Pith. sign in

REVIEW 3 major objections 6 minor 64 references

VideoPure: Diffusion-based Adversarial Purification for Video Recognition

T0 review · 3 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper introduces VideoPure, the first diffusion-based adversarial purification framework for video recognition, and claims it outperforms existing purification defenses without retraining the protected model.

desk verdict First diffusion-based video purification method with a plausible design, but the adaptive-attack evaluation likely reflects gradient masking rather than genuine robustness. read the letter →

arxiv 2501.14999 v1 pith:TA4OYLN6 submitted 2025-01-25 cs.CV

Kaixun Jiang , Zhaoyu Chen , Jiyuan Fu , Lingyi Hong , Jinglun Li , Wenqiang Zhang This is my paper · ORCID
classification cs.CV
keywords videorecognitionadversarialpurificationdiffusionmodelsdefensetemporalDDIMinversionmulti-stepvotingadaptiveattacksopticalflow
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper introduces VideoPure, a defense for video recognition models that purifies adversarial videos with a video diffusion model before classification. It claims to be the first to bring diffusion-based adversarial purification to the video domain, and reports that its combination of temporal DDIM inversion, spatial-temporal optimization, and multi-step voting outperforms both per-frame image purification methods and existing video defenses. The practical stakes are that a model-agnostic, training-free preprocessing step could make video recognition models substantially harder to attack without sacrificing their accuracy on clean videos. The evaluations span black-box, gray-box, and adaptive attacks on UCF-101 and Kinetics-400 with Non-local and SlowFast backbones.

What carries the argument

The load-bearing mechanism is temporal DDIM inversion, which replaces the stochastic forward diffusion with a deterministic trajectory in which the noise predicted from the first frame is replicated across all frames, making the forward path temporally consistent yet slightly mismatched with the denoising path so that adversarial detail is shed while video structure is retained. Spatial-temporal optimization then pushes each intermediate denoised latent away from the adversarial input with a negative MSE loss and enforces temporal consistency through an optical-flow warping L1 loss. Multi-step voting collects the predicted $\hat{z}_t^0$ latents from every denoising step, decodes them, and takes the majority class over the recognition model's outputs, which the paper argues traps an adaptive attacker in a local optimum across the voting list.

What would settle it

Run a PGD adaptive attack that computes gradients through the full VideoPure computation graph, including the spatial-temporal optimization, the voting over multiple $\hat{z}_t^0$ reconstructions, and the decoding step, rather than approximating the pipeline as identity. If a memory-efficient estimator such as a segment-wise backward pass or a surrogate that differentiates the voting aggregation drives robust accuracy down substantially from the reported values near 100 percent, the claimed defense strength rests on gradient obstruction rather than purification.

Watch

Extended reading notes

Core claim

The central claim is that diffusion-based purification, previously effective mostly on images, can be transferred to videos by making the diffusion trajectory temporally aware. Concretely, VideoPure encodes the video into a latent space, applies temporal DDIM inversion to reach a noisy but temporally consistent latent, denoises with DDIM while optimizing each intermediate latent with a spatial loss (negative MSE from the original latent) and a temporal loss (optical-flow warping consistency), and then runs majority voting over the $t^*+1$ decoded intermediate predictions. The paper reports that this design yields higher average defense accuracy than DiffPure, Temporal Shuffle, JPEG, and wavelet denoising across PGD, TT, EOT, DiffAttack, AutoAttack, and black-box attacks, and that it does so about four times faster than DiffPure DDPM while preserving clean accuracy near the undefended level.

Load-bearing premise

The central assumption is that the adaptive-attack evaluations, which approximate the whole VideoPure pipeline with the identity function in the backward pass, produce gradients faithful enough to reveal the defense's true robustness; if the voting and latent-space optimization instead hide gradients from the attacker, the reported robust-accuracy figures would overstate the defense.

Editorial extensions

If this is right

  • Video recognition models can be defended against a broad set of adversarial attacks without adversarial training, retraining, or any knowledge of the protected model, because VideoPure is a preprocessing plugin.
  • Naive per-frame purification is suboptimal because it ignores temporal correlation; any video-domain diffusion defense needs to model temporal consistency, not just denoise frames independently.
  • Using a video diffusion model as the denoiser is materially better than using image diffusers frame-by-frame, in both standard accuracy and adaptive robustness.
  • Multi-step voting converts the denoising trajectory's intermediate reconstructions into a committee, so an adaptive attacker must fool multiple related purified versions at once rather than a single output.
  • The reported efficiency of about 8.5 seconds per video makes this class of defense more practical than prior diffusion purification for video workloads.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's evaluation relies on BPDA's identity approximation for adaptive gradients; a natural next test is an adaptive attack that backpropagates through the actual voting aggregation and spatial-temporal optimization steps, which would reveal whether the high robust accuracy stems from true purification or from gradient obstruction through non-differentiable steps.
  • Because the temporal consistency loss depends on optical flow, a dedicated attacker could target the flow estimator itself; the paper tests attacks that perturb flow, but a joint adaptive attack that optimizes the video and the flow perturbation together would stress the defense further.
  • The same three-step recipe of temporally consistent inversion, flow-constrained denoising, and voting over intermediate latents could extend to other video tasks such as object tracking, segmentation, or video captioning, where adversarial perturbations are also temporal.
  • The method's model-agnostic nature means it could be stacked with other defenses, such as adversarial training or random frame shuffling; the paper does not explore whether combining defenses compounds robustness or merely increases inference cost.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes VideoPure, a diffusion-based adversarial purification framework for video recognition. The method combines temporal DDIM inversion, spatial-temporal optimization, and multi-step voting: a video latents are first encoded and inverted with a temporally replicated noise prediction, then denoised with DDIM while each intermediate latent is optimized with spatial and temporal losses, and finally the decoded candidates are classified and majority-voted. The authors claim to be the first to introduce diffusion-based adversarial purification in the video domain and report defense results against black-box, gray-box, and adaptive attacks on NL and SlowFast models using UCF-101 and Kinetics-400 subsets.

Significance. If the robustness results survive proper evaluation, VideoPure would be a useful model-agnostic defense plugin for video recognition, and the use of a video diffusion model rather than per-frame image diffusion is a sensible step toward temporal consistency. The paper has concrete strengths: it releases code, it systematically ablates the three proposed modules in Tables IV-IX, and it demonstrates a clear efficiency gain over DiffPure DDPM in Table X. The significance is conditional, however, on the adaptive-attack evaluation being valid, and the current evidence is weakened by the very small evaluation set and by hyperparameters tuned on the same test set.

major comments (3)
  1. [Section II-A3, Eq. (2), Algorithm 1, Table I] The BPDA implementation with g(x)=x is not a valid adaptive attack on the full VideoPure pipeline. Under that surrogate, the backward pass produces gradients of the classifier loss evaluated at P(x) without differentiating through P, so PGD+BPDA, TT+BPDA, and EOT+BPDA do not optimize the actual composed function F(x)=f(P(x)); moreover, Algorithm 1 (lines 16-19) votes by argmax over non-differentiable decoded samples, and the paper does not describe any relaxation or straight-through estimator for that step. The reported Robust Acc values, including the 100% values in Table I, may therefore reflect gradient masking rather than genuine robustness. Please specify the exact backward pass through the full pipeline, including the voting mechanism, or implement a full-backward adaptive attack (e.g., with differentiable soft voting or random-subset voting) and re-report the adaptive-attack results.
  2. [Section IV-A and Section IV-G] The evaluation is based on only 101 and 100 videos, with no error bars or repeated trials, and the hyperparameters t*, alpha_s, lambda_1, and lambda_2 are selected by inspecting accuracy on the same small test set in Figures 5b and 6. With such a small sample size, differences of a few percent, and especially values of 100%, are not statistically meaningful; the reported average improvements in Table I and the AutoAttack result on 30 videos in Table II need confidence intervals, multiple random splits, or a separate validation set for hyperparameter tuning.
  3. [Section IV-B4 and Algorithm 1] The PGD+Diffattack results are presented as a stronger adaptive attack, but the paper does not explain how Diffattack's segment-wise gradient estimation handles the non-differentiable multi-step voting or the repeated spatial-temporal optimization steps in Eqs. (12)-(16). Without such a description, the PGD+Diffattack row cannot serve as evidence that the defense survives attacks that optimize through the whole purification procedure.
minor comments (6)
  1. [Section III-B2, Eq. (14), Eq. (16), Algorithm 1] Equation (14) omits the sigma_t^2 scaling factor that appears in Eq. (16) and in Algorithm 1 line 8; please clarify whether the two update rules are intended to be identical.
  2. [Table IX] The text states that Lspa alone significantly improves Robust Acc, but the table has no condition with only Lspa; the missing ablation row should be added.
  3. [Section IV-G] Section IV-A says the hyperparameter tuning details are in Section IV-G, but Section IV-G reports sensitivity only for t* and alpha_s; sensitivity to lambda_1 and lambda_2 is not shown.
  4. [Table II] The AutoAttack experiment uses 30 randomly selected videos; please state the exact selection procedure and confirm that the same 30 videos are used for all defense methods.
  5. [Figures 2 and 7] The visual evidence for the claim that temporal DDIM inversion 'eliminates more adversarial noise' is qualitative; add a quantitative measure such as LPIPS, SSIM, or temporal consistency error.
  6. [Throughout] There are several minor typographical issues, including 'amog' in Section III-A, 'Combing' in Section III-B2, and 'adptive' in Section IV-C6; these should be corrected.

Circularity Check

1 steps flagged · score 2.0 of 10

No definitional circularity; the pipeline is assembled from independent diffusion/denoising components. Mild caveat: key hyperparameters are selected on the same UCF-101/NL test metrics that Table I reports, so part of the claimed robustness is test-set fitted rather than out-of-sample.

  1. fitted input called prediction [Section IV-G (hyper-parameter tuning), Fig. 5(b), Fig. 6; Implement Details in Section IV-A; results in Table I]
    "For the extra hyper-parameters in our method, we set timestep t∗ = 6 for DDIM ... guidance scale αs = −4 ... λ1 = 5, λ2 = 800. Hyper-parameters tuning's detials are in Section IV-G. ... Considering all three metrics, we choose t∗ = 6. ... Considering the overall defense performance, we select αs = −4."

    The hyperparameters t* and αs are chosen by inspecting the same Standard Acc, Robust Acc*, and Robust Acc metrics on the same UCF-101/NL experimental configuration that later appear as VideoPure's headline numbers in Table I. The paper does not describe a held-out validation split. Consequently, the reported superiority on that dataset/model is partly a selected optimum over the tuned parameters rather than an independent prediction from the algorithm. This is mild self-fitting, not a definitional equivalence: the pipeline itself is not derived from the reported accuracies.

full rationale

VideoPure is an algorithmic defense pipeline composed of independently motivated components: temporal DDIM inversion (Eq. 11, based on the first-frame noise replication idea from Text2Video-Zero), spatial-temporal optimization (Eqs. 12-16, based on flow-warping consistency from motion-guided latent diffusion), and multi-step voting over intermediate DDIM estimates (Eq. 15, Algorithm 1). None of these steps defines a target quantity in terms of the headline accuracy, and the method is evaluated against external pretrained video classifiers (NL, SlowFast) and datasets (UCF-101, Kinetics-400). No load-bearing self-citation or imported uniqueness theorem is used; citations [25], [35], [55], [56] supply standard samplers and prior design elements, not a forced conclusion. The main circularity-adjacent issue is that t*, αs, λ1, and λ2 are tuned on the same UCF-101/NL test metrics reported in Table I, so some reported robustness is fitted to the benchmark. Separately, the BPDA adaptive attacks use the identity surrogate g(x)=x (Section II-A3), which means the backward pass does not differentiate through the voting argmax or the spatial-temporal optimization; this is a serious threat to the validity of the 100% Robust Acc figures, but it is an evaluation-protocol problem (possible gradient masking) rather than a circular derivation. Given the hard rule that circularity requires an exhibited reduction, the appropriate score is low: the central contribution is not circular, with a mild self-fitting caveat.

Assumptions & free parameters 3 free parameters · 6 assumptions · 0 invented entities

The method is empirical, so the ledger is dominated by modeling assumptions and tuned hyperparameters. No new physical or mathematical entities are invented. The main borrowed axiom is that diffusion purification transfers from images to video latents; the main ad hoc assumptions are that first-frame noise replication plus flow-based optimization preserves structure while removing perturbations, and that multi-step voting disrupts attack optimization.

free parameters (3)
  • diffusion timestep t* = 6 (DDIM, T=50)
    Tuned on the evaluation set in Section IV-G, Figure 6; larger t* removes more adversarial noise but lowers clean accuracy.
  • guidance scale alpha_s = -4
    Tuned on the evaluation set in Section IV-G, Figure 5b; controls strength of spatial-temporal optimization.
  • loss weights lambda1, lambda2 = 5, 800
    Set in Section IV-A to balance magnitudes of Ltemp and Lspa; not cross-validated.
assumptions (6)
  • domain assumption Adversarial and clean videos converge to similar distributions after enough diffusion steps.
    Inherited from DiffPure (Nie et al., 2022) as cited in Section III-A; not re-derived for video latents, and underpins the entire purification approach.
  • domain assumption ModelScope, a text-to-video latent diffusion model, can act as a generic clean-video prior.
    The defense relies on the pretrained ModelScope denoiser without fine-tuning (Section III-A, IV-A); no evidence is given that its training distribution covers the test videos.
  • ad hoc to paper Replacing each frame's predicted noise with the first frame's predicted noise in DDIM inversion yields a temporally consistent trajectory.
    Eq. 11 in Section III-B1; motivated by Text2Video-Zero (ref [55]) but no formal support is given for the video purification setting.
  • domain assumption Optical-flow warping reconstruction Ltemp preserves temporal consistency of denoised latents.
    Borrowed from video super-resolution (ref [56], Eq. 13); assumes optical flow computed on denoised latents is reliable.
  • ad hoc to paper Multi-step voting traps adaptive attacks in a local optimum.
    Stated in Section III-B3 without proof; the mechanism is speculative and the adaptive attack protocol does not verify gradient flow through voting.
  • domain assumption BPDA with the identity approximation gives valid attack gradients through the full VideoPure pipeline.
    Section II-A3 and Section IV-B; the backward pass through the voting argmax and per-step latent optimization is not described, so this assumption is unchecked.

how reviews work

0 comments
Cite this review

Pith. "Pith review of VideoPure: Diffusion-based Adversarial Purification for Video Recognition." pith.science (2026). https://pith.science/paper/TA4OYLN6

@misc{pith2026250114999,
  author       = {Pith},
  title        = {Pith review of: VideoPure: Diffusion-based Adversarial Purification for Video Recognition},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TA4OYLN6}},
  note         = {Machine review of arXiv:2501.14999}
}
read the original abstract

Recent work indicates that video recognition models are vulnerable to adversarial examples, posing a serious security risk to downstream applications. However, current research has primarily focused on adversarial attacks, with limited work exploring defense mechanisms. Furthermore, due to the spatial-temporal complexity of videos, existing video defense methods face issues of high cost, overfitting, and limited defense performance. Recently, diffusion-based adversarial purification methods have achieved robust defense performance in the image domain. However, due to the additional temporal dimension in videos, directly applying these diffusion-based adversarial purification methods to the video domain suffers performance and efficiency degradation. To achieve an efficient and effective video adversarial defense method, we propose the first diffusion-based video purification framework to improve video recognition models' adversarial robustness: VideoPure. Given an adversarial example, we first employ temporal DDIM inversion to transform the input distribution into a temporally consistent and trajectory-defined distribution, covering adversarial noise while preserving more video structure. Then, during DDIM denoising, we leverage intermediate results at each denoising step and conduct guided spatial-temporal optimization, removing adversarial noise while maintaining temporal consistency. Finally, we input the list of optimized intermediate results into the video recognition model for multi-step voting to obtain the predicted class. We investigate the defense performance of our method against black-box, gray-box, and adaptive attacks on benchmark datasets and models. Compared with other adversarial purification methods, our method overall demonstrates better defense performance against different attacks. Our code is available at https://github.com/deep-kaixun/VideoPure.

Figures

Figures reproduced from arXiv: 2501.14999 by the authors.

Figure 1
Figure 1. Overview of our VideoPure framework. First, we encode video input [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Visualizations after different inversion methods. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. (a) shows the performance comparison of different defense methods. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Loss changes of different defense methods with attack steps under [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: (a) shows the effect of attack steps under PGD & PGD+BPDA on NL [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 6
Figure 6. Figure 6: Hyper-parameters tuning on diffusion timestep. [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]
Figure 7
Figure 7. Figure 7: Visualizations of decoded z t 0 . The first two rows show purification for Standard Acc, the middle two for Robust Acc*, and the last two for Robust Acc. PGD* denotes PGD+BPDA. G. Diagnostic Experiments In this section, we discuss the impact of different attack ϵadv, a…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

64 extracted references · 51 canonical work pages

  1. [1]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in IEEE Conf. Comput. Vis. Pattern Recog., 2016, pp. 770– 778

    work page 2016

  2. [2]

    Towards practical certifiable patch defense with vision transformer,

    Z. Chen, B. Li, J. Xu, S. Wu, S. Ding, and W. Zhang, “Towards practical certifiable patch defense with vision transformer,” in IEEE Conf. Comput. Vis. Pattern Recog. , 2022, pp. 15 148–15 158

    work page 2022

  3. [3]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” inInt. Conf. Learn. Represent., 2018

    work page 2018

  4. [4]

    Cross-shaped adversarial patch attack,

    Y . Ran, W. Wang, M. Li, L. Li, Y . Wang, and J. Li, “Cross-shaped adversarial patch attack,” IEEE Trans. Circuits Syst. Video Technol., pp. 2289–2303, 2024

    work page 2024

  5. [5]

    Adversarial attacks on video object segmentation with hard region discovery,

    P. Li, Y . Zhang, L. Yuan, J. Zhao, X. Xu, and X. Zhang, “Adversarial attacks on video object segmentation with hard region discovery,” IEEE Trans. Circuits Syst. Video Technol., pp. 5049–5062, 2024

    work page 2024

  6. [6]

    Diffusion patch attack with spatial-temporal cross-evolution for video recognition,

    J. Yang, Z. Guan, J. Li, Z. Shi, and X. Liu, “Diffusion patch attack with spatial-temporal cross-evolution for video recognition,” IEEE Trans. Circuits Syst. Video Technol., pp. 13 190–13 200, 2024

    work page 2024

  7. [7]

    Bullet-screen-emoji attack with temporal difference noise for video action recognition,

    Y . Zhang, H. Zhang, J. Li, Z. Shi, J. Yang, K. Yang, S. Yin, Q. Liang, and X. Liu, “Bullet-screen-emoji attack with temporal difference noise for video action recognition,” IEEE Trans. Circuits Syst. Video Technol., 2024

    work page 2024

  8. [8]

    Only once attack: Fooling the tracker with adversarial template,

    Z. Zhou, Y . Sun, Q. Sun, C. Li, and Z. Ren, “Only once attack: Fooling the tracker with adversarial template,” IEEE Trans. Circuits Syst. Video Technol., pp. 3173–3184, 2023

    work page 2023

Show all 64 references
  1. [9]

    A simple and strong baseline for universal targeted attacks on siamese visual tracking,

    Z. Li, Y . Shi, J. Gao, S. Wang, B. Li, P. Liang, and W. Hu, “A simple and strong baseline for universal targeted attacks on siamese visual tracking,” IEEE Trans. Circuits Syst. Video Technol. , pp. 3880–3894, 2022

    2022

  2. [10]

    Sparse adversarial perturbations for videos,

    X. Wei, J. Zhu, S. Yuan, and H. Su, “Sparse adversarial perturbations for videos,” in AAAI, vol. 33, no. 01, 2019, pp. 8973–8980

    2019

  3. [11]

    The apolloscape dataset for autonomous driving,

    X. Huang, X. Cheng, Q. Geng, B. Cao, D. Zhou, P. Wang, Y . Lin, and R. Yang, “The apolloscape dataset for autonomous driving,” in IEEE Conf. Comput. Vis. Pattern Recog. Worksh. , 2018, pp. 954–960

    2018

  4. [12]

    A system for video surveillance and monitoring,

    R. T. Collins, A. J. Lipton, T. Kanade, H. Fujiyoshi, D. Duggins, Y . Tsin, D. Tolliver, N. Enomoto, O. Hasegawa, P. Burtet al., “A system for video surveillance and monitoring,” VSAM final report , vol. 2000, no. 1-68, p. 1, 2000

    2000

  5. [13]

    Uncovering the limits of adversarial training against norm-bounded adversarial examples,

    S. Gowal, C. Qin, J. Uesato, T. Mann, and P. Kohli, “Uncovering the limits of adversarial training against norm-bounded adversarial examples,” arXiv preprint arXiv:2010.03593 , 2020

    2010 arXiv

  6. [14]

    Theoretically principled trade-off between robustness and accuracy,

    H. Zhang, Y . Yu, J. Jiao, E. Xing, L. El Ghaoui, and M. Jordan, “Theoretically principled trade-off between robustness and accuracy,” in Int. Conf. Mach. Learn. PMLR, 2019, pp. 7472–7482

    2019

  7. [15]

    Improving robustness using generated data,

    S. Gowal, S.-A. Rebuffi, O. Wiles, F. Stimberg, D. A. Calian, and T. A. Mann, “Improving robustness using generated data,”Adv. Neural Inform. Process. Syst., vol. 34, pp. 4218–4233, 2021

    2021

  8. [16]

    Adversarial machine learning at scale,

    A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial machine learning at scale,” in Int. Conf. Learn. Represent. , 2016

    2016

  9. [17]

    Defending against multiple and unforeseen adversarial videos,

    S.-Y . Lo and V . M. Patel, “Defending against multiple and unforeseen adversarial videos,” IEEE Trans. Image Process. , vol. 31, pp. 962–973, 2021

    2021

  10. [18]

    Analysis and extensions of adversarial training for video classification,

    K. A. Kinfu and R. Vidal, “Analysis and extensions of adversarial training for video classification,” in IEEE Conf. Comput. Vis. Pattern Recog. Worksh., June 2022, pp. 3416–3425

    2022

  11. [19]

    Defense-gan: Protecting classifiers against adversarial attacks using generative models,

    P. Samangouei, M. Kabkab, and R. Chellappa, “Defense-gan: Protecting classifiers against adversarial attacks using generative models,” in Int. Conf. Learn. Represent. , 2018

    2018

  12. [20]

    Pixelde- fend: Leveraging generative models to understand and defend against adversarial examples,

    Y . Song, T. Kim, S. Nowozin, S. Ermon, and N. Kushman, “Pixelde- fend: Leveraging generative models to understand and defend against adversarial examples,” in Int. Conf. Learn. Represent. , 2018

    2018

  13. [21]

    Defending video recognition model against adversarial perturbations via defense patterns,

    H. J. Lee and Y . M. Ro, “Defending video recognition model against adversarial perturbations via defense patterns,” IEEE Trans. Dependable Secure Comput., 2023. 13

    2023

  14. [22]

    Shield: Fast, practical defense and vaccination for deep learning using jpeg compression,

    N. Das, M. Shanbhogue, S.-T. Chen, F. Hohman, S. Li, L. Chen, M. E. Kounavis, and D. H. Chau, “Shield: Fast, practical defense and vaccination for deep learning using jpeg compression,” in ACM SIGKDD, 2018, pp. 196–204

    2018

  15. [23]

    Defense for adversarial videos by self-adaptive jpeg compression and optical texture,

    Y . Cheng, X. Wei, H. Fu, S.-W. Lin, and W. Lin, “Defense for adversarial videos by self-adaptive jpeg compression and optical texture,” in ACM Int. Conf. Multimedia Asia , 2021, pp. 1–7

    2021

  16. [24]

    Temporal shuffling for defending deep action recognition models against adver- sarial attacks,

    J. Hwang, H. Zhang, J.-H. Choi, C.-J. Hsieh, and J.-S. Lee, “Temporal shuffling for defending deep action recognition models against adver- sarial attacks,” Neural Networks, vol. 169, pp. 388–397, 2024

    2024

  17. [25]

    Diffusion models for adversarial purification,

    W. Nie, B. Guo, Y . Huang, C. Xiao, A. Vahdat, and A. Anandkumar, “Diffusion models for adversarial purification,” in Int. Conf. Mach. Learn. PMLR, 2022, pp. 16 805–16 827

    2022

  18. [26]

    Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,

    A. Athalye, N. Carlini, and D. Wagner, “Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,” in Int. Conf. Mach. Learn. PMLR, 2018, pp. 274–283

    2018

  19. [27]

    Synthesizing robust adversarial examples,

    A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok, “Synthesizing robust adversarial examples,” in Int. Conf. Mach. Learn. PMLR, 2018, pp. 284–293

    2018

  20. [28]

    Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,

    F. Croce and M. Hein, “Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,” in Int. Conf. Mach. Learn. PMLR, 2020, pp. 2206–2216

    2020

  21. [29]

    Threat model- agnostic adversarial defense using diffusion models,

    T. Blau, R. Ganz, B. Kawar, A. Bronstein, and M. Elad, “Threat model- agnostic adversarial defense using diffusion models,” arXiv preprint arXiv:2207.08089, 2022

    2022 arXiv

  22. [30]

    Guided diffusion model for adversarial pu- rification from random noise,

    Q. Wu, H. Ye, and Y . Gu, “Guided diffusion model for adversarial pu- rification from random noise,” arXiv preprint arXiv:2206.10875 , 2022

    2022 arXiv

  23. [31]

    Guided diffusion model for adversarial purification,

    J. Wang, Z. Lyu, D. Lin, B. Dai, and H. Fu, “Guided diffusion model for adversarial purification,” arXiv preprint arXiv:2205.14969 , 2022

    2022 arXiv

  24. [32]

    Enhancing adversarial robustness via score-based optimization,

    B. Zhang, W. Luo, and Z. Zhang, “Enhancing adversarial robustness via score-based optimization,” Adv. Neural Inform. Process. Syst. , vol. 36, 2024

    2024

  25. [33]

    Denoising diffusion probabilistic models,

    J. Ho, A. Jain, and P. Abbeel, “Denoising diffusion probabilistic models,” Adv. Neural Inform. Process. Syst. , vol. 33, pp. 6840–6851, 2020

    2020

  26. [34]

    Mod- elscope text-to-video technical report,

    J. Wang, H. Yuan, D. Chen, Y . Zhang, X. Wang, and S. Zhang, “Mod- elscope text-to-video technical report,”arXiv preprint arXiv:2308.06571, 2023

    2023 arXiv

  27. [35]

    Denoising diffusion implicit models,

    J. Song, C. Meng, and S. Ermon, “Denoising diffusion implicit models,” in Int. Conf. Learn. Represent. , 2020

    2020

  28. [36]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” in Int. Conf. Learn. Represent., 2014

    2014

  29. [37]

    Boosting the transferability of video adversarial examples via temporal translation,

    Z. Wei, J. Chen, Z. Wu, and Y .-G. Jiang, “Boosting the transferability of video adversarial examples via temporal translation,” in AAAI, vol. 36, no. 3, 2022, pp. 2659–2667

    2022

  30. [38]

    Global-local characteristic excited cross-modal attacks from images to videos,

    R. Wang, Y . Guo, and Y . Wang, “Global-local characteristic excited cross-modal attacks from images to videos,” in AAAI, vol. 37, no. 2, 2023, pp. 2635–2643

    2023

  31. [39]

    Cross-modal transferable adversarial attacks from images to videos,

    Z. Wei, J. Chen, Z. Wu, and Y .-G. Jiang, “Cross-modal transferable adversarial attacks from images to videos,” in IEEE Conf. Comput. Vis. Pattern Recog., 2022, pp. 15 064–15 073

    2022

  32. [40]

    Black-box adversarial attacks on video recognition models,

    L. Jiang, X. Ma, S. Chen, J. Bailey, and Y .-G. Jiang, “Black-box adversarial attacks on video recognition models,” in ACM Int. Conf. Multimedia, 2019, pp. 864–872

    2019

  33. [41]

    Motion-excited sampler: Video adversarial attack with sparked prior,

    H. Zhang, L. Zhu, Y . Zhu, and Y . Yang, “Motion-excited sampler: Video adversarial attack with sparked prior,” in Eur. Conf. Comput. Vis. Springer, 2020, pp. 240–256

    2020

  34. [42]

    Efficient decision-based black-box patch attacks on video recognition,

    K. Jiang, Z. Chen, H. Huang, J. Wang, D. Yang, B. Li, Y . Wang, and W. Zhang, “Efficient decision-based black-box patch attacks on video recognition,” in Int. Conf. Comput. Vis. , 2023, pp. 4379–4389

    2023

  35. [43]

    Towards decision-based sparse attacks on video recognition,

    K. Jiang, Z. Chen, X. Zhou, J. Zhang, L. Hong, J. Wang, B. Li, Y . Wang, and W. Zhang, “Towards decision-based sparse attacks on video recognition,” in ACM Int. Conf. Multimedia, 2023, pp. 1443–1454

    2023

  36. [44]

    Adversarial examples in the physical world,

    A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” in Artificial intelligence safety and security . Chapman and Hall/CRC, 2018, pp. 99–112

    2018

  37. [45]

    Adam: A method for stochastic optimization,

    D. P. Kingma and J. Ba, “Adam: A method for stochastic optimization,” arXiv preprint arXiv:1412.6980 , 2014

    2014 arXiv

  38. [46]

    Just one moment: Structural vulnerability of deep action recognition against one frame attack,

    J. Hwang, J.-H. Kim, J.-H. Choi, and J.-S. Lee, “Just one moment: Structural vulnerability of deep action recognition against one frame attack,” in Int. Conf. Comput. Vis. , 2021, pp. 7668–7676

    2021

  39. [47]

    Over-the-air adversarial flickering attacks against video recognition networks,

    R. Pony, I. Naeh, and S. Mannor, “Over-the-air adversarial flickering attacks against video recognition networks,” in IEEE Conf. Comput. Vis. Pattern Recog., 2021, pp. 515–524

    2021

  40. [48]

    Diffattack: Evasion attacks against diffusion-based adversarial purification,

    M. Kang, D. Song, and B. Li, “Diffattack: Evasion attacks against diffusion-based adversarial purification,” Adv. Neural Inform. Process. Syst., vol. 36, 2024

    2024

  41. [49]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572 , 2014

    2014 arXiv

  42. [50]

    Image super- resolution as a defense against adversarial attacks,

    A. Mustafa, S. H. Khan, M. Hayat, J. Shen, and L. Shao, “Image super- resolution as a defense against adversarial attacks,” IEEE Trans. Image Process., vol. 29, pp. 1711–1724, 2020

    2020

  43. [51]

    Taming transformers for high- resolution image synthesis,

    P. Esser, R. Rombach, and B. Ommer, “Taming transformers for high- resolution image synthesis,” in IEEE Conf. Comput. Vis. Pattern Recog., 2021, pp. 12 873–12 883

    2021

  44. [52]

    Null- text inversion for editing real images using guided diffusion models,

    R. Mokady, A. Hertz, K. Aberman, Y . Pritch, and D. Cohen-Or, “Null- text inversion for editing real images using guided diffusion models,” in IEEE Conf. Comput. Vis. Pattern Recog. , 2023, pp. 6038–6047

    2023

  45. [53]

    Content-based unrestricted adversarial attack,

    Z. Chen, B. Li, S. Wu, K. Jiang, S. Ding, and W. Zhang, “Content-based unrestricted adversarial attack,” in Adv. Neural Inform. Process. Syst. , vol. 36, 2023, pp. 51 719–51 733

    2023

  46. [54]

    Diffusion model-based image editing: A survey,

    Y . Huang, J. Huang, Y . Liu, M. Yan, J. Lv, J. Liu, W. Xiong, H. Zhang, S. Chen, and L. Cao, “Diffusion model-based image editing: A survey,” arXiv preprint arXiv:2402.17525 , 2024

    2024 arXiv

  47. [55]

    Text2video-zero: Text-to-image diffusion models are zero-shot video generators,

    L. Khachatryan, A. Movsisyan, V . Tadevosyan, R. Henschel, Z. Wang, S. Navasardyan, and H. Shi, “Text2video-zero: Text-to-image diffusion models are zero-shot video generators,” in Int. Conf. Comput. Vis., 2023, pp. 15 954–15 964

    2023

  48. [56]

    Motion-guided latent diffusion for temporally consistent real-world video super-resolution,

    X. Yang, C. He, J. Ma, and L. Zhang, “Motion-guided latent diffusion for temporally consistent real-world video super-resolution,” arXiv preprint arXiv:2312.00853, 2023

    2023 arXiv

  49. [57]

    Ucf101: A dataset of 101 human actions classes from videos in the wild,

    K. Soomro, A. R. Zamir, and M. Shah, “Ucf101: A dataset of 101 human actions classes from videos in the wild,”arXiv preprint arXiv:1212.0402, 2012

    2012 arXiv

  50. [58]

    Quo vadis, action recognition? a new model and the kinetics dataset,

    J. Carreira and A. Zisserman, “Quo vadis, action recognition? a new model and the kinetics dataset,” in IEEE Conf. Comput. Vis. Pattern Recog., 2017, pp. 6299–6308

    2017

  51. [59]

    Non-local neural net- works,

    X. Wang, R. Girshick, A. Gupta, and K. He, “Non-local neural net- works,” in IEEE Conf. Comput. Vis. Pattern Recog. , 2018, pp. 7794– 7803

    2018

  52. [60]

    Slowfast networks for video recognition,

    C. Feichtenhofer, H. Fan, J. Malik, and K. He, “Slowfast networks for video recognition,” in Int. Conf. Comput. Vis. , 2019, pp. 6202–6211

    2019

  53. [61]

    Raft: Recurrent all-pairs field transforms for optical flow,

    Z. Teed and J. Deng, “Raft: Recurrent all-pairs field transforms for optical flow,” in Eur. Conf. Comput. Vis. Springer, 2020, pp. 402–419

    2020

  54. [62]

    Discovering adversarial examples with momentum,

    Y . Dong, F. Liao, T. Pang, X. Hu, and J. Zhu, “Discovering adversarial examples with momentum,” arXiv preprint arXiv:1710.06081 , vol. 5, 2017

    2017 arXiv

  55. [63]

    High- resolution image synthesis with latent diffusion models,

    R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer, “High- resolution image synthesis with latent diffusion models,” in IEEE Conf. Comput. Vis. Pattern Recog., 2022, pp. 10 684–10 695

    2022

  56. [64]

    Diffusion models beat gans on image synthesis,

    P. Dhariwal and A. Nichol, “Diffusion models beat gans on image synthesis,” Adv. Neural Inform. Process. Syst. , vol. 34, pp. 8780–8794, 2021

    2021

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.