Quality-Preserving Imperceptible Adversarial Attack on Skeleton-based Human Action Recognition

2026-06-11 · Source: Takara TLDR - Daily AI Papers · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, quick

Summary

A new quality-preserving imperceptible adversarial attack targets skeleton-based human action recognition (S-HAR) systems, addressing a critical flaw in existing methods. Previous attacks introduce noise-like perturbations that degrade motion quality, making them perceptible and less effective against advanced S-HAR systems. Researchers discovered this degradation stems from a gap between empirical and true risks during optimization. Their proposed distribution-based adversarial attack method generates adversarial motions without compromising motion quality, avoiding noise-like perturbations. To accurately assess motion quality, a novel metric aligned with human perception of naturalness is introduced. Experiments conducted on leading S-HAR methods across two datasets demonstrate the method's superiority in both attack success rate and post-attack motion quality, raising serious concerns about the robustness of current action recognizers.

Key takeaway

For AI Security Engineers evaluating the robustness of skeleton-based human action recognition (S-HAR) systems, this research indicates that current defenses against adversarial attacks may be insufficient. You should prioritize enhancing your models' resilience against quality-preserving, imperceptible attacks, as traditional noise-based attack detection methods are likely ineffective. Consider integrating new defense mechanisms that account for subtle, distribution-based perturbations to ensure reliable system performance in real-world applications.

Key insights

Adversarial attacks on S-HAR can be imperceptible by preserving motion quality through distribution-based optimization.

Principles

• Motion quality degradation in S-HAR attacks stems from empirical-true risk gaps.
• Preserving motion quality is key for imperceptible adversarial attacks.
• Distribution-based methods can generate adversarial motions without noise.

Method

Proposes a distribution-based adversarial attack method to minimize the risk gap and preserve motion quality without introducing noise-like perturbations, alongside a new human perception-aligned motion quality metric.

In practice

• Develop imperceptible attacks for S-HAR systems.
• Evaluate motion quality using human perception-aligned metrics.

Topics

• Adversarial Attacks
• Skeleton-based Action Recognition
• Motion Quality
• Model Robustness
• Distribution-based Methods
• Imperceptible Perturbations

Best for: Research Scientist, AI Scientist, AI Security Engineer, Computer Vision Engineer

Related on AIssential

• Digital-to-Physical Transfer of Adversarial Patches for Aerial Vehicle Detection — Digital adversarial patches can transfer to physical environments, posing realistic threats to aerial object detection systems.
• Physics-Guided Attention in a Lightweight TCN for Efficient WiFi CSI-Based Human Activity Recognition — Incorporating physics-guided inductive biases into lightweight TCNs significantly improves WiFi CSI-based HAR efficiency and performance.
• Improving Viewpoint-Invariance and Temporal Consistency for Action Detection — A two-stage approach using augmented virtual viewpoints and a multi-scale temporal encoder improves action detection's viewpoint-invariance and temporal consistency.
• Adversarial Robustness of Activation Steering in Large Language Models — Activation steering in LLMs exhibits structural brittleness against adversarial text perturbations, significantly degrading control and making it unsuitable for robust deployment.
• SS-TPT: Stability and Suitability-Guided Test-Time Prompt Tuning for Adversarially Robust Vision-Language Models — SS-TPT enhances VLM adversarial robustness by dynamically weighting augmented views based on prediction stability and feature suitability.
• When Actions Disappear: Adversarial Action Removal in Self-Play Reinforcement Learning — Adversarial action removal severely degrades self-play RL agents by targeting high-value decision points, with no recovery.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Takara TLDR - Daily AI Papers.