Research On Black And White Box Attack Algorithm For Skeleton Human Action Recognition Model

Human action recognition(HAR)has been an important research topic in the field of artificial intelligence and computer vision.Efficient and stable action recognition models and algorithms are playing an increasingly important role in human-computer interaction,autonomous driving and even metaverse applications.With the continuous development of computer vision technology,deep learning gradually develops into multi-modality in various fields,and skeletal action data is favored by researchers for its low redundancy and high reliability,and many recognition models have been developed on it.Among the many skeleton action recognition models,the models based on graph convolutional network(GCN)dominate the leader board of recognition accuracy of related datasets with an accuracy rate of higher than 95%.Behind the rapid development of recognition models,there is no relevant work to systematically study and verify the robustness and security of these models.However,the adversarial examples generated by adversarial attack technology have been proved in other fields to have profound damage to deep learning models with their subtle differences that are difficult for human eyes to distinguish and their ability to mislead classification models to make wrong judgments.Such threats seriously hinder the implementation of high-performance skeleton behavior recognition models in industry and reality to improve production efficiency,especially in the field of human action,which is highly related to personal safety.In this context,based on the realistic concerns about the robustness and security of the skeletal human action recognition model,this thesis conducts an in-depth study on the reasons why the skeleton action recognition model is vulnerable to white box or black box attacks,which provides a basis for the subsequent construction of a strong robust behavior recognition model.And the main work of this th includes two parts: white box attack and black box attack.In white box attack,this thesis discard bone length constraint and constructs spatiotemporal consistency constraint to maintain the spatial consistency and temporal fluency of skeleton data.At the same time,based on the Sharpley Value in game theory and the interaction contribution analysis method,this thesis proposes the adversarial noise pruning scheme to constrain the unnecessary noise in the adversarial examples.The experimental verification and results show that the proposed method reach the state-of-art performance in this field.In the black box attack,we try to carry out the black box hard label attack on the human action recognition model under the strictest conditions,aiming at the problem of migration by using the white box attack.In this thesis,based on the boundary attack,the human skeleton is reconstructed into a tree structure to realize the multi-sphere coordinate system modeling of human skeleton data so that the free domain of anti-noise is limited to a sphere.Secondly,combining with the definition of the motion range of human joint in ergonomics,we further restrict the free domain of anti-noise to part of the sphere.In the process of random walk,we add the prior information of skeleton dynamic information and adjust the direction of the adversarial noise sampling so that the adversarial noise tends to be distributed in the main area of the movement.In the experiment of black box attack,the method in this thesis shows excellent generality,in which the counter sample completely in the activity space has good deception and naturalness.