Skeleton action models stop folding under attack: quantizing inputs and features cuts PGD and SMART attack success from near 100% to single digits

Self-supervised contrastive models for skeleton action recognition break badly under adversarial perturbation, and a plug-in quantization module suppresses that fragility. These models had been validated mainly on classification accuracy, with adversarial robustness not thoroughly investigated; the available defenses are either the general defense TRADES or the supervised skeleton-specific defense BEAT, and attaching them to mainstream contrastive models yields limited robustness gains. On NTU-60, NTU-120 and PKU-MMD, integrating the module into SkeletonCLR, AimCLR and ActCLR lowers PGD and SMART attack success to single digits in almost all scenarios, where the original models sit near 100%.

The robustness comes from two levels of quantization in the encoding pipeline: the input is rounded to uniformly spaced discrete values as it enters the encoder, and features are mapped to their nearest codeword in a codebook. Quantization turns continuous values into discrete codes, which breaks gradient propagation and absorbs small perturbations inside the quantization bins; but naive single-codebook vector quantization severely degrades representation quality and drops classification accuracy. To offset quantization error, feature quantization uses attention-guided multi-faceted quantization with multiple codebooks for distinct semantic facets, with spatial and temporal codebooks holding 512 and 256 codewords; on NTU-60 this strategy gives SkeletonCLR, AimCLR and ActCLR accuracies of 72.95, 76.07 and 80.85, while the first naive single-codebook implementation gives 1.67 for all three and the second gives 42.55, 48.65 and 64.55.

The module targets contrastive learning models for self-supervised skeleton action recognition, plugging into SkeletonCLR, AimCLR and ActCLR and evaluated on NTU-60, NTU-120 and PKU-MMD under the cross-subject setting. After integration each model grows from 1.84M to 5.12M parameters, pretext training and linear evaluation take three times as long, and inference time also triples but still runs at 433 samples per second, with a single TITAN RTX sufficient for memory.

The step size of input quantization sets how discrete the input space is and therefore moves both classification accuracy and robustness: a smaller step size raises accuracy back toward or above the original models while weakening defense against APGD-DLR and BASAR. The ablations also show input quantization alone stays vulnerable to PGD and SMART, while feature quantization alone fails against APGD-DLR and BASAR, so the two levels complement each other by acting at different stages.