Human motion prediction has achieved a brilliant performance with the help of CNNs, which facilitates human-machine cooperation. However, currently, there is no work evaluating the potential risk in human motion prediction when facing adversarial attacks, which may cause danger in real applications. The adversarial attack will face two problems against human motion prediction: 1. For naturalness, pose data is highly related to the physical dynamics of human skeletons where Lp norm constraints cannot constrain the adversarial example well; 2. Unlike the pixel value in images, pose data is diverse at scale because of the different acquisition equipment and the data processing, which makes it hard to set fixed parameters to perform attacks. To solve the problems above, we propose a new adversarial attack method that perturbs the input human motion sequence by maximizing the prediction error with physical constraints. Specifically, we introduce a novel adaptable scheme that facilitates the attack to suit the scale of the target pose and two physical constraints to enhance the imperceptibility of the adversarial example. The evaluating experiments on three datasets show that the prediction errors of all target models are enlarged significantly, which means current convolution-based human motion prediction models can be easily disturbed under the proposed attack. The quantitative analysis shows that prior knowledge and semantic information modeling can be the key to the adversarial robustness of human motion predictors. The qualitative results indicate that the adversarial sample is hard to be noticed when compared frame by frame but is relatively easy to be detected when the sample is animated.

翻译：人体运动预测在卷积神经网络（CNN）的辅助下取得了卓越的性能，从而促进了人机协作。然而，目前尚无研究评估人体运动预测在面对对抗攻击时可能存在的潜在风险，这种风险可能在现实应用中引发危险。对抗攻击在人运动预测中将面临两个问题：1. 在自然性方面，姿态数据与人体骨骼的物理动力学高度相关，而Lp范数约束无法有效约束对抗样本；2. 与图像中的像素值不同，姿态数据因采集装备和数据处理方式不同而尺度多样，导致难以设置固定参数进行攻击。为解决上述问题，我们提出了一种新的对抗攻击方法，通过最大化带有物理约束的预测误差来扰动输入的人体运动序列。具体而言，我们引入了一种新颖的自适应方案，使攻击能够适应目标姿态的尺度，并加入两种物理约束以增强对抗样本的不可感知性。在三个数据集上的评估实验表明，所有目标模型的预测误差显著增大，这意味着当前基于卷积的人体运动预测模型在所提攻击下容易被干扰。定量分析显示，先验知识和语义信息建模可能是提升人体运动预测器对抗鲁棒性的关键。定性结果表明，对抗样本在逐帧比较时难以被察觉，但在动画化时相对容易被检测到。