Adversarial Bone Length Attack on Action Recognition

Skeleton-based action recognition models have recently been shown to be vulnerable adversarial attacks. Compared attacks on images, perturbations skeletons are typically bounded a lower dimension of approximately 100 per frame. This lower-dimensional setting makes it more difficult generate imperceptible perturbations. Existing resolve this by exploiting the temporal structure skeleton motion so that perturbation increases thousands. In paper, we show can performed skeleton-based models, even in significantly low-dimensional without any manipulation. Specifically, restrict lengths skeleton's bones, which allows an adversary manipulate only 30 effective dimensions. We conducted experiments NTU RGB+D and HDM05 datasets demonstrate proposed attack successfully deceived with sometimes greater than 90% success rate small Furthermore, discovered interesting phenomenon: our setting, training bone length shares similar property data augmentation, not improves robustness but also classification accuracy original data. is counterexample trade-off between clean accuracy, has widely observed studies high-dimensional regime.