FeatureFool: Zero-Query Fooling of Video Models via Feature Map

TL;DR

FeatureFool introduces the first zero-query, black-box video attack that perturbs the feature map rather than raw frames. By selecting a single motion-rich frame via Maximum Optical Flow and applying Guided Back-propagation to generate a semantic, universal perturbation broadcast across all frames, it achieves high attack success (>70%) on traditional video classifiers and transfers to Video-LLMs while preserving perceptual quality. The approach demonstrates robustness to advanced defenses and highlights a pressing need for defenses that address feature-map–level perturbations in video systems. Practically, FeatureFool exposes vulnerabilities in both conventional video classifiers and Video-LLMs, with potential implications for safety and robustness in real-world deployments.

Abstract

The vulnerability of deep neural networks (DNNs) has been preliminarily verified. Existing black-box adversarial attacks usually require multi-round interaction with the model and consume numerous queries, which is impractical in the real-world and hard to scale to recently emerged Video-LLMs. Moreover, no attack in the video domain directly leverages feature maps to shift the clean-video feature space. We therefore propose FeatureFool, a stealthy, video-domain, zero-query black-box attack that utilizes information extracted from a DNN to alter the feature space of clean videos. Unlike query-based methods that rely on iterative interaction, FeatureFool performs a zero-query attack by directly exploiting DNN-extracted information. This efficient approach is unprecedented in the video domain. Experiments show that FeatureFool achieves an attack success rate above 70\% against traditional video classifiers without any queries. Benefiting from the transferability of the feature map, it can also craft harmful content and bypass Video-LLM recognition. Additionally, adversarial videos generated by FeatureFool exhibit high quality in terms of SSIM, PSNR, and Temporal-Inconsistency, making the attack barely perceptible. This paper may contain violent or explicit content.

Figures (18)

• Figure 1: The overview of FeatureFool: A zero-query video adversarial attack using only the feature map.
• Figure 2: Feature map extracted by Guided Back-propagation from the max-flow frame.
• Figure 3: Adversarial examples of FeatureFool. Left: clean video; middle: attack medium; right: adversarial video.
• Figure 4: Qualitative comparison of different methods.
• Figure 5: Harmful content crafted by FeatureFool can bypass the judgment of Video-LLM.