Imperceptible Local Adversarial Attacks on Human Pose Estimation

Though deep neural networks have achieved state-of-the-art performance in many tasks, they have recently been shown to be unstable to slight adversarial perturbations of data samples. In the task of adversarial attack on human pose estimation, large perturbations are usually required to achieve an attack, which degrades the imperceptibility. If, on the other hand, small perturbations preserve the imperceptibility, which weakens the adversary attack effect. To solve this issue, this paper proposes a two-stage local adversarial attack method for human pose estimation. The proposed method first estimates critical perturbation regions by pre-attack, and then generates adversarial perturbations within each critical region under the imperceptibility constraint. The proposed method improves the attack success rate on human pose estimation and retains imperceptibility as well. We validate the effectiveness of our method on COCO2017 dataset in terms of PCK metric and compare the results with existing methods including IGSM and C&W. Our proposed method outperforms existing methods, and improves the attack success rate by 15.4% and 2.8% respectively. The experiments show that our method achieves higher attack success rates while keeping the imperceptibility of the attack.