-based methods and texture attacks, ACA demonstrates superior capability in generating natural adversarial image examples by harnessing the powerful generative capacity of diffusion models. Therefore, this paper investigates the potential of leveraging the diffusion model to perform transferable video unrestricted attacks.In the transferable video restricted attacks, Temporal Translation (TT) [37] some transferable cross-modal attacks from images to videos have emerged. For instance, Image To Video (I2V) [38] generates adversarial video clips on the ImageNet pre-trained model by minimizing the cosine similarity between intermediate features of each benign frame and its adversarial frame. However, I2V treats a video clip as an orderless image set and ignores the inherent temporal information in video clips. In contrast, Global-Local Characteristic Excited Cross-Modal Attack [34] fully considers video characteristics from both global and local perspectives, which performs global interframe interactions in the attack process to induce more diverse and stronger gradients and proposes local correlation disturbance to prevent the target video model from capturing valid temporal clues. Furthermore, Generative Cross-Modal Attack (GCMA) [6] trains perturbation generators against the ImageNet domain but can fool target models from video domains, which proposes a random motion module and a temporal consistency loss based on intermediate features to narrow the gap between the image and video domains. Different from all of the prevision works that focus on restricted attacks, this work studies unrestricted attacks on video models. 
methodology 3.1 diffusion-based unrestricted attack framework: 
 Given a benign video clip 𝑥 ∈ X ⊂ R 𝑁 ×𝐻 ×𝑊 ×𝐶 with 𝑁 frames {𝑥 1 , 𝑥 2 , ..., 𝑥 𝑁 } and its corresponding ground-truth label 𝑦 ∈ Y = {1, 2, ...𝐾 }, where 𝑁 , 𝐻,𝑊 , 𝐶 denote the number of frames, height, width and the number of channels respectively, 𝐾 denotes the number of classes. Let 𝐹 𝜃 denote the video recognition model trained on the video dataset X. We use 𝐹 𝜃 (𝑥) : X → Y to denote the prediction of the video recognition model 𝐹 𝜃 (𝑥) for 𝑥. Our goal is to craft unrestricted adversarial video clip x against a surrogate video recognition model 𝐺𝜙 leveraging the Stable Diffusion [28] to deceive the target video recognition model 𝐹 𝜃 .Prior works on image diffusion-based unrestricted attacks [5, 7] use the DDIM inversion [23] technology to map the benign image back into the diffusion latent space by reversing the deterministic sampling process, then optimize the latent of the image along the adversarial direction. Finally, the adversarial image is generated from the optimized adversarial latent through the entire denoising process. For simplicity, the encoding and decoding of the VAE is ignored, as it is differentiable. However, such generation has obvious limitations for video attacks when applied directly to each frame. Firstly, given the fact that diffusion models tend to add coarse semantic information during the early denoising steps [22] , premature manipulation tends to change the layouts or semantic structure of frames, which leads to semantic inconsistency and changes. This spatial inconsistency further leads to temporal inconsistency in adversarial videos. Furthermore, because this framework applied in video attacks involves updating all the frames simultaneously, the gradient calculation throughout the entire denoising process leads to a heavy memory overhead and large time consumption.Therefore, we propose our ReToMe-VA to address these challenges, as shown in Figure 2 . Specifically, we utilize the Timestepwise Adversarial Latent Optimization (Sec.3.2) in the denoising process and introduce a Recursive Token Merging (Sec.3.3) technique to maintain the temporal consistency and boost adversarial transferability. The algorithm of ReToMe-VA is presented in Algorithm 1.Existing frame to substitute the adversarial output x0 for the prediction of the surrogate model 𝐺 𝜙 . The calculation of x𝑡 0 and our adversarial objective function is expressed as follows:EQUATIONwhere 𝛼 𝑡 represents the parameters of the scheduler, 𝜖 𝜃 denotes the noise predicted by the UNet, and 𝐽 (•) is the cross-entropy loss.After optimizing latents x𝑡 , we generate a sample x𝑡 -1 from x𝑡 for the preparation of next timestep-wise optimization via:EQUATIONFinally, x0 is used as the final adversarial video clip x to fool the target video recognition model 𝐹 𝜃 . Preservation of Structural Similarity. Adversarial optimization at each denoising step leads to a deviation of the latent from the original frame distribution. Despite the inevitable alterations to the benign frames for adding adversarial content, the challenge lies in preserving the structural similarity of the adversarial frames from the benign frames. Leveraging the fact that the spatial features of the self-attention layers are influential in determining both the structure and the appearance of the generated images, TALO minimizes the average difference of the self-attention maps between the benign and the adversarial latent at each timestep 𝑡:EQUATION)where 𝑠 𝑗 𝑡 , ŝ 𝑗 𝑡 are respectively the 𝑗-th self-attention map of benign latents 𝑥 𝑡 and adversarial latents x𝑡 , 𝑛 𝑠 denotes the total number of self-attention maps in the diffusion model.In general, the final objective function of ReToMe-VA is as follows, where 𝛾 and 𝛽 represent the weight factors of each loss:EQUATIONIncremental Iteration Strategy. TALO iteratively optimizes x𝑡 to seek optimal adversarial latents at timestep 𝑡 and the iteration number represents a trade-off between spatial imperceptibility and adversarial transferability. Recent work [22] has indicated that the diffusion models tend to add coarse semantic information (e.g., layout) during the early timesteps while more fine details during the later timesteps. As depicted in TALO strategy perturbs each benign frame of video separately. This per-frame optimization makes the frames likely optimized along different adversarial directions resulting in motion discontinuity and temporal inconsistency. Furthermore, separately perturbing each benign frame reduces the monotonous gradients because the interactions among the frames are not exploited. To this end, we introduce a recursive token merging (ReToMe) strategy that recursively matches and merges similar tokens across frames together enabling the self-attention module to extract consistent features. In the following, we first provide the basic operation of token merging and token unmerging and then our recursive token merging algorithm.Generally, tokens 𝑇 are partitioned into a source (𝑠𝑟𝑐) and destination (𝑑𝑠𝑡) set. Then, tokens in 𝑠𝑟𝑐 are matched to their most similar token in 𝑑𝑠𝑡, and 𝑟 most similar edges are selected subsequently. Next, we merge the connected 𝑟 most similar tokens in 𝑠𝑟𝑐 to 𝑑𝑠𝑡 by replacing them as the linked 𝑑𝑠𝑡 tokens. To keep the token number unchanged, we divide merged tokens after self-attention by assigning their values to merged tokens in 𝑠𝑟𝑐. Token matching, merging, and unmerging operations are expressed as: 𝑒 = 𝑚𝑎𝑡𝑐ℎ(𝑠𝑟𝑐, 𝑑𝑠𝑡, 𝑟 ),EQUATION)where 𝑚𝑎𝑡𝑐ℎ( 𝑑𝑠𝑡, while merged tokens (𝑇 𝑠𝑟𝑐 ) 𝑚 in 𝑠𝑟𝑐 is replaced by tokens in 𝑑𝑠𝑡.𝑇 !" #$% 𝑇 !" $&' (𝑇 !" $&' ) () 𝑓! 𝑓!"# … (𝑇 !" #$% ) #$% (𝑇 !" #$% ) $&' 𝑇 !" #$% … Self-A self-attention module takes a sequence of input and output tokens across all frames. The input and output tokens are denoted as 𝑇 𝑖𝑛 , 𝑇 𝑜𝑢𝑡 ⊂ R 𝑁 ×𝐿×𝐸 , where 𝐿 is the number of tokens per frame, and 𝐸 is the embedding dimension. To partition tokens across frames into 𝑠𝑟𝑐 and 𝑑𝑠𝑡, we define stride as 𝐵, we randomly choose one out of the first 𝐵 frames (e.g. the 𝑔 𝑡ℎ frame), and select the subsequent frames every B interval into the 𝑑𝑠𝑡 set (named as 𝑇 𝑑𝑠𝑡 𝑖𝑛 ). Tokens of other frames are in 𝑠𝑟𝑐 set (𝑇 𝑠𝑟𝑐 𝑖𝑛 ). Then merging operation mentioned above in Eq. 6 is used to merge source frames:EQUATION)where 𝑇 𝑟𝑚 = {𝑇 𝑑𝑠𝑡 𝑖𝑛 , (𝑇 𝑠𝑟𝑐 𝑖𝑛 ) 𝑢𝑚 }. We set 𝑟 1 = 𝑝 (𝑁 -𝑁 𝑑 1 )𝐿 where 𝑝 is the merging ratio, (𝑁 -𝑁 𝑑 1 )𝐿 is the 𝑠𝑟𝑐 token number in the first merging process and 𝑁 𝑑 1 is the 𝑇 𝑑𝑠𝑡 𝑖𝑛 frame number. Nevertheless, during the merging process expressed above, tokens in 𝑑𝑠𝑡 are not merged and compressed. To maximally fuse the inter-frame information, we recursively apply the above merging process to tokens in 𝑑𝑠𝑡 until they contain only one frame. For instance, in the next merging process of 𝑇 𝑑𝑠𝑡 𝑖𝑛 , after partition of 𝑠𝑟𝑐 and 𝑑𝑠𝑡 of 𝑇 𝑑𝑠𝑡 𝑖𝑛 (named as (𝑇 𝑑𝑠𝑡 𝑖𝑛 ) 𝑠𝑟𝑐 and (𝑇 𝑑𝑠𝑡 𝑖𝑛 ) 𝑑𝑠𝑡 ), we merge tokens in 𝑠𝑟𝑐 to 𝑑𝑠𝑡 by:EQUATIONWe set 𝑟 2 = 𝑝 (𝑁 𝑑 1 -𝑁 𝑑 2 )𝐿 where (𝑁 𝑑 1 -𝑁 𝑑 2 )𝐿 is the 𝑠𝑟𝑐 token number and 𝑁 𝑑 2 is 𝑑𝑠𝑡 frame number in this process. The difference is that we add the previous unmerged tokens (𝑇 𝑠𝑟𝑐 𝑖𝑛 ) 𝑢𝑚 into 𝑑𝑠𝑡 for token matching. Then we replace 𝑇 𝑑𝑠𝑡 𝑖𝑛 with (𝑇 𝑑𝑠𝑡 𝑖𝑛 ) 𝑟𝑚 in 𝑇 𝑟𝑚 . The token merging process of ReToMe is shown in Figure 3 . Next, we input the tokens 𝑇 𝑟𝑚 into the self-attention module to calculate (𝑇 𝑜𝑢𝑡 ) 𝑟𝑚 .The output tokens (𝑇 𝑜𝑢𝑡 ) 𝑟𝑚 need to be restored to their original shape 𝑇 𝑜𝑢𝑡 to perform the following operations. Therefore, in the unmerge process, the unmerging operation in Eq. 6 is applied in the reverse order of the merging process to get 𝑇 𝑜𝑢𝑡 .Our ReToMe has three advantages. Firstly, ReToMe ensures that the most similar tokens share identical outputs, maximizing the compression of tokens. This approach fosters internal uniformity of features across frames and preserves temporal consistency, thereby effectively achieving temporal imperceptibility. Secondly, given the fact that there is a negative correlation between the adversarial transferability and the interaction inside adversarial perturbations [35] , the merged tokens decrease interaction inside adversarial perturbations, effectively preventing overfitting on the surrogate model. Furthermore, the tokens in 𝑑𝑠𝑡 linked to merged tokens facilitate inter-frame interaction in gradient calculation, which may induce more robust and diverse gradients [34] . Therefore, ReToMe can effectively boost adversarial transferability. 
experiment 4.1 experiment settings: 
 Dataset. We evaluate the adversarial transferability of our proposed method on Kinetics-400 [4] dataset. The dataset contains approximately 240,000 videos from 400 human action classes, we carefully selected one video clip from each class that was correctly classified by all video recognition models, yielding a total of 400 videos as the validation dataset. Models. To assess the adversarial robustness of network architectures, we select CNNs and ViTs as the attacked models, respectively. For CNNs, we choose normally trained I3D SLOW [9] , TPN [42] with two different backbones: ResNet-50 and ResNet-101, and R(2+1)D [33] with backbone ResNet-50 (R(2+1)D-50). For ViTs, we consider VTN [24] , Motionformer [2] , TimeSformer [26] , Video Swin [19] . Implementation Details. Our experiments are run on an NVIDIA A800 with Pytorch. We set DDIM steps 𝑇 = 20, start attack DDIM step 𝑡 𝑠 = 5, initial attack Iteration 𝑁 𝑎 = 4, recursive token merging ratio 𝑝 = 0.5. Meanwhile, the weight factors 𝛾, 𝛽 in Eq. 5 are set to 10, 100 respectively. We adopt AdamW [20] with the learning rate set to 1𝑒 -2 . The version of Stable Diffusion we used is v2.0. Evaluation Metrics. We use the Attack Success Rate (ASR), i.e., the percentage of adversarial video clips that are successfully misclassified by the video recognition model, to evaluate the adversarial transferability. Thus a higher ASR means better adversarial transferability. If not specifically stated, Avg.ASR is the average ASR over all target video models. Besides, we quantitatively assess the frame quality using two reference perceptual image quality measures including Frechet Inception Distance (FID) [14] and LPIPS [44] , and three non-reference perceptual image quality measures NIMA-AVA [32] , HyperIQA [31] , and TReS [10] . For temporal consistency, we adopt four evaluation metrics in VBench [16] , including Subject Consistency, Background Consistency, Motion Smoothness, and Temporal Flickering. Each metric is tailored to specific aspects of video analysis. Subject Consistency measures whether an object's appearance remains consistent throughout the video. Background Consistency evaluates the temporal uniformity of background scenes through CLIP [27] feature similarity across frames. Motion Smoothness assesses the smoothness and realism of motion, adhering to real-world physics. Temporal Flickering computes the mean absolute difference across frames to detect abrupt changes. Moreover, we also select Pixel-MSE to evaluate the naturalness and continuity of frame-to-frame transitions. Specifically, each frame in the adversarial video clip is warped to the next frame by the optical flow between consecutive frames. Then, we compute the average mean-squared pixel error between each warped frame and its corresponding next frame. We first assess the adversarial transferability of normally trained CNNs and ViTs. For video restricted attacks, we compare the proposed method with state-of-the-art TT [37] . For video unrestricted attacks, due to the lack of comparable work, we extend the image unrestricted attacks to generate adversarial video clips frame-byframe, including SAE [15] , ReColorAdv [17] , cAdv [3] , tAdv [3] , ACE [45] , ColorFool [29] , NCF [43] , and ACA [7] . Adversarial video clips are crafted against Slow-50, TPN-50, VTN, Motionformer and TimeSformer respectively. The transferability of different methods is displayed in Table 1 . It can be observed that adversarial video clips generated by ReToMe-VA generally exhibit superior transferability compared to those generated by state-of-the-art competitors. Our proposed ReToMe-VA achieved a white-box attack success rate of 100% on the Motionformer and TimeSformer models. The results from Table 1 indicate that our method surpasses the restricted attack method TT in the black-box setting. When Slow-50, Motionformer, and TimeSformer are used as surrogate models, we significantly outperform state-of-the-art ACA by 17.10%, 26.62%, and 10.19%, respectively, indicating that our ReToMe-VA has higher transferability under the more challenging cross-architecture setting. Specifically, when the surrogate model is Slow-50, we surpass ACA by significant margins of 40%, 41.75%,41%, and 6.75% in Slow-101, TPN-50, TPN-101, and TimeSformer, respectively.We also assess its performance against five representative defense mechanisms, including the top-2 defense methods in the NIPS 2017 competition (high-level representation guided denoiser (HGD) [18] and random resizing and padding (R&P) [40] ), three popular input pre-process defenses, namely jpeg compression (JPEG) [12] , bit depth reduction (Bit-Red) [41] , and DiffPure [25] . We take Slow-50 as a surrogate model and all of the adversarial video clips are crafted on it.From the results demonstrated in Table 2 , we can see our method displays superiority over other advanced attacks by a significant margin. For example, against HGD and DiffPure defenses, our method outperforms the next best attack ACA by over 17.5% and 4.41% respectively, indicating its robustness and efficiency in penetrating these defenses. This evidences the advanced capability of our method in maintaining high attack success rates under diverse adversarial defense methods.In this section, we will demonstrate the superiority of our approach through qualitative and quantitative comparisons of frame quality and temporal consistency in videos. Frame Quality. In Figure 4 (a), we visualize the adversarial frames crafted by different attack approaches. We can see that our attack is much more natural than the restricted attack TT and more imperceptible compared with other unrestricted attacks. In detail, the color and texture changes of adversarial frames generated by SAE, ACE, ColorFool, NCF, and ACA are easily perceptible. Next, we give more adversarial frames generated by ReToMe-VA in Figure 4(b) . It is observed that our method adaptively modifies inconspicuous details to generate adversarial frames. For example, minor alteration is made to the texture of the knitted yarn in the frame in the fourth column of Figure 4(b) . Moreover, we quantitatively assess the frame quality using the reference and non-reference perceptual image quality measures. As illustrated in Table 4 , our method achieves top-2 performance across all metrics. And ReToMe-VA achieves the best result in HyperIQA and TReS. Temporal Consistency. To provide a qualitative comparison, Figure 5 shows an adversarial video clip crafted by our ReToMe-VA. From the visualization of the video, we can observe that our proposed method produces high-quality frames. The crafted frames by ReToMe-Va highly align with the benign frames in both appearance and structure and also maintain a high level of motion consistency with the benign frames. Quantitative evaluation results are shown in Table 3 , we evaluate the temporal quality of the videos using five metrics, all of which achieve top-2 results. Specifically, Motion Adversarial Frames Benign FramesIn Table 5 , we ablate the designs mentioned in Section 3.3. We can observe that the avg.ASR and Subject Consistency increase by 6.08% and 0.04 by using ReToMe, indicating that the Recursive Token Merging Technique exhibits strong adversarial transferability and enhanced temporal consistency. Additionally, the ablation study of II strategy is shown in Table 6 . In detail, the first two lines denote that we fix the iteration number at each timestep, while the last line displays our II strategy. The results verify that our II strategy performs a good trade-off between transferability and spatial imperceptibility. Moreover, we investigate the impact of different merging ratios on adversarial transferability and video quality, using Slow-50 as an example surrogate model. The results are illustrated in Figure 6 , which demonstrate that a merging ratio of 𝑝 = 0.5 achieves the best adversarial transferability with high frame quality. 
conclusion: 
 In this paper, we propose the Recursive Token Merging for Video Diffusion-based Unrestricted Adversarial Attack (ReToMe-VA). As far as we know, this is the first diffusion-based framework to generate imperceptible adversarial video clips with higher transferability. ReToMe-VA adopts a Timestep-wise Adversarial Latent Optimization strategy to achieve spatial imperceptibility. Moreover, ReToMe-VA introduces a Recursive Token Merging (ReToMe) mechanism. By aligning and compressing redundant tokens across frames, Re-ToMe produces temporally consistent adversarial videos. ReToMe provides more diverse and robust attack direction by incorporating inter-frame interactions into the adversarial optimization process, consequently boosting adversarial transferability. Extensive experiments and visualization demonstrate the efficacy of ReToMe-VA, particularly in surpassing the best baseline by an average of 14.16% in normally trained models. We hope our work will pave the way for future research in enhancing the robustness of video recognition models against adversarial threats, as well as contributing to the development of more effective video adversarial attack methods.  
 
 Appendix:  


Decision: This paper proposed the Recursive Token Merging for Video Diffusion-based Unrestricted Adversarial Attack which can generate imperceptible adversarial video clips with higher transferability. The paper received 4 acceptances from reviewers. AC has looked at reviews and agreed the acceptance of this paper.

Reviews: review: paper_summary: paper_summary: This paper introduces an unrestricted adversarial attack method against Stable Diffusion to generate imperceptible adversarial videos with high transferability. The proposed method is based on a time-step-wise latent optimization strategy that gradually updates perturbations in latent space at each step. Additionally, a token merging mechanism is proposed to enhance adversarial transferability. A series of experiments demonstrate the effectiveness of the proposed method in various settings.
strength_weakness: strength_weakness: 1. The paper is well-written and organized.
2. The proposed method is novel and effective.
3. Extensive experiments validate the effectiveness of the proposed method in diverse settings.
4. The visualization results are impressive.
limitations: limitations: 1. It would be interesting to see if the proposed method can be extended to standard adversarial settings, such as the lp norm setting, possibly by applying a simple clip at the pixel level.
2. The authors should provide an error analysis, such as a confusion matrix, to give a more detailed understanding of the model's performance under attacks / natural samples.
3. The authors could also apply the proposed attack methods to adversarially trained models to evaluate their performance, as adversarial training is one of the most effective adversarial defense methods.
4. I noticed that the performance of the proposed method is not as good as tAdv. I would like the authors to provide further discussions about it. If possible, the authors could provide more comparisons in diverse settings.
5. The ablation study should also considers diverse combinations of losses.
paper_summary: paper_summary: This paper presents a novel framework called Recursive Token Merging Unrestricted Adversarial Attack (ReToMe-VA) based on video diffusion. Its main focus is to generate antagonistic video clips that are imperceptible and highly transferable. Unlike existing research that mainly focuses on images, the framework specifically targets adversarial attacks in the video context. ReToMe-VA utilizes Timestep-wise Adversarial Latent Optimization (TALO) and Recursive Token Merging (ReToMe) to achieve imperceptibility and transferability. Extensive experiments demonstrated the advantages of ReToMe over the state-of-the-art methods.
strength_weakness: strength_weakness: 1. The idea of applying diffusion model to generate unrestricted video adversarial examples is novel. Previous research has extensively explored unrestricted image adversarial attacks, but fewer studies have been conducted in the video domain. This paper identifies two challenges in generating unrestricted video adversarial attacks, namely temporal consistency and model transferability, and provides two solutions to address these challenges.

2. This paper is technically sound since diffusion models have been used in the image domain to generate adversarial examples. Compared to the distance-regularized form, unrestricted adversarial examples show better imperceptibility and transferability.

3. Two strategies are introduced in this paper to further improve the stealth and transferability of the attack, which is supported by extensive experimental results. The transferability of adversarial examples generated by the proposed method is better than 9 baseline attacks in most cases. Meanwhile, visualized examples demonstrate the high quality of generated examples.
limitations: limitations: A major concern is about the selection of video adversarial defense methods, the paper evaluated the proposed method under 5 defenses. However, 4/5 of these methods are proposed before 2020 and all of them were initially designed for image adversarial instances. Therefore, it would be useful for the authors to explain why. Also, several video adversarial defense methods have been proposed in the past few years (e.g., [1-3]), so it would be desirable to use these new defense methods for discussion and analysis.

[1] Lo, Shao-Yuan, and Vishal M. Patel. "Defending against multiple and unforeseen adversarial videos." IEEE Transactions on Image Processing 31 (2021): 962-973.

[2] Kinfu, Kaleab A., and René Vidal. "Analysis and extensions of adversarial training for video classification." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2022.

[3] Lee, Hong Joo, and Yong Man Ro. "Defending Video Recognition Model against Adversarial Perturbations via Defense Patterns." IEEE Transactions on Dependable and Secure Computing (2023).
paper_summary: paper_summary: The paper proposes a framework called ReToMe-VA for generating imperceptible adversarial video clips with higher transferability.  The framework incorporates the Timestep-wise Adversarial Latent Optimization (TALO) strategy to achieve spatial imperceptibility and the Recursive Token Merging (ReToMe) mechanism to achieve temporal imperceptibility.
strength_weakness: strength_weakness: (1) The paper addresses the gap in the literature by proposing the first framework for video diffusion-based unrestricted adversarial attacks.
(2) The TALO strategy and ReToMe mechanism are innovative and effective in achieving spatial and temporal imperceptibility in adversarial videos.
limitations: limitations: (1) The evaluation of the proposed method is limited.  The paper only provides results on the Kinetics-400 dataset (why not other video datasets such as UCF101, ActivityNet) and does not compare the proposed method with other state-of-the-art approaches in the field.  This lack of comparison makes it difficult to assess the novelty and effectiveness of the proposed method.
(2) The paper does not provide a thorough analysis of the experimental results.  There is no discussion of the limitations or potential drawbacks of the proposed method, and there is no analysis of the failure cases or potential reasons for the low success rates.
paper_summary: paper_summary: Authors proposed a Recursive Token Merging for Video Diffusion-based Unrestricted Adversarial Attack, namely ReToMe-VA. Proposed framework can generate imperceptible adversarial video clips with enhanced transferability. The article is well written, but some of the technical details are not presented clearly. Please see the list below for details.
strength_weakness: strength_weakness: + The paper is well organized
+ The issues of transferability and continuity that the paper targeted are meaningful for the study of video adversarial examples
+ Evaluation is comprehensive
limitations: limitations: - line 342 where x_0 is x, what is the x? is this a typo? Should it be T here?
- line 344 is the t_s selected by attacker? or the last b frame?
- The incremental iteration strategy is very conceptual. How do you adjust the number of configuration iterations for actual use? This was also not discussed in the evaluation.
- line 394 there is no table 6 in paper and supply
- sec.3.3 The recursive token merge technique is not clearly explained:
-- How are tokens defined?
-- How is similarity measured?
-- The explanation in the main text does not match Figure 3. It is recommended that the authors provide additional explanations for this section and add references if applicable.
- Recursive Token Merging makes a trade-off for better transferability as well as frame content coherence. This meets the expectations of Table 5 for consistency, but also better ASR, why?
- How does the recursive token merge ratio affect performance? Why is half the merge ratio best? It's worth a deeper discussion here.