Adversarial Attacks Against LipNet: End-to-End Sentence Level Lipreading

Visual adversarial attacks inspired by Carlini-Wagner targeted audiovisual attacks can fool the state-of-the-art Google DeepMind LipNet model to subtitle anything with over 99% similarity. We explore several methods of visual adversarial attacks, including the vanilla fast gradient sign method (FGSM), the $L_{\infty}$ iterative fast gradient sign method, and the $L_{2}$ modified Carlini-Wagner attacks. The feasibility of these attacks raise privacy and false information threats, as video transcriptions are used to recommend and inform people worldwide and on social media.