TASAR: Transfer-based Attack on Skeletal Action Recognition
Human Activity Recognition;Transfer-based adversarial attack
Yes
No concerns
No ethics review needed.
1) In Table 4, why K=3 yields better results than K=5? I thought more samples lead to better approximation
1) The paper is well-written with clear motivations of each step
2) The proposed approch is easy to apply on existing methods since only a few layers are needed at the end of the networ.
3) Thorough experiments and ablation studies
This paper studies transfer-based attacks for skeleton-based action recognition. A last-layer Bayesian approches is applied to smooth the loss surface to improve adversarial transferability. The authors setup a benchmark for transfer-based skeleton-based action recognition attacks. The proposed method is evaluted using different backbone approaches on NTU-60, NTU-120, and HDM05. The results demonstrate the effectiveness of the proposed approaches.
1) As the pretrained models are frozen, modeling p(\theta’|D, \theta) is not as good as modeling p(\theta, \theta’|D). If trainable, it would be better to justify the performance difference on a small subset of data.
2) Besides the visualization of loss surfaces, quantitative evaluation of the surface smoothess can be added.
Yes
No ethics review needed.
Please see in Weaknesses.
1. Extensive experiments.
2. The post-train Dual Bayesian Motion attack method is reasonable in general.
For the transfer-based attack on skeletal action recognition tasks, this paper builds the first comprehensive benchmark, comprising 7 skeletal models, 10 attack models, 3 skeletal datasets, and 2 defense methods. Additionally, a novel post-train Dual Bayesian Motion attack is presented, aiming to explore a smoother model posterior by incorporating a small MLP layer. Unlike image data, the spatial-temporal characteristics, represented by first-order velocity and second-order acceleration, are considered.
1. Although it is reasonable to assume that a smoother loss landscape benefits transfer attacks, exploring the reasons for poor transferability in S-HAR tasks and comparing the differences among surrogate models may reveal various factors. Therefore, directly concluding that smoothing the loss landscape is the sole solution may not be entirely logical.

2. In this method, an MLP is primarily added after the original model. However, the consideration of first-order velocity and second-order acceleration to capture spatial-temporal information, as mentioned in this paper, has already been addressed by SMART (Wang et al., 2021), which limits the novelty of this approach.

3. The Bayesian optimization approach used in this method is similar to BEAT (Wang et al., 2023), and the differences between the two approaches should be discussed further.
Yes
No ethics review needed.
Please refer to my main comments above.
+ Overall this paper explores an interesting research problem.

+ The authors conduct large-scale evaluations to show that the proposed model achieves good performance on several benchmarks.

+ Some of the figures presented in the paper are quite nice and provide some insights to readers.
This paper explores an interesting research problem in skeleton-based action recognition.

This paper proposes the transfer-based attack on skeletal action recognition.

The proposed model incorporates motion dynamics into the Bayesian attack gradient, effectively disrupting the spatial-temporal coherence of the skeletal action recognition.

The authors explore and analyse several model architectures, and conduct experimental analysis and evaluations on several benchmarks and show that the proposed model achieves good performance compared to existing baselines.
Major: 

- One of the major issues of this paper is that some of the concepts presented in the paper are not properly and clearly explained. For example, in abstract section, what is "white-box scenarios". Also what does it mean by saying "its sharpness contributes to the weak transferability in S-HAR"?

- Fig. 1 is not being introduced and explained clearly. For example, what is spatial attack, spatial-temporal attack, why frozen, trainable, being lightweight and demanding? What are appended models and dual bayesian? These concepts should be clearly explained to readers, either in texts or figure caption. Moreover, how to tell which one is better? 

- The introduction section is not very well-motivated. For example, in Line 83, referring to Table 1; however, the concepts to understand the table are not being explained. The authors are encouraged to reorganise the section, explain the concepts properly before going deep into the technical jargon. What is "white-box"? In contribution section, what is "low adversarial transferability"?

- In related work section, the authors outline some closely related works; however, they do not highlight what are the major differences between existing works and the proposed method, what are the insights, how the proposed method has the potential to address the challenges etc.

- Fig. 2, the font sizes are invisible to reviewer, what are the x and y axis represent for? What do "random direction vectors" mean? These concepts should be properly explained. 

- In Eq. (2), what are boldface $x$ and $\tilde{x}$ mean?  In Line 158 and 183, it says "a clean motion" and "the adversarial sample", what do they mean and how they align with each other, what would be the relationship between them? These concepts and maths symbols are not properly explained. It is suggested to have a notation section detailing the maths symbols and operations used in the paper. Eq. (3) right hand side is a bit confusing, the reviewer cannot understand that, could you explain step by step?


Minor:

-  Remove the  full stop "." inside Sec. 3.4.1 and 3.4.2 headings.

- Table of font sizes should be consistent in the whole paper. In the main paper, table 1, 2, 3 and 5 font sizes are too small, and hard to read; however, table 6 in appendix section, the font sizes are too big. The authors should make those representations consistent and nicer.

- While the maths presented in the paper seem to be accurate, its presentations, especially in the method section, needs extensive improvement. The reviewer gets lost many times, and some of the concepts are not very well introduced and explained. A good paper should explain these concepts clearly and in a more intuitive way. 

- An excellent paper should use efficient figures and plots to show the experimental results. In this paper, most experimental results are presented in the form of tables, it would be better if the authors could provide some plots and visualisations to make the evaluations, comparisons and analysis more interesting to wide communities.
Yes
No ethics review needed.
N/A
The paper identifies a crucial limitation of existing S-HAR attacks and proposes a practical solution. The proposed TASAR attack is innovative and demonstrates potential improvements in adversarial transferability. The evaluation on the large-scale benchmark provides valuable insights into the effectiveness of existing and proposed methods.

The author has submitted the code, making the work reproducible.
This paper investigates the issue of weak adversarial transferability in skeleton-based Human Activity Recognition (S-HAR) attacks. It proposes a new transfer-based attack called TASAR, which aims to improve transferability by smoothing the loss surface. The authors also establish a large-scale robust S-HAR benchmark for comprehensive evaluation.
I suggest that the authors cite more papers related to recent research from top conferences over the past two years.

More related literature can be included, for instance, by adding a topic on noise-robust human action recognition.
This work proposes a new transfer-based attack on skeletal action recognition and builds a large-scale robust evaluation benchmark for this task.
@inproceedings{
anonymous2024tasar,
title={{TASAR}: Transfer-based Attack on Skeletal Action Recognition},
author={Anonymous},
booktitle={Submitted to The Thirteenth International Conference on Learning Representations},
year={2024},
url={https://openreview.net/forum?id=I393kV3bz4},
note={under review}
}
Skeletal sequences, as well-structured representations of human behaviors, play a vital role in Human Activity Recognition (HAR). The transferability of adversarial skeletal sequences enables attacks in real-world HAR scenarios, such as autonomous driving, intelligent surveillance, and human-computer interactions. However, most existing skeleton-based HAR (S-HAR) attacks are primarily designed for white-box scenarios and exhibit weak adversarial transferability. Therefore, they cannot be considered true transfer-based S-HAR attacks. More importantly, the reason for this failure remains unclear. In this paper, we study this phenomenon through the lens of loss surface, and find that its sharpness contributes to the weak transferability in S-HAR. Inspired by this observation, we assume and empirically validate that smoothening the rugged loss landscape could potentially improve adversarial transferability in S-HAR. To this end, we propose the first Transfer-based Attack on Skeletal Action Recognition, TASAR. TASAR explores the smoothed model posterior without requiring surrogate re-training, which is achieved by a new post-train Dual Bayesian optimization strategy. Furthermore, unlike previous transfer-based attacks that treat each frame independently and overlook temporal coherence within sequences, TASAR incorporates motion dynamics into the Bayesian attack gradient, effectively disrupting the spatial-temporal coherence of S-HARs. To exhaustively evaluate the effectiveness of existing methods and our method, we build the first large-scale robust S-HAR benchmark, comprising 7 S-HAR models, 10 attack methods, 3 S-HAR datasets and 2 defense methods. Extensive results demonstrate the superiority of TASAR. Our benchmark enables easy comparisons for future studies, with the code available in the anonymous link https://anonymous.4open.science/r/RobustBenchHAR-5492/README.md and supplementary material.
I certify that there is no URL (e.g., github page) that could be used to find authors’ identity.
I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics.
Human Activity Recognition Transfer-based adversarial attack
I certify that there is no acknowledgement section in this submission for double blind review.
/pdf/b8c3572888d5200b85aa8b7f080e4c5b54021b9e.pdf
alignment, fairness, safety, privacy, and societal considerations
I understand the reciprocal reviewing requirement as described on https://iclr.cc/Conferences/2025/CallForPapers. If none of the authors are registered as a reviewer, it may result in a desk rejection at the discretion of the program chairs. To request an exception, please complete this form at https://forms.gle/Huojr6VjkFxiQsUp6.
I certify that this submission complies with the submission instructions as described on https://iclr.cc/Conferences/2025/AuthorGuide.
/attachment/cbe50e203a968be507ca04dd4ff74ce050c69ed3.zip
TASAR: Transfer-based Attack on Skeletal Action Recognition
ICLR 2025 Conference Submission
ICLR.cc/2025/Conference/Submission