ML Security PapersStructured Universal Adversarial Attacks on Object Detection for Video Sequences
Sven Jacob 1,2, Weijia Shao 1, Gjergji Kasneci 2
Published on arXiv
2510.14460
Input Manipulation Attack
OWASP ML Top 10 — ML01
Key Finding
The proposed nuclear norm-regularized universal attack outperforms low-rank PGD and Frank-Wolfe baselines in attack effectiveness while generating more structured, imperceptible background perturbations across video frames.
AO-Exp-Attack
Novel technique introduced
Video-based object detection plays a vital role in safety-critical applications. While deep learning-based object detectors have achieved impressive performance, they remain vulnerable to adversarial attacks, particularly those involving universal perturbations. In this work, we propose a minimally distorted universal adversarial attack tailored for video object detection, which leverages nuclear norm regularization to promote structured perturbations concentrated in the background. To optimize this formulation efficiently, we employ an adaptive, optimistic exponentiated gradient method that enhances both scalability and convergence. Our results demonstrate that the proposed attack outperforms both low-rank projected gradient descent and Frank-Wolfe based attacks in effectiveness while maintaining high stealthiness. All code and data are publicly available at https://github.com/jsve96/AO-Exp-Attack.
Key Contributions
- Nuclear norm regularization to promote structured, low-rank adversarial perturbations concentrated in the background rather than on moving foreground objects
- Adaptive optimistic exponentiated gradient descent method enabling scalable and convergent optimization under nuclear norm regularization
- Universal adversarial perturbation for video object detection that outperforms low-rank PGD and Frank-Wolfe-based attacks in effectiveness while maintaining higher stealthiness
🛡️ Threat Analysis
The paper directly proposes and evaluates a novel gradient-based adversarial attack — a universal adversarial perturbation (UAP) — designed to cause object detectors to fail (object vanishing) at inference time. The contribution is a new attack formulation using nuclear norm regularization with an adaptive optimistic exponentiated gradient optimizer.