Quality-Preserving Imperceptible Adversarial Attack on Skeleton-based Human Action Recognition

2026-06-11 · Source: Computer Vision and Pattern Recognition · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, quick

Summary

A novel quality-preserving imperceptible adversarial attack targets skeleton-based human action recognition (S-HAR) systems, addressing limitations of prior methods that introduce perceptible noise and degrade motion quality. Researchers discovered this degradation stems from a gap between empirical and true risks during optimization. Their proposed distribution-based adversarial attack method generates adversarial motions without compromising natural motion quality, avoiding noise-like perturbations. To accurately assess post-attack motion quality, a new metric aligned with human perception of naturalness was introduced. Experiments conducted on state-of-the-art S-HAR methods across two datasets demonstrated the method's superior attack success rate and preserved motion quality through both qualitative and quantitative analyses, highlighting significant robustness concerns for current action recognizers.

Key takeaway

For Computer Vision Engineers or AI Security Engineers deploying skeleton-based human action recognition (S-HAR) systems, you must recognize the heightened vulnerability to sophisticated, imperceptible adversarial attacks. Your current S-HAR models may be compromised without visible degradation, necessitating immediate focus on developing robust defenses. Prioritize research into mitigating distribution-based attacks and integrating human perception-aligned quality metrics into your security evaluations.

Key insights

Imperceptible, quality-preserving adversarial attacks on skeleton-based human action recognition are achievable by minimizing the empirical-true risk gap.

Principles

• Adversarial attack perceptibility links to risk gap.
• Motion quality preservation is feasible for attacks.
• Human perception guides motion quality metrics.

Method

A distribution-based adversarial attack minimizes the empirical-true risk gap, generating quality-preserving adversarial motions without noise. A new human perception-aligned metric evaluates motion naturalness.

Topics

• Skeleton-based Human Action Recognition
• Adversarial Attacks
• Motion Quality Preservation
• Distribution-based Attacks
• Computer Vision Security
• AI Robustness

Best for: Research Scientist, AI Scientist, Computer Vision Engineer, AI Security Engineer

Related on AIssential

• Quality-Preserving Imperceptible Adversarial Attack on Skeleton-based Human Action Recognition — Adversarial attacks on S-HAR can be imperceptible by preserving motion quality through distribution-based optimization.
• Adversarial Flow Matching for Imperceptible Attacks on End-to-End Autonomous Driving — AFM leverages Flow Matching to create imperceptible, transferable gray-box attacks against Transformer-based autonomous driving systems.
• When Actions Disappear: Adversarial Action Removal in Self-Play Reinforcement Learning — Adversarial action removal severely degrades self-play RL agents by targeting high-value decision points, with no recovery.
• Friday Squid Blogging: Regulating Squid Fishing in the South Pacific — The "gap twixt physical object and sensor" makes digital identity verification inherently vulnerable to circumvention.
• Hierarchical Attacks for Multi-Modal Multi-Agent Reasoning — HAM3 reveals how hierarchical attacks across perception, communication, and reasoning layers compromise multi-modal multi-agent systems.
• Cross-Domain Human Action Recognition from Multiview Motion and Textual Descriptions — A new orientation-aware ZSAR method combines multiview motion and text descriptions to overcome domain shifts from varying human orientations and camera viewpoints.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Computer Vision and Pattern Recognition.