# MultAV: Multiplicative Adversarial Videos

arXiv: https://arxiv.org/abs/2009.08058 · HTML: https://mlsanity.com/paper/2009.08058/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 17 Sep 2020.

## Built on by (most cited first, 5 of 5)

- [PatchZero: Defending against Adversarial Patch Attacks by Detecting and Zeroing the Patch](https://mlsanity.com/paper/2207.01795/) (2022)
- [Adversarial Attacks on Black Box Video Classifiers: Leveraging the Power of Geometric Transformations](https://mlsanity.com/paper/2110.01823/) (2021)
- [Adversarially Robust One-class Novelty Detection](https://mlsanity.com/paper/2108.11168/) (2021)
- [Exploring Adversarially Robust Training for Unsupervised Domain Adaptation](https://mlsanity.com/paper/2202.09300/) (2022)
- [Error Diffusion Halftoning Against Adversarial Examples](https://mlsanity.com/paper/2101.09451/) (2021)

## Abstract (arXiv)

The majority of adversarial machine learning research focuses on additive attacks, which add adversarial perturbation to input data. On the other hand, unlike image recognition problems, only a handful of attack approaches have been explored in the video domain. In this paper, we propose a novel attack method against video recognition models, Multiplicative Adversarial Videos (MultAV), which imposes perturbation on video data by multiplication. MultAV has different noise distributions to the additive counterparts and thus challenges the defense methods tailored to resisting additive adversarial attacks. Moreover, it can be generalized to not only Lp-norm attacks with a new adversary constraint called ratio bound, but also different types of physically realizable attacks. Experimental results show that the model adversarially trained against additive attack is less robust to MultAV.