Research map / Adversarial robustness and security / Attacks on text and graphs

On the Robustness of Neural-Enhanced Video Streaming against Adversarial Attacks

AAAI 2024 · Adversarial robustness and security › Attacks on text and graphs · approach: Biologically inspired robust vision · 1 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes codec hijacking, a man-in-the-middle adversarial attack on neural-enhanced video streaming that jointly optimizes invisible input perturbation and a malicious macroblock QP matrix so the codec conceals the perturbation until decoding and SR amplify it.

Problem

Neural-enhanced video streaming (NeVS) pipelines, which combine video codecs with neural super-resolution on the receiver side, are vulnerable to adversarial attacks, yet existing codec-unaware attacks fail because the encoder filters high-frequency perturbations.

Approach

Jointly search segment-level invisible perturbation on low-resolution frames and a macroblock-level QP matrix under the original bitstream size budget, so normal encoding hides the perturbation while the malicious encoding lets it survive and be amplified by SR models.

Key results

• Codec hijacking drops restored-frame PSNR for 11 SR models to roughly 14-21 dB (e.g., ESRGAN 14.13 dB) while attacked LR frames stay above 32 dB PSNR.
• Multiple object tracking MOTA falls from about 80-83% to 32-41% with attack success rates of 75-81% using ESRGAN.
• Human pose estimation PCK drops from about 87-98% to 32-38% with attack success rates of 82-87%.

Measured effects reported in the paper

Surprising findings

• Perturbation injection alone without malicious QP encoding has almost no effect on restored video, so the codec itself acts as the trigger.
• GAN-based SR models such as ESRGAN and NATSR are the most damaged, because they amplify injected high-frequency perturbation.

Limitations

• Attack assumes a man-in-the-middle position that can modify the LR video before streaming and control QP via standard codec APIs.
• Evaluation is limited to UDM10 and a few downstream tasks with ESRGAN as the main SR example for downstream results.
• No defense is proposed or evaluated.

Experimental setup

Datasets: UDM10 MOTChallenge Human3.6M

Benchmarks: UDM10 MOTChallenge Human3.6M

Metrics: PSNR SSIM MOTA PCK attack success rate

Baselines: I-FGSM PGD FDA

Builds on: I-FGSM PGD H.264/AVC H.265/HEVC

Closest papers by meaning

• DeNC: Unleash Neural Codecs in Video Streaming with Diffusion Enhancement (AAAI 2025 · similarity 0.85)
• I2VGuard: Safeguarding Images against Misuse in Diffusion-based Image-to-Video Models (CVPR 2025 · similarity 0.82)
• Comparing the Robustness of Modern No-Reference Image- and Video-Quality Metrics to Adversarial Attacks (AAAI 2024 · similarity 0.82)
• Image Hijacks: Adversarial Images can Control Generative Models at Runtime (ICML 2024 · similarity 0.82)
• Adversarial Attacks on Federated-Learned Adaptive Bitrate Algorithms (AAAI 2024 · similarity 0.81)
• Towards Effective and Sparse Adversarial Attack on Spiking Neural Networks via Breaking Invisible Surrogate Gradients (CVPR 2025 · similarity 0.81)