Inter-frame Accelerate Attack against Video Interpolation Models

Recent studies have researched how to generate adversarial examples for multiple tasks such as image classification and super-resolution. Szegedy et al. (Szegedy et al., 2013) first propose an optimization-based attack algorithm which shows that adversarial examples generating by adding a small amount of perturbation to the original images can fool CNNs successfully. Goodfellow et al. (Goodfellow et al., 2014) show the fast sign gradient sign method (FGSM) which shows a great performance by using the sign of gradients of the model. Kurakin et al. (Kurakin et al., 2018) further develop an iterative vserion of FGSM called I-FGSM which shows a higher performance than FGSM. Madry et al. (Madry et al., 2017) investigate a gradient-based method named projected gradient descent (PGD). Moosavi-Dezfooli et al. (Moosavi-Dezfooli et al., 2017) study the universality of adversarial examples and propose the universal attack based on images. Liu et al. (Liu et al., 2016) show the transferability of adversarial images and developed an ensemble-based algorithm. While most works are for higer level vision task, (Choi et al., 2019) evaluates the adversarial robustness of the super-resolution model which is a lower level vision task.
Besides, when all these studies above are based on images, Wei et al. (Wei et al., 2019) extend adversarial attack to videos by using the temporal propagation of perturbations. Chen et al.(Chen et al., 2021) propose appending adversarial frames for video recognition task. And Chen and Wei et al.(Chen et al., 2022) suggest a bullet-screen comments adversarial frame for specific videos. In this paper, we propose a different attack method on video interpolation which is a lower level vision task compared to other video recognition, to accelerate the generation process of adversarial examples.

Video Frame interpolation has been widely studied for a long time. Long et al. (Long et al., [n. d.]) propose a CNN to synthesize the intermediate frame directly. And Meyer et al. (Meyer et al., 2015) show a phase-based video interpolation approach to combine all of the phase information. Liu et al. (Liu et al., 2017) develop a 3D optical flow across space and time to generate the intermediate frame. Other than rely on optical flow, Niklaus et al. (Niklaus et al., 2017a, b) study the kernel-based methods to synthesize pixels for intermediate frames from a large neighborhood. Then Bao et al. (Bao et al., 2019) further combine the flow-based and kernel-based approaches to achieve a more considerable performance. Xu et al. (Xu et al., 2019) take acceleration information into consideration so that the network can perform better in large-motion condition. To handle complex motion in videos, Lee et al. (Lee et al., 2020) propose adaptive collaboration of flows. Besides, Choi et al. (Choi et al., 2020) introduce channel attention to video interpolation task which performs very well. Ding et al. (Ding et al., 2021) investigate a compression-driven design for video interpolation networks and implement it based on (Lee et al., 2020). Other than focus on the size of network, Kalluri et al. (Kalluri et al., 2020) propose 3D space-time convolutions to enable end-to-end learning and inference which largely improved the efficiency of video interpolation. However, the adversarial robustness of these VIF models is not investigated yet.

In order to make video frame interpolation models fail to generate high quality frames, we develop an attack algorithm based on Projected Gradeient Descent (PGD)(Madry et al., 2017) method, which is one of the most effective adversarial attacks for image tasks. For video frame interpolation model, we customize PGD attack by generating adversarial perturbation pairs for the previous and next one frame of the intermediate frame.

Let $I_{i}$ denote the $i$-th frame pair of the video and the corresponding attacked frame pair $\hat{I_{i}}$, and each frame pair contains two frames which are used to synthesis the intermediate frame. From these frames and video frame interpolation models $f(\cdot)$, we obtain intermediate frames $f(I_{i})$ and $f(\hat{I_{i}})$. Then our goal is to maximize the loss between ground-truth $I_{gt}$ and attacked frames. We can describe the problem as the following function:

Then we apply the PGD algorithm to generate $\hat{I_{i}}$, which maximizes $L(I_{gt},\hat{I_{i}})$ with the $l_{\infty}$-norm constraint. In the process, we update the perturbation iteratively added into original images which is denoted as $\widetilde{P}_{n}$ as the following function:

where $eps$ represents the amount of perturbation generated by each iteration and $sgn(\nabla L(I_{gt},\hat{I}_{n}))$ calculates the gradient of $L(I_{gt},\hat{I}_{n})$. And $n$ denotes the $n$-th iteration.

The parameter $\alpha$ limits the amount of perturbation added into original images so that we can ensure the perturbation is invisible. And $clip_{a,b}(\cdot)$ can be defined as

By iteratively updating $P_{i}$, we can obtain the final adversarial example by:

where $T$ is the number of iterations.

Non-targeted Attack. Although the basic attack (BA) method can generate imperceptible adversarial perturbations for video interpolation task, it costs too much time and computation resources to generate adversarial examples for each frame in the video. And unlike video recognition task which only need to mislead the model to output negative labels, to attack VIF models, we have to destroy every frame in the video which disables other video attacks. We propose a new method named Inter-frame Accelerate Attack (IAA) to accelerate the attack process. The intuition here is to make full use of the similarity between consecutive frames in the video. Due to the temporal continuity of adjacent frames in the video and the difference between them is often very small, it is possible for us to generate $P_{i}$ based on $P_{i-1}$. Algorithm 1 shows the process of our proposed IAA method.

Let $P_{i},i\in\{0,1,\dots,N-1\}$ denote the perturbation added to $i$-th input frame pair. In basic attack method, we set up the initial value for $P_{i}$ before the first iteration as zero. As can be seen in Algorithm 1, in IAA, we set the initial value as

By inheriting the perturbation information from the previous frame pair, it will be possible for us to reduce the amount of iteration while reaching the same attack performance. In our experiment, we halve the number of the attack iterations for input frames other than the first frame. By this way, we can save almost 50% attack time in the video frame interpolation task theoretically.

Targeted Attack. Although the basic attack and Inter-frame Accelerate Attack for VIF models can degrade the quality of generated intermediate frames, the deterioration is measured by PSNR and SSIM. We want to further explore the attack method to degrade the visual quality of intermediate frames. Targeted attack in image classification task aims to mislead the classifier to specific labels. And in super-resolution task, the targeted attack is to make the model generate images that are more similar to the target than the original ground-truth (Choi et al., 2019). Here, we apply targeted attack to VIF models so that the generated intermediate frame can be more similar to the target. To make that, we simply modify the Eq. 2 as

where $I_{t}$ is the target image.

Video frame interpolation task is a lower level vision task compared to video recognition task. We further extend our attack method to higher level vision tasks such as video recognition task. For this, we divide the frames in a single video to multiple frame groups $G$, where the number of frames in $G$ is more than the minimum required input frames for the video recognition model. Our goal is to fool the model to misclassify the video by generating adversarial perturbations based on gradients. For each group, we obtain the perturbations by:

where $1_{G}$ is the ground-truth label of the video, $n$ denotes the $n$-th attack iteration and perturbation $P$ is limited within [$-\alpha,+\alpha$], the same as Algorithm 1. Instead of initializing the perturbations as zeros, we use the perturbation values of the previous group which is from the same video as the initialization value.

where $i$ denotes the $i$-th group frames in the video and $T$ denotes the maximum iteration of $(i-1)$-th frame group.

Datasets. We use three datasets that are widely used for video frame interpolation methods: Middlebury, Vimeo90K, and UCF-101. The UCF-101 (Soomro et al., 2012) used in our experiments is the standard dataset collected from Youtube, which contains 13,320 videos with 101 action classes covering a broad set of activities. For ease of our experiments, we streamline it and take the first 50 frames of the first video in the 101 categories, the dataset applied in our experiments contains 101 sets of data, each set of data has 50 consecutive frames. The Vimeo90K (Xue et al., 2019) is a large-scale high-quality video dataset for lower-level video processing. Our work adopts the Septuplet part of the Vimeo90K dataset, which contains 7824 videos, each of which contains 7 consecutive frames. The Middlebury (Baker et al., 2011) consists of high-resolution stereo sequences with complex geometry and pixel-accurate ground-truth disparity data. We use the Middlebury-other dataset, after excluding data containing only 2 frames. The existing dataset contains 10 groups of data, each with 9 consecutive frames.

Metrics. We use Peak Signal-to-Noise Ratio (PSNR), Structural Similarity (SSIM) and attack time to measure the robustness of the VIF models against our adversarial attacks. For different datasets and VIF models, we respectively calculate the PSNR/SSIM values between the ground truth and the generated intermediate frame. Then, the PSNR/SSIM values between the ground truth and the video frame attacked by the attacks are calculated. Besides, we assist in understanding the performance of basic attack and IAA by recording the attack time. For different VIF models, the attack time of basic attack method is recorded for 15 and 30 iterations respectively. In our experiment settings, it can be concluded that the time of IAA method is similar to that of basic attack method for 15 iterations, but far less than that of 30 iterations, so it can be judged that our proposed IAA method has good performance.

Video Interpolation Models. Our experiments use seven advanced deep learning-based VIF methods with various model sizes and properties, including RRIN (Li et al., 2020), FLAVR (Kalluri et al., 2020), QVI (Xu et al., 2019), CAIN (Choi et al., 2020), CDFI (Ding et al., 2021), AdaCoF (Lee et al., 2020) and XVFI (Xu et al., 2019). QVI is a flow-based model, while FLAVR, CAIN, CDFI and AdaCoF are kernel-based. And XVFI is the first method proposed for 4K videos with large motion. In the experiments, we employ the pre-trained models provided by original authors. Table 1 shows their characteristics in terms of the number of model parameters, the number of convolutional layers, and class according to (Dong et al., 2022).

Implementation details. For all our methods, we generate two adversarial perturbations for the previous and next frame of the intermediate frame. We set the $\alpha\in\{0.01,0.02,0.04,0.08\}$ and $T\in\{15,30\}$. And we set $eps\in\{0.0005,0.001,0.002,0.003\}$ for each $\alpha$ value. Our adversarial attack methods are implemented on the pytorch framework, and running on one Nvidia V100-32GB GPU.

We evaluate the performance of basic attack and our proposed attack algorithm with UCF-101, Vimeo90K and Middlebury benchmark. Figure 4 shows the IAA attack performance on UCF-101 dataset in terms of PSNR and SSIM with different $\alpha$ values. PSNR and SSIM both decreases rapidly as $\alpha$ increases on all video interpolation models which is consistent with our intuition. For example, in terms of AdaCoF model, the PSNR/SSIM values for $\alpha$ = 0.01 and 0.08 are 20.14/0.76 and 13.61/0.45 with our IAA method, respectively. Figure 3 shows the visualized results of attacked intermediate frames as $\alpha$ increasing. It is noticeable that among all VIF models, FLAVR is specially vulnerable to adversarial examples. This may be contributed to its 3D space-time convolutions which contain the least convolutional layers. The statistics reveal that the VIF models are vulnerable to adversarial attacks.

When it comes to the comparison of different attack methods, Figure 4 also shows that our proposed method exhibits comparable performance to basic attack while decreasing the attack cost. When $\alpha$ is $0.08$, the quality degradation even becomes much more severe with our method which reduces the PSNR/SSIM values of most tested models except XVFI more than basic attack on UCF-101 dataset. This result is attributed to the exploitation of similarity between consecutive frames which means the adversarial perturbation inherits properties from previous frames. Figure 5 shows the visualized results of IAA attack on different video frame interpolation models. Though $\alpha$ is only $0.02$, the generated intermediate frames are wrapped so severe that it is impossible to be used in the video quality enhancement task.

Transferability. Figure 7 summarizes the transferability for deep learning-based video interpolation models on UCF-101 benchmark when $\alpha$ = 0.02. Transferability represents the possibility that a misclassified adversarial example is also misclassified by another classifier in image classification task. In this paper, we also evaluate the transferability of video interpolation task by using adversarial examples from other source models as inputs for the target model. And we measure the PSNR and SSIM value of the output intermediate frames in the experiment. The figure 7 shows that the adversarial examples do not transfer very well between different models. But we can see that the adversarial examples generated by QVI, XVFI, CAIN and RRIN can transfer better than the rest methods. One possible reason for the poor transferability is that lower level vision tasks like video frame interpolation generalize poorly on its original task. The inherit property determines the poor transferability on the task. However, the outputs’ PSNR values are still been declined by the perturbation generated by other source models to some extent.

Relation to model size. It can be seen that the adversarial robustness of different video frame interpolation models is slightly related to their model sizes. Figure 6 shows the relationship between model size and model’s robustness in terms of the number of model parameters and convolutional layers. For example, CDFI, a compressed version based on AdaCoF, performs better than its larger version in terms of PSNR values on adversarial examples. However, for models with different network architectures, the model size and robustness of deep learning-based video interpolation models is almost irrelevant.

Attack time. The major goal of our IAA method is to improve attack efficiency for generating adversarial examples for tons of frames in the video for frame interpolation tasks. We record the time cost to obtain high-performance adversarial examples on UCF-101 dataset. Figure 8 shows that our method only spends almost half of the time to complete the attack process while achieving the same degradation on PSNR/SSIM values which means that it has become much easier for us to attack a whole video in practice.

Experiments above has shown the effectiveness of IAA on VIF models, it achieves the best attack performance on most models in terms of PSNR, SSIM and attack time. We then do the ablation study to investigate the role of our proposed improved part playing in the attack. Based on basic attack, we initialize perturbation pairs for each intermediate frame as $P_{0}\sim\mathbb{N}(0,1)$ and constrain it in $[-\alpha,\alpha]$. Noted that, to evaluate the contribution of IAA, the attack iteration for basic attack here is the same as IAA which is 15.
Table 2 shows the results of the attack with $\alpha=0.02$ on UCF-101. Although each initialized perturbation in $BA_{random}$ are given a value which is comparable to IAA, the attack performance is not been improved evidently. For example, on CDFI model which is a compressed version of AdaCoF, the PSNR and SSIM is 31.32 and 0.8748 which means that the generated intermediate frames are still of high quality after $BA_{random}$ attack. But under the same settings, the metrics deteriorate to 19.81 and 0.7281 at the same time with IAA. In general, our proposed IAA performs much better than $BA_{random}$ which shows that it is our proposed initialization method improve the attack performance.

In our experiments, we apply white image as the target image because such target images with extreme values usually make people uncomfortable. Figure 9 shows the visualization results of the targeted attack. It is obvious that the visually attack performance for targeted attack is better than non-targeted attack. And it can be observed that the first two attack performance is relatively similar visually compared to the IAA. When it comes to IAA based attack, the visual attack performance become much better and The latter frames in the video is destroyed much more serious than the former ones visually. The same results are not observed on the other two attacks. The main reason is that for BA-based targeted attack, the attack iteration is not enough. But IAA-based targeted attack successfully inherit the information from previous ones which make up for the drawbacks of attack iteration.
Table 3 shows the comparison of PSNR and SSIM values of VIF models under targeted attacks on UCF-101. When $\alpha=0.04$, IAA performs the best on most VIF models except XVFI. The PSNR and SSIM results for targeted attack is similar to non-targeted attacks in which IAA achieves better attack performance while recuding the attack cost.

We adopt C3D as the target model to attack in our experiments. The model is trained on sports-1m dataset and fine-tuned on UCF-101 training set. We evaluate the accuracy and attack time of basic attack (BA) and IAA $\alpha\in\{0.01,0.02,0.04,0.08\}$ and $eps\in\{0.0005,0.001,0.002,0.003\}$ on UCF-101 test set. We adopt the iteration number as $T\in\{15,30\}$.