Original: B OOSTING A DVERSARIAL T RANSFERABILITY USING D YNAMIC C UES
Revised: B OOSTING A DVERSARIAL T RANSFERABILITY USING D YNAMIC C UES

Original: Anonymous authors

Original: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: The transferability of adversarial perturbations between image models has been extensively studied.
Revised: The transferability of adversarial perturbations between image models has been extensively studied.

Original: In this case, an attack is generated from a known surrogate e.g. , the ImageNet trained model, and transferred to change the decision of an unknown (black-box) model trained on an image dataset.
Revised: In this case, an attack is generated from a known surrogate e.g. , the ImageNet trained model, and transferred to change the decision of an unknown (black-box) model trained on an image dataset.

Original: However, attacks generated from image models do not capture the dynamic nature of a moving object or a changing scene due to a lack of temporal cues within image models.
Revised: However, attacks generated from image models do not capture the dynamic nature of a moving object or a changing scene due to a lack of temporal cues within image models.

Original: This leads to reduced transferability of adversarial attacks from representation-enriched image models such as Supervised Vision Transformers (ViTs), Self-supervised ViTs ( e.g. , DINO) and Vision-language models ( e.g. , CLIP) to black-box video models.
Revised: This leads to reduced transferability of adversarial attacks from representation-enriched image models such as Supervised Vision Transformers (ViTs), Self-supervised ViTs ( e.g. , DINO), and Vision-language models ( e.g. , CLIP) to black-box video models.

Original: In this work, we induce dynamic cues within the image models without sacrificing their original performance on images.
Revised: In this work, we induce dynamic cues within the image models without sacrificing their original performance on images.

Original: To this end, we optimize temporal prompts through frozen image models to capture motion dynamics.
Revised: To this end, we optimize temporal prompts through frozen image models to capture motion dynamics.

Original: Our temporal prompts are the result of a learnable transformation that allows optimizing for temporal gradients during an adversarial attack to fool the motion dynamics.
Revised: Our temporal prompts are the result of a learnable transformation that allows optimizing for temporal gradients during an adversarial attack to fool the motion dynamics.

Original: Specifically, we introduce spatial (image) and temporal (video) cues within the same source model through taskspecific prompts.
Revised: Specifically, we introduce spatial (image) and temporal (video) cues within the same source model through taskspecific prompts.

Original: Attacking such prompts maximizes the adversarial transferability from image-to-video and image-to-image models using the attacks designed for image models.
Revised: Attacking such prompts maximizes the adversarial transferability from image-to-video and image-to-image models using the attacks designed for image models.

Original: As an example, an iterative attack launched from image model
Revised: As an example, an iterative attack launched from image model

Original: Deit-B with temporal prompts reduces generalization (top1 % accuracy) of a video model by 35% on Kinetics-400.
Revised: Deit-B with temporal prompts reduces generalization (top1 % accuracy) of a video model by 35% on Kinetics-400.

Original: Our approach also improves adversarial transferability to image models by 9% on ImageNet w.r.t the current state-of-the-art approach.
Revised: Our approach also improves adversarial transferability to image models by 9% on ImageNet w.r.t the current state-of-the-art approach.

Original: Our attack results indicate that the attacker does not need specialized architectures, e.g. , divided space-time attention, 3D convolutions, or multi-view convolution networks for different data modalities.
Revised: Our attack results indicate that the attacker does not need specialized architectures, e.g. , divided space-time attention, 3D convolutions or multi-view convolution networks for different data modalities.

Original: Image models arethe effective surrogate to optimize an adversarial attack to fool black-box models in a changing environment over time.
Revised: Image models are effective surrogates to optimize an adversarial attack to fool black-box models in a changing environment over time.

Original: Our code will be made public.
Revised: Code is available at https://bit.ly/3Xd9gRQ

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Deep learning models are vulnerable to imperceptible changes to the input images.
Revised: Deep learning models are vulnerable to imperceptible changes to the input images.

Original: It has been shown that for a successful attack, an attacker no longer needs to know the attacked target model to compromise its decisions (Naseer et al., 2019;  Nakka & Salzmann, 2021).
Revised: It has been shown that for a successful attack, an attacker no longer needs to know the attacked target model to compromise its decisions (Naseer et al., 2019; 2020; Nakka & Salzmann, 2021).

Original: Adversarial perturbations suitably optimized from a known source model (a surrogate) can fool an unknown target model (Kurakin et al., 2016).
Revised: Adversarial perturbations suitably optimized from a known source model (a surrogate) can fool an unknown target model (Kurakin et al., 2016).

Original: These attacks are known as black-box attacks since the attacker is restricted to access the deployed model or compute its adversarial gradient information.
Revised: These attacks are known as black-box attacks since the attacker is restricted to access the deployed model or compute its adversarial gradient information.

Original: Adversarial attacks are continuously evolving, revealing new blind spots of deep neural networks.
Revised: Adversarial attacks are continuously evolving, revealing new blind spots of deep neural networks.

Original: Adversarial transferability has been extensively studied in image-domain (Wang & He, 2021; Naseer et al., 2022; Aich et al., 2022; Akhtar & Mian, 2018).
Revised: Adversarial transferability has been extensively studied in image-domain (Akhtar & Mian, 2018; Wang & He, 2021; Naseer et al., 2022b; Malik et al., 2022).

Original: Existing works demonstrate how adversarial patterns can be generalized to models with different architectures (Zhou et al., 2018) and even different data domains (Naseer et al., 2019).
Revised: Existing works demonstrate how adversarial patterns can be generalized to models with different architectures (Zhou et al., 2018) and even different data domains (Naseer et al., 2019).

Original: However, the adversarial transferability between different architecture families designed for varying data modalities, e.g. , image models to video models, has not been actively explored.
Revised: However, the adversarial transferability between different architecture families designed for varying data modalities, e.g. , image models to video models, has not been actively explored.

Original: Since the adversarial machine learning topic has gained maximum attention in the image-domain, it is natural to question if image models can help transfer better to video-domain models.
Revised: Since the adversarial machine learning topic has gained maximum attention in the image-domain, it is natural to question if image models can help transfer better to video-domain models.

Original: However, the image models lack dynamic temporal cues which are essential for transfer to the video models.
Revised: However, the image models lack dynamic temporal cues which are essential for transfer to the video models.

Original: We are motivated by the fact that in a real-world setting, a scene is not static but mostly involves various dynamics, e.g. , object motion, changing viewpoints, illumination and background changes.
Revised: We are motivated by the fact that in a real-world setting, a scene is not static but mostly involves various dynamics, e.g. , object motion, changing viewpoints, illumination and background changes.

Original: Therefore, exploiting dynamic cues within an adversarial attack is essential to find blind-spots of unknown target models.
Revised: Therefore, exploiting dynamic cues within an adversarial attack is essential to find blind-spots of unknown target models.

Original: For this purpose, we introduce the idea of encoding disentangled temporal representations within an image-based Vision Transformer (ViT) model using dedicated temporal prompts while keeping the remaining network frozen.
Revised: For this purpose, we introduce the idea of encoding disentangled temporal representations within an image-based Vision Transformer (ViT) model using dedicated temporal prompts while keeping the remaining network frozen.

Original: The temporal prompts can learn the dynamic cues which are exploited during attack for improved transferability from image-domain models.
Revised: The temporal prompts can learn the dynamic cues which are exploited during attack for improved transferability from image-domain models.

Original: Specifically, we introduce the proposed temporal prompts to three types of image models with enriched representations acquired via supervised (ViT (Dosovitskiy et al., 2020)), self-supervised (DINO (Caron et al., 2021)) or multi-modal learning (CLIP (Radford et al., 2021)).
Revised: Specifically, we introduce the proposed temporal prompts to three types of image models with enriched representations acquired via supervised (ViT (Dosovitskiy et al., 2020)), self-supervised (DINO (Caron et al., 2021)) or multi-modal learning (CLIP (Radford et al., 2021)).

Original: Our approach offers the benefit that the attacks do not need to rely on specialized networks designed for videos towards better adversarial transferability.
Revised: Our approach offers the benefit that the attacks do not need to rely on specialized networks designed for videos towards better adversarial transferability.

Original: As an example, popular model designs for videos incorporate 3D convolutions, space-time attention, tube embeddings or multi-view information to be robust against the temporal changes (Bertasius et al., 2021; Arnab et al., 2021).
Revised: As an example, popular model designs for videos incorporate 3D convolutions, space-time attention, tube embeddings or multi-view information to be robust against the temporal changes (Bertasius et al., 2021; Arnab et al., 2021).

Original: Without access to such specific design choices, our approach demonstrates how an attacker can leverage regular image models augmented with temporal prompts to learn dynamic cues.
Revised: Without access to such specific design choices, our approach demonstrates how an attacker can leverage regular image models augmented with temporal prompts to learn dynamic cues.

Original: Such dynamic cues are shown here to aid in better transfer not only to video models, but also to the original domain (image) models due to the expressivity of dynamic information.

Original: Further, our approach can be easily extended to image datasets, where disentangled representations can be learned via tokens across a scale-space comprising of varying image resolutions.
Revised: Further, our approach can be easily extended to image datasets, where disentangled representations can be learned via tokens across a scale-space at varying image resolutions.

Original: In summary, the major contributions of this work include:
Revised: In summary, the major contributions of this work include:

Original: • We demonstrate how temporal prompts incorporated with frozen image-based models can help model dynamic cues which can be exploited to fool deep networks designed for videos.
Revised: • We demonstrate how temporal prompts incorporated with frozen image-based models can help model dynamic cues which can be exploited to fool deep networks designed for videos.

Original: • Our approach for dynamic cue modeling via prompts does not affect the original spatial representations learned by the image-based models during pre-training, e.g. , fully-supervised, self-supervised and multimodal models.
Revised: • Our approach for dynamic cue modeling via prompts does not affect the original spatial representations learned by the image-based models during pre-training, e.g. , fully-supervised, self-supervised and multi-modal models.

Original: • The proposed method significantly improves transfer to black-box image and video models.
Revised: • The proposed method significantly improves transfer to black-box image and video models.

Original: Our approach

Original: is easily extendable to 3D

Original: datasets

Original: via

Original:  learning cross view prompts; and image-only datasets via modeling the 
Revised: Our approach is easily extendable to 3D datasets via learning cross-view prompts; and image-only datasets via modeling the scale-space.

Original: scale

Original: -space.

Original: Finally , it enables generalization from popular plain ViT models without considering video-specific specialized designs
Revised: Finally, it enables generalization from popular plain ViT models without considering video-specific specialized designs.

Original: We analyse the adversarial space of three type of image models (fully-supervised, self-supervised, and text-supervised).
Revised: We analyse the adversarial space of three type of image models (fully-supervised, self-supervised, and text-supervised).

Original: A pre-trained ImageNet ViT with only 5 million parameters exhibits 44.6 and 72.2 top-1 (%) accuracy on Kinetics-400 and ImageNet validation sets using our approach, thereby significantly improves the adversarial transferability on video-domain models.
Revised: A pre-trained ImageNet ViT with approximately 6 million parameters exhibits 44.6 and 72.2 top-1 (%) accuracy on Kinetics-400 and ImageNet validation sets using our approach, thereby significantly improving the adversarial transferability on video-domain models.

Original: A similar trend exists on other image models.
Revised: A similar trend exists with other image models.

Original: Our results indicate that the multimodal CLIP can better adapt to video modalities than fully-supervised or self-supervised ViTs.
Revised: Our results indicate that the multi-modal CLIP can better adapt to video modalities than fully-supervised or self-supervised ViTs.

Original: However, CLIP adversaries are relatively less transferable as compared to fully-supervised ViT or self-supervised DINO model.
Revised: However, CLIP adversaries are relatively less transferable as compared to fully-supervised ViT or self-supervised DINO model.

Original: As an example, a momentum based iterative attack launched from our DINO model can reduce the performance of TimesFormer (Bertasius et al., 2021) from 90.6% to 45.2% on UCF dataset.
Revised: As an example, a momentum based iterative attack launched from our DINO model can reduce the performance of TimesFormer (Bertasius et al., 2021) from 75.6% to 35.8% on Kinetics-400 dataset.

Original:  B OOSTING A DVERSARIAL T RANSFERABILITY USING D YNAMIC C UES
Revised:  B OOSTING A DVERSARIAL T RANSFERABILITY USING D YNAMIC C UES

Original: Adversarial transferability refers to manipulating a clean sample (image, video, or 3D object rendered into multi-views) in a way that is deceiving for an unknown (black-box) model.
Revised: Adversarial transferability refers to manipulating a clean sample (image, video, or 3D object rendered into multi-views) in a way that is deceiving for an unknown (black-box) model.

Original: In the absence of an adversarial perturbation, the same black-box model predicts the correct label for the given image, video, or a rendered view of a 3D object.
Revised: In the absence of an adversarial perturbation, the same black-box model predicts the correct label for the given image, video, or a rendered view of a 3D object.

Original: A known surrogate model is usually used to optimize for the adversarial patterns.
Revised: A known surrogate model is usually used to optimize for the adversarial patterns.

Original: Instead of training the surrogate model from scratch on a given data distribution, an attacker can also adapt pre-trained image models to the new task.
Revised: Instead of training the surrogate model from scratch on a given data distribution, an attacker can also adapt pre-trained image models to the new task.

Original: These image models can include supervised ImageNet models such as Deit (Touvron et al., 2020), self-supervised
Revised: These image models can include supervised ImageNet models such as Deit (Touvron et al., 2020), self-supervised

Original: ImageNet models like DINO (Caron et al., 2021), and text-supervised large-scale multi-modal models e.g. CLIP (Radford et al., 2021).
Revised: ImageNet models like DINO (Caron et al., 2021), and text-supervised large-scale multi-modal models e.g. CLIP (Radford et al., 2021).

Original: The adversarial attack generated from such pre-trained models with enriched representations transfer better in the black-box setting for image-to-image transfer task (Zhang et al., 2022; Naseer et al., 2022; Aich et al., 2022).
Revised: The adversarial attack generated from such pre-trained models with enriched representations transfer better in the black-box setting for image-to-image transfer task (Zhang et al., 2022; Naseer et al., 2022b; Aich et al., 2022).

Original: However, adversarial perturbations optimized from image models are not well suited to fool motion dynamics learned by a video model (Sec. 3).
Revised: However, adversarial perturbations optimized from image models are not well suited to fool motion dynamics learned by a video model (Sec. 3).

Original: To cater for this, we introduce temporal cues to model motion dynamics within adversarial attacks through pre-trained image models.
Revised: To cater for this, we introduce temporal cues to model motion dynamics within adversarial attacks through pre-trained image models.

Original: Our approach, therefore, models both spatial and temporalinformation during the attack (Sec. 2.1) and does not depend on specialized video networks e.g. ,
Revised: Our approach, therefore, models both spatial and temporal

Original: Proposed training for dynamic cues within image models
Revised: Proposed training for dynamic cues within image models

Original: Image pre-trained vision transformer
Revised: Image pre-trained vision transformer

Original: M H S A
Revised: M H S A

Original: Frozen model
Revised: Frozen model

Original: L a y e r N o r m L a y e r N o r m
Revised: L a y e r N o r m L a y e r N o r m

Original: FF N
Revised: FF N

Original: Input Video ( 𝑥 )
Revised: Input Video ( 𝑥 )

Original: Target Video / Image Models (Black-box)
Revised: Target Video / Image Models (Black-box)

Original: Source Image Model R a nd o m
Revised: Source Image Model R a nd o m

Original: S a m p l e r
Revised: S a m p l e r

Original: S p a t i a l T o k e n s
Revised: S p a t i a l T o k e n s

Original: T o k e n i z e r
Revised: T o k e n i z e r

Original: Transformation 𝒯
Revised: Transformation 𝒯

Original: M H S A S p a t i a l P oo li n g
Revised: M H S A S p a t i a l P oo li n g

Original: T o k e n i z e r
Revised: T o k e n i z e r

Original: Learned
Revised: Learned

Original: T e m p o r a l
Revised: T e m p o r a l

Original: T o k e n s ( 𝑡 )
Revised: T o k e n s ( 𝑡 )

Original: Perturbed Video ( 𝑥′ )
Revised: Perturbed Video ( 𝑥′ )

Original: Multi-head Self-attention
Revised: Multi-head Self-attention

Original: Feed-forward network 𝑥 𝑥′
Revised: Feed-forward network 𝑥 𝑥′

Original: TimesFormer 𝑥 𝑥′
Revised: TimesFormer 𝑥 𝑥′

Original: ResNet3D 𝑥 𝑥′
Revised: ResNet3D 𝑥 𝑥′

Original: BiT
Revised: BiT

Original: Crawling
Revised: Crawling

Original: Jumping
Revised: Jumping

Original: Crawling
Revised: Crawling

Original: Playing
Revised: Playing

Original: Baby
Revised: Baby

Original: Whale
Revised: Whale

Original: Attack
Revised: Attack

Original: S p a t i a l h e a d
Revised: S p a t i a l h e a d

Original: T e m p o r a l h e a dadversarial attacks.
Revised: T e m p o r a l h e a d attacks.

Original:  with 3D convolutions (Tran et al., 2018), space-time divided attention (Bertasius et al., 2021) or even multi-branch models (Su et al., 2015).
Revised: information during the attack (Sec. 2.1) and does not depend on specialized video networks e.g. , with 3D convolutions (Tran et al., 2018), space-time divided attention (Bertasius et al., 2021) or even multi-branch models (Su et al., 2015).

Original: To this end, we first introduce temporal prompt adaptation of image models to learn dynamic cues on videos or multi-view information on rendered views of a 3D object, as explained next.
Revised: To this end, we first introduce temporal prompt adaptation of image models to learn dynamic cues on videos or multi-view information on rendered views of a 3D object, as explained next.

Original: 2. I NTRODUCING D YNAMIC C UES THROUGH T EMPORAL P ROMPTS
Revised: 2. I NTRODUCING D YNAMIC C UES THROUGH T EMPORAL P ROMPTS

Original: Preliminaries: We consider an image model F pre-trained on the input samples x of size c × h × w , where c, h and w represent the color channels, height and width, respectively.
Revised: Preliminaries: We consider an image model F pre-trained on the input samples x of size c × h × w , where c, h and w represent the color channels, height and width, respectively.

Original: We consider Vision
Revised: We consider Vision

Original: Transformers (ViTs) (Dosovitskiy et al., 2020; Touvron et al., 2020) sequentially composed of n Transformer blocks comprising of multi-head self-attention (MHSA) and feed-forward layer
Revised: Transformers (ViTs) (Dosovitskiy et al., 2020; Touvron et al., 2020) sequentially composed of n Transformer blocks comprising of multi-head self-attention (MHSA) and feed-forward layer

Original: Dosovitskiy et al.
Revised: Dosovitskiy et al.

Original: i.e. F = ( f 1 ◦ f 2 ◦ f 3 ◦ . . .
Revised: i.e. F = ( f 1 ◦ f 2 ◦ f 3 ◦ . . .

Original: f n ) , where f i represents a single Transformer block.
Revised: f n ) , where f i represents a single Transformer block.

Original: ViTs divide an input sample x into N patches also called patch tokens, P t ∈ R N × D , where D is the patch dimension.
Revised: ViTs divide an input sample x into N patches also called patch tokens, P t ∈ R N × D , where D is the patch dimension.

Original: A class token 1 , I cls ∈ R 1 × D , is usually combined with these patch tokens within these image models (Dosovitskiy et al., 2020; Caron et al., 2021; Radford et al., 2021).
Revised: A class token 1 , I cls ∈ R 1 × D , is usually combined with these patch tokens within these image models (Dosovitskiy et al., 2020; Caron et al., 2021; Radford et al., 2021).

Original: We refer to these patch and class tokens collectively as ‘ spatial tokens ’ (Fig. 1).
Revised: We refer to these patch and class tokens collectively as ‘ spatial tokens ’ (Fig. 1).

Original: These tokens are then processed by the model F to produce an output of the same size as of input i.e. F ( x ) ∈ R ( N +1)
Revised: These tokens are then processed by the model F to produce an output of the same size as of input i.e. F ( x ) ∈ R ( N +1)

Original: × D .
Revised: × D .

Original: In the case of image classification, the refined class token ( ˜ I cls ) is extracted from the model output and processed by MLP ( g s ), named spatial head (Fig. 1).
Revised: In the case of image classification, the refined class token ( ˜ I cls ) is extracted from the model output and processed by MLP ( g s ), named spatial head (Fig. 1).

Original: It maps the refined class token from R 1 × D to R 1 × C s , where C s represents the number of image class categories.
Revised: It maps the refined class token from R 1 × D to R 1 × C s , where C s represents the number of image class categories.

Original: Motivation: The spatial class token in image models, I cls , is never optimized for temporal information.
Revised: Motivation: The spatial class token in image models, I cls , is never optimized for temporal information.

Original: Our objective is to adapt the pre-trained and frozen image model for videos or multi-views by training a temporal class token
Revised: Our objective is to adapt the pre-trained and frozen image model for videos or multi-views by training a temporal class token

Original: I tcls ∈ R 1 × D that is optimal for input samples of size t × c
Revised: I tcls ∈ R 1 × D that is optimal for input samples of size t × c

Original: × h × w , where t represents the number of temporal frames in a video or rendered views of a 3D object.
Revised: × h × w , where t represents the number of temporal frames in a video or rendered views of a 3D object.

Original: We optimize the temporal token through MLP ( g t ), named temporal head (Fig. 1).
Revised: We optimize the temporal token through MLP ( g t ), named temporal head (Fig. 1).

Original: It maps the temporal token from R 1 × D to R 1 × C t , where C t represents the number of video action categories.
Revised: It maps the temporal token from R 1 × D to R 1 × C t , where C t represents the number of video action categories.

Original: A trivial way is to concatenate all the additional frames of a video to generate t × N patch tokens which can then be combined with the temporal token before forwadpass through the image model.
Revised: A trivial way is to concatenate all the additional frames of a video to generate t × N patch tokens which can then be combined with the temporal token before forwadpass through the image model.

Original: We can then optimize temporal class token I tcls and temporal head ( g t ) for video classification and incorporate the dynamic cues within a frozen image model.
Revised: We can then optimize temporal class token I tcls and temporal head ( g t ) for video classification and incorporate the dynamic cues within a frozen image model.

Original: This approach, however, has a drawback as the computational time complexity increases significantly to O (cid:0) ( t × N ) 2 × D (cid:1) within the self-attention layers of ViTs.
Revised: This approach, however, has a drawback as the computational time complexity increases significantly to O (cid:0) ( t × N ) 2 × D (cid:1) within the self-attention layers of ViTs.

Original: Another naive way is to either apply temporal pooling to convert t × N to only N spatial tokens or approximate a video via a single frame that is t i × c
Revised: Another naive way is to either apply temporal pooling to convert t × N to only N spatial tokens or approximate a video via a single frame that is t i × c

Original: ×
Revised: ×

Original: h × w , where t i corresponds to a randomly sampled frame from the input video.
Revised: h × w , where t i corresponds to a randomly sampled frame from the input video.

Original: These approaches are however sub-optimal as we are unable to optimize for motion dynamics available from different video frames.
Revised: These approaches are however sub-optimal as we are unable to optimize for motion dynamics available from different video frames.

Original: We induce the temporal information within image models without increasing the quadratic complexity within self-attention of a Vision Transformer.
Revised: We induce the temporal information within image models without increasing the quadratic complexity within self-attention of a Vision Transformer.

Original: We achieve this by representing a given video by a randomly sampled frame while at the same time each frame in a video is modeled via a temporal prompt of size R 1 × D .
Revised: We achieve this by representing a given video by a randomly sampled frame while at the same time each frame in a video is modeled via a temporal prompt of size R 1 × D .

Original: The temporal prompts for different frames in a videos are generated through our transformation T .
Revised: The temporal prompts for different frames in a videos are generated through our transformation T .

Original: Therefore, we only train transformation T , temporal class token I tcls and head g t to learn motion dynamics within pre-trained and frozen image models.
Revised: Therefore, we only train transformation T , temporal class token I tcls and head g t to learn motion dynamics within pre-trained and frozen image models.

Original: Our approach preserves the original image or spatial representation encoded within spatial class token I cls (Table 5).
Revised: Our approach preserves the original image or spatial representation encoded within spatial class token I cls (Table 5).

Original: Both spatial and temporal tokens, I cls and I tcls , are then used within our attack approach (Sec. 2.2).
Revised: Both spatial and temporal tokens, I cls and I tcls , are then used within our attack approach (Sec. 2.2).

Original: 2.1. T EMPORAL P ROMPTS THROUGH T RANSFORMATION
Revised: 2.1. T EMPORAL P ROMPTS THROUGH T RANSFORMATION

Original: As mentioned above, the transformation T processes a video with t number of temporal frames and produces only t temporal prompts (Fig. 1).
Revised: As mentioned above, the transformation T processes a video with t number of temporal frames and produces only t temporal prompts (Fig. 1).

Original: A video sample, x , is divided into patch tokens such that x ∈ R t × N × D .
Revised: A video sample, x , is divided into patch tokens such that x ∈ R t × N × D .

Original: The transformation T is a single self-attention layer (Dosovitskiy et al., 2020) that interacts between the tokens and learns the relationship between the video frames.
Revised: The transformation T is a single self-attention block (Dosovitskiy et al., 2020) that interacts between the tokens and learns the relationship between the video frames.

Original: The transformation output is then pooled across spatial dimension N to produce t temporal tokens
Revised: The transformation output is then pooled across spatial dimension N to produce t temporal tokens

Original: i.e. , T ( x ) ∈ R t × D .
Revised: i.e. , T ( x ) ∈ R t × D .

Original: Attacking such temporal tokens allows finding adversarial patterns capable of fooling the dynamic cues learned by the unknown black-box video model.
Revised: Attacking such temporal tokens allows finding adversarial patterns capable of fooling the dynamic cues learned by the unknown black-box video model.

Original: Mimicking dynamic behavior on image datasets: Image samples are static and have no temporal dimension.
Revised: Mimicking dynamic behavior on image datasets: Image samples are static and have no temporal dimension.

Original: So we adopt a simple strategy to mimic changing behavior for such static data.
Revised: So we adopt a simple strategy to mimic changing behavior for such static data.

Original: We consider images at different spatial scales to obtain a scale-space (Fig. 2) and model temporal prompts for image datasets.
Revised: We consider images at different spatial scales to obtain a scale-space (Fig. 2) and learn prompts for different spatial scales.

Original: The dynamic cues within image models not only boost transferability of the existing adversarial attacks from image-to-video models but also increase the attack success rate in the black-box image models (Sec. 3).
Revised: The dynamic cues within image models not only boost transferability of the existing adversarial attacks from image-to-video models but also increase the attack success rate in the black-box image models (Sec. 3).

Original: 2.1. I MAGE M ODELS WITH T EMPORAL AND S PATIAL P ROMPTS
Revised: 2.1. I MAGE M ODELS WITH T EMPORAL AND S PATIAL P ROMPTS

Original: Our approach is motivated by the shallow prompt transfer learning
Revised: Our approach is motivated by the shallow prompt transfer learning

Original: (Jia et al., 2022).
Revised: (Jia et al., 2022).

Original: As discussed above, we divide a given a video x into video patches such that x ∈ R t × N × D .
Revised: As discussed above, we divide a given a video x into video patches such that x ∈ R t × N × D .

Original: These video patches are processed by our transformation to produce temporal tokens
Revised: These video patches are processed by our transformation to produce temporal tokens

Original: i.e. T ( x ) ∈ R t × D .
Revised: i.e. T ( x ) ∈ R t × D .

Original: Further, we randomly sample a single frame x i ∼ x and divide it into patch tokens such that x i ∈ R N × D .
Revised: Further, we randomly sample a single frame x i ∼ x and divide it into patch tokens such that x i ∈ R N × D .

Original: These single frame tokens are then concatenated with the temporal prompts generated by T ( x ) , a temporal class token I tcls , and the image class token I cls to equip the pre-trained image representation of a model F with discriminative temporal information.
Revised: These single frame tokens are then concatenated with the temporal prompts generated by T ( x ) , a temporal class token I tcls , and the image class token I cls to equip the pre-trained image representation of a model F with discriminative temporal information.

Original: [Equation]
Revised: [Equation]

Original: After the forwardpass through the image model (Eq. 1), we extract the refined temporal class token and temporal prompts from the model’s output.
Revised: After the forwardpass through the image model (Eq. 1), we extract the refined temporal class token and temporal prompts from the model’s output.

Original: The average of these refined temporal class tokens, and t temporal prompts is then projected through the temporal head g t for the new  classification task.
Revised: The average of these refined temporal class tokens, and t temporal prompts is then projected through the temporal head g t for the new video classification task.

Original: For the sake of brevity, we will refer to the average of our refined temporal class and prompts tokens collectively as ˜ I tpcls .
Revised: For the sake of brevity, we will refer to the average of our refined temporal class and prompts tokens collectively as ˜ I tpcls .

Original: During backpass, we only update the parameters of our transformation, temporal class token and temporal head (Fig. 1).
Revised: During backpass, we only update the parameters of our transformation, temporal class token and temporal head (Fig. 1).

Original: Training:
Revised: Training:

Original: Given a pre-trained ViT, we freeze all of its existing weights and insert our learnable transformation ( T ), temporal class token I tcls , and video-specific temporal head.
Revised: Given a pre-trained ViT, we freeze all of its existing weights and insert our learnable transformation ( T ), temporal class token I tcls , and video-specific temporal head.

Original: We train for 15 epochs only using SGD optimizer with a learning rate of 0 .
Revised: We train for 15 epochs only using SGD optimizer with a learning rate of 0 .

Original: 005 which is decayed by a factor of 10 after the 11 th and 14 th epoch.
Revised: 005 which is decayed by a factor of 10 after the 11 th and 14 th epoch.

Original: We use batch size of 64 and train on 16 A100 GPUs for large-scale datasets such as Kinetics-400 (Kay et al., 2017) and only 2 A100 GPUs for other small datasets.
Revised: We use batch size of 64 and train on 16 A100 GPUs for large-scale datasets such as Kinetics-400 (Kay et al., 2017) and only 2 A100 GPUs for other small datasets.

Original: We discuss the effect of our temporal prompts on temporal (video) and spatial (image) solutions in Table 5.
Revised: We discuss the effect of our temporal prompts on temporal (video) and spatial (image) solutions in Table 5.

Original: Our method mostly retains the original image solution captured in image class token I cls while exhibiting dynamic temporal modeling.
Revised: Our method mostly retains the original image solution captured in image class token I cls while exhibiting dynamic temporal modeling.

Original: 2. T RANSFERABLE A TTACK USING S PATIAL AND T EMPORAL C UES
Revised: 2. T RANSFERABLE A TTACK USING S PATIAL AND T EMPORAL C UES

Original: Given an image model F adapted for motion dynamics via our approach (Fig. 1), our attack exploits the spatial and temporal cues to generate transferable perturbations for both image and video models.
Revised: Given an image model F adapted for motion dynamics via our approach (Fig. 1), our attack exploits the spatial and temporal cues to generate transferable perturbations for both image and video models.

Original: • Given a video and its corresponding label: Our attack uses the refined temporal class tokens ˜
Revised: • Given a video and its corresponding label: Our attack uses the refined temporal class token ˜

Original: I tpcls output by the model in a supervised manner, while the spatial class token˜
Revised: I tpcls output by the model in a supervised manner, while the spatial class token

Original:  I cls serves in an self-supervised objective.
Revised: ˜ I cls serves in an self-supervised objective.

Original: • Given an image and its corresponding label: Our attack uses the refinedtemporal class tokens
Revised: • Given an image and its corresponding label: Our attack uses the refined class tokens

Original: ˜ I tpcls learned at different resolutions to mimic the dynamic behavior from images in a 
Revised: ˜ I tpcls learned at different resolutions to mimic the dynamic behavior from images in a supervised manner

Original: supervised manner, while the spatial class token ˜ I cls serves in an self-supervised objective.
Revised: , while the spatial class token ˜ I cls serves in an self-supervised objective.

Original: We generate an adversarial example x ′ for a video or image sample x using the following objective:
Revised: We generate an adversarial example x ′ for a video or image sample x using the following objective:

Original: [Equation]
Revised: [Equation]

Original: x′ such that F
Revised: x

Original: [Equation]
Revised: [Equation]

Original: x ′ [Equation] argmax
Revised: F

Original: [Equation]
Revised: [Equation]

Original: where y is the original label and ϵ represents a maximum perturbation budget within a norm distance p .
Revised: where y is the original label and ϵ represents a maximum perturbation budget within a norm distance p .

Original: We optimize Eq. 2 by maximizing the loss objective in Eq.
Revised: We optimize Eq. 2 by maximizing the loss objective in Eq.

Original: 3 within existing adversarial attacks.
Revised: 3 within existing adversarial attacks.

Original: [Equation]
Revised: [Equation]

Original: where L s is a supervised loss function.
Revised: where L s is a supervised loss function.

Original: It uses the labels of a given image/video through supervised
Revised: It uses the labels of a given image/video through supervised

Original: MLP head.
Revised: MLP head.

Original: L s can be optimized by any of the existing supervised losses proposed in transferable attacks literature; cross-entropy (Dong et al., 2018), relativistic cross-entropy (Naseer et al., 2019), or logit loss (Zhao et al., 2021).
Revised: L s can be optimized by any of the existing supervised losses proposed in transferable attacks literature; cross-entropy (Dong et al., 2018), relativistic cross-entropy (Naseer et al., 2019), or logit loss (Zhao et al., 2021).

Original: Unless otherwise mentioned, we use cross-entropy loss to demonstrate the effectiveness of our approach.
Revised: Unless otherwise mentioned, we use cross-entropy loss to demonstrate the effectiveness of our approach.

Original: Similarly, L ss is self-supervised loss that exploits pre-trained representation within spatial class tokens.
Revised: Similarly, L ss is self-supervised loss that exploits pre-trained representation within spatial class tokens.

Original: We minimize the cosine similarity between the refined class tokens of clean and adversarial samples.
Revised: We minimize the cosine similarity between the refined class tokens of clean and adversarial samples.

Original: Specifically, we define L s and L ss as follows:
Revised: Specifically, we define L s and L ss as follows:

Original: [Equation]
Revised: [Equation]

Original: [Table]
Revised: [Table]

Original: In this manner, any of the existing attacks can be combined with our approach to transfer adversarial perturbations as we demonstrate in Sec. 3.
Revised: In this manner, any of the existing attacks can be combined with our approach to transfer adversarial perturbations as we demonstrate in Sec. 3.

Original: 2.2. C HANGING S PATIAL R ESOLUTION FOR R EGULARIZATION
Revised: 2.2. C HANGING S PATIAL R ESOLUTION FOR R EGULARIZATION

Original: An adversarial attack can easily overfit the source models meaning it can have a 100% success rate on the source model but mostly fails to fool the unknown black-box model.
Revised: An adversarial attack can easily overfit the source models meaning it can have a 100% success rate on the source model but mostly fails to fool the unknown black-box model.

Original: Different heuristics like adding momentum (Dong et al., 2018; Lin et al., 2019; Wang & He, 2021), augmentations (Naseer et al., 2021; Xie et al., 2019), ensemble of different models (Dong et al., 2018) or even self-ensemble (Naseer et al., 2022) at a target resolution are proposed to reduce such overfitting and increase adversarial transferability.
Revised: Different heuristics like adding momentum (Dong et al., 2018; Lin et al., 2019; Wang & He, 2021), augmentations (Naseer et al., 2021; Xie et al., 2019), ensemble of different models (Dong et al., 2018) or even self-ensemble (Naseer et al., 2022b) at a target resolution are proposed to reduce such overfitting and increase adversarial transferability.

Original: Low-resolution pre
Revised: Low-resolution pre

Original: -training followed by high-resolution fine-tuning have a regularization effect on the generalization of neural networks (Touvron et al., 2022).
Revised: -training followed by high-resolution fine-tuning have a regularization effect on the generalization of neural networks (Touvron et al., 2022).

Original: Similarly, we observe that fine-tuning temporal promptsfor motion dynamics at  low resolution (e g., 96 × 96) within a model pre-trained on high resolution (224 × 224) also has a complimentary regularization effect on the transferability of adversarial perturbations (Tables 3 and 4).
Revised: Similarly, we observe that fine-tuning scale-space prompts at different low resolutions (e g., 96 × 96) within a model pre-trained on high resolution (224 × 224) also has a complimentary regularization effect on the transferability of adversarial perturbations (Tables 3 and 4).

Original: Most publicly available image models are trained at a resolution of size 224 × 224 and their performance at low-resolution inputs is sub-optimal (Fig. 2).
Revised: Most publicly available image models are trained at a resolution of size 224 × 224 and their performance at low-resolution inputs is sub-optimal (Fig. 2).

Original: Learning at low-resolution with our approach (Fig. 1) also allows to mimic a changing scene over time from static datasets like ImageNet (Fig. 2).
Revised: Learning at low-resolution with our approach (Fig. 1) also allows to mimic a changing scene over time from static datasets like ImageNet (Fig. 2).

Original: Our low-resolution temporal prompts (Sec. 2.1) significantly improves generalization at low-resolution inputs (Fig. 2).
Revised: Our low-resolution scale-space prompts (Sec. 2.1) significantly improves generalization at low-resolution inputs (Fig. 2).

Original:  E XPERIMENTS
Revised:  E XPERIMENTS

Original: We generate l ∞ adversarial examples from the adapted image models and study their transferability to video and image models.
Revised: We generate l ∞ adversarial examples from the adapted image models and study their transferability to video and image models.

Original: We followed standard adversarial transferability protocol Dong et al.
Revised: We followed standard adversarial transferability protocol Dong et al.

Original: (2018); Naseer et al. 
Revised: ; Naseer et al. (2022b)

Original: ; the attacker is unaware of the black-box video model but has access to its train data.
Revised: ; the attacker is unaware of the black-box video model but has access to its train data.

Original: Our temporal cues also boost cross-task adversarial transferability with no access
Revised: Our temporal cues also boost cross-task adversarial transferability with no access

Original: [Table]
Revised: [Table]

Original: to the black-box video model, its training data, or label space ( Appendix B).
Revised: to the black-box video model, its training data, or label space ( Appendix B).

Original: The maximum pixel perturbation is set to ϵ ≤ 16 for pixel range of [0, 255].
Revised: The maximum pixel perturbation is set to ϵ ≤ 16 for pixel range of [0, 255].

Original: We use standard image attacks to optimize adversarial examples through our adapted image models and boost adversarial transferability to video models by using the following protocols:
Revised: We use standard image attacks to optimize adversarial examples through our adapted image models and boost adversarial transferability to video models by using the following protocols:

Original: Surrogate image models: We optimize adversaries from the known surrogate models.
Revised: Surrogate image models: We optimize adversaries from the known surrogate models.

Original: We study three types of surrogate image models trained via supervised (Touvron et al., 2020), self-supervised (Caron et al., 2021) and text-supervised (Radford et al., 2021) models.
Revised: We study three types of surrogate image models trained via supervised (Touvron et al., 2020), self-supervised (Caron et al., 2021) and text-supervised (Radford et al., 2021) models.

Original: − Supervised image models: We use Deit-T, DeiT-S, and DeiT-B with 5, 22, and 86 million parameters to video datasets.
Revised: − Supervised image models: We use Deit-T, DeiT-S, and DeiT-B with 5, 22, and 86 million parameters to video datasets.

Original: These models are pre-trained in a supervised manner on ImageNet.
Revised: These models are pre-trained in a supervised manner on ImageNet.

Original: − Self-Supervised image model: We use Vision Transformer trained in self-supervised fashion on ImageNet using DINO training framework (Caron et al., 2021).
Revised: − Self-Supervised image model: We use Vision Transformer trained in self-supervised fashion on ImageNet using DINO training framework (Caron et al., 2021).

Original: − Text-Supervised image model: We adapt CLIP image encoder only trained on text-guided images.
Revised: − Text-Supervised image model: We adapt CLIP image encoder only trained on text-guided images.

Original: DeiT-B, DINO, and CLIP share the same network based on Vision Transformer.
Revised: DeiT-B, DINO, and CLIP share the same network based on Vision Transformer.

Original: These
Revised: These

Original: models process images ofsize
Revised: models process images of

Original:  3 × 224 × 224 that are divided into 196 patches with a patch size of 16.
Revised: size 3 × 224 × 224 that are divided into 196 patches with a patch size of 16.

Original: Each of these patch tokens has 768 embedding dimensions.
Revised: Each of these patch tokens has 768 embedding dimensions.

Original: Thus, the only difference between these models lies in their corresponding training frameworks.
Revised: Thus, the only difference between these models lies in their corresponding training frameworks.

Original: These models are adapted to different video datasets.
Revised: These models are adapted to different video datasets.

Original: Adversarial examples are then simply created using existing single and multi-step attacks (Goodfellow et al., 2014; Madry et al., 2018;
Revised: Adversarial examples are then simply created using existing single and multi-step attacks (Goodfellow et al., 2014; Madry et al., 2018;

Original: Dong et al., 2018; Xie et al., 2019).
Revised: Dong et al., 2018; Xie et al., 2019).

Original: Target video and image models: We transfer adversarial examples to unknown (black-box) video and image models.
Revised: Target video and image models: We transfer adversarial examples to unknown (black-box) video and image models.

Original: − Target Video Models: We consider recently proposed
Revised: − Target Video Models: We consider recently proposed

Original: TimesFormer
Revised: TimesFormer

Original: (Bertasius et al., 2021) with divided space-time attention, 3D convolutional network (Tran et al., 2018), and multi-view convolutional network (Su et al., 2015).
Revised: (Bertasius et al., 2021) with divided space-time attention, 3D convolutional network (Tran et al., 2018), and multi-view convolutional network (Su et al., 2015).

Original: − Target Image Models:
Revised: − Target Image Models:

Original: We consider the same image models used in baseline by (Naseer et al., 2022): BiT-ResNet50 (BiT50) (Beyer et al.,
Revised: We consider the same image models used in baseline by (Naseer et al., 2022b): BiT-ResNet50 (BiT50) (Beyer et al.,

Original: [Table] [Table]
Revised: [Table] [Table]

Original: , ResNet152 (Res152) (He et al., 2016), Wide-ResNet-50-2 (WRN) (Zagoruyko & Komodakis, 2016), DenseNet201 (DN201) (Huang et al., 2017) and other ViT models including Token-to-Token transformer (T2T) (Yuan et al., 2021), Transformer in Transformer (TnT) (Mao et al., 2021).
Revised: (He et al., 2016), Wide-ResNet-50-2 (WRN) (Zagoruyko & Komodakis, 2016), DenseNet201 (DN201) (Huang et al., 2017) and other ViT models including Token-to-Token transformer (T2T) (Yuan et al., 2021), Transformer in Transformer (TnT) (Mao et al., 2021).

Original: Adapting image models for videos using dynamic cues: We use UCF (Soomro et al., 2012),
Revised: Adapting image models for videos using dynamic cues: We use UCF (Soomro et al., 2012),

Original: HMDB (Kuehne et al., 2011), K400 (Kay et al., 2017), and SSv2 (Goyal et al., 2017) training sets to learn temporal prompts and adapt image models to videos via our approach (Fig.1).
Revised: HMDB (Kuehne et al., 2011), K400 (Kay et al., 2017), and SSv2 (Goyal et al., 2017) training sets to learn temporal prompts and adapt image models to videos via our approach (Fig.1).

Original: HMDB has the smallest validation set of 1.5k samples.
Revised: HMDB has the smallest validation set of 1.5k samples.

Original: For evaluating robustness, we selected all validation samples in HMDB, while randomly selected 1.5k samples from UCF, K400, and SSv2 validation sets.
Revised: For evaluating robustness, we selected all validation samples in HMDB, while randomly selected 1.5k samples from UCF, K400, and SSv2 validation sets.

Original: We also use mult-view training samples rendered for 3D ModelNet40 (depth and shaded) for image models.
Revised: We also use multi-view training samples rendered for 3D ModelNet40 (depth and shaded) for image models.

Original: We use validation samples of rendered mult-views for both modalities.
Revised: We use validation samples of rendered multi-views for both modalities.

Original: Adapting image models to images mimicking dynamic cues: We use ImageNet training set and learn our proposed transformation and prompts at multiple spatial scales; 56 × 56, 96 × 96, 120 × 120, and 224 × 224.
Revised: Adapting image models to images mimicking dynamic cues: We use ImageNet training set and learn our proposed transformation and prompts at multiple spatial scales; 56 × 56, 96 × 96, 120 × 120, and 224 × 224.

Original: We optimize adversarial attacks at the target resolution of 224 × 224 by using the ensemble of ourtransformation learned  at multiple resolutions.
Revised: We optimize adversarial attacks at the target resolution of 224 × 224 by using the ensemble of our learned models at multiple resolutions.

Original: We mimic the change over time by changing the spatial scale or resolution over time.
Revised: In this manner, our approach mimic the change over time by changing the spatial scale or resolution over time.

Original: We study our attack approach using the 5k samples from ImageNet validation set proposed by (Naseer et al., 2022).
Revised: We study our attack approach using the 5k samples from ImageNet validation set proposed by (Naseer et al., 2022b).

Original: Inference and metrics: We randomly sample 8 frames from a given video for testing.
Revised: Inference and metrics: We randomly sample 8 frames from a given video for testing.

Original: We report drop in top-1 (%) accuracy on adversarial and clean videos.
Revised: We report drop in top-1 (%) accuracy on adversarial and clean videos.

Original: We report fooling rate (% of adversarial samples for which the predicted label is flipped w.r.t the original labels) to evaluate on image datasets.
Revised: We report fooling rate (%) of adversarial samples for which the predicted label is flipped w.r.t the original labels) to evaluate on image datasets.

Original: Extending image attacks to videos: We apply image attacks such as single step fast gradient sign method (FGSM)
Revised: Extending image attacks to videos: We apply image attacks such as single step fast gradient sign method (FGSM)

Original: (Goodfellow et al., 2014) as well as iterative attacks  including PGD (Madry et al., 2018), MIM (Dong et al., 2018) and input diversity (augmentations to the inputs) (DIM) (Xie et al., 2019) attacks to adapted image models and transfer their adversarial perturbations to black-box video models.
Revised: (Goodfellow et al., 2014) as well as iterative attacks with twenty iterations including PGD (Madry et al., 2018), MIM (Dong et al., 2018) and input diversity (augmentations to the inputs) (DIM) (Xie et al., 2019) attacks to adapted image models and transfer their adversarial perturbations to black-box video models.

Original: We follow thedefault attack settings used by (Naseer et al., 2022).
Revised: We follow the attack settings used by (Naseer et al., 2022b).

Original: Our propose transformation ( T ( . ) ) allows to model temporal gradients during attack optimization (Fig. 3).
Revised: Our proposed transformation ( T ( . ) ) allows to model temporal gradients during attack optimization (Fig. 3).

Original: We simply aggregates the gradients from both branches of our model to the input video frames.
Revised: We simply aggregates the gradients from both branches of our model to the input video frames (Fig. 1).

Original: 3. A DVERSARIAL T RANSFER FROM I MAGE - TO -V IDEO M ODELS
Revised: 3. A DVERSARIAL T RANSFER FROM I MAGE - TO -V IDEO M ODELS

Original: The generalization of image models on videos is discussed in Table 5.
Revised: The generalization of image models on videos is discussed in Table 5.

Original: We observe that image solution remains preserved in ViT backbones even after training with our proposed transformation and temporal prompts.
Revised: We observe that image solution remains preserved in ViT backbones even after training with our proposed transformation and temporal prompts.

Original: Deit models retain their top-1 (%) accuracy on ImageNet when measured through image class token, while also exhibiting decent performance on video datasets and rendered mulit-views of ModelNet40.
Revised: Deit models retain their top-1 (%) accuracy on ImageNet when measured through image class token, while also exhibiting decent performance on video datasets and rendered mulit-views of ModelNet40.

Original: CLIP achieves the best performance on videos.
Revised: CLIP achieves the best performance on videos.

Original: The transferability of image based attacks from our adapted image models to video and multi-view models is presented in
Revised: The transferability of image based attacks from our adapted image models to video and multi-view models is presented in

Original: Tables 1 and 2.
Revised: Tables 1 and 2.

Original: Following insights emerges from our analysis: a) The attack success to video models increases with size of the image models.
Revised: Following insights emerges from our analysis: a) The attack success to video models increases with size of the image models.

Original: The larger the image model ( e.g. Deit-T to DeiT-B)
Revised: The larger the image model ( e.g. Deit-T to DeiT-B)

Original: the
Revised: the

Original: [Figure] [Table]
Revised: [Table] [Table]

Original: [Table]
Revised: [Table]

Original: higher the attack success, b)
Revised: higher the attack success, b)

Original: The adversarial perturbations generated using self-supervised DINO transfer better than CLIP or supervised Deit-B, c) Divided space-time attention is more robust than 3D convolution, and d) MVCNN trained on shaded rendered views is more robust than depth.
Revised: The adversarial perturbations generated using self-supervised DINO transfer better than CLIP or supervised Deit-B, c) Divided space-time attention is more robust than 3D convolution, and d) MVCNN trained on shaded rendered views is more robust than depth.

Original: 3.1. E NSEMBLE A DVERSARIAL T RANSFER
Revised: 3.1. E NSEMBLE A DVERSARIAL T RANSFER

Original: Adversarial attacks optimized from an ensemble of models (Dong et al., 2018; Xie et al., 2019) or self-ensemble (Naseer et al., 2022) increases transferability.
Revised: Adversarial attacks optimized from an ensemble of models (Dong et al., 2018; Xie et al., 2019) or self-ensemble (Naseer et al., 2022b) increases transferability.

Original: We study three types of image ensembles:

Original: −

Original:  Ensemble of Different Networks: We transfer attack from three image models of the Deit family (Touvron et al., 2020) including Deit-T, Deit-S and Deit-B. These models differ in architecture. − Ensemble of Different Training Frameworks: We transfer attack from three image models including 
Revised: We study three types of image ensembles including a) Ensemble of Different Networks: We transfer attack from three image models of the Deit family (Touvron et al., 2020) including Deit-T, Deit-S and Deit-B. These models differ in architecture, b) Ensemble of Different Training Frameworks: We transfer attack from three image models including Deit-B, DINO and CLIP.

Original: Deit-B, DINO and CLIP.

Original: These models share similar architecture but differ in their training. − Ensemble of Different Spatial Resolutions: We transfer attack from three image models with the same architecture (Deit-B) but prompt adapted to different spatial resolutions via our approach.
Revised: These models share similar architecture but differ in their training, and c) Ensemble of Different Spatial Resolutions: We transfer attack from three image models with the same architecture (Deit-B) but prompt adapted to different spatial resolutions.

Original: Ensemble of different training frameworks performs favorably to boost attack transferability (Fig. 4).
Revised: Ensemble of different training frameworks performs favorably to boost attack transferability (Fig. 4).

Original: An attacker can adapt our approach at different resolutions to enhance transferability (Table 4).
Revised: An attacker can adapt our approach at different resolutions to enhance transferability (Table 4).

Original: We provide generalization of Deit-B at varying spatial scales for video datasets in Appendix I.
Revised: We provide generalization of Deit-B at varying spatial scales for video datasets in Appendix I.

Original: 3. A DVERSARIAL T RANSFER FROM I MAGE - TO -I MAGE M ODELS
Revised: 3. A DVERSARIAL T RANSFER FROM I MAGE - TO -I MAGE M ODELS

Original: Image datasets are static but we mimic the dynamic behaviour by learning our proposed transformation at different spatial scales (Fig. 2).
Revised: Image datasets are static but we mimic the dynamic behaviour by learning our proposed transformation at different spatial scales (Fig. 2).

Original: Our approach exhibit significant gains in adversarial transferability (Table 3).
Revised: Our approach exhibit significant gains in adversarial transferability (Table 3).

Original: Refer to Appendix J for latent space analysis  of class tokens learned at varying scales.
Revised: Refer to appendices B-J for extensive analysis on cross-task adversarial transferability, textual bias of CLIP on adversarial transferability, visualization of attention roll-outs and latent embeddings, and effect of the number of temporal prompts on adversarial transferability.

Original:  C ONCLUSION
Revised:  C ONCLUSION

Original: In this work, we study the adversarial transferability between models trained for different data modalities ( e.g. , images to videos).
Revised: In this work, we study the adversarial transferability between models trained for different data modalities ( e.g. , images to videos).

Original: We propose a novel approach to introduce dynamic cues within pre-trained (supervised or self-supervised) image models by learning a simple transformation on videos.
Revised: We propose a novel approach to introduce dynamic cues within pre-trained (supervised or self-supervised) image models by learning a simple transformation on videos.

Original: Our transformation enables temporal gradients from image models and boost transferability through temporal prompts.
Revised: Our transformation enables temporal gradients from image models and boost transferability through temporal prompts.

Original: We show how our approach can be extended to multi-view information from 3D objects and varying image resolutions.
Revised: We show how our approach can be extended to multi-view information from 3D objects and varying image resolutions.

Original: Our work brings attention to the image models as universal surrogates to optimize and transfer adversarial attacks to black-box models
Revised: Our work brings attention to the image models as universal surrogates to optimize and transfer adversarial attacks to black-box models.

Original: Reproducibility Statement : Training image models: We adapt pre-trained image models Deit,
Revised: Reproducibility Statement : Training image models: We adapt pre-trained image models Deit,

Original: DINO and CLIP, open sourced by the corresponding authors.
Revised: DINO and CLIP, open sourced by the corresponding authors.

Original: We freeze the weights of these models and adapt them for video datasets by introducing our modifications (transformation with temporal prompts).
Revised: We freeze the weights of these models and adapt them for video datasets by introducing our modifications (transformation with temporal prompts).

Original: We incorporate the adapted models into the open sourced TimesFormer github repo https: //github.com/facebookresearch/TimeSformer and train them with default settings.
Revised: We incorporate the adapted models into the open sourced TimesFormer github repo https: //github.com/facebookresearch/TimeSformer and train them with default settings.

Original: Training video models: We use the TimesFormer github  with  settings to train ResNet3D on
Revised: Training video models: We use the TimesFormer github repo with default settings to train ResNet3D on

Original: , HMDB, K-400, and SSv2.
Revised: UCF, HMDB, K-400, and SSv2.

Original:  We 
Revised: Training MVCNN: We use open source code https://github.

Original: ModelNet
Revised: com/jongchyisu/mvcnn_pytorch to train multi-view models on rendered views (depth, shaded) of ModelNet40.

Original: : We use adversarial attacks with default parameters as described in baseline (Naseer et al., 2022).
Revised: Attacks: We use adversarial attacks with default parameters as described in baseline (Naseer et al., 2022b).

Original: : We use the same 5k image  from ImageNet validation set, open sourced by Naseer et al.
Revised: Datasets: We use the same 5k image samples from ImageNet validation set, open sourced by Naseer et al.

Original: (2022), while randomly selected 1.5k samples from the validation sets of explored video datasets.
Revised: (2022b), while randomly selected 1.5k samples from the validation sets of explored video datasets.

Original: Furthermore, we will releaseindices of these samples along with all the pre-trained models to reproduce the results.
Revised: Furthermore, we will release the pre-trained model publicly.

Original: Ethics Statement : Our work highlights the use of freely available pre-trained image models to generate adversarial attacks.
Revised: Ethics Statement : Our work highlights the use of freely available pre-trained image models to generate adversarial attacks.

Original: This can be used to create attacks on real-world deep learning systems in the short run.
Revised: This can be used to create attacks on real-world deep learning systems in the short run.

Original: Our work also provides insights on how such attack can emerge from different resources.
Revised: Our work also provides insights on how such attack can emerge from different resources.

Original: Therefore, our work provides an opportunity to develop more robust models to defend against such attacks.
Revised: Therefore, our work provides an opportunity to develop more robust models to defend against such attacks.

Original: Further, the image and video datasets used in this work also pose privacy risks which is an important topic we hope to explore in future.
Revised: Further, the image and video datasets used in this work also pose privacy risks which is an important topic we hope to explore in future.

Original: Appendix
Revised: Appendix

Original: Our approach simply augments the existing adversarial attacks developed for image models and enhances their transferability to black-box video models using our proposed temporal cues.
Revised: Our approach simply augments the existing adversarial attacks developed for image models and enhances their transferability to black-box video models using our proposed temporal cues.

Original: We study cross-task adversarial transferability ((Naseer et al., 2019)); the attacker has no access to the black-box video model, its training data, or label space in Appendix B.
Revised: We study cross-task adversarial transferability ((Naseer et al., 2019)); the attacker has no access to the black-box video model, its training data, or label space in Appendix B.

Original: We compare the adversarial transferability of our best image models (DINO (Caron et al., 2021)) with temporal cues against pure video models (TimesFormer Bertasius et al.
Revised: We compare the adversarial transferability of our best image models (DINO (Caron et al., 2021)) with temporal cues against pure video models (TimesFormer Bertasius et al.

Original: (2021), ResNet3D (Tran et al., 2018), and I3D (Carreira & Zisserman, 2017) in Appendix C. We observe that adversarial examples found within adapted
Revised: (2021), ResNet3D (Tran et al., 2018), and I3D (Carreira & Zisserman, 2017) in Appendix C. We observe that adversarial examples found within adapted

Original: CLIP models show lower transferability to image and video models (Tables 1, 2, and 3).
Revised: CLIP models show lower transferability to image and video models (Tables 1, 2, and 3).

Original: We analyze the textual biases of CLIP vision features in Appendix D to further explain the difference between adversarial space of uni-modal and vision-language models such as CLIP.
Revised: We analyze the textual biases of CLIP vision features in Appendix D to further explain the difference between adversarial space of uni-modal and vision-language models such as CLIP.

Original: In Appendix E, we analyze the attention roll-out from our temporal prompts to signify that our prompts pay attention to temporal information across frames as compared to the original image features.
Revised: In Appendix E, we analyze the attention roll-out from our temporal prompts to signify that our prompts pay attention to temporal information across frames as compared to the original image features.

Original: We also observe the behavior of our temporal prompts across shuffled frames in Appendix F.
Revised: We also observe the behavior of our temporal prompts across shuffled frames in Appendix F.

Original: We study the effect of increasing the number of temporal prompts during the attack in Appendix G.
Revised: We study the effect of increasing the number of temporal prompts during the attack in Appendix G.

Original: The effect of fully fine-tuning the image models with our proposed temporal prompts on attack transferability is presented in Appendix
Revised: The effect of fully fine-tuning the image models with our proposed temporal prompts on attack transferability is presented in Appendix

Original: H. The generalization of the image model (Deit-B) at varying spatial scales on video modalities is presented in appendix I. In appendix J, we visualize the latent space of class tokens trained at a spatial resolution of 224 × 224 vs our adapted tokens at various spatial resolution scales.
Revised: H. The generalization of the image model (Deit-B) at varying spatial scales on video modalities is presented in appendix I. In appendix J, we visualize the latent space of class tokens trained at a spatial resolution of 224 × 224 vs our adapted tokens at various spatial resolution scales.

Original: The evolution of adversarial patterns across time generated using our approach is provided in appendix K.
Revised: The evolution of adversarial patterns across time generated using our approach is provided in appendix K.

Original: A R ELATED W ORK
Revised: A R ELATED W ORK

Original: Adversarial Attacks: Transferable adversarial attacks compromise the decision of a black-box target model.
Revised: Adversarial Attacks: Transferable adversarial attacks compromise the decision of a black-box target model.

Original: Attacker can not access weights, model outputs or gradient information of a black-box model.
Revised: Attacker can not access weights, model outputs or gradient information of a black-box model.

Original: These attacks can broadly be categorized into iterative (Goodfellow et al., 2014;
Revised: These attacks can broadly be categorized into iterative (Goodfellow et al., 2014;

Original: Dong et al., 2018;
Revised: Dong et al., 2018;

Original: Lin et al., 2019; Wang & He, 2021; Xie et al., 2019;
Revised: Lin et al., 2019; Wang & He, 2021; Xie et al., 2019;

Original: Zhou et al., 2018; Naseer et al., 2022; Wei et al., 2022) and generative (Poursaeed et al., 2018; Naseer et al., 2019; 2021; Aich et al., 2022) methods.
Revised: Zhou et al., 2018; Naseer et al., 2022b; Wei et al., 2022) and generative (Poursaeed et al., 2018; Naseer et al., 2019; 2021; 2022a) methods.

Original: Iterative attacks optimize adversary from a given clean sample by searching adversarial space of a white-box surrogate model iteratively.
Revised: Iterative attacks optimize adversary from a given clean sample by searching adversarial space of a white-box surrogate model iteratively.

Original: Attacker can access weights, model outputs and gradient information of a white-box surrogate model.
Revised: Attacker can access weights, model outputs and gradient information of a white-box surrogate model.

Original: Generative attacks on the other hand train a universal function (an auto-encoder) against the white-box model over a given data distribution.
Revised: Generative attacks on the other hand train a universal function (an auto-encoder) against the white-box model over a given data distribution.

Original: These attacks can generate adversary via single forward-pass after training.
Revised: These attacks can generate adversary via single forward-pass after training.

Original: Our proposed approach can be augmented with any of these existing attacks to boost transferability from image-to-video or multi-view models.
Revised: Our proposed approach can be augmented with any of these existing attacks to boost transferability from image-to-video or multi-view models.

Original: Prompt Adaptation of Image Models: Prompting refers to providing manual instructions (Liu et al., 2021a; Jiang et al., 2020; Shin et al., 2020) or fine-tuning task-specific tokens (Li & Liang, 2021;
Revised: Prompt Adaptation of Image Models: Prompting refers to providing manual instructions (Liu et al., 2021a; Jiang et al., 2020; Shin et al., 2020) or fine-tuning task-specific tokens (Li & Liang, 2021;

Original: Liu et al., 2021b; Lester et al., 2021) for a desired behavior from large language models ( e.g. ,
Revised: Liu et al., 2021b; Lester et al., 2021) for a desired behavior from large language models ( e.g. ,

Original: GPT-3).
Revised: GPT-3).

Original: Recently, prompt fine-tuning has been studied for vision models with promising results to adapt image models from one image task to another (Jia et al., 2022; Elsayed et al., 2018).
Revised: Recently, prompt fine-tuning has been studied for vision models with promising results to adapt image models from one image task to another (Jia et al., 2022; Elsayed et al., 2018).

Original: We extend prompt transfer learning to adapt image models to videos and multi-view data modalities.
Revised: We extend prompt transfer learning to adapt image models to videos and multi-view data modalities.

Original: We only train a transformation along with a prompt class token to learn dynamic cues and adapt image model to video tasks.
Revised: We only train a transformation along with a prompt class token to learn dynamic cues and adapt image model to video tasks.

Original: Our approach allows transferable attacks from image-to-video or multi-view models.
Revised: Our approach allows transferable attacks from image-to-video or multi-view models.

Original: B D YNAMIC C UES TO BOOST C ROSS -T ASK T RANSFERABILITY
Revised: B D YNAMIC C UES TO BOOST C ROSS -T ASK T RANSFERABILITY

Original: We apply the cross-task attack proposed by Naseer et al.
Revised: We apply the cross-task attack using self-supervised objective (cosine similarity such as described in

Original:  to our surrogate image models with temporal cues and compare the adversarial transferability with pure video surrogate models  in Table 6.
Revised: Eq. 3 in Sec. 2.2) to our surrogate image models with temporal cues and compare the adversarial transferability with pure video surrogate models (I3D (Carreira & Zisserman, 2017), and Timesformer (Bertasius et al., 2021)) in Table 6.

Original: The cross-task attack ((Naseer et al., 2019)) when combined with our approach described in Section 2.2 performs favorably well against the video models.
Revised: The cross-task attack transferability when combined with our approach described in Section 2.2 performs favorably well against the video models.

Original: This is contributed to the fact that the attack exploits an ensemble of two different representations (image and video) when combined with our adapted image models.
Revised: This is contributed to the fact that the attack exploits an ensemble of two different representations (image and video) when combined with our adapted image models.

Original: Therefore our approach frees the attacker from having access to a specialized video architecture trained specifically on the video to generate more transferable attacks.
Revised: Therefore our approach frees the attacker from having access to a specialized video architecture trained specifically on the video to generate more transferable attacks.

Original: [Table]
Revised: [Table]

Original: [Table]
Revised: [Table]

Original: Generalizationof Video Models
Revised: Generalization

Original: [Table]
Revised: [Table]

Original: C I MAGE V S . V IDEO S URROGATE M ODELS
Revised: C I MAGE V S . V IDEO S URROGATE M ODELS

Original: The attack transferability of our image models with dynamic cues is compared against pure video models (TimesFormer Bertasius et al. (2021), ResNet3D (Tran et al., 2018)
Revised: The attack transferability of our image models with dynamic cues is compared against pure video models (TimesFormer (Bertasius et al., 2021), ResNet3D (Tran et al., 2018)

Original: [Table]
Revised: [Table]

Original: and I3D (Carreira &
Revised: and I3D (Carreira &

Original: Zisserman, 2017)) in Table 7.
Revised: Zisserman, 2017)) in Table 7.

Original: The generalization (top-1 % accuracies) of the video models (Table 8) is higher than our adapted image models (Table 5).
Revised: The generalization (top-1 % accuracies) of the video models (Table 8) is higher than our adapted image models (Table 5).

Original: This is expected as video models are specifically designed and trained from scratch on the video datasets.
Revised: This is expected as video models are specifically designed and trained from scratch on the video datasets.

Original: However, the adversarial transferability of our image models compares well against these pure video models (Table 7).
Revised: However, the adversarial transferability of our image models compares well against these pure video models (Table 7).

Original: Our approach enables the attacker to exploit image and video solution from the same image model while pure video models lack the image representation.
Revised: Our approach enables the attacker to exploit image and video solution from the same image model while pure video models lack the image representation.

Original: D A NALYSING CLIP
Revised: D A NALYSING CLIP

Original: Vision-language models like CLIP consists of an image and a text encoder and are trained on largescale image-text pairs to find common feature space between images and textual labels.
Revised: Vision-language models like CLIP consists of an image and a text encoder and are trained on largescale image-text pairs to find common feature space between images and textual labels.

Original: Inherently visual features of CLIP are aliened with text.
Revised: Inherently visual features of CLIP are aliened with text.

Original: Our results indicate that adversarial perturbations
Revised: Our results indicate that adversarial perturbations

Original: [Figure]
Revised: [Figure]

Original: found via the CLIP vision encoder show lower transferability as compared to similar models such as DINO (Caron et al., 2021) and Deit-B (Touvron et al., 2020).
Revised: found via the CLIP vision encoder show lower transferability as compared to similar models such as DINO (Caron et al., 2021) and Deit-B (Touvron et al., 2020).

Original: The alignment of CLIP vision features towards text results into adversaries with textual bias.
Revised: The alignment of CLIP vision features towards text results into adversaries with textual bias.

Original: We can see textual patterns emerging within adversarial perturbations (Fig. 5).
Revised: We can see textual patterns emerging within adversarial perturbations (Fig. 5).

Original: These perturbations are optimal to fool CLIP but not that meaningful for vision models trained without text supervision.
Revised: These perturbations are optimal to fool CLIP but not that meaningful for vision models trained without text supervision.

Original: We quantify this as well by measuring cosine similarly between visual features of CLIP vision encoder, DINO, and Deit-B with CLIP
Revised: We quantify this as well by measuring cosine similarly between visual features of CLIP vision encoder, DINO, and Deit-B with CLIP

Original: [Table]
Revised: [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: textual features produced for text labels (Table 9).
Revised: textual features produced for text labels (Table 9).

Original: These observations further explain the lower performance of the ensemble of different training frameworks ({DINO, CLIP, Deit-B}) as compared to an ensemble of different networks ({Deit-T, Deit-S, Deit-B})
Revised: These observations further explain the lower performance of the ensemble of different training frameworks ({DINO, CLIP, Deit-B}) as compared to an ensemble of different networks ({Deit-T, Deit-S, Deit-B})

Original: (Fig. 4).
Revised: (Fig. 4).

Original: E A TTENTION R OLL - OUT ACROSS T IME
Revised: E A TTENTION R OLL - OUT ACROSS T IME

Original: We compute the roll-out attention (Abnar & Zuidema, 2020) of our temporal prompts within image models and compared those against original image models (Fig. 6).
Revised: We compute the roll-out attention (Abnar & Zuidema, 2020) of our temporal prompts within image models and compared those against original image models (Fig. 6).

Original: We observe that our temporal prompts focuses on action across different frames for a video as compared to the spatial class token with in pre-trained image models.
Revised: We observe that our temporal prompts focuses on action across different frames for a video as compared to the spatial class token with in pre-trained image models.

Original: Fooling such models allows for finding transferable adversarial patterns.
Revised: Fooling such models allows for finding transferable adversarial patterns.

Original: F A NALYSING D YNAMIC C UES AGAINST T EMPORAL V ARIATIONS
Revised: F A NALYSING D YNAMIC C UES AGAINST T EMPORAL V ARIATIONS

Original: We further analyse our dynamic cues by measure robustness to temporal variations.
Revised: We further analyse our dynamic cues by measure robustness to temporal variations.

Original: We provide inference results on shuffled video frames in Table 10.
Revised: We provide inference results on shuffled video frames in Table 10.

Original: We randomly sample a single view withframes and report average and standard deviation across three runs.
Revised: We randomly sample a single view withframes and report average and standard deviation across three runs.

Original: Our models are robust to such temporal variations.
Revised: Our models are robust to such temporal variations.

Original: G E FFECT OF N UMBER OF T EMPORAL P ROMPTS
Revised: G E FFECT OF N UMBER OF T EMPORAL P ROMPTS

Original: It’s a common practice to increase the number of frames for better temporal modeling.
Revised: It’s a common practice to increase the number of frames for better temporal modeling.

Original: In similar spirit, we also increase number of training frames and consequently the number of our temporal prompts through transformation.
Revised: In similar spirit, we also increase number of training frames and consequently the number of our temporal prompts through transformation.

Original: As expected, this strategy leads to better performance in modeling dynamic cues and attack transferability (Table 11).
Revised: As expected, this strategy leads to better performance in modeling dynamic cues and attack transferability (Table 11).

Original: [Figure]
Revised: [Figure]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: H P ROMPT LEARNING V S . F INE T UNING
Revised: H P ROMPT LEARNING V S . F INE T UNING

Original: We aim to use the same image backbone for different video or multi-view datasets.
Revised: We aim to use the same image backbone for different video or multi-view datasets.

Original: It has lower memory cost and computational overhead as we don’t need to update all the model parameters during the backpass (Table 13).
Revised: It has lower memory cost and computational overhead as we don’t need to update all the model parameters during the backpass (Table 13).

Original: Our attack exploits pre-trained image representations (for example learned on ImageNet) along with dynamic cues (introduced via learning temporal prompts) to fool black-box video models.
Revised: Our attack exploits pre-trained image representations (for example learned on ImageNet) along with dynamic cues (introduced via learning temporal prompts) to fool black-box video models.

Original: These adapted image models are not optimal for video learning as compared to specialized video networks such as TimesFormer (Bertasius et al., 2021).
Revised: These adapted image models are not optimal for video learning as compared to specialized video networks such as TimesFormer (Bertasius et al., 2021).

Original: When we fully fine-tune the pre-trained image model with our design to videos, the performance of the adapted models improves, in terms of top-1 (%) accuracy, on video datasets.
Revised: When we fully fine-tune the pre-trained image model with our design to videos, the performance of the adapted models improves, in terms of top-1 (%) accuracy, on video datasets.

Original: As a result of this fine-tuning, however, we loss the original image representations otherwise preserved in our approach.
Revised: As a result of this fine-tuning, however, we loss the original image representations otherwise preserved in our approach.

Original: This means that the contribution of our selfsupervised loss ( L ss ), designed to exploit image level representation, reduces and as a result it affects the transferability of adversarial attacks.
Revised: This means that the contribution of our selfsupervised loss ( L ss ), designed to exploit image level representation, reduces and as a result it affects the transferability of adversarial attacks.

Original: Our prompt learning approach preserves the original image representations within the spatial class token which is used in our self-supervised loss to boost adversarial transferability.
Revised: Our prompt learning approach preserves the original image representations within the spatial class token which is used in our self-supervised loss to boost adversarial transferability.

Original: We lose the original image representations when doing full fine-tuning of our model on videos and as a result, transferability decreases ( Table 12 ).
Revised: We lose the original image representations when doing full fine-tuning of our model on videos and as a result, transferability decreases ( Table 12 ).

Original: Interestingly this tradeoff between full fine-tuning and adversarial transferability is even more prominent with self-supervised DINO model as supervised fine-tuning affects the self-supervised inductive biases learned by the DINO.
Revised: Interestingly this tradeoff between full fine-tuning and adversarial transferability is even more prominent with self-supervised DINO model as supervised fine-tuning affects the self-supervised inductive biases learned by the DINO.

Original: In conclusion, attacks from pure image representations that is without temporal prompts, or from pure video representation that is without image representation show relatively lower transferability.
Revised: In conclusion, attacks from pure image representations that is without temporal prompts, or from pure video representation that is without image representation show relatively lower transferability.

Original: The combination of adversarial image and video representations compliments each other in enhancing the transferability to black-box videos and image models.
Revised: The combination of adversarial image and video representations compliments each other in enhancing the transferability to black-box videos and image models.

Original: Both image and video representations are well preserved in our approach with in a single image model.
Revised: Both image and video representations are well preserved in our approach with in a single image model.

Original: I I MAGE MODELS FOR VIDEOS AT VARYING SPATIAL SCALES
Revised: I I MAGE MODELS FOR VIDEOS AT VARYING SPATIAL SCALES

Original: We observe that our approach significantly improve generalization of image models on videos with low spatial resolutions (Table 14).
Revised: We observe that our approach significantly improve generalization of image models on videos with low spatial resolutions (Table 14).

Original: [Table]
Revised: [Table]

Original: J V ISUALIZING LATENT EMBEDDINGS
Revised: J V ISUALIZING LATENT EMBEDDINGS

Original: We show latent space embedding of our prompts for low resolution inputs in Fig.
Revised: We show latent space embedding of our prompts for low resolution inputs in Fig.

Original: The class tokens of DeiT-S models projected from R 384 to R 2 .
Revised: The class tokens of DeiT-S models projected from R 384 to R 2 .

Original: The class tokens of DeiT-B models projected from R 768 to R 2 .
Revised: The class tokens of DeiT-B models projected from R 768 to R 2 .

Original: [Equation]
Revised: K V ISUAL D EMOS

Original: Figures 8, 9, and 10 shows adversarial pattern from our adapted image models, Deit-B, DINO, and
Revised: Figures 8, 9, and 10 shows adversarial pattern from our adapted image models, Deit-B, DINO, and

Original: CLIP, for different video samples.
Revised: CLIP, for different video samples.

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure] [Figure][Figure]
Revised: [Figure] [Figure]