FeatureFool：基于特征图的视频模型零查询欺骗攻击
FeatureFool: Zero-Query Fooling of Video Models via Feature Map
对做视频模型安全与鲁棒性评测的人，这篇给出了一个无需查询、仅靠特征图迁移即可生成对抗视频的范式，可直接用于测试视频分类器与 Video-LLM 的对抗脆弱性，并提供了 SSIM/PSNR/时序一致性三项隐蔽性评估口径。
原文依据 FeatureFool, a stealthy, video-domain, zero-query black-box attack that utilizes information extracted from a DNN to alter the feature space of clean videos
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论深度神经网络（DNN）的脆弱性已得到初步验证。现有的黑盒对抗攻击通常需要与模型进行多轮交互并消耗大量查询，这在实际场景中不切实际，也难以扩展到近期出现的视频大语言模型（Video-LLM）。此外，视频领域尚无攻击直接利用特征图来偏移干净视频的特征空间。为此，我们提出 FeatureFool，一种隐蔽的、面向视频领域的零查询黑盒攻击，它利用从 DNN 中提取的信息来改变干净视频的特征空间。与依赖迭代交互的基于查询的方法不同，FeatureFool 通过直接利用 DNN 提取的信息执行零查询攻击。这种高效的方法在视频领域尚属首次。实验表明，FeatureFool 在没有任何查询的情况下对传统视频分类器取得超过 70% 的攻击成功率。得益于特征图的可迁移性，它还能构造有害内容并绕过 Video-LLM 的识别。此外，FeatureFool 生成的对抗视频在 SSIM、PSNR 和时序不一致性方面表现出高质量，使攻击几乎难以察觉。本文可能包含暴力或露骨内容。
英文原文摘要 1281 字符
The vulnerability of deep neural networks (DNNs) has been preliminarily verified. Existing black-box adversarial attacks usually require multi-round interaction with the model and consume numerous queries, which is impractical in the real-world and hard to scale to recently emerged Video-LLMs. Moreover, no attack in the video domain directly leverages feature maps to shift the clean-video feature space. We therefore propose FeatureFool, a stealthy, video-domain, zero-query black-box attack that utilizes information extracted from a DNN to alter the feature space of clean videos. Unlike query-based methods that rely on iterative interaction, FeatureFool performs a zero-query attack by directly exploiting DNN-extracted information. This efficient approach is unprecedented in the video domain. Experiments show that FeatureFool achieves an attack success rate above 70% against traditional video classifiers without any queries. Benefiting from the transferability of the feature map, it can also craft harmful content and bypass Video-LLM recognition. Additionally, adversarial videos generated by FeatureFool exhibit high quality in terms of SSIM, PSNR, and Temporal-Inconsistency, making the attack barely perceptible. This paper may contain violent or explicit content.