Abstract: Systems and methods for video backdoor attack include a trigger generation module for generating a universal adversarial trigger pattern specific to a task, an adversarial perturbation module for producing videos with manipulated features; and a poisoning and inference module for injecting the generated trigger into perturbed videos as poisoned samples for training; wherein the trigger pattern is patched and optimized on videos from all non-target classes but relabeled to a target class, and the trigger pattern is a universal adversarial trigger pattern generated by minimizing the cross-entropy loss.

Abstract: Systems and methods for video backdoor attack include a trigger generation module for generating a universal adversarial trigger pattern specific to a task, an adversarial perturbation module for producing videos with manipulated features; and a poisoning and inference module for injecting the generated trigger into perturbed videos as poisoned samples for training; wherein the trigger pattern is patched and optimized on videos from all non-target classes but relabeled to a target class, and the trigger pattern is a universal adversarial trigger pattern generated by minimizing the cross-entropy loss.

Abstract: A method for generating black-box adversarial attacks on video recognition models is provided, comprising a) passing input video frames into a public image model, to obtain pixel-wise tentative perturbations; b) partitioning the tentative perturbations into tentative perturbation patches; c) estimating the rectification weight required for each patch, via querying the target video model; d) applying the patch-wise rectification weight on the patches, to obtain the rectified pixel-wise perturbations; e) applying one step projected gradient descent (PGD) perturbation on the input video, according to the rectified pixel-wise perturbations; and f) iteratively performing steps a)-e) until an attack succeeds or a query limit is reached. Systems and networks therefor are also provided.