Public-Domain Locator for Boosting Attack Transferability on Videos

Transfer-based attacks depend on commonalities between models. However, unique analysis patterns of different models cause overfitting to source models and limit transferability to the target model. In this paper, we argue that the public domain is the spatial-temporal commonality that contributes most to the recognition for most video models. For that, we propose a novel Public-Domain Locator (PDL) Attack method, which calculates adversarial perturbations on the public domain for different source models, reducing overfitting caused by the model-specific spatial-temporal analysis pattern to enhance the transferability of video attacks on the target model. To accurately localize these public domains between different models, a locator based on Multi-Agent Reinforcement Learning (MARL) is designed in our methods. The locator is trained using elaborately designed rewards received from multiple sources to adjust the public-domain selection strategy. Extensive experiments on nine mainstream video recognition models and the widely-used action recognition dataset Kinetics400 demonstrate that the proposed PDL attack outperforms state-of-the-art methods.