Adversarial Attack for Asynchronous Event-based Data

Due to the sparse and asynchronous characteristics of the event-based data, typical event-based algorithms aggregate events into a grid representation. Event-based data consists of a stream of events that encode the location, time, and polarity of the brightness changes (Gallego et al. 2019). When event-based data is converted into a grid representation, $(x,y)$ position coordinates become pixel position coordinates, and time coordinates become tensor values. As each event alone contains little information, events must be aggregated into a grid representation. The event count model (Maqueda et al. 2018; Zhu et al. 2018) measures event counts for each pixel and polarity, but it discards temporal and polarity information. The two-channel model (Maqueda et al. 2018; Zhu et al. 2018; Sironi et al. 2018) uses only one time as a tensor value. The voxel grid model (Zhu et al. 2019) uses all the temporal information, but it discards polar information. The EST model (Gehrig et al. 2019) processes events with a specific kernel and converts event-based data into a grid representation of multiple channels. Compared to other representations, EST keeps the most information from raw event streams. EST is a generalized grid representation, thus it can be transformed to other representations by projecting over the temporal or polar axis. For example, projecting the EST over the temporal axis leads to the two-channel, and projecting the EST over the polar axis leads to the voxel grid. We demonstrate our attacking algorithm for grid representation of event-based data with the EST and the projected EST.

Szegedy et al. (2014) first pointed out that DNNs were vulnerable to intentionally designed adversarial examples. Adversarial examples can easily fool DNNs by adding imperceptable perturbations to the original data. Since 2014, several approaches (Goodfellow, Shlens, and Szegedy 2015; Madry et al. 2018; Lecuyer et al. 2019; Athalye, Carlini, and Wagner 2018; Song et al. 2018) have been proposed to generate adversarial examples to attack models effectively. Fast gradient sign method (FGSM) (Goodfellow, Shlens, and Szegedy 2015) is one of the most popular one-step gradient-based approaches for $L_{\infty}$-bounded attacks. A PGD attack (Madry et al. 2018) iteratively applies FGSM multiple times, and is one of the strongest adversarial attacks. But, they mainly target 2D images. Recent studies have shown that DNNs are vulnerable to 3D adversarial objects. Xiang et al. (2018) generated 3D adversarial point clouds through point perturbation or point generation. Tsai et al. (2020) generated physical 3D adversarial objects and proved that physical objects can mislead the DNNs to make wrong predictions. While adversarial examples of 2D images and 3D point clouds have been extensively studied, studies on event-based data are limited.

Marchisio et al. (2021) studied various types of adversarial examples for event-based data. They performed a typical adversarial attack on intermediate features of the event-based deep learning model. The intermediate features are 2D grid representations of event-based data. However, adversarial examples of the input event cannot be retrieved from 2D adversarial features. Inverse operation is not possible, because input events are convolved with nonlinear kernel functions and aggregated into grid representations. As the input data of an event camera cannot be attacked, it does not pose a real threat to the event-based deep learning. To the best of our knowledge, this is the first study to generate adversarial examples for event-based data.

We first recall the PGD attack to generate adversarial examples. A PGD attack is a typical multistep attack algorithm for an $L_{\infty}$ bounded adversary. Given the 2D image $u\in\mathbb{R}^{C\times H\times W}$, the PGD attack generates an adversarial example as follows:

where $i$ the iteration of the attack; $\epsilon$ the perturbation size; $\text{Proj}_{\epsilon}$ projects the adversarial sample into the $\epsilon-L_{\infty}$ neighbor of the benign sample; $\alpha$ is the step size; $J$ the loss function; $\theta$ parameters of the DNNs; and $y$ the true label.

The event-based deep learning model extracts features based on the event times. Therefore, we add imperceptible perturbations to the original event times and intentionally mislead the DNNs. The original event times are attacked by a PGD attack as follows:

where $t$ is the timestamp of $\mathcal{E}$, $B$ is the number of temporal bins, and $f$ is the relative frequency. We divide the perturbation size $\epsilon$ and step size $\alpha$ by the number of temporal bins $B$ and relative frequency $f$. For event-based data, convolved signals are given to each temporal bin of grid representation. As $B$ increases, the temporal scale of each bin decreases. Therefore, we use the relative perturbation size $\frac{\epsilon}{B\cdot f}$ and step size $\frac{\alpha}{B\cdot f}$ to perturb the time value in the smaller time scale $\Delta t$.

The perturbation size is generally proportional to the attack success rate because more perturbation can mislead DNNs easily. However, larger perturbation size can shift the events to the same location of another temporal bin. In the bottom of Figure 4, large perturbation can shift the event to the same location of another temporal bin. As another temporal bin may contain the same information, the attack performance is reduced. Therefore, the relative perturbation size $\frac{\epsilon}{B\cdot f}$ balances the two opposing cases. We demonstrate it in the experiment section.

An adversarial attack on the original events only deals with $N$ time values. However, an infinite number of adversarial events can be theoretically generated in the region where $x\in\{0,1,..W\},y\in\{{0,1,..H}\}$, and normalized timestamp $t\in(0,1]$. In a pixel with $k$ events, only $k$ events can be attacked and additional adversarial events cannot be generated. In addition, a pixel without an event cannot have any adversarial event.

Therefore, we propose to add null events to the original event-based data. The time value of the null event is set to 0 to satisfy two conditions. The first condition is that the null event should be distinguished from the original event. The normalized time value of the original event lies in the interval $(0,1]$. Because the time value $t$ is recorded when the brightness changes, there is no original event at time 0. The time value of the null event should be set to the interval excluding $(0,1]$. Second, the null event should not affect the prediction of DNNs for the original event. A nonzero time value of the event is mapped to a nonzero tensor value in the grid representation. Even a small time value can make real events in the grid representation. Therefore, we set the time value of the null event to 0. As shown in Figure 5, null event of time value 0 does not change the original events.

When null events are added to the original event, adversarial attacks can be performed at the desired location and time. Furthermore, a null event controls the perturbation size. For adversarial attacks on 2D images, perturbations of pixel values are limited to make invisible changes to the human eye. Similarly, adversarial attacks on event-based data can achieve the same effect by adjusting the number of null events. The effect of null events is included in the supplemental material.

An original event does not have an event with time value 0, but a null event is defined as a multiset that allows redundancy at time value 0. $m$ represents the number of null events added to each pixel. Null events can be added differently for each pixel, but in this paper, we add the same number of null events to the location without any event for simplicity as follows:

where no event exists in $(x_{l},y_{l},p_{l})$. Null events $\mathcal{N}^{m}$ are added to the original events to make adversarial events $\mathcal{E}^{{}^{\prime}}$.

By adding null events, adversarial events can be created in any space and time. However, additional adversarial events should be generated at the appropriate location and time to attack DNNs. The method proceeds in two stages. First, the location of additional adversarial events are set based on the null event’s loss gradient. An event is generated when the time value of a null event increases from 0 to the time interval $(0,1]$. If the generated event increases the loss, the generated event is assumed to have attacked the original event properly. Therefore, the position of loss gradient’s + component indicates the location where the original event should be attacked. The null events’ loss gradients are defined as $\nabla_{t_{l}}J(\theta,t_{l},y)$, where $t_{l}\in(0,1]$; $\theta$ is the model parameter; and $y$ is the true label. We use the location $(x_{l},y_{l},p_{l})$ of the top $p\%$ loss gradients to generate additional adversarial events. Then, we set the time of additional adversarial events. We initialized additional adversarial events as random values between 0 and 1. We use the PGD attack for the time perturbation of additional adversarial events. The overall procedure for generating additional adversarial events is explained in Algorithm 1.

After generating the adversarial events, we apply constraints on the adversarial events because events cannot occur simultaneously at the same location. Thus, when adversarial events are generated simultaneously at the same location, the adversarial events are separated by a minimum time resolution $\lambda$. In addition, the time values of adversarial events are limited in the interval (0, 1].

We mainly focus on the EST model (Gehrig et al. 2019) for the attacking target: MLP kernel, EST representation, and ResNet-34 (He et al. 2016) architecture. The MLP kernel consists of two hidden layers each with 30 units. The MLP kernel takes event times as input and derives the meaningful signal around it. The temporal bins in the EST are set to 10, 5, and 1.

We follow the settings in the original EST model (Gehrig et al. 2019) to train target models: ADAM optimizer (Kingma and Ba 2014) with an initial learning rate of 0.0001 that decays by 0.5 times every 1 epoch; weight decay of 0; the batch normalization momentum (Ioffe and Szegedy 2015) of $0.1$. We train the networks for 30 epochs for the event camera dataset.

We use N-Caltech101 dataset (Orchard et al. 2015) in our evaluation. N-Caltech101 is the event-based version of Caltech101 (Zhao, Dua, and Singh 2004). It was recorded with an ATIS event camera (Posch, Matolin, and Wohlgenannt 2010) on a motor. The event camera records the event from Caltech101 examples, while the motor is moving. N-Caltech101 consists of 4,356 training samples and 2,612 validating samples in 100 classes.

In this subsection, we evaluate the attack success rate of three methods for generating adversarial examples: shifting original events, generating additional adversarial events, and a combined method. The times of the original events are shifted with a PGD attack of $L_{\infty}$ norm. We set the number of iterations to $3$. We set the default attacker step size $\alpha$ to $0.5$ and divided $\alpha$ by the number of temporal bins $B$. The $\frac{\alpha}{B}$ is the attacker step size relative to the temporal scale. But the $\frac{\alpha}{B}$ is limited below $0.1$ for visual imperceptibility. The perturbation size is set to twice of the $\frac{\alpha}{B}$. When generating additional adversarial events, we selected only the top $1\%$ loss gradients of null events and assigned five null events to the location. The number of null events is related with the visual perceptibility of adversarial examples, but the attacker parameters of generating additional adversarial events had little effect on the perceptibility. Therefore, we set the attacker parameters larger compared to the shifting events: attacker step size to $0.01$, the perturbation size to $0.1$, and the number of iterations to $10$.

The attacking targets are EST, voxel grid, and two-channel representations models. EST (10), EST (5), and EST (1) have ten, five, and one temporal bin(s) for each polarity, respectively. Two-channel (1) has one temporal bin as EST (1), but it is derived by averaging the EST (10) temporal bins. Voxel grid (10) is derived by averaging the EST (10) polarity channels.

As shown in Table 1, shifting original events substantially reduces the model’s recognition performance because it distorts the features of the original events. This method achieves a 95.50% untargeted attack success rate with a small step size of $0.05$ for the EST (10). However, larger step size of $0.1$ is required to fool the EST (1) and two-channel (1). Generating additional adversarial events does not significantly reduce the recognition performance compared to shifting events. However, additional adversarial events improve the attack success rate of shifting events for most models.

Figure 6 shows the adversarial events of the EST (10) from Table 1. Shifting events changes the times of the original events, resulting in the color change in grid representation. Additional adversarial events create adversarial features in the grid representation. Visualization results show that all the attack method fool the deep learning model with imperceptible changes. More visualization results can be found in the supplemental material.

Large perturbations increase the attack success rate in general. In the adversarial attack on the event-based data, perturbation size relative to the temporal scale is more important. Temporal scale is determined by the temporal bins of grid representation model and the data frequency.

Tables 2 and 3 show the attack success rates for shifting events with different perturbation sizes. The step size is set to half of the perturbation size, and the number of iterations is set to three. As shown in Table 2, the attack success rates of the EST (10), EST (5), and voxel grid (10) do not increase continuously as the perturbation size increases. The attack success rate of EST (10) and voxel grid (10) is oscillating. For example, the optimal perturbation size is $0.05$ for attacking the EST (10) model. EST (1) and two-channel (1) have only one temporal bins, thus the attack success rates increase continuously.

Table 3 shows the attack success rates for the EST (10) with respect to data frequency and perturbation size. Data frequency is determined by the repeated movements of an event camera. We decrease the data frequency by half by using the first half of the time and normalizing the time to one. Our results show that the perturbation size is inversely proportional to the number of temporal bins $B$ and data frequency.

In this subsection, we use the proposed attack algorithm to train networks on the perturbed features. The goal of this adversarial training is to produce networks that perform well both on the original events and adversarial events. We started on the pretrained model and trained the models for 5 epochs with ADAM optimizer with initial learning rate of $0.00001$. Each model is trained with original events and adversarial events. Table 4 shows the robustness of each model to the attack methods. The results demonstrate that the adversarial training model improves the robustness on the adversarial events compared to the original model.

We feed adversarial events of EST (10), EST (1), and voxel grid (10) models to other models. Each model is trained with different weight initialization. Table 5 shows that adversarial events of EST (1) transfer to other models. However, adversarial events of EST (10) and voxel grid (10) hardly transfer to the EST (1). As the EST (10) and voxel grid (10) have smaller temporal scale in each temporal bin, the adversarial events of each temporal bin are merged into the larger temporal scale of the EST (1). Thus, the perturbations are eliminated in the EST (1). On the contrary, adversarial events of EST (1) perturbs the EST (10) and voxel grid (10) along all temporal bins without elimination.