mlsanityData to 7 Oct 2026

BASAR:Black-box Attack on Skeletal Action Recognition

arXiv 2103.05266 ↗First posted 9 Mar 2021cs.CV cs.AIcited by 25

Not on the map. Why?

Abstract (arXiv)

Skeletal motion plays a vital role in human activity recognition as either an independent data source or a complement. The robustness of skeleton-based activity recognizers has been questioned recently, which shows that they are vulnerable to adversarial attacks when the full-knowledge of the recognizer is accessible to the attacker. However, this white-box requirement is overly restrictive in most scenarios and the attack is not truly threatening. In this paper, we show that such threats do exist under black-box settings too. To this end, we propose the first black-box adversarial attack method BASAR. Through BASAR, we show that adversarial attack is not only truly a threat but also can be extremely deceitful, because on-manifold adversarial samples are rather common in skeletal motions, in contrast to the common belief that adversarial samples only exist off-manifold. Through exhaustive evaluation and comparison, we show that BASAR can deliver successful attacks across models, data, and attack modes. Through harsh perceptual studies, we show that it achieves effective yet imperceptible attacks. By analyzing the attack on different activity recognizers, BASAR helps identify the potential causes of their vulnerability and provides insights on what classifiers are likely to be more robust against attack. Code is available at https://github.com/realcrane/BASAR-Black-box-Attack-on-Skeletal-Action-Recognition.

Key facts. Cited by 25 papers in the map (data through 7 Oct 2026). Builds on 42 of its 64 references that are in the map. First posted on arXiv 9 Mar 2021.

Builds on

42 of 64 references.

References · 42

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2013Intriguing properties of neural networkscited by 5,114
  3. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  4. 2017The Kinetics Human Action Video Datasetcited by 1,894
  5. 2016Adversarial examples in the physical worldcited by 1,762
  6. 2018Spatial Temporal Graph Convolutional Networks for Skeleton-Based Action Recognitioncited by 1,199
  7. 2016Realtime Multi-Person 2D Pose Estimation using Part Affinity Fieldscited by 1,061
  8. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  9. 2016NTU RGB+D: A Large Scale Dataset for 3D Human Activity Analysiscited by 683
  10. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  11. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  12. 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 459
30 more
  1. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
  2. 2020Disentangling and Unifying Graph Convolutions for Skeleton-Based Action Recognitioncited by 339
  3. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
  4. 2018Adversarial Attacks and Defences: A Surveycited by 259
  5. 2019Actional-Structural Graph Convolutional Networks for Skeleton-based Action Recognitioncited by 228
  6. 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 173
  7. 2018Disentangling Adversarial Robustness and Generalizationcited by 171
  8. 2018Adversarial Attack and Defense on Graph Data: A Surveycited by 166
  9. 2017The Space of Transferable Adversarial Examplescited by 156
  10. 2016Spatio-Temporal LSTM with Trust Gates for 3D Human Action Recognitioncited by 142
  11. 2018AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networkscited by 137
  12. 2019Semantics-Guided Neural Networks for Efficient Skeleton-Based Human Action Recognitioncited by 135
  13. 2018Query-Efficient Hard-label Black-box Attack:An Optimization-based Approachcited by 130
  14. 2016An End-to-End Spatio-Temporal Attention Model for Human Action Recognition from Skeleton Datacited by 126
  15. 2017A New Representation of Skeleton Sequences for 3D Action Recognitioncited by 125
  16. 2019Sign-OPT: A Query-Efficient Hard-label Adversarial Attackcited by 118
  17. 2020QEBA: Query-Efficient Boundary-Based Blackbox Attackcited by 103
  18. 2017Interpretable 3D Human Action Analysis with Temporal Convolutional Networkscited by 88
  19. 2018View Adaptive Neural Networks for High Performance Skeleton-based Human Action Recognitioncited by 84
  20. 2017Adversarial Transformation Networks: Learning to Generate Adversarial Examplescited by 60
  21. 2019Adversarial Attacks on Deep Neural Networks for Time Series Classificationcited by 53
  22. 2019Adversarial Attacks on Time Seriescited by 40
  23. 2019Heuristic Black-box Adversarial Attacks on Video Recognition Modelscited by 37
  24. 2019Spatio-temporal Manifold Learning for Human Motions via Long-horizon Modelingcited by 32
  25. 2019Adversarial Attack on Skeleton-based Human Action Recognitioncited by 32
  26. 2018Adversarial Attacks for Optical Flow-Based Action Recognition Classifierscited by 14
  27. 2020Dynamic Future Net: Diversified Human Motion Generationcited by 14
  28. 2020Adversarial Attacks on Multivariate Time Seriescited by 13
  29. 2020Towards Understanding the Adversarial Vulnerability of Skeleton-based Action Recognitioncited by 12
  30. 2019SMART: Skeletal Motion Action Recognition aTtackcited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 5; 2022: 3; 2023: 3; 2024: 9; 2025: 3; 2026: 2.

25 papers.

Sort:

By area:

  1. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  2. 2022Physical Adversarial Attack meets Computer Vision: A Decade Surveycited by 66
  3. 2021Fusing Higher-order Features in Graph Neural Networks for Skeleton-based Action Recognitioncited by 22
  4. 2021Adversarial Visual Robustness by Causal Interventioncited by 13
  5. 2024Vulnerabilities in AI-generated Image Detection: The Challenge of Adversarial Attackscited by 12
  6. 2021Adversarial Bone Length Attack on Action Recognitioncited by 10
  7. 2023Hard No-Box Adversarial Attack on Skeleton-Based Human Action Recognition with Skeleton-Motion-Informed Gradientcited by 10
  8. 2025Fast Adversarial Training with Weak-to-Strong Spatial-Temporal Consistency in the Frequency Domain on Videoscited by 9
  9. 2022Defending Black-box Skeleton-based Human Activity Classifierscited by 8
  10. 2022Understanding the Vulnerability of Skeleton-based Human Activity Recognition via Black-box Attackcited by 7
  11. 2024Towards Physical World Backdoor Attacks against Skeleton Action Recognitioncited by 7
  12. 2024TASAR: Transfer-based Attack on Skeletal Action Recognitioncited by 7
13 more
  1. 2021Anonymization for Skeleton Action Recognitioncited by 5
  2. 2024Two-Person Interaction Augmentation with Skeleton Priorscited by 5
  3. 2024Physics-Based Adversarial Attack on Near-Infrared Human Detector for Nighttime Surveillance Camera Systemscited by 3
  4. 2023Fourier Analysis on Robustness of Graph Convolutional Neural Networks for Skeleton-based Action Recognitioncited by 2
  5. 2024LocalStyleFool: Regional Video Style Transfer Attack Using Segment Anything Modelcited by 2
  6. 2023Post-train Black-box Defense via Bayesian Boundary Correctioncited by 1
  7. 2024Fooling Neural Networks for Motion Forecasting via Adversarial Attackscited by 1
  8. 2025Unveiling Hidden Vulnerabilities in Digital Human Generation via Adversarial Attackscited by 1
  9. 2024Emotion Loss Attacking: Adversarial Attack Perception for Skeleton based on Multi-dimensional Featurescited by 0
  10. 2024Boosting Adversarial Transferability for Skeleton-based Action Recognition via Exploring the Model Posterior Spacecited by 0
  11. 2025Spoofing-aware Prompt Learning for Unified Physical-Digital Facial Attack Detectioncited by 0
  12. 2026Quality-Preserving Imperceptible Adversarial Attack on Skeleton-based Human Action Recognitioncited by 0
  13. 2026A Black-Box Adversarial Attack on Human Pose Estimation and Keypoint-Based Action Recognition Modelscited by 0