Title Page

Contents

1. Introduction 7

2. Background 9

2.1. Imperceptibility of adversarial examples 9

2.2. Temporal responsibility 10

3. Proposed method 11

3.1. Preliminaries 12

3.2. PGD-TL 13

3.2.1. Temporal summation loss Lₜₘₚ 13

3.2.2. Formulation of PGD-TL 13

3.2.3. Determining hyperparameters 16

3.3. Extensions of PGD-TL 19

4. Experiments 20

4.1. Experimental Setup 20

4.2. Quantitative evaluation 21

4.3. Qualitative evaluation 25

4.3.1. Comparison with PGD 26

4.3.2. Discussion of critical duration 28

4.4. Analysis of PGD-TL extensions 30

4.5. Attack defense and limitation 32

5. Conclusion 33

Reference 34

초록 39

Abstract 40

Table 1. Quantitative evaluation results with similar PSNR (≈ 35dB) values. 21

Table 2. Comparison of PGD and PGD-TL in object detection and video classification tasks. 30

Table 3. Results of combining temporal summation loss with other attack methods 31

Figure 1. An adversarial image sequence with PGD-TL distortion is displayed on a monitor. The perturbation is optimized through the proposed temporal summation loss, mak-... 11

Figure 2. Experiments to determine critical duration. (a) Estimating critical duration using temporal summation of two perturbations, (b) and estimated critical duration versus... 17

Figure 3. Comparison of perturbations at similar PSNR values (M＝2). (a) Pixel intensity and subjective brightness over time, and (b) visualization of overlapped pertur-... 22

Figure 4. Graphs showing the changes with є. The color of the dots represents the PSNR value. (a) targeted attack, (b) untargeted attack. 23

Figure 5. The relationship between average iterations to optimization completion and hyperparameters. (a) window size M, and (b) stride S. 24

Figure 6. (a) Experimental setup for our qualitative evaluation, and (b) shows screens used for the subjectives assessment. 25

Figure 7. Graphs of subjective evaluation results with a maximum score of 5 points: changes in (a) FPS and (b) PSNR. 26

Figure 8. Conducted quality preference (QP) results with varying window sizes M. (Details of QP-test setup (①, ②, ③) can be found in Section 4.3.2) 28