Robustness Evaluation for Video Models with Reinforcement Learning

Antonio Guillen; Ashwin Ramesh Babu; Avisek Naug; Ricardo Luna Gutierrez; Sahand Ghorbanpour; Sajad Mousavi; Soumyendu Sarkar; Vineet Gundecha

REVIEW 5 major objections 6 minor 37 references

Robustness Evaluation for Video Models with Reinforcement Learning

T0 review · 5 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A multi-agent reinforcement-learning attack that picks sensitive frames and patches evaluates video-model robustness with smaller distortion and fewer queries than prior black-box attacks.

desk verdict Incremental RL attack on video models with a plausible but unverified SOTA claim due to non-matched baselines and unclear query accounting; worth reviewing if protocols get fixed. read the letter →

arxiv 2506.05431 v1 pith:E5NKWYXU submitted 2025-06-05 cs.CV cs.AIcs.LG

Ashwin Ramesh Babu , Sajad Mousavi , Vineet Gundecha , Sahand Ghorbanpour , Avisek Naug , Antonio Guillen , Ricardo Luna Gutierrez , Soumyendu Sarkar This is my paper

classification cs.CVcs.AIcs.LG

keywords adversarialattackblack-boxvideoactionrecognitionreinforcementlearningmulti-agentrobustnessevaluationqueryefficiencyspatiotemporallocalization

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Video models are harder to audit than image models because their extra time dimension makes black-box adversarial attacks expensive in both queries and visible distortion. This paper tries to make such audits cheap by having two reinforcement-learning agents cooperate: one picks the frames that matter, one picks the patch within each frame, and both are rewarded by how much the victim model's confidence drops. The authors report that the resulting attack induces misclassification with smaller mean absolute perturbation and far fewer queries than existing black-box video attacks on four standard video recognizers and two datasets, while staying competitive in success rate. A final reverse step strips away perturbations that no longer contribute, trimming the distortion further. If the claim holds, robustness evaluation of video models becomes more practical and can use distortions tailored to a deployment scenario.

What carries the argument

The central mechanism is a multi-agent PPO formulation with a hierarchical spatial policy and a recurrent temporal policy. The temporal policy is an LSTM that consumes per-frame CNN features and global video features and binary-decides inclusion of each frame. The spatial policy picks one of $D$ non-overlapping patches at level 1, then subdivides that patch and picks a finer patch at level 2, concentrating perturbation on a small region. The shared reward ties both agents to the victim's confidence drop: the temporal agent receives $r_3 = \exp(\mathcal{L}(V(x_{t+1}) - V(x_t)))$ and the spatial agent receives $r_3 = \exp(P(y|x') - P(y|x))$, with additional rewards for frame sparsity, representativeness, objectness, and motion saliency. A reverse distortion-removal step iteratively prunes low-impact perturbations after misclassification, which is what holds the $L_1$ norm down.

What would settle it

Rerun the strongest baseline attack and the proposed attack on the same correctly classified test videos with the same query cap, and count the queries spent in the reverse distortion-removal stage. If the baseline's mean absolute perturbation approaches the proposed method's values (for example, AstFocus on TSM over UCF-101 moving from 3.411 toward 0.835) or its average query count drops once protocols are matched, the reported superiority is a protocol artifact rather than a property of the attack.

Watch

Extended reading notes

Core claim

The paper proposes a black-box adversarial attack for video action recognition in which two reinforcement-learning policies cooperate. A temporal policy, built from an LSTM over features extracted from frames, decides for each frame whether to include it for perturbation; a spatial policy first localizes a large patch in the frame (level-1 localization), then subdivides that patch to choose a finer region (level-2 localization). Both policies are trained with Proximal Policy Optimization under a shared reward derived from the victim model's confidence change, plus task-specific rewards: the temporal agent is encouraged to select few yet representative frames, and the spatial agent is encouraged to pick patches that overlap foreground objects and motion-salient regions. After a successful misclassification, the method reverses distortions that no longer matter, so the reported $L_1$ perturbation is lower than the perturbation that actually achieved the attack. The paper reports that this combination beats prior black-box video attacks on mean absolute perturbation and average query number for C3D, TSN, TSM, and SlowFast on HMDB-51 and UCF-101, with success rates that remain competitive.

Load-bearing premise

The load-bearing premise is that the comparison is fair: the baseline numbers in Table 1 came from the same subset of correctly classified videos, the same 10,000-query cap, and the same counting of queries spent during reverse distortion removal, since the paper does not say the baselines were rerun under its protocol.

Editorial extensions

If this is right

Robustness audits of video models could require only hundreds of queries instead of thousands, with average $L_1$ distortion below 1 on several tested model-dataset pairs.
The same framework can probe robustness under custom distortion families, such as Gaussian blur, dead pixels, or Gaussian noise, chosen to match a deployment scenario.
Experiments across C3D, TSN, TSM, and SlowFast on HMDB-51 and UCF-101 report stable success across all three distortion types, suggesting the attack is not tied to one perturbation model.
The reverse distortion-removal step lowers the net $L_1$ distortion after a successful attack, so the final perturbation is smaller than the perturbation that first caused misclassification.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A testable accounting extension is to report the query cost of the reverse distortion-removal step separately; the paper's query counts do not state whether reversion queries are included, and that accounting determines how much of the reported query reduction belongs to the attack itself.
Because the policies identify sparse frames and patches rather than memorizing a classifier, the same multi-agent setup could be pointed at video transformers or spatiotemporal action-localization models, which the paper does not evaluate.
The combined agents beat the best single agent by roughly 21% in MAP in the ablation, so a natural next test is whether a single policy with a factored action space can recover the same gain with less training overhead.
The custom distortion mechanism suggests a broader use: evaluating robustness against compression artifacts or weather corruptions as an alternative to pixel-space $\ell_p$ perturbations.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: this is a competent engineering extension of your group's RL attack work to video, and the reverse-distortion step is a nice practical trick. The headline claim—'outperforms SOTA on Lp and queries'—is plausible but not yet established, because the comparison against literature baselines doesn't show a matched protocol, and the paper never says whether reverse-removal queries are counted in QN.

What's genuinely useful: the framing of robustness evaluation as a cooperative two-agent problem (spatial + temporal) is clean, and the custom distortion types (Gaussian blur, dead pixels, Gaussian noise) make the attack portable to real-world distortions. The hierarchical two-level localization is a sensible way to cut search space, and the ablation in Table 3 showing the combined agents beat either alone is a legitimate check. Four victim models and two datasets is a decent spread for a systems paper.

Soft spots, in order of severity. First, the SOTA comparison. Table 1 takes baseline numbers from other papers, but there's no statement that those baselines were run on the same correctly-classified subset, the same 10,000 query cap, or the same definition of a query. The queried numbers (e.g., QN under 1,000 vs. AstFocus at 1,500–4,000) are good enough that the difference could be real, but with no matched protocol it's unverifiable. This is the main barrier to taking the headline seriously. Second, query accounting for the reverse distortion removal (Algorithm 1, line 17). If the reversion loop queries the victim and those queries aren't counted, QN is understated in a way no baseline has an equivalent for. The paper should state this explicitly. Third, no error bars or multiple seeds. RL training is stochastic; a single run per condition doesn't support the 'significantly better' language in the text. Fourth, the novelty is incremental—most components are from your own prior image-attack papers—but the combination for video with a temporal agent is new enough to be a contribution.

The citation pattern is mostly self-citations to your own prior work. That's defensible because the method is built on it, but it also means an independent reader can't easily assess how much is genuinely new without digging.

This paper is for people building robustness benchmarks and black-box attack toolkits. They'd get value from the custom-distortion framing and the reversion trick. It's not a breakthrough, but it's a solid systems contribution if the protocol issues are fixed. I'd like to see it go to peer review, with the clear expectation that the authors provide code, run the baselines themselves, and clarify the query definition.

Referee Report

5 major / 6 minor

Summary. The paper proposes a multi-agent reinforcement learning black-box attack for video action recognition. A temporal agent selects a sparse set of frames and a hierarchical spatial agent localizes a patch within each selected frame; both are trained with PPO using a shared victim-feedback reward plus auxiliary rewards, and the attack supports custom distortion types (Gaussian blur, dead pixels, Gaussian noise). A reverse-distortion stage then removes perturbations that are not needed for misclassification. The authors report experiments on HMDB-51 and UCF-101 against C3D, TSN, TSM, and SlowFast models, claiming state-of-the-art results in mean absolute perturbation (MAP) and average query number (QN).

Significance. If the reported comparison is trustworthy, the method would be a useful contribution to query-efficient robustness evaluation for video models, with strengths including evaluation on four victim models and two datasets, an ablation of patch size, and an ablation of the two agents. The paper also makes a falsifiable claim: lower MAP and lower QN than prior black-box video attacks under the same protocol. However, the central comparison is currently not established because the evaluation protocols for cited baselines are not shown to match, the reported numbers lack statistical grounding, and the novelty relative to prior multi-agent RL attacks (particularly AstFocus and the authors' own earlier works) is not clearly delineated. The significance is therefore conditional on a careful re-evaluation, not on the current evidence.

major comments (5)

[§6.3, §6.4, Table 1] The headline claim that the method outperforms state-of-the-art on MAP and average QN is not supported by a matched protocol. Section 6.1 states that only correctly classified samples are used, but the paper does not state that the baseline numbers copied into Table 1 were produced on the same subset, under the same 10,000-query cap, or with the same query-accounting rule. This matters because Algorithm 1, line 17 performs a reverse distortion-removal stage that queries the victim model, and Section 6.3 defines QN as 'the number of query attempts needed to successfully fool' without stating whether reverse-removal queries are counted. If they are excluded, the reported QN undercounts the true cost, and no baseline has a comparable uncounted phase. The cap inconsistency in Table 1 reinforces the concern: several Heuristic-attack QN entries exceed 10,000 even though Section 6.3 states a 10,000 upper limit. The authors should rerun all baselines under the identical protocol, or explicitly report how each cited number was obtained, including the exact test subset, the cap, and the treatment of reverse-distortion queries.
[§6.4, Table 1, Table 2, Table 3] No statistical evidence is provided for any of the reported improvements. There are no error bars, no multiple seeds, and no significance tests, although the method is a stochastic RL procedure. Some differences in Table 1 are large, but others are not; the ablation tables report single numbers (e.g., Table 2 MAP values such as 0.39 vs 1.22, and Table 3 MAP 0.975 vs 1.021) without variance across training runs or test subsets. The authors should report mean and standard deviation over at least three independent training/evaluation runs for the proposed method and for any rerun baselines, and state the number of test videos used in each average.
[§5.2.1, §5.2.3, §2.2] The novelty of the proposed architecture relative to prior multi-agent RL attacks is not clearly established. Section 2.2 describes AstFocus [29] as a multi-agent RL setup with frame and patch selection and a shared reward, which is structurally similar to the proposed spatial/temporal agent design. The paper does not provide a controlled comparison with AstFocus under identical conditions, nor does it explain why replacing PGD/NES with PPO and adding a hierarchical localization is sufficient for the large reported gains. The issue is compounded by the paper's own statements that the level-1 localization is 'similar to the method proposed in [18]' (§5.2.1), the edgebox reward comes from [34] (§5.2.3), and the representativeness reward is 'inspired by [37]' (§5.1.2). The authors should either provide a direct ablation isolating each novel component or temper the contribution claim.
[§6.4, Table 1] The text in Section 6.4 overstates the results in its own table. It says that the query values of the proposed method are 'significantly lesser than the black-box attacks,' but Table 1 contains counterexamples: for C3D on HMDB-51, Ours (GB) has QN 8710 while VBAD has QN 4107; for C3D on UCF-101, Ours (DP) has MAP 6.351 while AstFocus has MAP 4.015. The abstract's universal-superiority claim should be restricted to the configurations and metric combinations where it actually holds, or the reported numbers should be corrected.
[§5.1.2, §5.2.3, Eq. (1)-(3), (7)-(8)] Several reward definitions are ambiguous or under-specified as printed. Equation (1) as typeset is not fully legible and the role of the threshold L is unclear (whether the reward encourages exactly L frames or at most L frames). Equation (3) uses a function L for the victim-confidence difference but L is already used as the frame threshold in Eq. (1), and the 'loss function' is not defined. These ambiguities make it difficult to reproduce the method exactly.

minor comments (6)

[Abstract and §6.3] The abstract says 'Lp metric' but the paper evaluates only p = 1 (MAP); please state this explicitly in the abstract or use 'L1/MAP' throughout.
[Throughout] There are many typos and formatting artifacts, including 'hirararchical', 'actor-ciritc', 'the the', and garbled equation renderings. A thorough proofread is needed.
[Table 1 caption] The caption lists 'SVAL(2022) [28]' and 'Sparse (2022)[28]' as if they are different methods, but both point to reference [28]; also SVAL appears only for C3D in the table. Please clarify the identity and source of each baseline.
[§6.1] The dataset split is described as 70% training / 30% validation, but action recognition benchmarks normally use fixed official splits. Please specify which split is used and report the number of correctly classified test videos per model/dataset, since the averages depend on that subset.
[Figure 6] The difference images in Figure 6 have no scale or normalization information, so a reader cannot judge the visual imperceptibility claim quantitatively.
[§6.4.2] The limitations subsection is only a brief note about computational cost vs. performance; it should also acknowledge the protocol limitations discussed in the major comments, especially the lack of matched baselines and statistical error bars.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper's claims are empirical attack results against external baselines, and its self-citations are component-level credits rather than load-bearing reductions.

full rationale

The paper does not contain a derivation chain in which a predicted quantity is defined in terms of the same quantity, nor does it fit a parameter and then rename that fit as a prediction. The proposed method is an RL-based attack pipeline trained with PPO using victim-model confidence rewards, and its evaluation is a comparison against external baselines in Table 1. The self-citations to [18, 19, 21] are used to credit component designs such as hierarchical localization and custom distortion types; these are explicitly acknowledged prior building blocks, not an unverified uniqueness theorem or an imported ansatz that forces the paper's conclusions. The reverse distortion removal stage (Section 5.3, Algorithm 1 line 17) is an algorithmic post-processing step; whether its queries are counted in QN is an evaluation-protocol concern, not a circularity. Similarly, the unstated matching of baseline subsets and query caps is an empirical validity risk, not a circular reduction. The central claim therefore has independent content and is not equivalent to its inputs by construction.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central claim rests on several tuned hyperparameters and domain assumptions inherited from prior work; no new theoretical entity is introduced.

free parameters (6)

Gaussian noise variance = 0.005
Chosen by grid search to balance query number and MAP (Section 6.4).
Frame threshold L = not reported
Threshold for reward r1 penalizing number of selected frames (Section 5.1.2); no value given.
Gaussian blur kernel size = not reported
Kept constant during training (Section 6.4) but never specified.
Patch size = either 13x13 or 5x5
Ablated in Table 2; main experiments' patch size not stated.
Number of hierarchical localization levels = up to three
Authors observed that more than three levels gave diminishing returns (Section 6.4), selected by hand.
Reward weights for r1, r2, r3 = not reported
Combination weights for temporal and spatial rewards are not specified in Equations (1)-(8).

assumptions (5)

domain assumption Pretrained MobileNet-V2 features are informative for identifying sensitive frames and patches
Both the temporal agent (Section 5.1.1) and spatial agent (Section 5.2.2) rely on a pretrained MobileNet-V2 backbone with frozen weights.
domain assumption PPO will converge to a policy that cooperatively minimizes perturbation
No convergence guarantee is provided; the method relies on empirical success.
domain assumption EdgeBox objectness and Lucas-Kanade motion saliency are reliable proxies for perception sensitivity
Used as rewards r1 and r2 for the spatial agent (Eq. 5-7).
domain assumption mmaction2 pretrained weights correctly represent the victim models
Victim models C3D, TSN, TSM, SlowFast are used via pre-trained weights from mmaction2 (Section 6.2).
standard math Standard MDP and RL background
The method is framed as a Markov Decision Process and uses PPO (Section 3).

how reviews work

0 comments

Cite this review

Pith. "Pith review of Robustness Evaluation for Video Models with Reinforcement Learning." pith.science (2026). https://pith.science/paper/E5NKWYXU

@misc{pith2026250605431,
  author       = {Pith},
  title        = {Pith review of: Robustness Evaluation for Video Models with Reinforcement Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/E5NKWYXU}},
  note         = {Machine review of arXiv:2506.05431}
}

read the original abstract

Evaluating the robustness of Video classification models is very challenging, specifically when compared to image-based models. With their increased temporal dimension, there is a significant increase in complexity and computational cost. One of the key challenges is to keep the perturbations to a minimum to induce misclassification. In this work, we propose a multi-agent reinforcement learning approach (spatial and temporal) that cooperatively learns to identify the given video's sensitive spatial and temporal regions. The agents consider temporal coherence in generating fine perturbations, leading to a more effective and visually imperceptible attack. Our method outperforms the state-of-the-art solutions on the Lp metric and the average queries. Our method enables custom distortion types, making the robustness evaluation more relevant to the use case. We extensively evaluate 4 popular models for video action recognition on two popular datasets, HMDB-51 and UCF-101.

Figures

Figures reproduced from arXiv: 2506.05431 by the authors.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

37 extracted references · 32 canonical work pages

[29]

Effi- cient robustness assessment via adversarial spatial -temporal focus on videos

Xingxing Wei, Songping Wang, and Huanqian Yan. Effi- cient robustness assessment via adversarial spatial -temporal focus on videos. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2023. 2, 6

work page 2023
[18]

Robustness with black-box adversarial attack using reinforce- ment learning

Soumyendu Sarkar, Ashwin Ramesh Babu, Sajad Mousavi, Vineet Gundecha, Sahand Ghorbanpour, Alexander Shmakov, Ricardo Luna Gutierrez, Antonio Guillen, and Avisek Naug. Robustness with black-box adversarial attack using reinforce- ment learning. 2023. 1, 4

work page 2023
[34]

Efficient sparse attacks on videos using reinforcement learning

Huanqian Yan and Xingxing Wei. Efficient sparse attacks on videos using reinforcement learning. In Proceedings of the 29th ACM International Conference on Multimedia, pages 2326–2334, 2021. 2, 4

work page 2021
[37]

Deep reinforce- ment learning for unsupervised video summarization with diversity-representativeness reward

Kaiyang Zhou, Yu Qiao, and Tao Xiang. Deep reinforce- ment learning for unsupervised video summarization with diversity-representativeness reward. In Proceedings of the AAAI Conference on Artificial Intelligence, 2018. 4

work page 2018
[1]

Appending adversarial frames for universal video at - tack

Zhikai Chen, Lingxi Xie, Shanmin Pang, Yong He, and Qi Tian. Appending adversarial frames for universal video at - tack. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 3199–3208, 2021. 2

work page 2021
[2]

Openmmlab’s next generation video understanding toolbox and benchmark

MMAction Contributors. Openmmlab’s next generation video understanding toolbox and benchmark. http s://github. com/open-mmlab/mmaction2, 2020. 7

work page 2020
[3]

Identifying the key frames: An attention-aware sampling method for action recognition

Wenkai Dong, Zhaoxiang Zhang, Chunfeng Song, and Tieniu Tan. Identifying the key frames: An attention-aware sampling method for action recognition. Pattern Recognition , 130: 108797, 2022. 3

work page 2022
[4]

Slowfast networks for video recognition

Christoph Feichtenhofer, Haoqi Fan, Jitendra Malik, and Kaiming He. Slowfast networks for video recognition. In Proceedings of the IEEE/CVF international conference on computer vision, pages 6202–6211, 2019. 6, 7

work page 2019

Show all 37 references

[5]

Can spatiotemporal 3d cnns retrace the history of 2d cnns and im- agenet? In Proceedings of the IEEE conference on Computer Vision and Pattern Recognition, pages 6546–6555, 2018

Kensho Hara, Hirokatsu Kataoka, and Yutaka Satoh. Can spatiotemporal 3d cnns retrace the history of 2d cnns and im- agenet? In Proceedings of the IEEE conference on Computer Vision and Pattern Recognition, pages 6546–6555, 2018. 6, 7

2018
[6]

Just one moment: Structural vulnerability of deep action recognition against one frame attack

Jaehui Hwang, Jun-Hyuk Kim, Jun-Ho Choi, and Jong-Seok Lee. Just one moment: Structural vulnerability of deep action recognition against one frame attack. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 7668–7676, 2021. 2

2021
[7]

Prior convictions: Black-box adversarial attacks with bandits and priors

Andrew Ilyas, Logan Engstrom, and Aleksander Madry. Prior convictions: Black-box adversarial attacks with bandits and priors. arXiv preprint arXiv:1807.07978, 2018. 2

2018 arXiv
[8]

Black-box adversarial attacks on video recog- nition models

Linxi Jiang, Xingjun Ma, Shaoxiang Chen, James Bailey, and Yu-Gang Jiang. Black-box adversarial attacks on video recog- nition models. In Proceedings of the 27th ACM International Conference on Multimedia, pages 864–872, 2019. 2, 6

2019
[9]

Hmdb: a large video database for human motion recognition

Hildegard Kuehne, Hueihan Jhuang, Estíbaliz Garrote, Tomaso Poggio, and Thomas Serre. Hmdb: a large video database for human motion recognition. In 2011 International conference on computer vision , pages 2556 –2563. IEEE,

2011
[10]

Adversarial perturbations against real-time video classification systems

Shasha Li, Ajaya Neupane, Sujoy Paul, Chengyu Song, Srikanth V Krishnamurthy, Amit K Roy Chowdhury, and Ananthram Swami. Adversarial perturbations against real-time video classification systems. arXiv preprint arXiv:1807.00458, 2018. 2

2018 arXiv
[11]

Adversarial attacks on black box video classifiers: Leveraging the power of geometric transformations

Shasha Li, Abhishek Aich, Shitong Zhu, Salman Asif, Chengyu Song, Amit Roy-Chowdhury, and Srikanth Krish- namurthy. Adversarial attacks on black box video classifiers: Leveraging the power of geometric transformations. Advances in Neural Information Processing Systems , 34:2085 –2096,
[12]

Tsm: Temporal shift module for efficient video understanding

Ji Lin, Chuang Gan, and Song Han. Tsm: Temporal shift module for efficient video understanding. In Proceedings of the IEEE/CVF international conference on computer vision, pages 7083–7093, 2019. 6, 7

2019
[13]

Transferability in machine learning: from phenomena to black-box attacks using adversarial samples

Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv:1605.07277, 2016. 2

2016 arXiv
[14]

Measuring robustness with black-box adversarial attack using reinforcement learning

Soumyendu Sarkar, Sajad Mousavi, Ashwin Ramesh Babu, Vineet Gundecha, Sahand Ghorbanpour, and Alexander K Shmakov. Measuring robustness with black-box adversarial attack using reinforcement learning. In NeurIPS ML Safety Workshop, 2022. 2

2022
[15]

Rl-cam: Visual explana- tions for convolutional networks using reinforcement learning

Soumyendu Sarkar, Ashwin Ramesh Babu, Sajad Mousavi, Sahand Ghorbanpour, Vineet Gundecha, Antonio Guillen, Ricardo Luna, and Avisek Naug. Rl-cam: Visual explana- tions for convolutional networks using reinforcement learning. In Proceedings of the IEEE/CVF Conference on Compute...

2023
[16]

Robustness with query - efficient adversarial attack using reinforcement learning

Soumyendu Sarkar, Ashwin Ramesh Babu, Sajad Mousavi, Sahand Ghorbanpour, Vineet Gundecha, Antonio Guillen, Ricardo Luna, and Avisek Naug. Robustness with query - efficient adversarial attack using reinforcement learning. In Proceedings of the IEEE/CVF Conference on Computer Vi...

2023
[17]

Reinforcement learning based black -box adversarial attack for robustness improvement

Soumyendu Sarkar, Ashwin Ramesh Babu, Sajad Mousavi, Sahand Ghorbanpour, Vineet Gundecha, Ricardo Luna Gutier- rez, Antonio Guillen, and Avisek Naug. Reinforcement learning based black -box adversarial attack for robustness improvement. In 2023 IEEE 19th International Conferen...

2023
[19]

Benchmark generation framework with customizable distortions for image classifier robustness

Soumyendu Sarkar, Ashwin Ramesh Babu, Sajad Mousavi, Zachariah Carmichael, Vineet Gundecha, Sahand Ghorban - pour, Ricardo Luna Gutierrez, Antonio Guillen, and Avisek Naug. Benchmark generation framework with customizable distortions for image classifier robustness. In Proceed...

2024
[20]

Robustness and visual explanation for black box image, video, and ecg signal classification with reinforcement learning

Soumyendu Sarkar, Ashwin Ramesh Babu, Sajad Mousavi, Vineet Gundecha, Avisek Naug, and Sahand Ghorbanpour. Robustness and visual explanation for black box image, video, and ecg signal classification with reinforcement learning. In Proceedings of the AAAI Conference on Artifici...

2024
[21]

Reinforcement learning platform for adversarial black - box attacks with custom distortion filters

Soumyendu Sarkar, Ashwin Ramesh Babu, Sajad Mousavi, Vineet Gundecha, Sahand Ghorbanpour, Avisek Naug, Ri - cardo Luna Gutierrez, Antonio Guillen, and Desik Rengara - jan. Reinforcement learning platform for adversarial black - box attacks with custom distortion filters. In Pr...

2025
[22]

Proximal policy optimization algo - rithms

John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Rad - ford, and Oleg Klimov. Proximal policy optimization algo - rithms. arXiv preprint arXiv:1707.06347, 2017. 2, 5

2017 arXiv
[23]

Ucf101: A dataset of 101 human actions classes from videos in the wild

Khurram Soomro, Amir Roshan Zamir, and Mubarak Shah. Ucf101: A dataset of 101 human actions classes from videos in the wild. arXiv preprint arXiv:1212.0402, 2012. 5

2012 arXiv
[24]

Autoattacker: A reinforcement learning approach for black - box adversarial attacks

Ilias Tsingenopoulos, Davy Preuveneers, and Wouter Joosen. Autoattacker: A reinforcement learning approach for black - box adversarial attacks. In 2019 ieee european symposium on security and privacy workshops (euros&pw), pages 229–237. IEEE, 2019. 2

2019
[25]

Temporal segment networks: Towards good practices for deep action recognition

Limin Wang, Yuanjun Xiong, Zhe Wang, Yu Qiao, Dahua Lin, Xiaoou Tang, and Luc Van Gool. Temporal segment networks: Towards good practices for deep action recognition. In European conference on computer vision, pages 20–36. Springer, 2016. 6, 7

2016
[26]

Reinforcement learning based sparse black -box adversarial attack on video recognition models

Zeyuan Wang, Chaofeng Sha, and Su Yang. Reinforcement learning based sparse black -box adversarial attack on video recognition models. arXiv preprint arXiv:2108.13872, 2021. 2, 6

2021 arXiv
[27]

Sparse adversarial perturbations for videos

Xingxing Wei, Jun Zhu, Sha Yuan, and Hang Su. Sparse adversarial perturbations for videos. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 8973–8980,
[28]

Sparse black - box video attack with reinforcement learning

Xingxing Wei, Huanqian Yan, and Bo Li. Sparse black - box video attack with reinforcement learning. International Journal of Computer Vision, 130(6):1459–1473, 2022. 6

2022
[30]

Heuristic black-box adversarial attacks on video recognition models

Zhipeng Wei, Jingjing Chen, Xingxing Wei, Linxi Jiang, Tat- Seng Chua, Fengfeng Zhou, and Yu-Gang Jiang. Heuristic black-box adversarial attacks on video recognition models. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 12338–12345, 2020. 2, 6

2020
[31]

Towards transferable adversarial attacks on vision transformers

Zhipeng Wei, Jingjing Chen, Micah Goldblum, Zuxuan Wu, Tom Goldstein, and Yu-Gang Jiang. Towards transferable adversarial attacks on vision transformers. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 2668– 2676, 2022. 2

2022
[32]

Boosting the transferability of video adversarial examples via temporal translation

Zhipeng Wei, Jingjing Chen, Zuxuan Wu, and Yu-Gang Jiang. Boosting the transferability of video adversarial examples via temporal translation. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 2659–2667, 2022. 2

2022
[33]

Cross-modal transferable adversarial attacks from images to videos

Zhipeng Wei, Jingjing Chen, Zuxuan Wu, and Yu-Gang Jiang. Cross-modal transferable adversarial attacks from images to videos. In Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition , pages 15064– 15073,
[35]

Cube-evo: A query-efficient black-box attack on video classification system

Yu Zhan, Ying Fu, Liang Huang, Jianmin Guo, Heyuan Shi, Houbing Song, and Chao Hu. Cube-evo: A query-efficient black-box attack on video classification system. IEEE Trans- actions on Reliability, 2023. 2

2023
[36]

Motion- excited sampler: Video adversarial attack with sparked prior

Hu Zhang, Linchao Zhu, Yi Zhu, and Yi Yang. Motion- excited sampler: Video adversarial attack with sparked prior. In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XX 16, pages 240–256. Springer, 2020. 2, 6

2020

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [29]

Effi- cient robustness assessment via adversarial spatial -temporal focus on videos

Xingxing Wei, Songping Wang, and Huanqian Yan. Effi- cient robustness assessment via adversarial spatial -temporal focus on videos. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2023. 2, 6

work page 2023

[2] [18]

Robustness with black-box adversarial attack using reinforce- ment learning

Soumyendu Sarkar, Ashwin Ramesh Babu, Sajad Mousavi, Vineet Gundecha, Sahand Ghorbanpour, Alexander Shmakov, Ricardo Luna Gutierrez, Antonio Guillen, and Avisek Naug. Robustness with black-box adversarial attack using reinforce- ment learning. 2023. 1, 4

work page 2023

[3] [34]

Efficient sparse attacks on videos using reinforcement learning

Huanqian Yan and Xingxing Wei. Efficient sparse attacks on videos using reinforcement learning. In Proceedings of the 29th ACM International Conference on Multimedia, pages 2326–2334, 2021. 2, 4

work page 2021

[4] [37]

Deep reinforce- ment learning for unsupervised video summarization with diversity-representativeness reward

Kaiyang Zhou, Yu Qiao, and Tao Xiang. Deep reinforce- ment learning for unsupervised video summarization with diversity-representativeness reward. In Proceedings of the AAAI Conference on Artificial Intelligence, 2018. 4

work page 2018

[5] [1]

Appending adversarial frames for universal video at - tack

Zhikai Chen, Lingxi Xie, Shanmin Pang, Yong He, and Qi Tian. Appending adversarial frames for universal video at - tack. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 3199–3208, 2021. 2

work page 2021

[6] [2]

Openmmlab’s next generation video understanding toolbox and benchmark

MMAction Contributors. Openmmlab’s next generation video understanding toolbox and benchmark. http s://github. com/open-mmlab/mmaction2, 2020. 7

work page 2020

[7] [3]

Identifying the key frames: An attention-aware sampling method for action recognition

Wenkai Dong, Zhaoxiang Zhang, Chunfeng Song, and Tieniu Tan. Identifying the key frames: An attention-aware sampling method for action recognition. Pattern Recognition , 130: 108797, 2022. 3

work page 2022

[8] [4]

Slowfast networks for video recognition

Christoph Feichtenhofer, Haoqi Fan, Jitendra Malik, and Kaiming He. Slowfast networks for video recognition. In Proceedings of the IEEE/CVF international conference on computer vision, pages 6202–6211, 2019. 6, 7

work page 2019