Quality-Preserving Imperceptible Adversarial Attack on Skeleton-based Human Action Recognition

2026-06-11

AI Summary

This work addresses the limitations of existing adversarial attacks on skeleton-based action recognition, which often introduce noise-like perturbations that distort motion and are easily perceptible. To overcome this, the authors propose a naturalness-preserving adversarial attack method that leverages kinematic distribution modeling and perceptual alignment optimization to generate high-fidelity adversarial examples without explicit noise injection. This approach achieves, for the first time, imperceptible yet highly effective attacks while introducing a novel action quality metric aligned with human perception. The proposed metric further reveals a notable gap between empirical and true risk. Evaluated on two benchmark datasets, the method attains high attack success rates against state-of-the-art models while significantly outperforming existing approaches in terms of motion naturalness and visual quality.

Abstract

Adversarial attacks on skeletal human action recognition have received significant attention. However, existing methods typically introduce noise-like perturbations that degrade motion quality post-attack, and thereby are inherently perceptible with recent advancements in S-HAR systems. We discover that this degradation stems from the gap between empirical and true risks during the optimization process of previous adversarial attacks. To address this issue, we propose an attack where adversarial motions are obtained without compromising their motion quality. To minimize the risk gap and preserve motion quality, we propose a distribution-based adversarial attack method without introducing noise-like perturbations. To faithfully evaluate the motion quality, we propose a new metric that aligns with human perception on real-world naturalness. Experiments have been conducted on the state-of-the-art S-HAR methods across two datasets, demonstrating the superiority of our method in both the attack success rate and the post-attack motion quality through qualitative and quantitative analyses. The success of our quality-preserving attack application and distribution-based method raises serious concerns about the robustness of action recognizers, highlighting the need for further enhancements in this domain.

Problem

• adversarial attack
• skeleton-based human action recognition
• motion quality
• imperceptibility
• risk gap

Innovation

• distribution-based adversarial attack
• quality-preserving
• skeleton-based human action recognition
• imperceptible perturbation
• motion naturalness metric