Research map / Adversarial robustness and security / Backdoor and poisoning
Temporal-Distributed Backdoor Attack against Video Based Action Recognition
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes an imperceptible, temporally distributed backdoor trigger for video action recognition by perturbing selected components in a transformed domain (DFT, DCT, DWT, random transform), evading frame-wise image defenses.
Problem
Backdoor attacks on video recognition models have been largely direct extensions of image attacks that embed independent per-frame triggers, which are perceptible and detectable by existing defenses.
Approach
Plant a trigger by adding perturbations to selected coefficients of a temporally non-identical transform basis (DFT, DCT, DWT, random), so the trigger spreads across all frames with minimal per-pixel change and evades frame-wise defenses.
Key results
- DFT-based attack reaches ASR of about 97-100% on most model/dataset pairs (e.g., SlowFast UCF-101 ACC 81.0% vs clean 84.5%, ASR 97.9%).
- The DFT trigger evades NC-D, PT-RED, TABOR detection (anomaly index 0.1, 1.6, 0.2) while BadNet, Blend, SIG are flagged; STRIP TPR 25.7% vs 93.5-98.8% for salient triggers.
- Trigger imperceptibility: DFT PSNR 41.6 and SSIM 0.972 versus BadNet 36.3/0.173 and Blend 20.2/0.435 (global metrics).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply the temporal-distributed DFT trigger | SlowFast · UCF-101 | ASR: 97.9 | Helped |
| Apply the temporal-distributed DFT trigger | Res(2+1)D · UCF-101 | ASR: 99.4 | Helped |
| Apply the temporal-distributed DFT trigger | S3D · HMDB-51 | ASR: 90.4 | Mixed |
| Apply the temporal-distributed DFT trigger | I3D · HMDB-51 | ASR: 85.0 | Mixed |
| Use DCT instead of DFT (ablation) | Proposed attack · HMDB-51, Res(2+1)D | ACC: 53.0 -> 43.3 | Hurt |
| Use DCT instead of DFT (ablation) | Proposed attack · HMDB-51, I3D | ASR: 85.0 -> 96.8 | Helped |
| Use DWT instead of DFT (ablation) | Proposed attack · HMDB-51, I3D | ASR: 85.0 -> 99.4 | Helped |
| Use RT instead of DFT (ablation) | SlowFast · UCF-101 | ASR: 90.5 | Mixed |
| Embed the trigger before down-sampling the video (ablation) | S3D · UCF-101 | ASR: 96.36% | Helped |
| Increase the poisoning ratio (ablation) | DFT attack on video models · UCF-101 | ASR | Helped |
| Increase the perturbed frequency (ablation) | DFT attack on video models · UCF-101 | ASR | Hurt |
| Increase the number of perturbed components (ablation) | DFT attack on video models · UCF-101 | ASR | Helped |
Surprising findings
- Collateral damage: perturbations at test-time in frequency bands different from training can still activate the backdoor, attributed to pixel clipping.
- Res(2+1)D remains vulnerable at 1% poisoning (ASR ~80%) and across a broader frequency range than other models.
Limitations
- Only all-to-one attacks studied; many-to-one and one-to-one not evaluated.
- Some mitigation methods (e.g., I-BAU, UNICORN) not evaluated due to computational cost.
- Collateral damage's effect on stealthiness under defenses left as open question.
Experimental setup
Datasets: UCF-101 HMDB-51 Greek Sign Language (GSL) subset
Benchmarks: UCF-101 HMDB-51 GSL
Metrics: ACC ASR PSNR SSIM TPR FPR anomaly index
Baselines: BadNet Blend SIG WaNet FTtrojan
Builds on: BadNet WaNet FTtrojan UNICORN
Closest papers by meaning
- Attention-Imperceptible Backdoor Attacks on Vision Transformers (AAAI 2025 · similarity 0.86)
- BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Model (NeurIPS 2025 · similarity 0.86)
- A Theoretical Analysis of Backdoor Poisoning Attacks in Convolutional Neural Networks (ICML 2024 · similarity 0.86)
- Conditional Backdoor Attack via JPEG Compression (AAAI 2024 · similarity 0.86)
- Not All Prompts Are Secure: A Switchable Backdoor Attack Against Pre-trained Vision Transfomers (CVPR 2024 · similarity 0.86)
- Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shift (CVPR 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.