Adversarial Attacks on Video Object Segmentation with Hard Region Discovery

Semi-supervised Video Object Segmentation (SVOS) [25] aims to distinguish the pixel-wise object region in a video where the object is specified by the annotation of the first frame. Sometimes, it is also called one-shot VOS [26]. Current SVOS approaches can be mainly divided into two categories: 1) online learning; 2) offline learning. The online learning methods [18, 27, 28, 29] update and optimize model parameters by the historical prediction mask or ground-truth mask to obtain robust appearance representations during inference. However, they require video frames to optimize model parameters during inference. When video frames are attacked by perturbations, it has adverse impacts on the model optimization, thus degrading the segmentation performance.

Different from the online methods requiring model training during inference, the offline methods infer segmentation directly using the trained model, and they can be further divided into propagation methods and spatio-temporal matching methods. The propagation methods [30, 31, 32] propagate the mask of the first frame to other frames sequentially, but they exploit the temporal consistency of nearby frames and easily suffer from drastic object deformations in long videos. By contrast, the spatio-temporal matching methods [33, 19, 34, 35] achieve better segmentation effects by using the memory network to reveal the spatio-temporal relations of the historical frames and the current frames. Thus, this paper takes the spatio-temporal matching method as the target VOS model.

Adversarial attacks are implemented by adversarial examples [10, 36], i.e., applying small but almost human-imperceptible perturbations to clean data samples. When the sample is an image, its pixels are either partially or fully perturbed, and full perturbation is considered in this paper. Then, the adversarial example is used to fool a model to make incorrect estimations, which is called an attack. Generally, adversarial attacks can be divided into white-box and black-box attacks. The white-box attack [10, 7] exploits the model knowledge, including the structure, the parameters, and the trainable weights used for computing the gradients to generate the model-aware perturbations. By contrast, the black-box attack [37] has very limited or no knowledge about the model, so it yields the model-agnostic perturbations. Our work mainly focuses on while-box attacks, and provides the empirical studies on black-box attacks.

Image Classification. In computer vision, Szegedy et al. [36] first discovered that images with tiny perturbations can be used as adversarial examples to deceive image classifiers for making wrong predictions. Then, Goodfellow et al. [10] pointed out that due to the naturally linear characteristics, deep neural networks are susceptible to the deception of adversarial examples. The image gradients back-propagated by a model can be used to generate perturbations to deceive the classification network. Besides, Kurakin et al. [38] iteratively updated the adversarial examples by gradually adding perturbations to the source image. Moreover, Madry et al. [7] found that adding random perturbations to the source image at the initial iteration can increase the attack ability of adversarial examples. Additionally, most image classification networks adopt convolution operations, and the pixel-level features are easily affected by its adjacent regions. Therefore, Gao et al. [39] adjusted the image gradients and assigned those exceeding a threshold to the neighbors of each pixel, making adversarial examples more robust. Furthermore, Dong et al. [9] proposed a translation-invariant attack method, which equips the adversarial example with more transferability by employing image gradients on translated images.

Image Segmentation. Adversarial attacks [40, 41, 42] on semantic segmentation [43, 44] are often adapted from the attack methods on image classification. For example, Arnab et al. [40] found that the segmentation model using a deep neural network is vulnerable to adversarial examples; Xie et al. [41] investigated the influence of adversarial examples on object detection and semantic segmentation models simultaneously by a high-transferability attack method; Gu et al. [42] develop a model that creates more effective adversarial examples than PGD [7] under the same number of attack iterations.

Video Classification. For this task, Pony et al. [12] proposed a flickering temporal perturbation to deceive the classifier to generate wrong predictions. Existing anti-attack methods for classifiers usually rely on maximizing the probability of misclassification to obtain the gradient and then convert the gradient into perturbation. To capture more effective gradients, Li et al. [11] searched for better gradient update directions through the geometric transformation of the input frames, thus generating the desired deviations for improving the attack power. Additionally, Hwang et al. [45] focused on the structural vulnerability of action recognition, i.e., the influences of modeling temporal information in deep models.

Object Tracking. Unlike classification, object tracking [46, 47, 48] aims to capture the trajectory of the moving object in videos and produce a series of object bounding boxes. To this end, several attempts [14, 49, 50, 13, 15] have been made on the adversarial attacks for object tracking. For instance, Guo et al. [49] proposed an online and incremental sparse perturbation generation scheme in the spatial domain to ensure attack efficiency; Chen et al. [14] added perturbations only to the object area of the first frame. For multi-object tracking, Jia et al. [13] introduced a tracking error reduction process to attack the object detection and tracking model at the same time, causing the tracker to lose the object. Additionally, Jia et al. [15] attempted to generate more effective perturbations by optimizing the IoU (Intersection over Union) scores of the current and previous frames.

However, existing adversarial attack methods in the computer vision field are specially designed for certain tasks or models, so it is difficult to transfer them to the VOS model. For example, an adversarial attack approach for object tracking designs a regression loss against the object bounding box in the tracker to generate perturbations. Such a regression loss fails to handle the pixel-level classification task like VOS. Meanwhile, the video classification model is designed to assign the video with one label from predefined categories, but VOS is a class-agnostic task. Besides, the attack methods against the image classifier or semantic segmentation model aim to deceive the target model from one semantic class to another in predefined categories, which does not hold for VOS. Therefore, it is desirable to develop an adversarial attack method specially for the VOS task.

Our attacker concentrates on the most popular semi-supervised VOS models during inference. Formally, the already-trained VOS model is defined as $\Phi(\cdot)$ with the parameters $\theta$. Given a video $\mathcal{V}=\{\mathbf{I}_{t}\in\mathbb{R}^{H\times W\times 3}|t=1,\ldots,T\}$ and the ground-truth mask $\mathbf{Y}_{1}\in\mathbb{R}^{H\times W}$ of the first frame $\mathbf{I}_{1}$, the goal of the segmentation model is to produce the prediction mask $\mathbf{\hat{Y}}_{t}\in\mathbb{R}^{H\times W}$ of all remaining frames. Here, $H$ is the frame height, $W$ is the frame width, $t$ is the frame index, and $T$ denotes the total number of frames. Each foreground pixel of the mask is set to 1, while the background pixel is set to 0. If there are multiple objects, each object corresponds to a binary classification problem. Thus, VOS is an object class-agnostic task. In this setting, this work manipulates only the first frame by adding a small human-imperceptible perturbation $\bm{\eta}\in\mathbb{R}^{H\times W\times 3}$ to generate the adversarial example, i.e., $\mathbf{I}_{1}^{adv}=\mathbf{I}_{1}+\bm{\eta}$, which is used to mislead the model to degrade the segmentation performance on the subsequent frames. Thus, the inference process produces the attacked mask sequence $\hat{\mathcal{Y}}^{adv}=\{\mathbf{\hat{Y}}_{t}^{adv}\}_{t=2}^{T}$, whose entry is represented as

To generate the perturbation $\bm{\eta}$, this paper follow the gradient-based adversary, i.e., the fast gradient sign method [10], which linearizes the cost function $\mathcal{L}_{1}(\cdot)$ around the current value of $\theta$ and utilizes the back-propagation gradients to generate the max-norm constrained perturbation

where $\mathcal{L}_{1}(\cdot)$ is the CE loss, $\nabla_{\mathbf{I}_{t}}$ denotes the gradient with regard to the $t$-th frame $\mathbf{I}_{t}$ obtained by back-propagation according to $\mathcal{L}_{1}(\cdot)$, the constant $\epsilon>0$ is the upper-bound perturbation value and is set to $8/255$, and $\text{sign}[\cdot]$ denotes a sign function that maps all input gradient elements to a discrete set $\{-1,0,1\}$. Here, $(-\epsilon,+\epsilon)$ forms a ball of the infinite norm.

In this paper, the spatio-temporal matching-based VOS model is adopted as the target model for attacking, and the early work Space Time Memory (STM) networks [19] of this type is taken as an example. The target model processes from the second frame in the video sequence using the ground-truth mask $\mathbf{Y}_{1}$ of the first frame, resulting in the prediction masks $\{\mathbf{\hat{Y}}_{2},\ldots,\mathbf{\hat{Y}}_{t-1}\}\in\mathbb{R}^{H\times W}$. When processing the current frame $\mathbf{I}_{t}$, the past frames with predicted object masks are used to establish a pair-wise memory set, i.e., $\mathcal{M}=\{(\mathbf{I}_{1},\mathbf{Y}_{1}),(\mathbf{I}_{2},\mathbf{\hat{Y}}_{2}),\ldots,(\mathbf{I}_{t-1},\mathbf{\hat{Y}}_{t-1})\}$. The memory set provides long-range spatio-temporal visual semantics, which helps to distinguish the object from the background in a frame.

Meanwhile, the frame-mask pairs in the memory set are fed into one ResNet [21] encoder to produce the past frame feature subspace, and the current frame is fed into the other encoder to produce the current frame feature subspace. Then, spatio-temporal matching is performed in the feature subspace, i.e., the pixel class of the current frame is inferred from that in past frames (the elements of the predicted mask reflect the pixel-wise binary classes) according to the semantic similarity, generating a class feature map of the current frame. Then, this class feature map is exploited to produce the mask of the current frame by a softmax function after several convolution layers with bi-linear interpolation. Thus, the mask sequence is produced by $\mathbf{\hat{Y}}_{t}=\Phi(\mathcal{M},\mathbf{I}_{t};\theta)\in\mathbb{R}^{H\times W}$.

To attack the VOS model, the perturbation (i.e., vanilla noise) in Eq. (2) is weak, as VOS is actually a pixel-wise binary classification problem. The pixel class label is either foreground or background, and the object class remains unknown. Such a binary problem increases the attack difficulty. This is because it is easy to deceive the model for randomly picking one wrong class from several candidates in a multi-class problem, but it becomes more difficult when there is only one candidate. For example, given a ten-class problem, the probability of a successful attack is $0.9$ in theory, which decreases to 0.5 for binary classification. Inspired by this, our work develops an ARA method to strengthen the attack power of adversarial examples, and the whole framework is drawn in Fig. 1.

In practice, segmentation errors usually occur in the pixel area where the foreground and the background are easily confused, e.g., similar appearance, vague boundary, and salient background (like large trees). Thus, the possibly-confused pixel area is the hard region that requires more emphasis, and it is often vulnerable to perturbations. That is, perturbing the hard region of the frame can produce a stronger adversarial example. To this end, this paper designs a Hard Region Learner (HRL) to derive a hardness map, which reveals how difficult each pixel is to be correctly segmented. The hardness map and the vanilla noise in Eq. (2) are incorporated by the element-wise product operation to generate a stronger perturbation. The details are described below.

Our attacker adopts the white-box attack and exploits the image gradients obtained from the back-propagation in the model. Both the vanilla noise map and the hardness map are learned from the gradient map of the first frame $\mathbf{I}_{1}$, and the gradient map $\mathbf{G}$ is obtained by

where the memory subset $\mathcal{M}^{\prime}$ contains two nearby frames of the first frame and their prediction masks, i.e., the second and the third frame-mask pairs. Here, using two nearby frames follows the model training process [19], which stacks three frames in the GPU memory for efficiency. If more powerful GPUs are available, more frames can be considered. The $\mathcal{L}_{1}(\cdot)$ represents the segmentation loss between the prediction mask $\hat{\mathbf{Y}}_{1}=\Phi(\mathcal{M}^{\prime},\mathbf{I}_{1};\theta)$ and the ground-truth mask $\mathbf{Y}_{1}$ of the first frame. The gradient values are generally smaller than the original image pixel values, and the layer normalization [51] strategy is adopted to normalize the gradient values along each channel.

By default, the vanilla noise map is denoted as $\bm{\eta}_{1}\in\mathbb{R}^{H\times W\times 3}$, which is calculated by Eq. (2). To capture the hardness map, this paper uses convolution neural networks to construct the HRL $\Omega(\cdot)$ and adopts the light ResNet18 [21] as the backbone.The ResNet involves four stages and each stage has a resolution downsampling ratio, i.e., $\{1/4,1/8,1/16,1/32\}$, for the learned feature map. To keep a large spatial resolution of the feature map, only the former two stages, followed by one convolution layer with a kernel size of $3\times 3$, are employed to discover the hard region from the frame. Then, the bilinear upsampling $\text{Upsample}(\cdot)$ and the sigmoid function $\sigma(\cdot)$ are performed on the obtained feature map to obtain the hardness map, i.e.,

where $f(\cdot)$ represents the modified ResNet module, and the bilinear upsampling is employed to scale the feature map up to the same size as the input frame. The scores in the hardness map fall between 0 and 1. The higher the hardness score, the more difficult the pixel is for segmentation.

Optimization of the HRL. To solve the problem that the ground-truth hardness map is unavailable for optimizing the hardness loss function, this paper introduces the hardness pseudo-label map as the supervisor to guide the hard region learning. Particularly, the segmentation loss $\mathcal{L}_{1}(\cdot)$ calculated in the already trained VOS model is used to generate the hardness pseudo-label map. The rationale is that the segmentation loss of a well-trained model is minimized during training, and a large proportion of the pixels are expected to produce small loss values while only a small set of pixels have large values. Generally, a large loss value indicates that the corresponding pixel is difficult to separate from the foreground and background. And the CE loss is adopted as the segmentation loss.

The pixel class labels are the entries of the ground-truth mask $\mathbf{Y}\in\{0,1\}^{H\times W}$, which is flattened into a long vector $\mathbf{y}=[y_{i}]_{i=1}^{n}\in\{0,1\}^{n}$, where $n=H\times W$, and the index $i$ specifies the spatial position of each pixel in the mask. Similarly, the prediction mask $\hat{\mathbf{Y}}\in\mathbb{R}^{H\times W}$ is flattened into a long vector $\hat{\mathbf{y}}=[\hat{y}_{i}]_{i=1}^{n}\in\mathbb{R}^{n}$, whose entries denote the probability of the pixel belonging to the object class. The CE loss is defined as $-\mathbf{y}\log\hat{\mathbf{y}}$, and a thresholding strategy is adopted to generate the hardness pseudo label vector $\mathbf{z}$, whose entries are obtained by

where $\alpha>0$ is an empirical threshold, $\log(\cdot)$ denotes the natural logarithm, and $\mathbf{z}=[z_{i}]_{i=1}^{n}\in\{0,1\}^{n}$. Then, the obtained pseudo-label vector is reshaped to the hardness pseudo-label map $\mathbf{Z}\in\{0,1\}^{H\times W}$ of the first frame. The pixels with loss values larger than the threshold indicate they are difficult to segment, and those with loss values smaller than the threshold are relatively easier to segment.

After the hardness pseudo-label map $\mathbf{Z}$ and the hardness map $\hat{\mathbf{Z}}$ are obtained, the objective function of the HRL is defined in a vector form as

where $\hat{\mathbf{z}}\in\mathbb{R}^{n}$ is a flattened vector of the matrix $\hat{\mathbf{Z}}$, and the operator $\|\cdot\|_{2}$ denotes the $\ell_{2}$ norm and is a $\ell_{2}$-loss. In this way, the optimal hardness map can be obtained by minimizing the error between the two hardness maps, i.e., $\mathbf{E}=\mathbf{Z}-\hat{\mathbf{Z}}$.

During the VOS inference, only the first frame $\mathbf{I}_{1}$ is attacked, and its adversarial example $\mathbf{I}_{1}^{adv}$ is generated by imposing the perturbation $\bm{\eta}^{\prime}$. This perturbation considers the hard pixel areas discovered by the HRL with the vanilla noise in Eq. (2). Meanwhile, an iterative scheme is adopted to generate a strong adversarial example.

In the initial period, the perturbation is the random noise $\bm{\eta}_{0}^{\prime}\in[-\epsilon,\epsilon]^{H\times W\times 3}$, which is added to the first frame for the next iteration. The maximum iteration number is $K$, which is set to 10 for efficiency. If the perturbation in the $r$-th iteration is $\bm{\eta}_{r}^{\prime}$, then the corresponding adversarial example is represented as:

where $\text{Clip}_{\mathbf{I}_{1},\epsilon}(\cdot)$ squeezes the numerical range of the input frame to a range $[(\min(\mathbf{I}_{1})-\epsilon,\max(\mathbf{I}_{1})+\epsilon]$. Here, $\min(\cdot)$ and $\max(\cdot)$ are the minimum and the maximum function of pixel values, respectively.

Perturbation Update. To update the perturbation, the gradient map $\mathbf{G}_{r}$ of the first frame like Eq. (3) is first calculated according to

where the model parameters $\theta$ are fixed during back-propagation. Then, the gradient map $\mathbf{G}_{r}$ is taken as the input of Eq. (4) to derive the hardness map $\hat{\mathbf{Z}}_{r}$, which is replicated for a triple of maps to form the hardness tensor $\hat{\mathbf{Z}}_{r}^{\prime}\in\mathbb{R}^{H\times W\times 3}$. Meanwhile, the gradients are projected to a set $\{-1,0,1\}$ by a sign function, i.e., $\mathbf{G}_{r}^{\prime}=\text{sign}(\mathbf{G}_{r})$. Finally, an element-wise product is made between the hardness tensor and the sign gradient tensor, resulting in the updated perturbation as

where the constant $\beta>0$ governs the numerical range of the perturbation, and $\odot$ denotes an element-wise product. As the iteration continues, the perturbation ability is strengthened, thus generating a stronger adversarial example. The final adversarial example $\mathbf{I}_{1,K}^{adv}$ is fed into the VOS model to generate a sequence of attacked masks.

Besides Eq. (9), other perturbation generation schemes [39, 7, 52] also using the gradient-based adversarial attack can be adopted by simply adding the element-wise product of the hardness map to its vanilla noise. This enables our attacker to be generalized to more scenarios easily.

Our proposed Adversarial Region Attack (ARA) method is a white-box attacker, and its primary procedure is briefly summarized in Algorithm 1. The ARA attacker is developed for attacking an already well-trained VOS model $\Phi$ with the parameter $\theta$.

Given a video sequence $\mathcal{V}$ with $T$ frames and the first frame mask $\mathbf{Y}_{1}\in\mathbb{R}^{H\times W}$, our attacker obtains the gradient map $\mathbf{G}\in\mathbb{R}^{H\times W\times 3}$ of the first frame. Then, by using the gradient map, the hardness map $\mathbf{\hat{Z}}_{r}\in\mathbb{R}^{H\times W}$ is obtained via the HRL (ResNet). Next, the vanilla noise and the hardness map are unified, and the attacker produces an adversarial example $\mathbf{I}_{1,r+1}^{adv}$ by iteration. Finally, by replacing the first frame with the adversarial example as the input of the VOS model, our attacker can fool the model to degrade the segmentation performance.

Besides the white-box ARA attacker, this paper provides its black-box version since the model structure, parameters, and gradients are unknown to users in many situations. Most of the procedures are the same as those in Algorithm 1 except for the perturbation update. For the black-box attack, the initial perturbation is also the random noise added to the first frame and is updated in iteration without gradients, but the perturbation update is simple:

where the constant $\beta>0$ governs the numerical range of the perturbation.

In addition, this paper explores the adversarial training of the white-box ARA attacker to investigate its defense performance. For the pre-trained VOS model $\Phi(\cdot)$ with the parameter $\theta$, the perturbation derived from the ARA attacker is added to the first frame to obtain the attacked training set. Then, the model $\Phi(\cdot)$ is trained by using the attacked training set, and the segmentation performance of the updated VOS model $\Phi^{\prime}(\cdot)$ is investigated.

DAVIS2016 [22]¹¹1https://davischallenge.org/davis2016/code.html contains a total of 50 video sequences, and there are 3,455 video frames with ground-truth (GT) annotations. Each video sequence contains only a single object, and there are 50 objects in total. The video contents mainly include animals, sports, vehicles, etc. Here, 30 video sequences are used for training and 20 video sequences are used for validation.

DAVIS2017 [23]²²2https://davischallenge.org/davis2017/code.html is expanded on DAVIS2016 by increasing the number of videos to 150, and there are 10,459 video frames with GT annotations. Meanwhile, annotations for multiple objects are added, and there are 376 objects in total. The dataset is split into four subsets, namely, training set, validation set, test-dev set, and test-challenge set. Among them, the training set contains 60 videos, while the validation set contains 30 videos, and GT mask annotations are provided.

YouTube-VOS [24]³³3https://competitions.codalab.org/competitions/20127 has three subsets, namely, training set, validation set, and test set. Among them, the training set contains 3,471 videos, and there are 65 object categories, with a total of 6,459 object instances; the validation set contains 507 videos with 1,063 object instances, and 65 of its object categories also appear in the training set, while 26 categories do not; the test set contains 541 videos with 1,092 object instances, and 65 object categories also appear in the training set, while 29 categories do not. Note that each video in the validation set only provides the GT mask of the first frame, and the final evaluation results need to be uploaded to the official server.

A2D Sentences [54]⁴⁴4https://kgavrilyuk.github.io/publication/actor_action/ is extended from the Actor-Action Dataset [55] by adding textual descriptions for each video. It contains 3782 videos annotated with 8 action classes performed by 7 actor classes and 6,655 sentences. For each video, there are 3 to 5 frames annotated with pixel-wise segmentation masks. The dataset is split into a training set and a test set with 3,036 and 746 videos, respectively.

Among them, and the attack performance for semi-supervised VOS models on the former three datasets is examined, which is the focus of this work. Without loss of generality, all experimental results are reported on the validation set except for A2D Sentences. Additionally, the performance of our attacker for several unsupervised VOS models and referring VOS models is investigated by using the DAVIS2016 [22] validation set and the A2D Sentences [54] test set, respectively.

Following previous works [19][35], the same evaluation metrics on the benchmarks are adopted in this paper. For DAVIS2016 and DAVIS2017 datasets, region similarity $\mathcal{J}$ and contour accuracy $\mathcal{F}$ [22] are used, where the former measures the IoU ratio between the prediction mask and the ground-truth mask, and the latter measures the F1 score of the predicted and ground-truth masks at the object contour pixels. Overall, $\mathcal{J}$&$\mathcal{F}$ represents the mean of region similarity and contour accuracy, which evaluates the overall segmentation performance of the VOS model.

For YouTube-VOS [24], this paper uses the same $\mathcal{J}$ and $\mathcal{F}$ provided by the official server ⁵⁵5https://youtube-vos.org/dataset/vos/. Since the semantic categories of some objects in the validation set do not appear in the training set, the validation set is further divided into two subsets, i.e., seen and unseen sets, where the seen subset contains the videos with seen categories in the training set, and the unseen subset contains the videos with unseen categories in the training set. The average of each metric is calculated on each subset to obtain $\mathcal{J}_{seen},\mathcal{J}_{unseen},\mathcal{F}_{seen}$, and $\mathcal{F}_{unseen}$. The global index $\mathcal{G}$ is the mean of the above four metrics of the seen and unseen subsets.

The first frame of the videos in the validation set is attacked by adding almost human-imperceptible perturbations. The maximum perturbation value $\epsilon$ in Eq. (7) and the constant $\beta$ used in Eq. (9) are both set to $8/255$, while the threshold $\alpha$ is set to $-\log(0.4)$. During the perturbation update, the maximum iteration number of the iteration-based attack is set to 10, and the Adam optimizer [56] is adopted to obtain the gradient map with a learning rate of 0.1 and a weight decay of 0.01.

Attackers. To comprehensively evaluate the effect of our ARA attacker against the VOS model, several gradient-based adversarial attack methods are taken for comparison, including FGSM [10], BIM (Basic Interactive Method) [38], PGD (Projected Gradient Descent) [7], TI (Translation-Invariant attack Method) [9], PI (Patch-wise Iterative FGSM) [39], VMI (Variance tuning Momentum Iterative FGSM) [52], AutoAttack [58], SegPGD [42], and ALMA (Augmented Lagrangian Minimal Adversarial perturbation) [59]. Among them, FGSM is an non-iterative attack methods. FGSM is proposed by Goodfellow et al. [10], who pointed out that the vulnerability of deep neural networks comes from its linear characteristics. Note that our method just uses the already trained VOS models, and other attackers need modification for attacking these models.

Semi-supervised VOS models. This paper compares the attack power of different adversarial attack methods on several spatio-temporal matching based semi-supervised video object segmentation (SVOS) models, including STM [19], HMMN [35], STCN [33], and AOT (Associating Objects with Transformers) [57]. Note that AOT Large version with ResNet50 backbone (AOTL-R) and the Large version with Swin Transformer [60] backbone (AOTL-S) are adopted here.

Unsupervised VOS models. They segment the objects in a video without any user annotation [61][62], and our attacker is also applied to several unsupervised VOS models, including COSNet (CO-attention Siamese Network) [63], MATNet (Motion-Attentive Transition Network) [20], and FSNet (Full-duplex Strategy Network) [64]. Among them, COSNet adopts a global co-attention mechanism to capture the inherent correlation across all video frames in the video, and it only utilizes the appearance feature, thus avoiding the time-consuming optical flow extraction like MATNet and FSNet.

Referring VOS models. They segment the objects in a video with textual descriptions [65][66], and the referring VOS models examined in this paper include RefVOS (Referring video object segmentation) [67], MTTR (Multimodal Tracking Transformer) [68], and ReferFormer [69]. Among them, RefVOS utilizes a semantic segmentation model along with a language processing model to segment the language referred target object frame by frame, but it fails to incorporate rich spatial temporal features of the video. MTTR handles both text and frames in a single transformer. It not only captures rich spatial-temporal features but also associates the language feature and video feature at both word and pixel levels. Similar to MTTR, ReferFormer is also a transformer-based approach with a better feature backbone and more complex network architecture that requires more training data, and it has three versions, i.e., ReferFormer-T/S/L, where the “T/S/L” indicates a tiny, small, and large version of video Swin Transformer [70].

All ablation studies are conducted by attacking the semi-supervised VOS model, i.e., STCN [33], on the DAVIS2017 validation set.

HRL Backbone. To investigate the influence of the backbone on the HRL, several popular deep neural networks are compared in Table V, including VGG16 [71], MobileNetV3-large [72], InceptionV3 [73], DenseNet121 [74], and ResNet-18/34/50 [21], which are pre-trained on the ImageNet [75] database. The last fully-connection layer and pooling layer of these neural networks are removed to derive the feature map of the input frame. Besides the common evaluation metrics, some statistics of these backbones are shown, such as the model parameters in #Params (Million), the computational complexity in GFLOPs (Giga Floating Point Operations) with a $480\times 854\times 3$ gradient map as the input, and average time of attacking a video in seconds. Among the backbones, ResNet18 achieves the best attack performance with the fastest speed 5.8 s per video and modest parameters. The larger backbones like InceptionV3 and ResNet50 are more difficult to optimize because there are too many parameters to learn, leading to inferior attack results.

Attack Variant. Table VI presents the attack performance of the adversarial example generated by the HRL with several gradient-based attack methods, including PI [39], VMI [52], and PGD [7]. Our attacker takes advantage of unifying both PGD and the HRL, and it degrades the segmentation performance the most by 4.1% in terms of $\mathcal{J}$&$\mathcal{F}$, as indicated by the bottom row in Table VI. Meanwhile, when using the HRL for PI and VMI, the attack performances are improved by 1.6% and 1.9%, respectively, which justifies the good transferability of our HRL.

Hardness Loss. This paper adopts the Mean Squared Error (MSE) as the hardness loss function, and Table VII shows the attack performance of other loss functions, such as Mean Absolute Error (MAE) and CE. Among the three losses, MSE leads to the worst segmentation results when attacking the VOS model, which indicates it is the best choice for computing the hardness loss of the gradient map. Compared with MAE, the MSE function is smoother and easier to optimize.

Norm of Gradient Map. Table VIII shows the impacts of different norms applied to the gradient map $\mathbf{G}_{r}$, including $\ell_{\infty}$-norm, i.e., the $\epsilon\text{sign}(\cdot)$ function in Eq. (9), $\ell_{2}$-norm, and $\ell_{1}$-norm. It can be seen that the $\ell_{\infty}$-norm has the most powerful attack ability on the segmentation model, and $\ell_{2}$-norm is slightly better than $\ell_{1}$-norm by perturbing the first video frame.

Parameter Sensitivity. When the threshold $\alpha$ of the hardness pseudo-label map varies from $-\log(0.1)$ to $-\log(0.9)$, the attack results are illustrated in Fig. 2(a). When $\alpha$ takes $-\log(0.4)$, the attacker performs the best. Meanwhile, the sensitivity of $\epsilon$ and $\beta$ on the perturbation is investigated by increasing the value from $1/255$ to $128/255$, and the performances are presented in Fig. 2(b). Although the segmentation performance of $\epsilon$ drops quickly after $32/255$, the perturbation becomes more easily visible to human eyes. Thus, following [10], this paper set $\epsilon$ to $8/255$. Since the performance saturates after $\beta$ equals $16/255$, so the same value of $\epsilon$ is used here.

Attacked Region and Frame. To further explore our attacker, Fig. 3 illustrates the VOS performance by adding perturbations to different regions of the first frame and different numbers of frames. It can be seen from Fig. 3(a) that the segmentation performance degrades gradually when the percentage of the attacked region increases from 10% to 100%. Compared with other alternatives, such as FGSM [10], BIM [38], TI [9], and VMI [52], our ARA attacker exhibits more powerful attacking ability as indicated by the much steeper curve. As shown in Fig. 3(b), our attacker greatly degrades the VOS performance with the increasing number of frames attacked, e.g., the $\mathcal{J}$&$\mathcal{F}$ decreases from 82.5% to 67.2% with a margin of 15.3%. Besides, BIM [38] and PGD [7] have stronger attacking power than other alternatives.

Attack Transferability. To explore the transferability of the attack, we choose the STCN [33] model as the surrogate, which generates adversarial examples to attack other VOS models, including STM [19] and HMMN [35]. The transferring attack results are shown in Table IX. From the table, we see that the attack transferability seems weak on other segmentation models, which might be the reason that the white-box attack methods usually depend on the model gradients, and the different VOS models propagate distinct gradients, leading to the inferior transferability. Moreover, compared to PGD [7] and SegPGD [42], the model transferability of our ARA attacker is better. This is because our attacker focuses on the hard region area where the foreground and the background are easily confused.

To investigate the performance of our black-box version, this paper compares several SOTA alternatives including OP [76], SimBA [77], and DE (Differential Evolution) [78] to attack the first video frame against the VOS models. Among them, OP generates one-pixel adversarial perturbations based on differential evolution and requires less adversarial information, SimBA randomly samples a vector from a predefined orthonormal basis and either adds to or subtracts it from the target frame, and DE is an approximated gradient sign method that uses differential evolution to solve the black-box adversarial attack problem, by searching the gradient sign rather than the perturbation. The results for three benchmarks are presented in Table X.

It can be seen from Table X that our black-box ARA attacker generates consistently powerful perturbations to the VOS models by attacking only the first video frame, e.g., the VOS performance degrades by at most 6.5%, 5.8%, and 4.7%, on DAVIS2016 [22], DAVIS2017 [23], and YouTube-VOS [24], respectively. Meanwhile, our ARA algorithm leads to larger performance drops than the compared methods, demonstrating its stronger attack power.

To investigate the defense performance of adversarial training, our ARA attacker and the PGD [7] attacker are taken as an example to generate attacked frames for training robust semi-supervised VOS models STM [19] and STCN [33]. The results are presented in Table XI. In detail, perturbations are added to the first frame of the videos from the training sets in DAVIS2017 [23] and YouTube-VOS [24], and the perturbed frames are used to conduct adversarial training for obtaining robust VOS models. Note that the original pre-training with clean videos is completed before the adversarial training with attacked videos, and the perturbation parameters are kept the same as those on the attacker.

According to Table XI, the top group shows the VOS performance of the adversarial training or the white-box attack using the PGD and our attacker individually. The first row shows the original segmentation performance as a baseline without any attack or defense. Rows 2 and 3 show that our attacker degrades the performance more significantly than PGD by 2.2%; Rows 4 and 5 indicate that the VOS model performance is slightly affected by adversarial training of both PGD and our attacker. The bottom group lists the records of the defense results against the attack by the PGD and our attacker. Rows 6 and 7 show that the adversarial training with our method is robust to the VOS model attacked by PGD, and our attacker has higher model robustness than PGD when the video frames are attacked by our ARA method, as indicated by the last two rows. Therefore, the overall defense performance of our ARA method is promising.

To illustrate the attack performance, several videos were randomly chosen from DAVIS2017 [23], and the first frame of each video is attacked against the VOS model, i.e., STCN [33], which adopts ResNet as the backbone. As illustrated in Fig. 4 where each color indicates one object, it is almost impossible to perceive the perturbation added to the adversarial example (Row 2) by human eyes, indicating the good safety of our attacker.

For the test examples in Row 3, the VOS model obtains satisfactory segmentation results (Row 4), while the PGD [7] attacker and our ARA attacker (including white-box and black-box) successfully fool the model to make incorrect pixel predictions indicated by the red area of Rows 5 to 7. For the PGD attacker, the proportion of its prediction error pixels is less than that of our attacker, demonstrating that the developed ARA attacker produces adversarial examples with a stronger attacking power. Also, for our ARA attacker, the power of the white-box attacker is better than that of the black-box one, i.e., the red error area is larger. This is because the white-box setting can employ the gradients during the optimization, but the gradients are unavailable for the black-box setting. Moreover, our method has a satisfactory defense effect against the ARA attacker, as the red error area is greatly reduced compared to those results in the above rows.