Deep neural networks are vulnerable to attacks from adversarial inputs. Corresponding attack research on human pose estimation (HPE), particularly for body joint detection, has been largely unexplored. Transferring classification-based attack methods to body joint regression tasks is not straightforward. Another issue is that the attack effectiveness and imperceptibility contradict each other. To solve these issues, we propose local imperceptible attacks on HPE networks. In particular, we reformulate imperceptible attacks on body joint regression into a constrained maximum allowable attack. Furthermore, we approximate the solution using iterative gradient-based strength refinement and greedy-based pixel selection. Our method crafts effective perceptual adversarial attacks that consider both human perception and attack effectiveness. We conducted a series of imperceptible attacks against state-of-the-art HPE methods, including HigherHRNet, DEKR, and ViTPose. The experimental results demonstrate that the proposed method achieves excellent imperceptibility while maintaining attack effectiveness by significantly reducing the number of perturbed pixels. Approximately 4% of the pixels can achieve sufficient attacks on HPE.

中文翻译：

---

针对人体姿态估计网络的局部不可察觉的对抗性攻击

深度神经网络很容易受到对抗性输入的攻击。针对人体姿态估计（HPE）的相应攻击研究，尤其是身体关节检测，在很大程度上尚未被探索。将基于分类的攻击方法转移到身体关节回归任务并不简单。另一个问题是攻击有效性和不可察觉性是相互矛盾的。为了解决这些问题，我们提出对 HPE 网络进行本地不可察觉的攻击。特别是，我们将身体关节回归的难以察觉的攻击重新表述为受限制的最大允许攻击。此外，我们使用基于迭代梯度的强度细化和基于贪婪的像素选择来近似解决方案。我们的方法精心设计了有效的感知对抗攻击，同时考虑了人类感知和攻击有效性。我们对最先进的 HPE 方法进行了一系列难以察觉的攻击，包括 HigherHRNet、DEKR 和 ViTPose。实验结果表明，该方法通过显着减少扰动像素的数量，在保持攻击有效性的同时实现了优异的不可感知性。大约4%的像素可以对HPE实现足够的攻击。