mlsanityData to 7 Oct 2026

Defending Black-box Skeleton-based Human Activity Classifiers

arXiv 2203.04713 ↗First posted 9 Mar 2022cs.CVcited by 8

Not on the map. Why?

Abstract (arXiv)

Skeletal motions have been heavily replied upon for human activity recognition (HAR). Recently, a universal vulnerability of skeleton-based HAR has been identified across a variety of classifiers and data, calling for mitigation. To this end, we propose the first black-box defense method for skeleton-based HAR to our best knowledge. Our method is featured by full Bayesian treatments of the clean data, the adversaries and the classifier, leading to (1) a new Bayesian Energy-based formulation of robust discriminative classifiers, (2) a new adversary sampling scheme based on natural motion manifolds, and (3) a new post-train Bayesian strategy for black-box defense. We name our framework Bayesian Energy-based Adversarial Training or BEAT. BEAT is straightforward but elegant, which turns vulnerable black-box classifiers into robust ones without sacrificing accuracy. It demonstrates surprising and universal effectiveness across a wide range of skeletal HAR classifiers and datasets, under various attacks. Code is available at https://github.com/realcrane/RobustActionRecogniser.

Key facts. Cited by 8 papers in the map (data through 7 Oct 2026). Builds on 60 of its 80 references that are in the map. First posted on arXiv 9 Mar 2022.

Builds on

60 of 80 references.

References · 60

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  3. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  4. 2016Adversarial examples in the physical worldcited by 1,762
  5. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  6. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  7. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  8. 2018Spatial Temporal Graph Convolutional Networks for Skeleton-Based Action Recognitioncited by 1,199
  9. 2017Virtual Adversarial Training: A Regularization Method for Supervised and Semi-Supervised Learningcited by 918
  10. 2018Robustness May Be at Odds with Accuracycited by 873
  11. 2016NTU RGB+D: A Large Scale Dataset for 3D Human Activity Analysiscited by 683
  12. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
38 more
  1. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  2. 2019NTU RGB+D 120: A Large-Scale Benchmark for 3D Human Activity Understandingcited by 530
  3. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
  4. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  5. 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
  6. 2019Your Classifier is Secretly an Energy Based Model and You Should Treat it Like Onecited by 402
  7. 2018Adversarial Attacks on Neural Networks for Graph Datacited by 395
  8. 2014Stochastic Gradient Hamiltonian Monte Carlocited by 341
  9. 2020Disentangling and Unifying Graph Convolutions for Skeleton-Based Action Recognitioncited by 339
  10. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
  11. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
  12. 2021Channel-wise Topology Refinement Graph Convolution for Skeleton-Based Action Recognitioncited by 317
  13. 2018Certified Defenses against Adversarial Examplescited by 305
  14. 2018Adversarial Attack on Graph Structured Datacited by 300
  15. 2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 276
  16. 2018Adversarial Attacks and Defences: A Surveycited by 259
  17. 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
  18. 2018Lipschitz-Margin Training: Scalable Certification of Perturbation Invariance for Deep Neural Networkscited by 193
  19. 2018Semidefinite relaxations for certifying robustness to adversarial examplescited by 178
  20. 2018Disentangling Adversarial Robustness and Generalizationcited by 171
  21. 2020Understanding and Mitigating the Tradeoff Between Robustness and Accuracycited by 148
  22. 2019Semantics-Guided Neural Networks for Efficient Skeleton-Based Human Action Recognitioncited by 135
  23. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  24. 2017Deep Text Classification Can be Fooledcited by 105
  25. 2019On the Anatomy of MCMC-Based Maximum Likelihood Learning of Energy-Based Modelscited by 105
  26. 2020Adversarial Distributional Training for Robust Deep Learningcited by 79
  27. 2020Opportunities and Challenges in Deep Learning Adversarial Robustness: A Surveycited by 71
  28. 2020On the Loss Landscape of Adversarial Training: Identifying Challenges and How to Overcome Themcited by 59
  29. 2020Stochastic Security: Adversarial Defense Using Long-Run Dynamics of Energy-Based Modelscited by 58
  30. 2018Sparse Adversarial Perturbations for Videoscited by 56
  31. 2019Certified Robustness for Top-k Predictions against Adversarial Perturbations via Randomized Smoothingcited by 54
  32. 2018Improving the Generalization of Adversarial Training with Domain Adaptationcited by 48
  33. 2020Black-Box Certification with Randomized Smoothing: A Functional Optimization Based Frameworkcited by 45
  34. 2019Adversarial Attacks on Time Seriescited by 40
  35. 2019Heuristic Black-box Adversarial Attacks on Video Recognition Modelscited by 37
  36. 2020Over-the-Air Adversarial Flickering Attacks against Video Recognition Networkscited by 35
  37. 2019Spatio-temporal Manifold Learning for Human Motions via Long-horizon Modelingcited by 32
  38. 2019Adversarial Attack on Skeleton-based Human Action Recognitioncited by 32

50 most cited of 60 All 60 (JSON)

Built on by

Cited by year

Citing papers per year: 2023: 3; 2024: 4; 2025: 1.

8 papers.

  1. 2024Vulnerabilities in AI-generated Image Detection: The Challenge of Adversarial Attackscited by 12
  2. 2023Hard No-Box Adversarial Attack on Skeleton-Based Human Action Recognition with Skeleton-Motion-Informed Gradientcited by 10
  3. 2025Fast Adversarial Training with Weak-to-Strong Spatial-Temporal Consistency in the Frequency Domain on Videoscited by 9
  4. 2024TASAR: Transfer-based Attack on Skeletal Action Recognitioncited by 7
  5. 2024Two-Person Interaction Augmentation with Skeleton Priorscited by 5
  6. 2023Fourier Analysis on Robustness of Graph Convolutional Neural Networks for Skeleton-based Action Recognitioncited by 2
  7. 2023Post-train Black-box Defense via Bayesian Boundary Correctioncited by 1
  8. 2024Boosting Adversarial Transferability for Skeleton-based Action Recognition via Exploring the Model Posterior Spacecited by 0