Research map / Adversarial robustness and security / Black-box and transfer attacks
TASAR: Transfer-based Attack on Skeletal Action Recognition
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes TASAR, a transfer-based adversarial attack on skeleton action recognition that smooths the surrogate's loss via post-train dual Bayesian sampling and adds temporal motion gradients, plus the RobustBenchHAR benchmark.
Problem
Transfer-based adversarial attacks on skeleton-based human action recognition (S-HAR) perform poorly and unreliably, and the reason was unclear; the paper asks why transferability fails and how to improve it.
Approach
Low loss-surface smoothness of skeleton surrogates explains poor transferability; a post-train dual Bayesian strategy appends tiny Gaussian-perturbed MLP heads to a frozen surrogate to smooth the posterior, and temporal motion gradients (velocity and acceleration via TV-AR models) are added to the attack gradient.
Key results
- TASAR achieves an average untargeted transfer success rate of 35.5% across models and datasets, versus 23.4 points above SMART and 8.1 points above MIG as stated by the authors.
- With MS-G3D as surrogate, TASAR adds only 0.012M parameters versus 255.57M for the BA Bayesian surrogate.
- On NTU60 with ST-GCN surrogate, TASAR reaches 64.60% transfer success on MS-G3D and 42.55% on 2s-AGCN in untargeted attacks.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use TASAR instead of existing attack methods | Transfer attacks on S-HAR · NTU60 and NTU120 across surrogate and target models | attack success rate: 35.5%; surpassing SMART by 23.4% and MIG by 8.1% | Helped |
| Add dual sampling to the post-train Bayesian attack (ablation) | TASAR without motion gradient · NTU60, ST-GCN surrogate, transfer attack | attack success rate: 39.06 -> 42.55; 58.39 -> 64.60; 19.53 -> 20.33; 43.75 -> 49.41 | Helped |
| Increase dual sample count from M=0 to M=10 (ablation) | TASAR without motion gradient, K=3 · NTU60, ST-GCN surrogate, transfer attack | attack success rate: 97.46 -> 98.07; 39.25 -> 42.01; 56.45 -> 60.57; 19.34 -> 19.73; 43.16 -> 46.49 | Mixed |
| Increase dual sample count from M=10 to M=20 (ablation) | TASAR without motion gradient, K=3 · NTU60, ST-GCN surrogate, transfer attack | attack success rate: 98.07 -> 99.29; 42.01 -> 42.55; 60.57 -> 64.60; 19.73 -> 20.33; 46.49 -> 49.41 | Mixed |
| Add temporal motion gradient (ablation) | TASAR · White-box and transfer-based S-HAR attacks | attack success rate | Helped |
| Set lambda_xi,sigma to 0.001 (ablation) | TASAR · NTU120, ST-GCN surrogate, black-box targets | attack success rate: 2s-AGCN: 17.62 -> 19.60; MS-G3D: 13.10 -> 19.37; CTR-GCN: 14.29 -> 15.28; FR-HEAD: 20.23 -> 22.79; accuracy: 64.30 -> 63 | Mixed |
| Model the full surrogate posterior instead of only the appended component (ablation) | TASAR training strategy · NTU60, untargeted attack | attack success rate: ST-GCN: 99.29 -> 90.63; 2s-AGCN: 42.55 -> 37.11; MS-G3D: 64.60 -> 69.53; CTR-GCN: 20.33 -> 17.58; FR-HEAD: 49.41 -> 43.3 | Mixed |
| Train both the original surrogate and appended component (ablation) | TASAR training strategy · NTU60, untargeted attack | attack success rate: ST-GCN: 99.29 -> 93.75; 2s-AGCN: 42.55 -> 41.80; MS-G3D: 64.60 -> 73.04; CTR-GCN: 20.33 -> 18.75; FR-HEAD: 49.41 -> 46.8 | Mixed |
| Keep the pretrained surrogate fixed and train the appended Bayesian component (ablation) | TASAR · NTU60, model size and training time | training time: 5.7 -> 0.65; 6.4 -> 0.65 | Helped |
| Smooth the loss landscape with TASAR (ablation) | ST-GCN surrogate · HDM05, perturbation magnitude -1.0 | loss change: 7.46 -> 2.66 | Helped |
Surprising findings
- Transferability in S-HAR is highly sensitive to surrogate choice, and loss smoothness correlates with transferability more than gradient optimization techniques, per the authors.
Limitations
- Attacks evaluated only under l_inf budget 0.01 with 200 iterations; transfer success on some targets remains low (e.g., CTR-GCN under MS-G3D surrogate is not fully robust).
- Relies on a Gaussian (SWAG-based) posterior approximation; hyperparameters lambda, K and M chosen empirically.
- Evaluation limited to three skeleton datasets and a fixed set of 7 classifiers plus 2 defenses.
Experimental setup
Datasets: NTU 60 NTU 120 HDM05
Benchmarks: NTU 60 NTU 120 HDM05
Metrics: attack success rate white-box attack success rate black-box attack success rate loss change (smoothness)
Baselines: I-FGSM MI-FGSM MIG DIM SMART CIASA ENS SVRE BA
Builds on: BA (Bayesian attack) BEAT MI-FGSM SWAG SGAHMC
Closest papers by meaning
- MaskCLR: Attention-Guided Contrastive Learning for Robust Action Representation Learning (CVPR 2024 · similarity 0.85)
- Skeleton-based Action Recognition with Non-linear Dependency Modeling and Hilbert-Schmidt Independence Criterion (AAAI 2025 · similarity 0.84)
- Navigating Open Set Scenarios for Skeleton-Based Action Recognition (AAAI 2024 · similarity 0.84)
- Neuron: Learning Context-Aware Evolving Representations for Zero-Shot Skeleton Action Recognition (CVPR 2025 · similarity 0.84)
- Recovering Complete Actions for Cross-dataset Skeleton Action Recognition (NeurIPS 2024 · similarity 0.83)
- Revealing Key Details to See Differences: A Novel Prototypical Perspective for Skeleton-based Action Recognition (CVPR 2025 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.