# Defending Against Multiple and Unforeseen Adversarial Videos

arXiv: https://arxiv.org/abs/2009.05244 · HTML: https://mlsanity.com/paper/2009.05244/

## Key facts

- Cited by 19 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 11 Sep 2020.

## Built on by (most cited first, 19 of 19)

- [PatchZero: Defending against Adversarial Patch Attacks by Detecting and Zeroing the Patch](https://mlsanity.com/paper/2207.01795/) (2022)
- [Adversarially Robust One-class Novelty Detection](https://mlsanity.com/paper/2108.11168/) (2021)
- [Revisiting adapters with adversarial training](https://mlsanity.com/paper/2210.04886/) (2022)
- [Analysis and Extensions of Adversarial Training for Video Classification](https://mlsanity.com/paper/2206.07953/) (2022)
- [Visual Adversarial Attacks and Defenses in the Physical World: A Survey](https://mlsanity.com/paper/2211.01671/) (2022)
- [Learning Feature Decomposition for Domain Adaptive Monocular Depth Estimation](https://mlsanity.com/paper/2208.00160/) (2022)
- [Fast Adversarial Training with Weak-to-Strong Spatial-Temporal Consistency in the Frequency Domain on Videos](https://mlsanity.com/paper/2504.14921/) (2025)
- [Exploring Adversarially Robust Training for Unsupervised Domain Adaptation](https://mlsanity.com/paper/2202.09300/) (2022)
- [Temporal Shuffling for Defending Deep Action Recognition Models against Adversarial Attacks](https://mlsanity.com/paper/2112.07921/) (2021)
- [Understanding the Vulnerability of Skeleton-based Human Activity Recognition via Black-box Attack](https://mlsanity.com/paper/2211.11312/) (2022)
- [VideoPure: Diffusion-based Adversarial Purification for Video Recognition](https://mlsanity.com/paper/2501.14999/) (2025)
- [RoVISQ: Reduction of Video Service Quality via Adversarial Attacks on Deep Learning-based Video Compression](https://mlsanity.com/paper/2203.10183/) (2022)
- [Adversarially Robust Video Perception by Seeing Motion](https://mlsanity.com/paper/2212.07815/) (2022)
- [PAT: Pseudo-Adversarial Training For Detecting Adversarial Videos](https://mlsanity.com/paper/2109.05695/) (2021)
- [Adversarially Robust Deepfake Detection via Adversarial Feature Similarity Learning](https://mlsanity.com/paper/2403.08806/) (2024)
- [Adaptive Batch Normalization Networks for Adversarial Robustness](https://mlsanity.com/paper/2405.11708/) (2024)
- [Towards Generalized Certified Robustness with Multi-Norm Training](https://mlsanity.com/paper/2410.03000/) (2024)
- [Off-The-Shelf Image-to-Image Models Are All You Need To Defeat Image Protection Schemes](https://mlsanity.com/paper/2602.22197/) (2026)
- [Deep Learning-based Multi-Organ CT Segmentation with Adversarial Data Augmentation](https://mlsanity.com/paper/2302.13172/) (2023)

## Abstract (arXiv)

Adversarial robustness of deep neural networks has been actively investigated. However, most existing defense approaches are limited to a specific type of adversarial perturbations. Specifically, they often fail to offer resistance to multiple attack types simultaneously, i.e., they lack multi-perturbation robustness. Furthermore, compared to image recognition problems, the adversarial robustness of video recognition models is relatively unexplored. While several studies have proposed how to generate adversarial videos, only a handful of approaches about defense strategies have been published in the literature. In this paper, we propose one of the first defense strategies against multiple types of adversarial videos for video recognition. The proposed method, referred to as MultiBN, performs adversarial training on multiple adversarial video types using multiple independent batch normalization (BN) layers with a learning-based BN selection module. With a multiple BN structure, each BN brach is responsible for learning the distribution of a single perturbation type and thus provides more precise distribution estimations. This mechanism benefits dealing with multiple perturbation types. The BN selection module detects the attack type of an input video and sends it to the corresponding BN branch, making MultiBN fully automatic and allowing end-to-end training. Compared to present adversarial training approaches, the proposed MultiBN exhibits stronger multi-perturbation robustness against different and even unforeseen adversarial video types, ranging from Lp-bounded attacks and physically realizable attacks. This holds true on different datasets and target models. Moreover, we conduct an extensive analysis to study the properties of the multiple BN structure.